Sanctions Evasion

Sanctions evasion generates illicit proceeds that qualify as a predicate offense for money laundering.

Adversaries further obscure sanctioned entities' involvement by creating shell or front companies, manipulating beneficial ownership structures, and forging documentation. These tactics exploit weaknesses in customer due diligence processes that fail to detect the true owners and beneficiaries.

Sanctions evasion exploits cross-border vulnerabilities by routing funds and commercial transactions through permissive or weakly supervised jurisdictions. Adversaries leverage insufficient enforcement of export controls and AML requirements to conceal sanctioned parties’ involvement, making this the primary vulnerability exploited by the technique.

• Documents import-export activities, including declared goods, routes, and involved parties.
• Enables identification of shipments that deviate from legitimate channels or are destined for sanctioned jurisdictions under false pretenses.

• Consolidates country- and region-specific regulatory and sanctions risk information.
• Flags high-risk or sanctioned jurisdictions in transaction flows, supporting targeted investigations for possible sanctions evasion activities.

• Provides details on licensed professionals (e.g., lawyers, accountants), their regulatory status, and affiliations.
• Reveals repeated involvement of certain professionals facilitating cross-border deals for sanctioned clients, aiding in uncovering professional enablers of evasion.

• Includes invoice amounts, contract terms, and payment instructions for goods or services provided.
• Helps detect inflated or under-invoiced transactions that may disguise sanctions evasion within trade documentation.

• Consists of incorporation papers, contracts, court records, and other legally binding documents.
• Helps uncover discrepancies in ownership claims or shadow directors connected to sanctioned entities, emphasizing hidden beneficial owners.

Consolidated sanctions lists from regulatory bodies (e.g., OFAC, UN, EU) detail sanctioned individuals, entities, and vessels. Cross-referencing transactions, beneficial ownership records, and business relationships against these lists enables the direct identification of sanctioned parties attempting to circumvent restrictions.

• Provides comprehensive records of financial transactions, including timestamps, amounts, counterparties, currencies, and account details.
• Enables detection of unusual transaction flows or persistent transfers to sanctioned entities, indicating possible sanctions evasion strategies.

• Includes data on revenue streams, operational scope, and market presence of a business.
• Supports detection of abnormal expansions, sudden shifts in operations, or uncharacteristic activities tied to sanctioned markets or entities.

• Comprises official shipping logs, bills of lading, customs declarations, and certificates of origin.
• Assists in identifying hidden routes, re-shipments, or final destinations associated with sanctioned countries concealing illicit flows.

• Contains user account information, wallet addresses, transaction details, and trading activities within cryptocurrency exchanges.
• Highlights suspicious transfers to unregulated exchanges or mixers linked to sanctioned addresses, aiding in sanctions evasion investigations.

• Provides verified identifying details (e.g., names, addresses, beneficial owners), risk profiles, and documented relationships for customers and intermediaries.
• Helps detect potential ties to sanctioned individuals or front companies, allowing enhanced due diligence to pinpoint undisclosed connections or suspicious cross-border activities.

• Details property deeds, asset purchase histories, and beneficial ownership for real estate or luxury assets.
• Facilitates detection of covert acquisitions by sanctioned individuals leveraging opaque corporate vehicles in permissive jurisdictions.

• Captures on-chain transaction details such as sender and receiver wallet addresses, timestamps, and transaction amounts.
• Identifies the usage of cryptocurrency mixers or flagged wallet addresses linked to sanctioned entities, supporting investigations into illicit crypto flows.

• Includes transaction logs, trade volumes, counterparties, and timestamps for securities, commodities, and digital assets.
• Enables identification of suspicious trades or large off-market transactions that may conceal sanctions violations or launder associated proceeds.

Captures details of cross-border financial transactions, including currencies, amounts, originators, beneficiaries, and participating financial institutions. This data helps identify sanctioned or high-risk jurisdictions and uncovers potential sanctions evasion by analyzing transaction patterns and corridors.

• Contains official corporate registration information, shareholder data, and beneficial ownership structures.
• Helps identify shell or front companies used to obscure sanctioned individuals or entities, which is critical for exposing hidden ownership ties in sanctions evasion schemes.

