Sanctions Evasion Red Flags: 12 Patterns Compliance Teams Miss
Sanctioned parties rarely put their own names on transactions. The serious cases hide behind front companies, transhipment chains, payment routing tricks and structured ownership opacity — patterns that conventional name-match screening cannot catch on its own. This guide covers 12 red flags drawn from FinCEN, OFAC, OFSI and FATF guidance, with the underlying behaviour patterns and the controls that detect them.
Every major sanctions enforcement case in the past decade has involved evasion rather than direct violation. The pattern is consistent: a designated party, an Iranian or Russian or DPRK entity under sanctions, conducts business through intermediary structures specifically designed to be unrecognisable as the sanctioned party. The financial institutions in the chain screen the immediate counterparty, the screening passes, and the transaction processes — because the screening was looking for the designated party itself, not for the structural fingerprints of evasion.
OFAC, OFSI and FinCEN have published extensive evasion typology guidance because the regulators understand that name screening alone is structurally insufficient. The expectation is that mature sanctions programmes layer behavioural and structural detection on top of name matching — looking for the patterns that recur across cases regardless of which specific names appear.
Why Sanctions Evasion Detection Is Hard
Three structural factors make sanctions evasion difficult to catch with conventional screening:
The sanctioned party's name is never on the transaction. By design. The front company is incorporated in a non-sanctioned jurisdiction, controlled (often indirectly) by the sanctioned party, but operationally independent on paper. The screening engine looking for the Iranian shipping company finds nothing wrong with the BVI shell company — because the BVI shell company is not on any sanctions list.
The transaction documents are constructed to mislead. Bills of lading, invoices, packing lists and trade documents are routinely falsified in sanctions evasion cases. A shipment from Iran is documented as originating in the UAE; a payment for sanctioned oil is invoiced as a payment for unrelated petrochemicals; cargo manifests describe one product but contain another.
Intermediaries are often complicit or wilfully blind. The shipping companies, trading houses, intermediary banks and trade-finance providers in the chain may or may not know they are facilitating sanctions evasion. In some cases the structure is sophisticated enough that genuine due diligence cannot penetrate it. In others, the intermediaries are knowing participants — which is itself the enforcement risk that financial institutions need to manage.
The implication for compliance programmes: name-match screening is necessary but not sufficient. The additional layer is pattern recognition — looking for the structural fingerprints of evasion regardless of whether any specific name on the screening list matches.
The 12 Red Flag Patterns
The patterns below appear repeatedly in published OFAC, OFSI and FinCEN advisories on sanctions evasion typologies. None is conclusive on its own; the presence of multiple patterns in a single relationship or transaction is the signal that warrants escalation.
Recently Incorporated Counterparties in Intermediary Jurisdictions
Counterparty company formed within the past 12–24 months in a jurisdiction known for company-formation services (BVI, Cayman, Hong Kong, Dubai, Belize) but with declared operational presence in a higher-risk jurisdiction. The pattern is the registration of a clean-looking entity specifically to act as an intermediary for the underlying sanctioned activity.
Cargo Routing Through Non-Logical Transhipment Ports
A shipment of goods routed through a port that has no commercial logic — significantly out of the natural geographic route, or through a port with known historic role in transhipment of sanctioned cargo. UAE ports, Turkish ports and select Black Sea ports recur in case data. The transhipment break is where the cargo origin documentation is changed.
Common Mailing Address Across Multiple Counterparties
Multiple ostensibly unrelated customers sharing a registered address — particularly a corporate-service-provider address in a small jurisdiction. The pattern is the use of nominee company structures from a single service provider to layer the sanctioned party's transactions across multiple legal entities.
Vessel AIS Dark Periods
Vessels involved in the underlying trade going AIS-dark (transponder switched off) during specific portions of their voyage — often in the vicinity of sanctioned ports. AIS data is publicly available and increasingly machine-readable; programmes screening trade finance counterparties should monitor vessel transponder behaviour as part of routine due diligence.
Payment Routing Through Multiple Intermediary Banks
Payments routed through more banks than commercially necessary — particularly with intermediaries in jurisdictions with weaker sanctions enforcement, or with intermediary banks known to have correspondent relationships with sanctioned-jurisdiction institutions. The pattern is engineered complexity to obscure the originator and beneficiary path.
