How sanctions evasion actually works
Most sanctions training explains the prohibitions and stops there. Very little of it explains what the other side of the table is actually doing, or which parts of it are visible from inside a financial institution. This note is about the mechanics, and about being candid with yourself on the limits of what payment data will ever tell you.
Start with what the evader is trying to achieve
Every sanctions evasion scheme I have unpicked in about twenty years has had the same objective underneath it: break the visible link between a restricted interest and the payment or the cargo, without breaking the commercial reality. The goods still need to move. The money still needs to arrive. Somebody still needs to be paid.
That constraint is the analyst's friend. An evasion structure is not free. It costs money to incorporate companies, to hire nominees, to re-document cargo, to route payments through an extra two intermediaries who each take a cut. Those costs leave traces — in the pricing, in the routing, in the sudden appearance of a counterparty with no commercial history who somehow handles eight-figure volumes.
What follows is the anatomy of the common methods. I have grouped them by where they happen, because that determines whether you can see them.
The ownership layer
The simplest move is to put the designated interest below whatever ownership line the relevant regime draws. In the United States, OFAC blocks entities owned fifty per cent or more, directly or indirectly, by one or more blocked persons — so an interest of forty-nine per cent sits outside the automatic rule, even though control may be complete. The UK approach under OFSI adds a control limb that catches arrangements an ownership percentage alone would miss. The EU, and other regimes again, aggregate and test differently. If you have internalised one regime's arithmetic as the arithmetic, you will misread files. I have written separately on why the fifty per cent ownership rule catches people out, and that is worth reading alongside this.
Restructuring below a threshold is usually accompanied by a change in the register: a transfer of shares to a spouse, an adult child, a long-standing business associate, or a foundation in a jurisdiction that does not publish beneficial ownership. The tell is almost never the new owner's name. It is the timing. A shareholding that moved in the four weeks either side of a designation announcement is a fact worth recording in the file even if you can draw no conclusion from it.
Alongside restructuring sits the front company. Here the distinction between a trading entity with thin substance and a dormant corporate bought off the shelf matters more than people assume — I have set out the difference in shell companies versus shelf companies. For sanctions work the relevant question is not "is this a shell" but "does this entity's activity make sense without the restricted party behind it". A freight agent incorporated eleven months ago, with a registered address shared by two hundred other companies and a sole director resident in a third country, may be perfectly legitimate. It is also exactly what you would build.
The physical layer: ships, transfers and paperwork
This is where evasion becomes operationally interesting and where a bank's visibility drops off sharply.
Ship-to-ship transfers are a normal commercial practice in parts of the world where port infrastructure cannot take large vessels. They are also the standard method for severing the documentary link between a cargo's origin and its destination. Oil loaded at a restricted terminal is transferred at sea to a second vessel, blended with product of a different origin, and discharged with paperwork describing it as something else from somewhere else.
Automatic Identification System gaps accompany this. A vessel switches off its transponder, or transmits a falsified position, for a period that conveniently covers the transfer. FATF and the specialist maritime advisories have documented the pattern extensively. What matters for our purposes is the shape: a gap of several days in a voyage that otherwise reports continuously, in a sea area known for transfers, followed by a draught reading inconsistent with the declared cargo. That is a detectable signal — but it is detectable with vessel tracking data, not with payment data.
The documentation layer sits on top. A falsified certificate of origin, a bill of lading reissued at a transhipment hub, an inspection certificate from a surveyor nobody has heard of. If you handle trade finance you will see some of these, and the reading technique overlaps heavily with what I described in reading an invoice for trade-based money laundering red flags: compare the document against itself, against the commercial logic, and against what the route would physically require.
Why origin documents are the weak point
Certificates of origin are issued by a wide variety of bodies — chambers of commerce, trade ministries, industry associations — with wildly varying verification standards. A certificate that looks authentic very often is authentic, in the sense that the issuing body really did issue it, on the basis of a declaration nobody checked. That is not forgery. It is a true document containing a false fact, which is considerably harder to challenge.
The payment layer, and what you can actually see
Here is the part most relevant to the majority of readers, because for most of us the payment is all we have.
