Sanctions Evasion Reference

How do investigators actually find sanctions evasion?

Almost always by reconciling records held by different parties. Individual documents in an evasion scheme are internally consistent; what fails is the comparison between them.

step

6 of 7

reviewed

2026-08-20

This is the page that explains what the rest of the site is doing.

The single organising principle

A well-built evasion scheme produces documents that are individually correct. The invoice is a real invoice, the company is really registered, the director really was appointed, the vessel really has that name today.

What cannot be made consistent is the relationship between records held by different parties, in different countries, for different purposes. Detection is the practice of putting two such records beside each other.

The five recurring methods

Comparison against a benchmark. An invoice price against a market price. A country’s imports against its industrial capacity. A freight rate against the published rate for the route. Where an independent measure of what something should be exists, the deviation is the finding.

Aggregate pattern analysis. A structure designed to be invisible in a single lookup is frequently obvious across a whole dataset — the director named on four hundred boards, the formation agent who built two hundred identical companies, the commodity code that collapsed while its neighbour tripled.

Physical corroboration. Documents assert; the world records. A vessel’s actual track, a terminal’s records, a recovered component’s part number, a satellite image. This is what resolves phantom shipments and at-sea transfers, and it is why the absence of transmitted data is itself evidence.

Relational linking. Fronts and shells are found through what they share with something already known: an address, a phone number, an email domain, an officer, a payment.

The internal record. In nearly every published case, somebody inside the organisation asked the right question. The document trail of how that question was answered, or closed without an answer, is what turns negligence into knowledge.

What none of this is

None of it is a single decisive test, and none of it produces certainty from one indicator. Every published red flag has an innocent explanation available. Their value is cumulative, and treating any one of them as proof is the characteristic error of amateur analysis in this field.

Read next

Terms used on this page

  • Red-flag indicator — A published, attributable observation that a transaction or relationship warrants further enquiry, drawn from patterns seen in past cases.
  • Mirror statistics — Comparing what one country reports exporting to a partner with what the partner reports importing from it, treating persistent gaps as evidence of misreporting.
  • Blockchain analytics — The practice of clustering addresses and attributing them to real-world services or actors, using on-chain patterns and off-chain information.
  • Screening — Automated comparison of names, identifiers and other transaction data against sanctions lists and internal watchlists, at onboarding and on each payment.
  • Typology — A published study describing how a category of illicit activity is actually carried out, built from case material contributed by member jurisdictions.
  • Customer due diligence — The ongoing process of understanding a customer's identity, ownership, expected activity and risk, and checking that actual activity remains consistent with it.

Sources

  1. Trade-Based Money Laundering: Risk Indicators. Financial Action Task Force and Egmont Group, 2021.
  2. Guidance to Address Illicit Shipping and Sanctions Evasion Practices. U.S. Department of State, U.S. Department of the Treasury and U.S. Coast Guard, 2020. Global maritime advisory, 14 May 2020.
  3. Trade Misinvoicing. Global Financial Integrity, 2024.
  4. Concealment of Beneficial Ownership. Financial Action Task Force and Egmont Group, 2018.
  5. UN Comtrade Database. United Nations Statistics Division, 2026.