Cross-border compliance should follow the business model
A company operating between Armenia and the United States can be exposed to multiple legal and commercial regimes at once. The answer is not to import a 200-page U.S. policy manual into an Armenian operation. The answer is to identify the actual points of risk in the business and build controls that employees can use.
A software company with U.S. customers, Armenian engineers, cloud infrastructure, and no physical goods has a different risk profile from an Armenian distributor reexporting U.S.-origin electronics. A healthcare business, financial-services company, manufacturer, or investor will require a different control environment again. Compliance therefore starts with mapping products, services, customers, countries, payments, employees, data, intermediaries, and regulated touchpoints.
Define governance and responsibility
Someone must own the program. In a smaller company that may be a senior executive supported by outside advisers; in a larger organization it may be a compliance officer or committee. Responsibility should include authority to pause transactions, obtain information, escalate concerns, preserve records, and report material issues to senior management or the board.
The governance structure should also clarify the relationship between the Armenian and U.S. entities. If the U.S. affiliate contracts with customers while the Armenian entity performs services, who screens the customer? Who approves vendors? Who handles data incidents? Who reviews export-control questions? Ambiguous ownership produces inconsistent controls.
Sanctions and export controls require transaction visibility
Companies with U.S.-origin products, software, technology, U.S. persons, or dollar transactions should assess sanctions and export-control exposure. OFAC recommends a risk-based compliance approach, and BIS rules may affect exports, reexports, or transfers depending on product classification, destination, end user, and end use.
The program should specify screening expectations, beneficial-ownership review, product-classification responsibility, enhanced diligence triggers, end-use documentation, and escalation for unusual routing or payments. Armenian operations should understand that list screening alone is not sufficient for sensitive transactions. The program should also define when U.S. legal counsel must review a transaction.
Third parties are a major control point
Distributors, sales agents, customs brokers, consultants, referral sources, freight forwarders, contractors, and joint-venture partners can create risk that the company does not directly control. A proportionate third-party program should classify intermediaries by risk and apply diligence accordingly. Low-risk commodity vendors should not receive the same review as an agent paid to obtain government-related business.
Higher-risk review may include ownership, management history, sanctions screening, qualifications, references, conflicts, government relationships, compensation, litigation or regulatory history where lawfully available, and verification of the actual services to be performed. Contracts should include relevant compliance obligations and information rights.
Anti-bribery controls should focus on real pressure points
U.S.-connected companies should evaluate exposure to the Foreign Corrupt Practices Act and other applicable anti-corruption laws. The practical focus should be on areas where employees or intermediaries interact with public officials or state-linked institutions: permits, customs, inspections, licensing, public procurement, healthcare, utilities, tax administration, and government contracts.
Policies should address gifts, hospitality, travel, sponsorships, charitable contributions, facilitation-type requests, political activity, conflicts, and use of agents. Employees need a realistic escalation path when a payment is requested in ambiguous circumstances. Training should use examples drawn from the company's operations rather than abstract definitions.
Data, cybersecurity, and confidentiality cross borders too
U.S. customers may impose contractual cybersecurity and privacy requirements even when the underlying Armenian legal standard differs. Companies should know where data is stored, who can access it, whether subprocessors are used, how access is revoked, how incidents are escalated, and what contractual notification deadlines apply.
Professional-services and technology companies should pay particular attention to remote access, personal devices, source code, customer credentials, privileged or confidential information, and employee departures. A cross-border operating model often creates legitimate reasons for broad digital access; compliance must distinguish operational necessity from uncontrolled access.
Financial controls and payment review support every other program
Many compliance failures become visible in payment records before they appear elsewhere. Approval thresholds, segregation of duties, vendor onboarding, invoice support, reimbursement rules, bank-account controls, and review of third-party payments can identify unusual conduct early.
Armenia-U.S. operations should document intercompany payments and service arrangements, maintain a clear distinction between business and personal expenditure, and establish enhanced review for unusual commissions, cash requests, payments to unrelated parties, or sudden changes in beneficiary accounts. Tax and transfer-pricing advice should be coordinated with qualified professionals.
Create an investigations and reporting protocol before a problem arises
Employees need a way to report concerns without routing every issue through the person implicated. The company should define who receives reports, when outside counsel is engaged, how evidence is preserved, who conducts interviews, and how confidentiality is protected.
Cross-border investigations can create additional complications involving data location, employment rights, privilege, language, and access to devices. A basic protocol established before an incident can prevent destruction of evidence, uncontrolled internal messaging, retaliatory conduct, or premature conclusions. Material investigations should also lead to remediation: policy changes, training, discipline, contract revisions, or enhanced monitoring.
Test the program instead of assuming it works
A written policy is not evidence of implementation. Companies should periodically sample customers, vendors, payments, distributor files, export documentation, and training records to determine whether procedures are actually followed. Findings should be reported to management and tracked to completion.
The program should also change when the business changes. Entry into a new country, launch of a new product, acquisition, significant U.S. customer, new distributor, financing round, or expansion into a regulated industry can materially change risk. Annual review may be sufficient for some companies; faster-growing or higher-risk businesses may need more frequent updates.
A practical implementation sequence
A company can build a credible program in stages. First, map the business and identify material risks. Second, assign responsibility and escalation authority. Third, implement core controls for customers, third parties, payments, sanctions, export controls, data, and conflicts. Fourth, train employees whose roles touch those risks. Fifth, create a reporting and investigations process. Sixth, test selected controls and correct deficiencies.
Axon Point Advisory assists companies with cross-border risk assessments, policy design, third-party diligence, transaction review, internal investigations, training, and compliance remediation. Where an issue requires a formal U.S. legal opinion, government filing, privilege-sensitive legal investigation, or representation before an agency, the company should engage appropriately licensed U.S. counsel under a separate legal engagement.
Frequently Asked Questions
Does a small company need a formal compliance department?
Not necessarily. It does need defined responsibility, workable controls, and an escalation path proportionate to its risk.
Should Armenian and U.S. entities use identical policies?
The core principles should align, but procedures may need to reflect each entity's role, legal environment, and actual operations.
How often should third parties be rescreened?
Frequency should reflect risk. High-risk distributors or intermediaries may require periodic review and transaction-level controls; lower-risk vendors may require less.
What is the first document to create?
Usually a risk assessment or compliance map. Policies should be written after the company understands what risks the policies are intended to control.
Selected official sources
- U.S. Department of the Treasury, OFAC, Framework for OFAC Compliance Commitments and current risk-based compliance guidance.
- U.S. Department of Commerce, Bureau of Industry and Security, Export Administration Regulations and diversion red-flag guidance.
- U.S. Department of Commerce, Armenia Country Commercial Guide, current 2025-2026 market-entry, distribution, customs, and trade guidance.
This article is provided for general informational and business-advisory purposes and does not constitute legal advice. Laws, regulations, sanctions, and enforcement policies change. Legal advice should be obtained from appropriately licensed counsel for a specific matter.