Sanctions Evasion Typologies to Watch

Sanctioned parties do not announce themselves. To keep moving money and goods, they use recognisable techniques to hide behind others and route around controls. Compliance teams study these evasion typologies because knowing the patterns is what makes detection possible. Here are the major ones and the red flags that give them away.

Shell and front companies

The most common building block of evasion is a company that hides the real party. A shell company has no meaningful operations — it exists on paper to hold assets or route transactions and to obscure ownership. A front company does have real activity, but it is used as cover for a sanctioned party operating behind it. Both defeat name-based screening because the transacting entity is not itself on any list; only the hidden owner is.

Red flags include opaque or layered ownership structures, companies registered in secrecy-friendly jurisdictions with no local footprint, recently formed entities transacting large volumes, and directors or addresses shared across many unrelated companies. This is exactly why the OFAC 50 Percent Rule and beneficial-ownership analysis matter: you must look through the entity to who controls it.

Transshipment and diversion

To move goods to a sanctioned destination, evaders route them through a third country first. Transshipment sends goods to an intermediary jurisdiction, where paperwork is altered or the goods are re-exported to the ultimate, prohibited destination. A related trade-finance red flag is a mismatch between the stated destination and the logical trade route, or shipments through a country with no economic reason to be involved.

Warning signs include last-minute changes to the destination, a consignee that is a freight forwarder rather than an end user, goods whose value or type does not match the buyer's business, and routing through jurisdictions known as diversion hubs near a sanctioned country.

Nested accounts and correspondent abuse

In banking, a powerful technique is the nested account. A sanctioned or high-risk institution gains indirect access to the international financial system by processing its transactions through another bank's correspondent account, without the correspondent bank knowing. The transactions appear to come from the known respondent bank, masking the true originator. This abuses the correspondent banking chain, where a bank may not see beyond its direct customer.

Red flags include unexpected transaction volumes or geographies flowing through a respondent's account, payments referencing parties or countries inconsistent with the respondent's stated business, and third-party institutions appearing in payment details.

Trade-based money laundering and value manipulation

Trade provides cover because goods, prices, and quantities are hard to verify. In trade-based money laundering, value is moved by manipulating trade documents: over- or under-invoicing goods, multiple invoicing for the same shipment, or shipping goods that do not match the paperwork (phantom shipments or misdescribed goods). By mispricing a trade, parties transfer value across borders while appearing to conduct ordinary commerce.

Red flags include prices markedly out of line with market value, documentation inconsistencies between invoices, bills of lading, and letters of credit, and goods descriptions that are vague or economically implausible.

Cross-cutting techniques

• Layering payments. Splitting and routing funds through many intermediaries and jurisdictions to break the audit trail.
• Stripping. Deliberately removing or altering identifying information from payment messages so screening cannot catch a sanctioned party — a serious violation in itself.
• Use of crypto and alternative rails. Moving value through virtual assets or informal value transfer systems to sidestep the regulated banking system.
• Newly formed or dormant entities suddenly transacting, often to stay ahead of screening data.

Why typology awareness matters

No single data point proves evasion; it is the pattern that betrays it. A company in a secrecy jurisdiction is not suspicious alone, but a newly formed shell with hidden ownership, routing goods through a diversion hub, at prices far above market, into a correspondent account showing unexplained geographies, is a coherent evasion story. Compliance teams combine sanctions screening with behavioural monitoring, trade-document review, and network analysis precisely because these typologies live in relationships and patterns, not in a single name.

Key takeaways

• Shell and front companies hide sanctioned parties behind entities that are not themselves listed, defeating name-based screening.
• Transshipment routes goods through third countries to reach prohibited destinations, exposed by illogical routing and end-user mismatches.
• Nested accounts give high-risk banks indirect access via a correspondent's account, masking the true originator.
• Trade-based laundering moves value through over-, under-, and multiple invoicing and misdescribed goods.
• Evasion is detected by patterns — layering, stripping, and opaque ownership together — not by any single data point.