Author Archives: Anastasios Kanellopoulos

As has been analyzed in the previous parts of this white paper series, in an environment where sanctions are both expanding and becoming more sophisticated, especially in sectors like maritime trade, institutions must transition from reactive controls to proactive intelligence-led risk management. Private intelligence does not serve as a supplementary resource but is central to building a resilient and credible sanctions compliance program.

While the Anti-Money Laundering (AML) regime has long operated within a structured and globally harmonized framework, sanctions compliance remains fragmented. Only in 2019 did OFAC formally articulate its expectations for sanctions risk assessments (SRAs), and it is only recently that global regulators have begun to adopt a similar stance. Many institutions still approach sanctions risk through an AML lens, applying legacy tools to a distinct and geopolitically sensitive threat landscape.

It is true that traditional compliance systems are struggling to keep pace with increasingly sophisticated evasion methods. This challenge is especially pronounced in the maritime sector, where obfuscation techniques such as layered ownership structures, secrecy jurisdictions, and document manipulation are widely used to circumvent sanctions regimes. Against this backdrop, enhanced due diligence emerges as a critical tool—not just for compliance, but for strategic risk mitigation.

While initial screening processes reveal elevated risk—whether due to exposure to high-risk jurisdictions, suspicious trade routes, or strange corporate structures— enhanced due diligence provides a more targeted and in-depth analysis. This includes identifying ultimate beneficial owners (UBOs), understanding the source of wealth and key business interests, and uncovering prior associations or red flags. In the maritime domain, these efforts are particularly important given the common use of single-purpose entities, front companies, and nominee shareholders to conceal sanctioned involvement.

Private intelligence capabilities significantly enhance the effectiveness of enhanced due diligence. Access to global corporate registries, vessel ownership databases, litigation records, and local media sources can turn a vague suspicion into a well-substantiated threat assessment—or alternatively, help eliminate false positives. In maritime compliance, where vessels may change ownership or flags frequently and often operate under aliases, such intelligence provides the necessary granularity to identify evasive behavior.

A major challenge for the maritime sector is the operational lag between the imposition of new sanctions and the corresponding updates in official databases. During this window, a recently sanctioned vessel or beneficial owner may still be active in trade, potentially with unwitting counterparties. Private intelligence fills this gap by identifying emerging risks through real-time monitoring of vessel movements, ownership changes, and regional activity.

Also, sanctions risk is no longer limited to primary actors. Regulatory efforts by the U.S., EU, and others are expanding to include those who facilitate restricted trade, such as insurers, port authorities, brokers, and even fuel suppliers. These secondary parties are increasingly being held accountable for indirect exposure to sanctioned activity. For these stakeholders, private intelligence offers a way to map third-party relationships, assess regional vulnerability, and detect involvement in potentially illicit transactions.

Equally important is the effective communication of risk intelligence. Senior leadership and boards must understand exposures and vulnerabilities without needing to interpret technical or operational minutiae. Risk reporting should be concise, strategically framed, and tailored to highlight potential impact and alignment with regulatory expectations. Well-structured intelligence outputs ensure that decision-makers are equipped with the insights they need to balance compliance with commercial objectives.

The reactive nature of traditional compliance—built for known threats and checklist-based assessments—is limited. Activity-based and proliferation-related sanctions, in particular, demand investigative capabilities. A compliance function that merely screens transactions or counterparties post-facto cannot meet today’s regulatory expectations. Instead, institutions must adopt a forward-looking approach grounded in dynamic risk assessment, real-time monitoring, and multidisciplinary expertise.

Conclusion

Enhanced due diligence, when properly executed, becomes more than a compliance requirement – it becomes a strategic decision-support mechanism. It enables organizations to assess exposure with clarity, determine appropriate mitigation strategies, and articulate defensible positions to regulators, stakeholders, and internal governance bodies.

Nowadays, private intelligence should not be seen as an external layer or optional add-on. It is a critical component of modern sanctions compliance—particularly in sectors like maritime shipping, where conventional controls are often inadequate. As regulatory expectations rise and sanctions evasion tactics grow more sophisticated, institutions that adopt intelligence-led approaches will be best positioned to manage risk effectively, protect reputation, and stay ahead of enforcement trends.

