Where Your Gold Comes From: Supplier Due Diligence for Conflict and Sanctions Risk

A dealer can screen every supplier by name and still buy gold that financed an armed group. In 2026, OFAC twice sanctioned parts of a network that moved gold out of rebel-held mines in eastern Congo and into the regular trade. The lesson for dealers is that the supplier review has to ask where the metal came from, not only who is selling it.

What OFAC did in 2026

On June 25, 2026, OFAC designated Gasabo Gold Refinery LTD in Kigali, Rwanda, its chairman and general manager, and three Rwandan mining companies the chairman controls, all under Executive Order 13413 (Treasury press release, June 25, 2026). Treasury described the route: after gold was removed from mines in areas of South Kivu held by Rwanda's army and the M23 armed group, Rwandan forces kept "strict oversight of the gold" while it was moved across the border to Gasabo Gold in Kigali, where refining began immediately. Treasury said at least 60 kilograms moved through the scheme in early 2026, and noted that the European Union had already designated the refinery. It also said that minerals from eastern Congo are often "smuggled through Rwanda before being transported to major refining and processing countries."

On October 28, 2026, OFAC designated Rwanda's Ministry of Defence and Zigama Credit and Savings Society, a Rwandan financial institution that Treasury said operates on behalf of Rwanda's security services (Treasury press release, Oct. 28, 2026). According to Treasury, a Zigama branch "enabled the transportation of gold sourced from M23-controlled territory in eastern DRC to Kigali." The release added a point any sourcing review can use: minerals from M23-controlled territory "are integrated into supply chains in Rwanda, whose domestic mining capacity is smaller than export volumes reported since M23's rebellion began."

Both releases repeat OFAC's standard warning that entities owned 50 percent or more by blocked persons are also blocked. Our post on OFAC's 50 Percent Rule explains how that reaches companies that are not on any list.

Why the seller's name is not enough

A U.S. dealer rarely buys from a refinery in Kigali. It buys from a wholesaler, a trading company, or another dealer, which bought from someone else. A name screen of the seller tells you whether the seller is blocked. It does not tell you whether the bars in the shipment were refined by a blocked refinery, or whether a blocked person has an interest in the metal. OFAC's prohibitions reach property in which a blocked person has an interest, directly or indirectly, and OFAC states that its civil penalties are generally based on strict liability, so not knowing is not a defense to a civil penalty (see OFAC applies to every business).

The same problem appears with recycled gold. The 2023 Africa Gold Advisory, issued by State, Treasury, Commerce, Homeland Security, Labor, and USAID, told businesses that buy recycled gold downstream that they "must ensure that they conduct due diligence on such purchases to determine whether recyclers may be introducing mined gold from sanctioned, conflict-affected, or other high-risk sources." The advisory says it is "explanatory only and does not have the force of law," but it tells you what the agencies will look for. It also named the United Arab Emirates and Switzerland as key trading and refining centers for gold from sub-Saharan Africa.

What applies to a dealer

Required of dealers by Part 1027: the risk assessment must take into account the nature of the dealer's suppliers and geographic locations, and the extent of dealings with anyone other than established sources of supply (31 CFR 1027.210(b)(1)(i)). The program must include procedures for making reasonable inquiries and for refusing or terminating suspicious transactions, and the rule's red flags apply to suppliers as well as customers: a supplier's unwillingness to give complete information, an unusual degree of secrecy, and purchases not in conformity with standard industry practice (1027.210(b)(1)(ii)). Our post on writing a dealer risk assessment covers the supplier factor in context.
Required of every U.S. person by OFAC: not dealing in property in which a blocked person has an interest, and blocking or rejecting and reporting when required. This is separate from the Bank Secrecy Act and applies whether or not you are a dealer under Part 1027. Russia-origin gold has its own import ban, also covered in our 50 Percent Rule post.
Voluntary, above the requirement: adopting the five-step framework in the OECD Due Diligence Guidance for Responsible Supply Chains of Minerals, or buying only LBMA Good Delivery or otherwise certified product. No dealer rule requires either. Refiners and members bound by LBMA's Responsible Gold Guidance or the Responsible Jewellery Council's Code of Practices have their own obligations and will ask their trading partners questions that follow from them. A dealer that adopts any of these should write it into the program and follow it.

One more line to keep straight. Section 1502 of the Dodd-Frank Act and the SEC's conflict minerals rule require certain public companies to report on gold and the "3T" minerals from the Congo region. That rule applies to SEC reporting issuers that manufacture products, not to dealers as such. Do not describe your supplier review as complying with it.

A supplier review sized for a dealer

The OFAC releases and the advisory point to the same questions. A workable procedure:

Know the supplier. Legal name, address, ownership, and who signs. Screen the company, its owners, and the signer, and check ownership against the 50 Percent Rule.
Ask about origin and chain of custody. For refined bars, the refiner and its accreditation. For doré, grain, or scrap, the country of origin and the route. For recycled material, where the recycler gets it. Ask for the documents that support the answer, such as assay certificates, export permits, and shipping records, and keep them.
Test the story against the facts. Treasury's own red flag is a country exporting more gold than it can mine. Others follow from the rule's red flags: prices below market without a reason, a supplier that will not name its sources, routing through a third country with no business reason, "recycled" material in volumes or forms that look like newly mined gold, and payment instructions to an unrelated party or a different country.
Scale the review to the risk. An established U.S. wholesaler selling accredited bars needs less than a new foreign trading company offering doré or large lots of scrap. Write down which suppliers get which level of review, and why. The 2005 FinCEN guidance that accompanied the rule treats dealings with established suppliers and other U.S. dealers as relatively low risk, and dealings with parties in or paid through vulnerable jurisdictions as significantly higher risk.
Re-screen when the lists change. A supplier that was clean last year can be designated, or acquired by someone who is. The Gasabo designation in June and the Ministry of Defence and Zigama designations in October came four months apart.
Know when to stop. If a supplier cannot or will not answer, the rule's procedures for refusing or terminating a transaction apply. If a blocked person has an interest in metal you already hold, OFAC's blocking and reporting rules apply, with a report due within 10 business days.

Consider a dealer offered a large lot of 22-karat "recycled" grain by a new trading company abroad, at a discount to spot, with payment to an account in a third country. Each fact on its own has an innocent explanation. Together they are the pattern the advisory describes, and the dealer's file should show the questions it asked and why it bought or declined.

What is not settled

No U.S. rule tells a dealer how far up the chain it must trace, or which documents are enough. The OFAC releases describe risks, and the advisory recommends enhanced due diligence "as appropriate and necessary," but neither sets a standard of care for a downstream dealer. In practice, the measure is whether your review was reasonable for the risk you wrote down in your assessment, and whether you can show it.