Every technique described elsewhere on this site is about concealment — a party doing something deliberately to defeat a control. This one is different. Nothing is hidden. The transaction simply never reaches a system that would have stopped it, because the system belongs to the parent and the transaction was booked on the subsidiary’s own.
How it works
A company acquires a foreign business — a logistics agent, a distributor, a trading arm. The acquired business keeps its own transaction systems, its own customer list and its own export paperwork, at least for a while, because integrating two companies’ systems is slow, expensive and rarely the acquisition’s first priority.
OFAC’s own compliance framework identifies exactly this sequence as a recurring source of violations: risk assessment and sanctions-related due diligence are important during mergers and acquisitions, particularly involving non-US companies or corporations1 , and compliance functions should be integrated into the merger, acquisition and integration process itself, not bolted on afterward2 . Where that does not happen, the acquired unit goes on dealing with counterparties, countries and airlines it has always dealt with, and nothing about the transaction looks unusual to the people processing it — it only looks unusual to a screening system the transaction never reaches.
Two ways the gap is expressed
The subsidiary is foreign and assumed to be out of reach. US companies and their foreign subsidiaries can both be caught by sanctions programmes — Cuba and Iran in particular reach US-owned or -controlled foreign entities directly — but OFAC’s framework records “facilitating transactions by non-U.S. persons”3 as a distinct, recurring root cause: a foreign unit approves or processes a transaction on the assumption that its non-US location puts it outside OFAC’s reach.
The system is foreign and simply not connected yet. Even where the legal exposure is understood, the acquired entity’s export or trade-finance system was never wired into the parent’s screening. This is the C.H. Robinson pattern: a Spanish subsidiary, acquired in February 2019, exported textile-machinery parts to Iran the following month using its own export system, which the parent could not yet see.
What the record shows
The C.H. Robinson case is the clearest documented instance: five subsidiaries acquired between 2016 and 2019 kept their own systems until at least 2022, and OFAC found that the “vast majority” of the resulting 82 shipments happened because those systems had not yet been integrated into the parent’s screening. The gap was not one transaction; it was years of ordinary business, unexamined, at every acquired unit until an internal audit — OFAC’s recommended post-deal check4 — finally found it.
The Toll Holdings case shows the same structural cause at a larger scale: 2,958 payments over six years connected to shipments to, from or through North Korea, Iran and Syria, arising from what this site’s own account of the case describes as growth by acquisition across many jurisdictions without a corresponding sanctions screening capability. Neither case alleges a scheme. Both describe an absence.
How it is caught
A dated integration record. For any acquisition, the interval between closing and full screening connection is a fact a company should be able to produce on request. A parent that cannot say when a given subsidiary’s transactions started being screened is describing this gap whether or not any violation has yet occurred.
Post-closing audit and testing. OFAC’s framework treats the period after a deal completes as where sanctions-related issues actually surface, naming the organisation’s audit and testing function as critical to identifying them4 . Both documented cases here were found this way — not by a customer complaint or a bank query, but by the parent’s own internal review.
Reading the shipping and payment documents already on file. In the C.H. Robinson case, an air waybill named the carrier code for a sanctioned airline and Tehran as the destination in plain text. The information was not hidden; it was on paperwork nobody at the acquired unit was yet required to check against a list.
What this is not
It is not front-company use, professional enabling or deliberate layering — every entity involved is the real, disclosed, wholly owned subsidiary of a public or well-known company, and every filing accurately names it. The distinguishing fact is timing: the same conduct at the same subsidiary, discovered the day after screening went live, would not be a sanctions story at all. What makes it one is the interval during which the acquisition was complete and the control was not.
It is also not what happened in the Murad case, which looks similar from the outside — an acquisition, a subsidiary, exports to Iran — and is not an integration gap at all. Murad’s executives concealed the conduct from Unilever during due diligence and continued it for over two years after being specifically instructed to stop. Every case above describes a parent that could not see what its acquisition was doing. Murad describes a parent that was told to look away.