It'd be nice to list what those "various compliance requirements" are on a public open source project.
> Treasury, in consultation with the Department of State, has issued a new determination under Executive Order (E.O.) 14071, which prohibits the supply to any person in the Russian Federation of (1) IT consultancy and design services; and (2) IT support services and cloud-based services for enterprise management software and design and manufacturing software. The determination will take effect on September 12, 2024.
https://home.treasury.gov/news/press-releases/jy2404#:~:text....
There is no inherent issue with C's contributions coming in by way of B especially if B vetted and examined said contributions personally.