The Question at Hand
Your sanctions screening program flagged a Brazilian logistics company. It's not on the SDN List, but it operates in São Paulo, where Primeiro Comando da Capital (PCC) has a significant presence. Do you escalate the relationship for enhanced due diligence, or do you clear it and move on?
This isn't hypothetical. Since OFAC designated PCC as both a Foreign Terrorist Organization and a Specially Designated Global Terrorist in spring 2026, and sanctioned six PCC-linked entities on July 1, 2026, compliance teams face a practical question: how wide do you cast the net when the designated party is the largest transnational criminal organization in the Western Hemisphere?
Two camps have emerged among sanctions analysts. One argues for aggressive screening expansion. The other warns against wasting resources without reducing risk. Both have valid points.
The Case for Expanded Screening Protocols
The argument for heightened scrutiny starts with OFAC's enforcement posture. The July 1 designations weren't limited to PCC leadership or front companies. They included a Portuguese entity, a construction firm, a transportation company, and financial services providers. This sectoral spread signals something important: OFAC is targeting the commercial infrastructure that enables PCC operations, not just the criminal core.
When OFAC uses secondary sanctions authority this way, it's telling you the risk perimeter is wider than the SDN List itself. Any non-US entity that provides material or technological support to PCC can be designated. OFAC has wide discretion here, and these are strict liability violations. You don't need knowledge or intent to violate. You just need to have facilitated a transaction.
The FTO designation compounds the problem. Under 18 U.S.C. § 2339B(d), providing "material support or resources" to an FTO carries criminal liability. "Material support" includes currency, monetary instruments, and financial securities. The DOJ has historically used this statute to prosecute companies that made payments to FTOs, and violations can trigger extensive asset forfeiture.
So the risk isn't just getting added to the SDN List. It's criminal prosecution and forfeiture of assets derived from or used in the violation. That's a different order of magnitude than a civil penalty for a sanctions miss.
Given PCC's documented presence in Florida, the United Kingdom, Türkiye, Japan, and Chinese e-commerce platforms, the geographic scope alone justifies broader screening. If your Brazil-facing business touches freight forwarding, customs brokerage, payment processing, or trade finance, you're operating in sectors where PCC operatives have embedded themselves. The January 2026 indictment of six PCC members in Florida for laundering drug proceeds shows how these networks surface in routine commercial channels.
The Case for Risk-Based Restraint
The counterargument is practical: if you screen every Brazilian counterparty as high-risk, you haven't improved your risk assessment. You've just created alert fatigue and slowed down legitimate business.
PCC is the largest transnational criminal organization in the Western Hemisphere. Brazil is the ninth-largest economy in the world. You can't treat every Brazilian entity as suspicious without rendering your screening program useless.
The July 1 designations sanctioned six entities. That's a data point, not a mandate to overhaul your entire Brazil risk framework. OFAC has always had the authority to designate parties that support SDNs. The fact that they exercised it here doesn't mean every logistics provider in São Paulo is one transaction away from designation.
More importantly, the designation itself doesn't tell you how to identify the next PCC-linked entity before OFAC does. The press release mentions a PCC-controlled money laundering operation through a Chinese electronics distribution network, but it doesn't give you a typology to screen for. It doesn't tell you what red flags distinguished the sanctioned construction company from the hundreds of other construction companies operating in the same region.
If you expand your screening criteria without corresponding intelligence about how PCC embeds in commercial networks, you're just generating false positives. Your analysts will spend their time clearing legitimate Brazilian businesses instead of investigating genuine risk indicators.
The risk-based approach says: use the July 1 designations to refine your understanding of PCC's sectoral footprint, but don't abandon risk segmentation. Not every Brazilian counterparty presents the same exposure.
Where Practitioners Actually Land
Most sanctions analysts are taking a middle path. They're not screening every Brazilian entity as high-risk, but they're not treating PCC as just another SDN List update either.
The practical steps look like this:
First, revisit existing Brazilian relationships in sectors represented in the July 1 designations: financial services, construction, transportation, and storage. If you already do business with a Brazilian logistics provider, that relationship warrants a fresh look at beneficial ownership, payment flows, and whether the counterparty operates in regions where PCC maintains documented operations.
Second, monitor Brazilian law enforcement actions, particularly Operation Carbono Oculto, for public information about parties with alleged PCC connections. This isn't about preemptively blacklisting entities that haven't been sanctioned. It's about incorporating investigative intelligence into your risk segmentation.
Third, update contract language. Compliance and termination clauses should account for the possibility that a counterparty could be designated for PCC links mid-contract. You need a clean exit mechanism that doesn't require you to continue performance while you wait for legal clarity.
Fourth, map payment channels and intermediaries. PCC-related exposure may not be obvious from the face of a transaction. It surfaces through how goods move, how payments are structured, and who controls the counterparty. If your Brazilian supplier routes payments through a Portuguese entity you've never heard of, that's a red flag worth investigating.
Our Take
Expand your due diligence on Brazilian counterparties, but don't abandon risk segmentation. The July 1 designations signal that OFAC is targeting PCC's commercial infrastructure, not just its criminal leadership. That means your exposure can arise through ordinary business relationships in sectors you wouldn't traditionally associate with organized crime.
But the answer isn't to treat every Brazilian entity as high-risk. It's to get smarter about the specific risk indicators that distinguish a legitimate counterparty from one that's providing material support to PCC. That requires sector-specific intelligence, not blanket screening escalations.
If you're importing from, exporting to, or financing Brazilian operations, treat this as a supply-chain risk issue. Review your logistics providers, payment intermediaries, and beneficial ownership data for entities in the six sectors represented in the July 1 designations. Monitor Brazilian law enforcement disclosures. Update your contract exit provisions. And document your risk assessment process, because if OFAC designates a party you've been doing business with, you'll need to show you conducted reasonable due diligence based on the information available at the time.
The risk is real. The solution isn't to screen everything. It's to screen smarter.
