Sanctions Evasion Reference

What are third-country bank accounts and how are they used?

Holding accounts in a jurisdiction unconnected to the restricted party, the goods or the contract, so that payments reach and leave the restricted economy without ever appearing to touch it.

also known as

proxy accounts, conduit accounts, third-jurisdiction banking

seen in

Russian Federation, Islamic Republic of Iran, Democratic People's Republic of Korea

reviewed

2026-08-20

A payment carries the jurisdictions of the parties with it. If a restricted party’s account is in a restricted bank, the payment says so. The response is to hold accounts somewhere else, in a bank with no restrictions, in the name of an entity with no obvious connection to the restricted party.

The technique is the financial counterpart of third-country transshipment, and it is used alongside it constantly, because the goods and the money have to make the same journey.

How it works

An account is opened in a permissive jurisdiction in the name of a trading company. The company is real enough to be onboarded: it has an address, a director, a business description and, ideally, a genuine trading history.

Payments arrive from counterparties and are forwarded onward. What distinguishes the account from an ordinary corporate account is that essentially nothing happens locally. Money enters and leaves. Very little stays, and nothing accumulates.

FATF and the Egmont Group describe the resulting profile precisely. An account of a trade entity appears to be a pay-through or transit account, with rapid movement of high-volume transactions and a small end-of-day balance and no clear business reason1 ; payments are sent or received in large round amounts in sectors where that is unusual2 ; cash deposits are subsequently transferred to persons or entities in free trade zones or offshore jurisdictions with no business relationship to the account holder2 .

The choice of jurisdiction

Three properties matter, and they are practical rather than ideological.

Correspondent access: the jurisdiction’s banks must hold the currency the trade settles in, or the account is useless.

Regulatory posture: the country must not apply the restriction in question, or must apply it differently.

Volume: a financial centre handling large trade flows offers cover that a small jurisdiction does not.

The result is that the countries appearing in this role are frequently significant, well- regulated trading hubs rather than obscure offshore centres. That is not a failure of their regulation; it is a consequence of the fact that concealment requires volume to hide in.

Why this is where sanctions and laundering diverge

An important distinction: a laundering network wants funds to end up somewhere they can be used. A sanctions network wants funds to end up with a specific party in a specific place, which is a harder constraint.

The money cannot stay in the third country. It has to complete its journey, and the final leg — into the restricted jurisdiction, or into the hands of a restricted party — is the point at which the structure is exposed to a record it does not control.

That is why the accounts have such a distinctive shape. They are not stores of value; they are conduits, and conduits look like conduits.

How it is caught

Balance and flow profile. An account whose inflows and outflows match, whose balance is negligible and whose activity has no local component is describing itself. This is one of the few purely quantitative indicators in the whole field.

Counterparty geography. The corridor structure of the account — where money comes from and where it goes — is visible to the account bank and to any correspondent in the chain, and it either matches the declared business or does not.

Payment third parties. FATF and Egmont flag payment for imported commodities made by an entity other than the consignee with no clear economic reason — for instance by a shell or front company not party to the trade3 . Both are ordinary questions a trade finance reviewer can ask.

Aggregation at the FIU. Layering across several banks is invisible to each of them and visible to the financial intelligence unit that holds all their reports, which is the structural reason FIUs exist.

What the sources say

Each numbered claim above, with the words of the document it rests on and — for the Panel of Experts reports — the paragraph it comes from. Quotes are checked against the source text at build time.

  1. “rapid movement of high-volume transactions”

    Trade-Based Money Laundering: Risk Indicators. Financial Action Task Force and Egmont Group, 2021.

  2. “transferred to persons or entities in free tra de zones or offshore jurisdictions”

    Trade-Based Money Laundering: Risk Indicators. Financial Action Task Force and Egmont Group, 2021.

  3. “payment for imported commodities is made by an entity other than the consignee”

    Trade-Based Money Laundering: Risk Indicators. Financial Action Task Force and Egmont Group, 2021.