Introduction

China’s expanding global investment footprint reflects a shift in how states project influence in the international system. Once primarily a recipient of foreign capital, China has, over the past two decades, become one of the world’s most assertive investors, leveraging foreign direct investment and large-scale infrastructure projects to strengthen diplomatic ties, open markets, and access strategic resources.

The Western Balkans, a region with fragile institutions, unresolved ethnic tensions, and protracted paths toward European Union integration, presents fertile ground for external actors pursuing influence. China has identified this geopolitical vacuum as an opportunity. While the European Union remains the dominant economic partner for most Balkan states, its delayed accession process and bureaucratic conditionality have made Chinese capital an attractive alternative for local governments seeking rapid infrastructure development and politically unconditional funding.

Theoretical Framework

The concepts of economic diplomacy and geoeconomics offer valuable lenses through which to interpret China’s activities in the Balkans. Economic diplomacy refers to the use of economic tools by states to achieve foreign policy goals. This includes trade negotiations, foreign aid, investment strategies, and participation in multilateral economic institutions. Geoeconomics, a related but more strategic concept, emphasizes the deliberate use of economic instruments to produce geopolitical advantages.

China’s foreign policy blends both approaches. Through State-Owned Enterprises (SOEs), concessional loans, bilateral agreements, and the Belt and Road Initiative (BRI), Beijing mobilizes its economic assets not just for commercial returns but to reshape global alignments. These investments are not ideologically driven. Rather, they aim to build long-term partnerships, access markets and critical infrastructure, and project soft power, all while maintaining a posture of political non-interference.

Overview of Chinese Investments in the Balkans

Chinese investment in the Western Balkans is dominated by large infrastructure projects, particularly in transportation, energy, and industrial production. Serbia is the most significant recipient of Chinese capital in the region. Projects include the Belgrade-Budapest railway, the Smederevo steel plant acquisition by Hesteel, and the construction of highways and energy facilities. These initiatives have been executed largely by SOEs, such as China Road and Bridge Corporation (CRBC) and PowerChina, often funded through loans from China’s Exim Bank.

In Montenegro, China funded the Bar-Boljare highway project, representing nearly one-fifth of the country’s GDP. The loan terms, currency denomination, and arbitration clauses raised concerns over sovereignty and debt sustainability. In North Macedonia, Chinese companies have been awarded contracts for road construction projects, though some have been accompanied by allegations of corruption and opacity.

Hungary, though an EU member, has also welcomed Chinese investment under the 17+1 framework. The Budapest-Belgrade rail line, co-financed by Chinese and Hungarian institutions, represents China’s strategic interest in connecting Piraeus Port (controlled by COSCO) to Central Europe.

While state actors dominate major projects, some private Chinese companies have engaged in the region, especially in telecommunications and technology. Huawei and ZTE have expanded their presence, raising questions among EU and NATO partners about cybersecurity and strategic infrastructure resilience.

Diplomatic and Political Dimensions

China’s activities in the Balkans align with the broader strategic objectives of the Belt and Road Initiative, launched in 2013. The BRI enables China to establish transport and energy corridors that bypass traditional Western-controlled routes and promote the internationalization of the yuan. The Western Balkans, positioned between Europe and Asia, are pivotal to the so-called Balkan Silk Road.

Politically, China maintains a stance of non-interference in internal affairs, a position that resonates with Balkan governments seeking investment without democratic conditionality. This approach contrasts sharply with the European Union, whose funding and accession talks are tied to complex governance reforms.

China’s strategy often involves bilateral agreements with limited transparency and engagement with local parliaments. This has raised governance concerns, especially regarding procurement processes, environmental standards, and long-term fiscal impacts. The reliance on Chinese loans, particularly those denominated in foreign currencies, has also led to fears of debt traps, as evidenced by Montenegro’s highway case.

Furthermore, China’s use of cultural diplomacy, educational exchange, and media partnerships under the 17+1 platform has bolstered its soft power in the region. Confucius Institutes, student scholarships, and high-level visits have complemented economic engagement with political symbolism.

