Suspended on arrival: what Washington's waiver of the Graham Act means for CIS and Gulf compliance
A sanctions statute that lived 30 days before the President froze it. The compliance machinery built around it did not get the memo.
One number frames the week for every treasurer with Russia exposure: zero. That is the operative scope of the sanctions regime that the Lindsey O. Graham Sanctioning Russia and Iran Act of 2026 was supposed to impose from 18 October. On the evening of Friday 17 October, hours before the statute's 30-day activation window closed, the US President signed an executive order suspending — on national-interest grounds — every restriction, designation and tariff the Act had been drafted to switch on.
Three data points fix the shape of the problem for anyone obligated to assess secondary-sanctions risk from Moscow, Astana, Dubai or Riyadh.
First, the statutory architecture. The Graham Act, signed in September, codifies existing Russia-related restrictions and empowers the President to levy tariffs of up to 100% on the top five purchasers of Russian oil and gas — China and India principal among them — alongside fresh designations against the Russian President, named officials, major banks and shadow-fleet tonnage. Crucially, the same statute hands the President an open-ended national-interest waiver. He used it on day thirty.
Second, the policy signal underneath. The waiver follows the President's announcement of a diesel arrangement under which Russia would supply over 300,000 tons immediately, a further 500,000 tons in November, and 1,000,000 tons thereafter, with a stated subsequent tranche of 3,000,000 tons. Moscow has read the direction of travel plainly: the Russian presidential envoy for investment cooperation publicly dismissed sanctions as an ineffective idea of the previous US administration on 17 October. The Ukrainian President, speaking in Brussels the same day, warned that diesel would be followed by gas, then banking, then individual designations, then the frozen-assets question.
Third, the enforcement vacuum. A statute whose designations are suspended is still a statute. OFAC retains every pre-existing authority. The shadow-fleet tanker that would have been designated on Sunday is not designated — but it may still trigger a US correspondent bank's internal risk scoring, a European flag-state inquiry, or a UAE port-state inspection under IMO rules the Emirates applies independently of US listings.
That is the operational problem for the CIS counterparty and the Gulf trading house. Washington has demonstrated that a signed sanctions bill can be dark on arrival. Brussels has given no indication it will mirror the waiver; the EU's 2026 restrictive-measures architecture against Russia operates on its own timetable and renewal cycle. UAE and KSA onshore banks continue to run US-dollar clearing through New York correspondents whose compliance desks apply conservative risk policies that do not update at the speed of a Friday-night executive order.
The conflict the general counsel must now manage is between a US rulebook that is politically fluid and a European and Gulf operational environment that is not. Predictability has shifted from the statute to the correspondent-bank questionnaire.
Four steps the compliance function can take on Monday:
1. Re-baseline Russia-exposure screening against pre-waiver assumptions; the designations your onboarding team modelled for 18 October did not take effect, but your EU and UK screening lists are unchanged. 2. Request written confirmation from US-dollar correspondent banks on how they are treating entities that would have been designated under the Graham Act had the waiver not issued. 3. Review force-majeure, sanctions and material-adverse-change clauses in CIS-linked contracts signed between September and this weekend; many were drafted on the assumption the Act would bite. 4. Flag to the board that the waiver is suspension, not repeal — the designations can be reactivated by a subsequent executive order with no further congressional action.