Trade Documentation Inconsistencies
Bills of lading inconsistent with invoices, port-of-loading not matching the declared origin, weights and volumes not matching the underlying cargo type, unit prices significantly above or below market for the declared product. These inconsistencies are the operational fingerprints of falsified trade documentation.
Dual-Use Goods Shipments to Risk Jurisdictions
Shipments of technical goods with both civilian and military applications (semiconductors, certain industrial equipment, specific materials) routed to or through risk jurisdictions. Export controls overlap with sanctions in this space, and a customer shipping dual-use goods through ambiguous trade chains warrants enhanced scrutiny regardless of whether any specific party is sanctioned.
Sudden Beneficial Ownership Changes Pre-Onboarding
A corporate customer's beneficial ownership structure changes materially in the months immediately preceding their account application — typically with previously named owners being replaced by jurisdictions or structures that produce cleaner screening results. The pattern is restructuring specifically to enable banking relationships that would otherwise fail due diligence.
Multiple Customers With Common Directors or Beneficial Owners
Apparently unrelated corporate customers sharing directors, beneficial owners or signatories — particularly when those individuals appear on a high number of corporate registers across multiple jurisdictions. This is the nominee-director pattern that recurs in front-company structures.
Payment Instructions Specifying Removal of Identifying Information
Customer instructions to omit, alter or shorten payment message fields — typically the originator's name or the underlying purpose of the payment. The pattern is the deliberate stripping of identifying information from the payment chain to avoid downstream screening.
Round-Number Payments Disconnected From Trade Documentation
Large round-number payments (USD 5 million, USD 10 million) that do not align cleanly with any specific invoice or shipment — particularly between counterparties with thin trade history or in industries that do not produce round-number commercial settlements naturally.
Negative News Mentioning Sanctioned-Jurisdiction Connections
Adverse media covering the customer that references — even indirectly — connections to sanctioned jurisdictions, designated individuals, or known evasion networks. The negative coverage is itself a signal the underlying due diligence missed. Open-web and licensed adverse media should both surface this category of content.
Combining Red Flags Into Risk Scoring
No single red flag justifies an automatic escalation — most have innocent explanations in isolation. A recently incorporated counterparty in a jurisdiction known for company formation is also the profile of most legitimate startups in that jurisdiction. Round-number payments disconnected from invoices are also the profile of many normal intercompany settlements.
The detection value comes from combinations. Three or four of the patterns appearing in the same relationship — a recently-incorporated counterparty, shared address with other customers, payment routing through non-logical intermediaries, sudden ownership change pre-onboarding — is a different proposition entirely. The probability that a relationship combining four independent evasion fingerprints is innocent declines sharply with each additional pattern.
Operational risk scoring tracks red-flag combinations rather than individual occurrences. Each pattern adds weight to the relationship's risk score; threshold triggers automatic escalation when the combined score reaches a defined level. The scoring methodology should be documented and approved as part of the firm's risk-based approach — covered in detail in our CRA methodology guide.
Building a Sanctions Evasion Detection Programme
A defensible programme covering sanctions evasion has four operational layers:
- Name-match screening as the baseline. Every customer and counterparty screened against current sanctions lists; this catches direct violations but not structured evasion.
- Ownership and control analysis. UBO discovery on every corporate customer, with attention to nominee-director patterns, recent restructuring, jurisdictional risk in the ownership chain. Connects to the firm's UBO discovery methodology.
- Behavioural transaction monitoring. Patterns of transaction routing, counterparty geography, payment instructions and trade-documentation consistency monitored against typology rules and behavioural baselines. The transaction-monitoring component of evasion detection is as material as the customer-due-diligence component.
- Trade-finance specific monitoring where applicable. For firms with trade-finance exposure, vessel AIS monitoring, cargo manifest reconciliation, and dual-use goods controls layered on top of the standard programme.
Each layer is independently necessary; none alone is sufficient. Programmes that rely on a single layer (typically name screening) consistently produce the enforcement findings that drive the multi-hundred-million-dollar settlements.
Sanctions Detection Beyond Name Matching
One Constellation combines real-time sanctions list screening with UBO discovery, behavioural transaction monitoring and adverse media — surfacing evasion patterns name-match alone cannot catch.