Assign elevated risk ratings to jurisdictions known for weak sanctions enforcement, low regulatory oversight, or historical involvement in sanctions violations. Impose enhanced checks or mandatory approval for cross-border transactions involving high-risk regions to ensure sanctions evasion attempts are flagged at the jurisdictional level.

Conduct deeper verification of beneficial owners and controlling interests by cross-referencing corporate filings and verifying the legitimacy of supplied documents to ensure that any potential sanctioned parties or hidden relationships are uncovered. This includes assessing the source of wealth or funds and obtaining senior management approval for relationships tied to sanctioned or high-risk jurisdictions, directly mitigating the use of shell or front companies in sanctions evasion.

Obtain and verify foundational customer information, including ultimate beneficial ownership, from the outset, particularly for clients or accounts with geographic ties to sanctioned or thinly regulated jurisdictions. By confirming customer identity and examining ownership structures early, institutions can detect or block sanctioned entities from accessing financial services under false pretenses.

Configure automated monitoring scenarios to flag complex layering across multiple jurisdictions or abrupt shifts in transactional patterns linked to potential sanctions violations. Prioritize alerts for cross-border payments passing through known permissive transit points, enabling fast compliance evaluation and intervention when suspicious beneficiary details or documentation emerge.

Screen all customer accounts and transactions in real-time or batch processes against relevant sanctions lists (e.g., OFAC, UN, EU) to promptly detect restricted entities or high-risk jurisdictions. For any matches or near matches, institute immediate follow-up verification, freeze or reject transactions as appropriate, and escalate to specialized compliance teams for additional review. This ensures sanctioned parties cannot exploit front or shell companies to bypass restrictions.

Require rigorous AML and sanctions compliance evidence from external service providers (e.g., lawyers, accountants, corporate formation agents) before establishing or renewing service agreements. Conduct periodic audits on these intermediaries to confirm they are not knowingly or unknowingly facilitating undisclosed cross-border flows or concealing sanctioned parties in legal structures.

Deploy chain-analysis tools to trace incoming and outgoing cryptocurrency flows, focusing on flagged wallet addresses tied to sanctioned entities. Identify the use of mixers, layering across multiple unregulated exchanges, or abrupt shifts in digital asset transaction patterns that obscure sanctioned involvement, triggering rapid compliance intervention.

Implement specialized internal triggers for transactions that suggest sanctions evasion, such as the sudden rerouting of funds to a newly established shell company with ties to sanctioned regions. Promptly submit SARs/STRs to relevant authorities. This explicit focus on sanctions evasion scenarios ensures that these red flags receive the highest-priority investigation and reporting.

Continuously cross-check information such as corporate registrations, shipping documents, and beneficial ownership records with reliable public databases and open-source intelligence. This helps detect forged paperwork, undisclosed ties to sanctioned entities, or hidden front companies seeking to obscure sanctions violations, enabling more accurate targeting of high-risk relationships.

• Limit or block product offerings, such as cross-border wire transfers or complex corporate accounts, for jurisdictions and customers flagged as high risk for sanctions evasion.
• Require additional documentation or approvals before permitting services that could be misused to circumvent sanctions, effectively constraining illicit financial flows.

Review trade documentation and invoicing details for over/under-invoicing, suspicious routing of goods, and final destinations in embargoed regions. Use standard price and quantity checks to spot anomalies indicative of sanctions evasion. Escalate questionable shipments or sudden changes in trade routes, especially those involving controlled dual-use items or intermediary stops in high-risk jurisdictions.

• Certain restricted goods, including dual-use items, are subject to export controls when shipped to sanctioned jurisdictions or parties.
• Criminals mislabel these commodities or provide falsified end-user certificates to circumvent detection and oversight.
• Evasive shipments funnel proceeds back through complex trade deals, bypassing sanctions targeting specific goods or destinations.

• Sanctioned regimes often rely heavily on selling oil or other petroleum products; adversaries disguise the origin or destination of these shipments to evade restrictions.
• By forging bills of lading or commercial invoices, criminals conceal that products originate from, or are destined for, sanctioned regions.
• They then launder proceeds through trade documentation that appears to represent legitimate commodities, complicating detection by financial institutions and authorities.

• Adversaries open or control bank accounts—often in permissive jurisdictions—under front or shell company names, concealing sanctioned parties as the ultimate owners or beneficiaries.
• These accounts are used to route funds in or out of sanctioned regions, forging or omitting documentation to obscure the true source or destination of money.
• Weak customer due diligence and beneficial ownership controls enable offenders to bypass sanctions screening by masking who actually controls the account.

