The clearest published example of how special purpose companies and location data interact.
OFAC’s enforcement release describes a shipping industry client in Crimea, onboarded before the 2014 invasion, who owned three special purpose companies each holding an account at Swedbank Latvia. Between February 2015 and October 2016 the client initiated 386 transactions totalling $3,312,120 through those accounts, processed through US correspondent banks.
Around March 2016 the client attempted to send payments from an IP address in Crimea, and a US correspondent bank rejected them citing a potential connection to Crimea and alerted Swedbank Latvia.
The two structural points
The first is the single-purpose company. Three accounts in the names of three special purpose vehicles present, to a monitoring system, as three customers. They were one.
The second is that the warning arrived from outside. The correspondent bank saw something the account bank had not, and told it. That is the correspondent chain working the way the Wolfsberg guidance intends, and it is worth noting how often in the published record the alert originates upstream rather than at the institution holding the relationship.
The location signal
The IP address is the same indicator that recurs across the virtual currency cases: data the institution already held, describing where the customer actually was, not being tested against where the customer said they were.