A sanctions authorization covering Iranian oil transactions lasted sixteen days, and institutions on both sides of the decision to rely on it now have to be able to show what they knew, and when.
On June 21, 2026, the Treasury Department's Office of Foreign Assets Control issued General License X, authorizing transactions tied to the production, sale, and delivery of Iranian crude and petroleum products. On July 7, OFAC issued GL X1, revoking the earlier license and allowing ten days to wind down commercial arrangements that parties had expected to have sixty days to complete. Treasury then issued three rounds of designations over the following week, some naming entities engaged in activity the earlier license had authorized. Writing in Just Security, Rachel Alpert of Jenner & Block observes that the relief was difficult to use even while it was live. It carved out nothing for exposure to the Islamic Revolutionary Guard Corps, no public State Department statutory waivers accompanied it, and United Kingdom and European Union restrictions were untouched. OFAC can revoke a general license at any time, without advance notice.
Authorization State Lives Outside Screening Systems
The operative compliance question during that window was never whether a counterparty appeared on a list. It was what a particular transaction type, with a particular party, on a particular date, under a particular jurisdiction's rules, was actually permitted to do, and on whose authority. Every institution with potential exposure had to run that analysis, including the ones that concluded the license was too fragile to act on. Screening infrastructure is built to answer the first question. It holds current designation status and refreshes as lists change. Authorization state is a different object: conditional, time-bounded, layered across jurisdictions, and revocable without notice. In most institutions it lives in policy memoranda, outside counsel guidance, and manual review queues rather than in any system of record.
Reconstruction Under Examination Pressure
The cost of that gap surfaces afterward. When an examiner asks why a transaction cleared in early July, the answer requires reconstructing what the institution understood at the time, which counterparty relationships it had resolved, and which authority it relied on. That is an as-of question, and it rarely resolves inside a single system. The screening platform holds one fragment, the payment system another, the trade finance file a third. Automated cross-system lineage, of the kind in Cloudera's Octopai-derived lineage platform, makes that reconstruction tractable at examination speed, mapping how a record moved and transformed across the estate rather than leaving an analyst to assemble the trail by hand under deadline. What it does not do on its own is preserve the decision basis. Knowing where the data came from is not the same as knowing which list version was live, which authorization the reviewer relied on, and when it lapsed. That has to be captured deliberately at the point of decision. Lineage makes the evidence assemblable. It does not make it exist.
Entity Resolution Beyond Name Matching
The relationship problem compounds it. Treasury has designated the National Iranian Oil Company as an agent or affiliate of the IRGC, which turned the carve-out into a question of ownership, control, and affiliation rather than name matching. A counterparty two steps removed from a designated entity does not announce itself in a screening hit. Resolving those relationships before a transaction rather than after it is entity resolution work, and the parts that matter most, agency and affiliation rather than published ownership, do not happen inside a list check.
The Pattern Holds Across Programs
None of this is Iran-specific. The Venezuela licenses show the same instrument operating as standard practice across programs: authorizations that carry conditions, reporting requirements to multiple agencies, and scope limits that have to be evaluated transaction by transaction. Whether a given license proves durable, as the Venezuela relief so far has, or collapses in sixteen days, the compliance obligation is identical, because durability is only knowable in hindsight. The exposure is not confined to firms that acted on GL X. It sits with any institution whose screening architecture can establish who was blocked on a given morning but cannot establish what was permitted, to whom, and under which authority. There is no reason to assume the next authorization will arrive with a longer fuse, and the question examiners ask afterward will be the same one.
The exposure is not confined to firms that acted on GL X. It sits with any institution whose screening architecture can establish who was blocked on a given morning but cannot establish what was permitted, to whom, and under which authority. There is no reason to assume the next authorization will arrive with a longer fuse, and the question examiners ask afterward will be the same one.