r/pcicompliance

Looking for views from sanctions/compliance practitioners on a hypothetical scenario on resources sector:
- An Australian entity released a payment to a Chinese counterparty.
- The counterparty was subject to a UK sanctions designation
- The payment was stopped by the bank following sanctions screening.
- For the purpose of this question, assume the payment had gone through
- It has been established that there was no UK nexus to the transaction.
- all internal ongoing monitoring and system controls failed

The organisation’s Sanctions and Trade Controls Policy states:
“The organisation is committed to complying with relevant Sanctions and Trade Control laws and regulations in the jurisdictions in which it operates. This includes, but is not limited to, the laws of; Australia, the United States of America, the European Union, the United Kingdom and those derived from measures imposed by the United Nations. Compliance with these laws and regulations is a key element of our robust culture of compliance.”

My question:
If there is no UK nexus and therefore no UK sanctions law applies to the transaction, would successfully paying a UK-designated entity nevertheless be considered a near miss of a breach of the organisation’s sanctions policy?

Or does the reference to complying with UK sanctions only apply where the UK sanctions laws are legally applicable to the particular transaction?

Interested specifically in the distinction between legal breach vs policy breach/near miss.

Also interested in how this would interact with China’s current countermeasures/anti-foreign-sanctions and blocking framework, where complying with a foreign sanctions regime could potentially create conflicting obligations under Chinese law.

We take card payments so we are in PCI scope and 6.2.3 is the one that caught us on the last assessment. Custom code must be reviewed for vulns before release, whether automated or manual.

Our QSA did not care that the change went through the pipeline with a clean scan. She wanted the review records and asked to see what our SAST was tuned to look for. We did not have either in a form we could hand over. Ended up spending the back half of that week screenshotting findings and writing up after the fact what the scanner checks for.

The scan itself is fine but turning its output into evidence an assessor accepts is all manual right now. For people who have been through an assessment, what are you running that does the code review and produces records mapped to the control?