Red-flag indicators

12 listed
01 The entity's trade activity is inconsistent with its stated line of business — a car dealer exporting clothing, or a precious metals dealer importing seafood. FATF and Egmont Group, 2021
“trade activity is inconsistent with the stated line of business”

FATF and Egmont Group, Trade-Based Money Laundering: Risk Indicators (2021). Read the source document

02 Payment for imported commodities is made by an entity other than the consignee with no clear economic reason — for instance by a shell or front company not party to the trade. FATF and Egmont Group, 2021
“payment for imported commodities is made by an entity other than the consignee”

FATF and Egmont Group, Trade-Based Money Laundering: Risk Indicators (2021). Read the source document

03 A respondent provides correspondent banking services onward to other institutions — a downstream, or nested, arrangement — so the correspondent serves customers it never onboarded. The Wolfsberg Group, 2022
“downstream fi (also referred to as “nested”)”

The Wolfsberg Group, Wolfsberg Financial Crime Principles for Correspondent Banking (2022). Read the source document

04 It cannot be determined whether the respondent has controls in place to ensure payment transparency in the services it offers onward. The Wolfsberg Group, 2022
“controls are in place to ensure payment transparency”

The Wolfsberg Group, Wolfsberg Financial Crime Principles for Correspondent Banking (2022). Read the source document

05 An account functions as a pay-through or transit account: rapid movement of high-volume transactions with a small end-of-day balance and no clear business reason. FATF and Egmont Group, 2021
“rapid movement of high-volume transactions”

FATF and Egmont Group, Trade-Based Money Laundering: Risk Indicators (2021). Read the source document

06 Incoming wire transfers to a trade-related account are split and forwarded to unrelated accounts with little or no connection to commercial activity. FATF and Egmont Group, 2021
“forwarded to non- related multiple accounts”

FATF and Egmont Group, Trade-Based Money Laundering: Risk Indicators (2021). Read the source document

07 Payments are routed in a circle: funds sent from one country and received back in the same country after passing through others. FATF and Egmont Group, 2021
“payments are routed in a circle”

FATF and Egmont Group, Trade-Based Money Laundering: Risk Indicators (2021). Read the source document

08 Very late changes are made to payment arrangements — payment redirected to a previously unknown entity at the last moment, or changes to the scheduled date or amount. FATF and Egmont Group, 2021
“very late changes to payment arrangements”

FATF and Egmont Group, Trade-Based Money Laundering: Risk Indicators (2021). Read the source document

09 An account shows frequent cash deposits subsequently transferred to persons or entities in free trade zones or offshore jurisdictions with no business relationship to the account holder. FATF and Egmont Group, 2021
“frequent deposits in cash”

FATF and Egmont Group, Trade-Based Money Laundering: Risk Indicators (2021). Read the source document

10 An account shows an unexpectedly high number or value of transactions inconsistent with the client's stated business activity. FATF and Egmont Group, 2021
“inconsistent with the stated business activity of the client”

FATF and Egmont Group, Trade-Based Money Laundering: Risk Indicators (2021). Read the source document

11 Cash deposits or other transactions are consistently just below the relevant reporting thresholds. FATF and Egmont Group, 2021
“consistently just below relevant reporting thresholds”

FATF and Egmont Group, Trade-Based Money Laundering: Risk Indicators (2021). Read the source document

12 Transaction activity associated with a trade entity increases quickly and significantly in volume, then goes dormant after a short period. FATF and Egmont Group, 2021
“goes dormant after a short period”

FATF and Egmont Group, Trade-Based Money Laundering: Risk Indicators (2021). Read the source document

Each indicator above is quoted or paraphrased from the advisory or typology report named beside it. Expand a row for the citation. These are recognition aids drawn from published guidance, not a compliance checklist.

How it is detected

Conduit accounts have a quantitative signature that is unusually clean: inflows that match outflows, negligible retained balance, and no local economic activity to explain either. The corridor structure — where money arrives from and where it leaves for — is visible to the account bank and every correspondent in the chain, and either matches the declared business or does not. At transaction level, payment by or to a party with no role in the underlying trade, and requests to settle into a jurisdiction unconnected to the contract or the goods, are questions any trade finance reviewer can ask. Layering across several banks is invisible to each and visible to the financial intelligence unit holding all their reports.

