Issue #25 | October 13, 2026 | 7 min read
The Brief
On June 12, 2025, OFAC assessed GVA Capital $215 million, the statutory maximum, for managing a $20 million investment that belonged, in substance, to a Russian oligarch it knew was sanctioned. GVA isn't a bank. It's a San Francisco venture capital firm, and it had no BSA program requirement to fail.
This issue covers how a legal opinion built on the 50 percent rule became the firm's only defense, why the subpoena response added 28 separate violations to a case that was already at the ceiling, and what it means that none of this required a single new control to exist.
Main Feature
The 50 Percent Rule Was GVA Capital's Defense. OFAC Said the Evidence Contradicted It.
A venture firm relied on a formal reading of ownership while everyone involved knew whose money it was.
GVA's relationship with Suleiman Kerimov predated his sanctioning. In the summer of 2016, senior managers met him at his estate in France, on at least two occasions, to secure his personal sign-off. In September 2016 a $20 million investment went in through Prosperity Investments L.P., a Guernsey entity in which Kerimov held an interest, and into a Delaware vehicle GVA managed. OFAC designated Kerimov on April 6, 2018. Between then and May 2021, GVA kept managing the investment. At its peak, in April 2021, the position was valued at about $436 million.
GVA assigned Prosperity's interest to entities with identical beneficial ownership. It attempted sales and attempted distributions that would have delivered substantial economic benefit to Kerimov. It dealt day to day with his nephew, whom the firm understood to speak for "the Investor." OFAC found that senior management had actual knowledge that the money ultimately belonged to Kerimov, which is what moved this from a negligence case to a willful one.
Penalty: $215,988,868 ($214,000,000 sanctions + $1,988,868 reporting)
Basis: statutory maximum, egregious, not voluntarily self-disclosed
Subpoena response: about 173 documents certified complete in 2021; about 1,300 more produced after a 2023 pre-penalty notice
In May 2018, weeks after the designation, GVA got a legal opinion concluding that Prosperity wasn't blocked property, because Kerimov didn't nominally hold 50 percent or more of it. That's a defensible reading of the 50 percent rule taken alone. The same advice also warned that any sale or transfer of the investment couldn't directly or indirectly involve Kerimov. GVA kept the first sentence and ignored the second. OFAC rejected the opinion, finding it contradicted by the evidence, pointing to Kerimov's retained property interest through a Delaware trust that OFAC would later notify as blocked property, holding over $1 billion. A legal opinion is a control only if the facts you hand the lawyer are the facts you know.
The subpoena failure is its own story. OFAC subpoenaed GVA in 2021 about the investment. The firm produced about 173 documents and certified in October 2021 that its response was complete. After OFAC sent a pre-penalty notice in September 2023, GVA produced roughly 1,300 additional records. OFAC counted 28 separate reporting violations, one for each month of the delay, and added $1,988,868 to the total. The certification of completeness is the part that should worry an audit team. Somebody signed a statement that a collection was done, and the collection missed several times more material than it found.
One last piece of context. FinCEN's rule that would extend AML program and SAR requirements to registered investment advisers was postponed in a final rule on December 31, 2025, to January 1, 2028. GVA wasn't penalized for lacking an AML program. It was penalized under OFAC's strict-liability sanctions regime, which has applied to every US person all along. The $216 million bill arrived without a single BSA obligation in play.
Red Flags in This Case
A fund investor who meets management in person, at a personal residence, to approve the investment
A principal who communicates only through a relative and acts through an offshore holding entity that holds a minority-looking interest
A legal opinion that clears the structure on a percentage test while cautioning against the very transactions that follow
Assignment of an investor's interest to a new entity with identical beneficial ownership after a sanctions designation
A regulatory production certified complete, then supplemented with several times the original volume once penalties are on the table
The question for a program is whether anyone is paid to disagree with the opinion. Ownership percentages are an input. Whether the firm knows who benefits is the test, and GVA's own record said it knew. Treating a lawyer's reading of a threshold as the end of the analysis is how a $20 million investment became a $216 million penalty.
GVA had one defense and it was a number in a footnote. OFAC looked at who sat across the table in France.
Source: OFAC Enforcement Release, GVA Capital Ltd., June 12, 2025 | FinCEN, Final Rule Postponing the Investment Adviser AML Rule, Dec. 31, 2025
Controls & Testing
Risk & Control Matrix
Risk | Control |
|---|---|
An investor or investor vehicle is later designated, or is found to be controlled by a designated person, and the firm keeps managing the position | Screening of investors, beneficial owners, and known controllers at onboarding and on every list update, with a hold on distributions, transfers, and assignments when a hit is open |
Ownership analysis relies on a percentage threshold while control and benefit run through relatives, trusts, or nominees | Ownership-and-control questionnaire covering relatives who act for the investor, trust beneficiaries, and powers of attorney, reviewed by someone independent of the relationship owner |
Outside counsel's opinion is accepted without testing the facts given to counsel or the transactions that follow | Documented fact package for each sanctions opinion, with a log of whether subsequent transactions fall inside or outside the conditions the opinion sets |
A regulatory production is certified complete without verifying the collection | Custodian and data-source inventory for any subpoena, with a second-person reconciliation of the search scope before the certification is signed |
Audit Test Steps
An audit program built around this typology could test for it by:
Pulling the investor and investor-vehicle population and testing a sample for evidence of sanctions screening at onboarding and after each list update, including screening of beneficial owners and anyone acting on the investor's behalf.