Routing through intermediaries does two things. It inserts parties who are not themselves restricted, and it strips or degrades the reference information that would have identified the underlying trade. A payment that began as "settlement, cargo X, vessel Y, contract dated Z" arrives as "intercompany transfer". Where there is a nested relationship behind the correspondent — a respondent bank providing access to downstream institutions you have no direct relationship with — your visibility of the originating party can be close to nil. The Wolfsberg Group correspondent banking work remains the clearest statement of what the sending institution ought to be providing, and the gap between that and what actually arrives is the whole problem. I have gone into the mechanics in nested correspondent banking risk.
From payment data alone, realistically, you can see:
- Counterparty churn. A set of beneficiaries that turns over every two or three months rather than persisting, which is unusual for genuine supply relationships.
- Jurisdictional re-routing. Trade that used to settle directly now settling via a third country that has no obvious role in the goods' journey, with the change dating from a specific month.
- Value and frequency shifts that outrun the business. This is arithmetic rather than suspicion — a customer whose stated turnover supports perhaps a million a year receiving nine million in six months has a question to answer, and the answer may well be good.
- Reference field residue. People are lazy. Vessel names, IMO numbers, contract references and commodity descriptions survive in free-text fields far more often than you would expect, and they are searchable against open maritime sources.
What you cannot see from payment data: whether a ship-to-ship transfer occurred, whether a certificate of origin is accurate, whether the forty-nine per cent shareholder takes instructions from the person who used to hold eighty. Those require trade documents, vessel tracking, corporate registry work, or external intelligence. Pretending otherwise produces files full of confident conclusions resting on nothing.
Case note
A payments institution I advised had onboarded a freight forwarding company in late 2021. Stated activity was road and sea freight between two neighbouring states, projected annual turnover about four hundred thousand euros. For the first three quarters the account behaved accordingly: thirty to forty payments a quarter, average value just under nine thousand euros, counterparties stable.
Between October 2022 and September 2023 the account received four point one million euros across one hundred and forty-two credits, with ninety-one per cent arriving from four entities incorporated in a single third jurisdiction between June and August 2022. Outgoing payments went to eleven beneficiaries, six of which appeared only once. Nothing screened as a match. No designated party was named anywhere in the data.
What turned the file was the reference fields. Eighteen payments carried what looked like IMO numbers. Three of those vessels, checked against open sources, had reported AIS gaps of between four and nine days in a period matching the payment dates. The analyst did not conclude that sanctions had been breached, and the write-up was careful not to. It set out the arithmetic, the timing coincidence, the registry dates, and the limits of what the institution could verify. The relationship was restricted pending documentary evidence of the underlying contracts, and a disclosure was made to the relevant national authority.
Writing it up when you cannot prove it
The discipline that separates a useful sanctions escalation from a useless one is the willingness to state what you do not know. A file that says "the customer is evading sanctions" and cannot evidence it is worse than useless; it invites a reviewer to dismiss the whole thing. A file that says "payments totalling X were received from entities incorporated within a defined window; three vessel identifiers in reference fields correspond to vessels with reported AIS discontinuities; the institution has no sight of the underlying trade documentation" gives a receiving authority something to work with.
That matters because your disclosure is one input among many. The authority receiving it may hold the registry data, the intelligence, or the three other reports that make yours make sense. The FATF framework assumes exactly this division of labour — institutions report observable facts, authorities assemble them.
Be specific about dates, amounts and the source of every assertion. Mark inference as inference. If you adopted a counterparty's own description of its business, say so rather than presenting it as verified. The same construction principles I set out in how to write a SAR narrative apply with more force here, because sanctions files are read by people with legal powers and short patience for padding.
The honest limits
A bank sitting at the payment layer sees a shadow of the scheme. It will rarely see the transfer at sea, the nominee agreement, or the handshake that put the shares in a cousin's name. What it can see is inconsistency: between stated business and observed flow, between a corporate history and the volumes it suddenly handles, between a route that made commercial sense in February and the one that replaced it in March.
Train your analysts to document the inconsistency precisely and to resist the pull towards a tidy narrative. Sanctions evasion is designed by people who know what your screening engine looks for. The thing it is not designed to survive is a patient reader asking why this particular company, incorporated eleven months ago, is moving this particular volume along this particular route — and writing the answer down honestly, including the parts that remain unknown.
Worth remembering: You are looking at a shadow of the scheme, not the scheme — document what the data shows, mark what you inferred, and let the authority with the wider view assemble the rest.