Enforcement record

Documented outcomes on this site that turned on this technique.
Case Outcome Authority Date Penalty
British American Tobacco and the North Korea joint venture 2007–2023 Settlement OFAC 2023-04-25 $508,612,492
Swedbank Latvia: a client banking from Crimea 2015–2023 Settlement OFAC 2023-06-20 $3,430,900
Sojitz Hong Kong: dollar payments for Iranian-origin polyethylene 2016–2022 Settlement OFAC 2022-01-11 $5,228,298
Essentra FZE: cigarette filters to North Korea through front companies 2018–2020 Settlement OFAC 2020-07-16 $665,112
Standard Chartered: 9,335 payments from accounts in Dubai 2009–2019 Settlement OFAC 2019-04-09 $657,040,033
Commerzbank: a manual payment queue for Iranian counterparties 2002–2015 Settlement OFAC 2015-03-12 $258,660,796
Clearstream: one layer deeper in the custody chain 2007–2014 Settlement OFAC 2014-01-23 $151,902,000
BNP Paribas: the $963m correspondent banking settlement 2005–2014 Settlement OFAC 2014-06-30 $963,619,900

Related techniques

  • How is correspondent banking used to evade sanctions? — Using a chain of banks that each know only their own customer, so that a payment for a restricted party reaches a currency it could not access directly, without any bank in the chain seeing the whole transaction.
  • What is a front company? — A front company is a business that trades normally but exists largely to hide another party's involvement in its transactions. The real activity is the cover; the concealed party is the point.
  • What is shell company layering? — Layering is the use of successive companies in different jurisdictions between an asset and its owner, so that no single register, filing or payment record shows the connection between them.
  • What is trade misinvoicing? — Trade misinvoicing is misstating the price, quantity or description of goods on trade documents, so that value moves across a border in a direction and an amount the paperwork does not admit.
  • What is hawala and how does informal value transfer work? — Settling obligations between brokers in different countries by netting them against each other, so a customer's payment reaches a recipient abroad without any funds crossing a border.

Where this appears

Sanctions programmes

  • Russia sanctions — Measures imposed from 2014 and greatly expanded from 2022, combining designations, sectoral restrictions, export controls and a price cap on seaborne oil.
  • Iran sanctions — A layered set of US, EU and UN measures dating from 1979 and substantially rebuilt after 2018, covering energy, finance, shipping, and proliferation-related procurement.
  • North Korea sanctions — The most comprehensive UN-mandated regime, prohibiting most trade with North Korea, backed by Panel of Experts reporting that documents evasion in unusual detail.

Jurisdictions in the published record

  • United Arab Emirates — A major re-export hub and financial centre that appears in enforcement records across almost every technique on this site, principally because of the volume of trade that passes through it.
  • Türkiye — A large manufacturing and transit economy whose trade with several restricted destinations has grown substantially, making it central to third-country routing analysis.
  • Hong Kong — A major financial and trading centre whose company formation regime, banking sector and re-export role place it in a large share of published corporate concealment cases.
  • Cyprus — An EU member state with a substantial corporate services and holding-company sector that appears in a large share of published beneficial ownership concealment material.
  • Kazakhstan — A customs union member with extensive land connections to Russia and China, prominent in trade-statistics analysis of re-routed goods since 2022.

Terms used on this page

  • Correspondent banking — An arrangement in which one bank holds an account for another and provides payment and other services on its behalf, usually to give it access to a foreign currency.
  • Financial intelligence unit — The national agency that receives suspicious activity reports, analyses them, and disseminates intelligence to law enforcement and to counterpart units abroad.
  • Suspicious activity report — A confidential report filed by a regulated firm with its national financial intelligence unit when it knows or suspects that activity may involve criminal proceeds or sanctioned parties.
  • Layering — Inserting successive intermediate parties, transactions or jurisdictions between an asset and its owner so that the connection cannot be established from any single record.
  • Know your customer — The obligation on a regulated firm to identify its customer, verify that identity, and understand the purpose of the relationship before providing services.
  • Secondary sanctions — Measures that threaten non-US persons with loss of access to the US market or financial system if they engage in specified dealings with sanctioned parties.

Further reading and sources

  1. Trade-Based Money Laundering: Trends and Developments. Financial Action Task Force and Egmont Group, 2020.
  2. Correspondent banking principles and guidance. The Wolfsberg Group, 2022.
  3. The FATF Recommendations. Financial Action Task Force, 2025.
  4. Professional Money Laundering. Financial Action Task Force, 2018.
  5. Egmont Group of Financial Intelligence Units. Egmont Group, 2026.