• Adversaries purchase properties under layered corporate structures or shell companies, shielding sanctioned individuals from direct association.
• Complex ownership arrangements obscure the beneficial owners, allowing high-value assets to be acquired in the interests of sanctioned parties.
• The layering of transactions through multiple jurisdictions confounds authorities' efforts to identify sanctioned owners, thus evading restrictions.

• Illicit actors exploit the decentralization of common cryptocurrencies (e.g., Bitcoin, Ethereum) to move funds across borders without relying on traditional banks.
• By transacting through unregulated exchanges, criminals circumvent the rigorous screening that might flag sanctioned wallets or addresses.
• This decentralized framework reduces the visibility of underlying participants, enabling sanctioned entities to transfer or convert funds covertly.

• Privacy-centric cryptocurrencies (e.g., Monero, Zcash) incorporate features such as stealth addresses, ring signatures, or zero-knowledge proofs that obscure transaction details.
• Sanctioned parties exploit these anonymity features to conceal the flow of value from blacklisted addresses or jurisdictions, preventing detection by compliance tools.
• This heightened privacy thwarts standard blockchain analytics, allowing undisclosed funds to move into or out of sanctioned regions.

• Malicious actors exploit letters of credit in cross-border trade to finance transactions involving sanctioned goods or entities.
• Adjustments or misrepresentations of beneficiary details in these letters enable funds to move under the guise of legitimate commercial activity, bypassing scrutiny.

• Criminals embed illicit proceeds in cross-border trade using instruments such as bills of lading and invoices that misrepresent goods, quantities, or parties.
• Over- or under-invoicing helps siphon funds between sanctioned and legitimate entities, appearing as normal commercial transactions.
• By complicating documentation trails, adversaries evade scrutiny and bypass sanctions-related payment blocks.

• Stablecoins pegged to fiat (e.g., USDT, USDC) offer a low-volatility means to hold and transfer value outside regulated banking channels, sidestepping sanctions checks.
• Adversaries convert funds from or to sanctioned entities into stablecoins, then transact globally via unregulated platforms.
• Because stablecoin transactions can occur peer-to-peer, limited oversight allows sanctioned users to shift value, bypassing official watchlists or blocklists.

• The separation between legal and beneficial ownership in trusts allows sanctioned parties to hide their economic interests behind nominal trustees.
• Illicit actors exploit this structure to receive income and asset distributions out of public view, bypassing sanctions compliance tied to beneficiary identification.

• Bearer shares allow ownership of a corporation to transfer simply by possessing the physical share certificates.
• For sanctions evasion, criminals exploit this feature to hide the true beneficial owners of companies dealing with sanctioned parties.
• Without a formal registration process linking shares to an identified owner, financial institutions struggle to detect sanctioned individuals behind these business structures.

• Criminals generate or falsify invoices to overstate or understate the value of shipped goods, concealing the actual origin or destination.
• These manipulated receivables help disguise sanctions-prohibited transactions as normal commercial accounts, embedding illicit proceeds into legitimate company revenue streams.

• Sanctioned persons or proxies invest in legitimate companies or subsidiaries, obscuring their ownership through nominee shareholders and layered structures.
• This tactic circumvents sanctions screening by sidestepping direct listings of sanctioned individuals in corporate records, enabling illicit proceeds to blend with legitimate corporate income.

• Used in trade-based moves where shipping and title documents can be altered to hide sanctioned beneficiaries.
• Complex documentary chains and multiple intermediaries make attributing final ownership or payees challenging.

• Operate without central intermediaries, allowing sanctioned actors to hold and transfer funds off traditional radar.
• Smart contracts and cross-chain possibilities limit the ability of authorities to freeze or track assets.

• Enable direct exchanges of cryptocurrencies without centralized oversight, reducing traceability for sanctioned entities.
• Escrow services and private negotiation features can mask transaction details, complicating sanctions screening.

• Facilitate international trade payments that can be manipulated to conceal sanctioned parties by falsifying documents.
• Structured LC arrangements obscure the true origin or destination of goods tied to restricted entities.

• Enables rapid, cross-border transfers of digital assets beyond conventional banking oversight.
• Can facilitate covert transactions with sanctioned entities, especially where AML/KYC protocols are weak or absent.