Conclusion and Policy Implications

China’s growing presence in the Western Balkans represents a deliberate and multifaceted strategy of economic diplomacy. Through a combination of state-led investment, strategic infrastructure projects, and soft power initiatives, Beijing is reshaping the region’s external alignments, often at the expense of Western influence.

For due diligence and intelligence professionals, these dynamics present critical challenges and opportunities. The opacity of Chinese financing mechanisms, the complex ownership structures of SOEs, and the geopolitical sensitivities surrounding strategic assets demand robust investigative capacity and risk assessment frameworks. Enhanced scrutiny of contractual terms, arbitration clauses, and political exposure is essential.

As China continues to blend commerce with statecraft, the role of due diligence expands beyond financial verification into the realm of geopolitical risk analysis. Understanding the full implications of Chinese investment in the Western Balkans is not only an economic necessity but a strategic imperative for institutions engaged in the region.

Introduction

Terrorist groups use complex financial networks to fund their activities, particularly in vulnerable countries across the Middle East, where instability and weak regulatory frameworks prevail. This report serves as the introduction to a regional analysis series, examining the challenges the middle east faces in combating Anti-Money Laundering (AML), financial crime, and terrorism financing.

The analysis series shed light on how banking sectors in these fragile environments are exploited by sanctioned groups, using real-world examples to illustrate the heightened risk of illicit financial flows. The report also underscores the critical role of AML measures, international cooperation, and regulatory enforcement in addressing the convergence of financial crime and terrorism financing, where financial institutions often act as both a target and a facilitator, whether knowingly or not.

Terrorism Financing Channels in the Middle East

Terrorism financing may involve illicit or legitimate economic channels. The use of legitimate channels presents significant challenges to financial regulators, especially in jurisdictions where oversight is weak, enforcement is politically constrained, or international coordination is limited. When it comes to legitimate economic channels, sectors such as used car sales, real estate, construction, and import/export businesses may provide a facade of legality while facilitating illicit financial flows.

In addition to these, cash-intensive businesses such as restaurants, convenience stores, casinos, and beauty salons enable large volumes of cash transactions that can obscure illicit proceeds. The trade in precious metals and stones, especially gold and diamonds, offers a portable and difficult-to-trace means of transferring value. Likewise, the luxury goods market, including art, high-end watches, and vehicles, provides discreet methods to store or move wealth.

Emerging technologies have introduced new vulnerabilities. Cryptocurrencies and online payment platforms, prized for their pseudonymity and ease of cross-border transfers, are increasingly exploited. Terrorist designated groups in the Middle East have utilized cryptocurrency mixers, privacy coins, and decentralized exchanges to conceal the origin of funds. Similarly, crowdfunding platforms and online donation systems, often presented as humanitarian initiatives, have sometimes been manipulated to finance extremist causes.

Key financing channels exploited by terrorist organizations include,

• State Sponsorship: Direct or indirect financial and logistical support from certain state actors.
• Diaspora Networks: Transnational communities, particularly in West Africa, Latin America, and Europe, which funnel funds for extremist groups.
• Legitimate Businesses: Investments in sectors such as real estate, construction, and telecommunications that both generate lawful revenue and serve as vehicles for laundering illicit funds.
• Charities and NGOs: Organizations that operate as fronts, leveraging donor trust and humanitarian narratives to conceal terrorism financing.
• Trade-Based Money Laundering (TBML): Manipulation of trade documents, through over- or under-invoicing, to covertly transfer value across borders.
• Luxury Goods and High-Value Assets: Use of art, luxury vehicles, watches, gold, and diamonds to discreetly store or transfer wealth.
• Cryptocurrencies and Online Platforms: Virtual assets providing anonymity and borderless transferability, with some groups employing privacy coins and mixing services to obscure transactions.
• Crowdfunding and Online Donations: Fundraising platforms, often framed as charitable, which may be exploited to finance extremist activities.