Selecting investors with offshore holding vehicles or relatives as primary contacts and testing whether the ownership file documents control and benefit, not only the equity percentage.
Obtaining each outside counsel opinion on a sanctions question and tracing the facts given to counsel to the firm's own records, flagging any known fact that was omitted.
Comparing transactions after a designation or sanctions-related opinion (assignments, transfers, attempted sales, distributions) against the conditions set in the opinion and any hold placed on the account.
Reviewing the last regulatory or subpoena response, reconciling the sources searched against the firm's system inventory, and testing whether the certification was supported by a documented search scope and a second reviewer.
Intelligence Briefing
American Express consents to Fed and OCC orders over financial crimes failures. On October 8, the Federal Reserve announced an enforcement action against American Express Company citing its failure to sufficiently detect and report certain suspicious activity related to money laundering, and significant deficiencies in how its enterprise-wide AML program was implemented, particularly at its national bank subsidiary. American Express National Bank consented to a separate OCC order and agreed to pay a $350 million civil money penalty, part of which the company said it had reserved in prior periods. The Fed's release names no penalty of its own.
Source: Federal Reserve Board, Oct. 8, 2026 | American Express Form 8-K, Oct. 8, 2026
A freight forwarder settles with OFAC after missing a designated supplier. On October 9, OFAC announced that Pegasus Worldwide Logistics agreed to pay $175,015 over four apparent violations of the Illicit Drug Trafficking Sanctions Regulations and six reporting violations. Between September 2023 and February 2024, Pegasus facilitated the import of a customized sugar packet-filling machine from a designated Chinese manufacturer and didn't identify the supplier as designated. It also failed to respond fully to an OFAC subpoena for six months. OFAC treated the case as non-egregious and not voluntarily self-disclosed. The subpoena delay is the thread it shares with GVA, at one twelve-hundredth of the price.
Source: OFAC, Oct. 9, 2026
Career Intel
FinCEN has pushed the investment adviser AML rule out to January 1, 2028, but GVA shows the sanctions side never waited. OFAC applies to every US person today, and the case's fine was set under sanctions law, not the BSA. For anyone looking at fund managers, advisers, or private markets as a next step, sanctions screening and ownership analysis is the skill those firms need first, regardless of when the AML program requirement lands.
Source: FinCEN, Dec. 31, 2025
AI in Financial Crimes Compliance
AI IN FINANCIAL CRIMES COMPLIANCE
Legal-entity knowledge graphs are one of the more concrete uses of machine learning in sanctions work. The tool resolves records from corporate registries into single entities, links them through ownership and control, and encodes OFAC's 50 percent rule directly in the graph, so an investigator can follow a "sanctions path" from a designated person to an unlisted company. A 2025 OpenCorporates paper describes pairing deterministic matches, like registry numbers, with probabilistic ones, like name, address, and officer overlap, and keeping a log of why each match was made.
The catch is that the graph is only as good as the registries behind it. The same paper says no single dataset gives a full picture of risk, and notes the US narrowed beneficial ownership collection in March 2025. It also stresses that ownership has to be modeled alongside control: voting rights, powers of attorney, and relationships with formation agents.
For an auditor, GVA is the awkward test case. No graph would have caught the problem, because management already knew whose money it was. The question for any ownership tool is what happens when the person using it has a reason not to act on the output.
Source: OpenCorporates, Oct. 1, 2025
Tip Line
Got any idea for something you'd want to see covered here? Doesn't have to fit neatly into a category. If you think it's interesting, we probably will too.
Send it to [email protected].
If someone forwarded this to you, welcome.
The AML Brief goes out every Tuesday. Subscribe for free and get the Top 10 AML Red Flags cheat sheet as a thank-you:
[BUTTON: Subscribe → theamlbrief.com]
Already subscribed? Forward this to one colleague who works in financial crimes. That's how we grow.
The AML Brief | theamlbrief.com
Disclaimer: The AML Brief is an independent financial crimes intelligence publication. All content is sourced from publicly available regulatory documents, enforcement actions, and published research. Nothing published here constitutes legal, compliance, or regulatory advice. The AML Brief is not affiliated with any financial institution, regulator, law firm, or employer. For advice specific to your situation, consult a qualified attorney or compliance professional.