The real risk is to their US end users - if a US company is found to have commercial dealings with a company that has commercial dealings with Iran / N. Korea e

The real risk is to their US end users - if a US company is found to have commercial dealings with a company that has commercial dealings with Iran / N. Korea etc, the US company is in breach of the regulations. So in this case, if Bank of America had a company subscription with this hypothetical Maltese GitHub, BoA would be in breach, and could face sanctions (and this would probably cause the Maltese GH to get on the entity list as well)