• Offer expertise to structure contracts, trusts, and corporate entities that circumvent explicit sanctions requirements.
• May draft complex legal frameworks that obscure sanctioned beneficial owners and facilitate prohibited transactions.

• Allow foreign banks’ customers direct use of a domestic correspondent account, circumventing typical host-bank due diligence.
• Sanctioned actors exploit these accounts to access the global financial system indirectly.

• Aggregate funds from multiple clients into a single account, obscuring direct links to sanctioned individuals.
• Reduces transparency of wealth ownership, hindering efforts to identify or freeze restricted parties’ assets.

• Enables the purchase of properties using layered corporate structures, obscuring sanctioned individuals’ involvement.
• Large, high-value transactions serve as a vehicle to store or ‘clean’ illicit proceeds from sanctioned activities.

• Involves creating and handling invoices, shipping records, and certificates, which can be falsified to hide sanctioned parties.
• Over- and under-invoicing tactics leverage false documents to route funds undetected.

• Over- and under-invoicing can embed illicit flows linked to sanctioned entities into otherwise legitimate trade.
• Complex trade-based transactions reduce transparency, allowing sanctioned parties to move funds undetected.

• Allow cross-border fund movements that can hide the true beneficiary when compliance is circumvented.
• Sanctioned parties often route payments through multiple intermediaries to mask their involvement.

• Provide financial accounts in jurisdictions with weaker transparency, enabling sanctioned parties to skirt oversight.
• Layered offshore accounts disguise the origin of funds or the identities of restricted entities.

• Can be manipulated to create false financial statements, obscuring transactions tied to sanctioned entities.
• Professional oversight lends legitimacy to illicit flows, helping conceal beneficial owners and transactional footprints.

• Provide foreign banks with access to the domestic banking system, facilitating cross-border transactions that may obscure sanctioned parties.
• Nested accounts and insufficient oversight in respondent institutions can enable covert movement of restricted funds.

• Facilitate rapid establishment of corporate entities in secrecy jurisdictions, shielding sanctioned owners.
• Complex structures limit regulatory visibility, enabling cross-border fund flows beyond sanctions enforcement.

• Allow the formation of layered legal entities or front companies, shielding sanctioned owners behind nominee arrangements.
• Provide fiduciary oversight and administration that can hide true beneficial ownership from authorities.

Real estate professionals manage transactions that can be used to purchase properties under complex corporate structures. Such arrangements help sanctioned actors hide their involvement in high-value acquisitions, complicating financial institutions' efforts to identify and screen ultimate beneficiaries.

Money services businesses, including currency exchange and remittance providers, can be used to move funds internationally without triggering standard banking oversight. This activity allows sanctioned parties to evade detection, challenging financial institutions' ability to track and block illicit flows.

Unregulated or loosely regulated cryptocurrency exchanges provide a channel for sanctioned individuals or entities to convert and transfer digital assets while avoiding traditional banking oversight. This weakens sanctions enforcement by enabling cross-border value movements without the scrutiny of standard financial institutions.

Import-export companies employ trade-based techniques, such as over- or under-invoicing, to embed illicit proceeds in legitimate commerce. By manipulating trade documents and flows, they conceal sanctioned entities' involvement in cross-border transactions, making it harder for financial institutions to detect and block prohibited activities.

Lawyers, accountants, and corporate service providers within DNFBPs can be exploited to create intricate corporate structures, mask beneficial ownership, and facilitate cross-border transfers. This involvement helps sanctioned individuals or entities circumvent restrictions, rendering financial institutions' customer due diligence processes less effective.

Document forgers alter or create fraudulent paperwork to conceal ownership relationships or falsify trade records. By forging documents, they hide connections to sanctioned parties, impeding financial institutions' ability to verify authenticity during customer and transaction due diligence.

Shell or front companies are used to disguise beneficial ownership and the true origin or destination of funds. Adversaries establish them, often in permissive jurisdictions, to bypass sanctions restrictions, complicating financial institutions' due diligence and screening efforts.

Mixers pool and redistribute digital assets, obscuring their original source or destination. By using mixers, sanctioned parties can further mask cryptocurrency transaction trails, undermining financial institutions' ability to identify and block blacklisted wallets or addresses.