International and Regional AML Frameworks and Enforcements

The Financial Action Task Force (FATF) is the leading global body setting AML/CFT standards, conducting evaluations, and managing compliance, including jurisdictional grey- and black-listing. While national regulators and central banks in the middle east are responsible for enforcement, effectiveness varies. GCC countries like Saudi Arabia and the UAE have made regulatory reforms, enforcing their own sanctions regimes that may differ from U.S. sanctions policies. Countries such as Lebanon, Syria, and Iraq face significant challenges due to political instability and institutional weaknesses, which hinder effective enforcement.

The United States continues to play a leading role globally in combating money laundering and terrorism financing through agencies such as the Office of Foreign Assets Control (OFAC) and comprehensive legislation that restricts access to the U.S. financial system. On the international stage, bodies including the United Nations Security Council, the European Union, the United Kingdom, and Canada implement coordinated sanctions and regulatory measures. Collectively, these efforts constitute a global framework aimed at isolating illicit actors and disrupting illegal financial networks.

The Banks in the Middle East

Banks in high-risk jurisdictions of the Middle East face a combination of vulnerabilities:

• Weak KYC/CDD Protocols: Many financial institutions lack rigorous Know Your Customer and Customer Due Diligence systems.
• Political Interference: Government influence and corruption can undermine regulatory independence and supervisory effectiveness.
• Banking Secrecy and Fragmentation: Variations in regulatory frameworks and secrecy laws hinder international collaboration and data exchange.

Extremist-linked actors have successfully exploited regional banks through:

• The use of front companies and non-governmental organizations as money laundering vehicles.
• Complex import/export schemes that mask illicit fund transfers.
• Access to correspondent banking relationships, often via domestic banks with weak oversight.

Historical incidents in Lebanon serve as a critical example—where sanctioned entities reportedly laundered funds through local banks prior to the country’s financial collapse in 2019. In 2011, the Lebanese Canadian Bank (LCB) was designated under Section 311 of the Patriot Act as a “primary money laundering concern” due to allegations that it facilitated Hezbollah’s laundering of drug trafficking proceeds, leading to its collapse. Similarly, in 2019, the Lebanese “Jammal Trust Bank (JTB)” was sanctioned by the U.S. Treasury for providing financial services to Hezbollah’s Martyrs Foundation, resulting in its forced liquidation by Lebanese regulators. Today, Lebanon remains a vulnerable country, as the financial crisis has led to a cash-based economy where illicit financing thrives.

Conclusion

The Middle East remains a complex and challenging environment for combating money laundering and terrorism financing. Several countries such as Lebanon, Syria, and Iraq continue to grapple with political instability, weak institutional capacity, and fragmented oversight. These conditions create fertile ground for illicit financial flows, with banks often serving as conduits for extremist funding. Addressing these challenges requires a sustained, multifaceted approach combining strengthened AML regimes, enhanced regional cooperation, and advanced technological tools. This report is the first installment in a broader series that will explore detailed case studies and real-world examples from the most vulnerable jurisdictions, shedding light on both the evolving threats and the efforts to disrupt these illicit networks effectively.

Disclaimer: This report is prepared by Global Risk Intelligence for general information purposes only. The information contained herein is based on data believed to be accurate and reliable at the time of publication; however, no warranty, express or implied, is given as to its accuracy, completeness, or reliability. Any opinions or forecasts represent the views of Global Risk Intelligence at the time of publication. This report does not constitute investment, legal, tax, or other professional advice; recipients should seek independent advice before making any commercial decisions.

As discussed in the previous part of this white paper series, the sanctions landscape is becoming increasingly complex. Regulatory bodies are not only intensifying enforcement efforts but are also placing growing emphasis on individual accountability alongside corporate responsibility. In this heightened environment, legal and compliance teams are expected to move beyond reactive measures and adopt a forward-looking, risk-aware posture.

At the same time, sanctioned actors are evolving their methods. There has been a notable shift toward more sophisticated evasion tactics, including obscured ownership structures, the use of third-party intermediaries, and deceptive shipping practices, all designed to bypass conventional compliance systems and undermine standard screening protocols.

The second part of this paper series delves into some of the most common evasion techniques used today, as well as real-world examples and explains how legal teams can strengthen their risk posture by integrating private intelligence into their compliance processes. Through the examples and practical takeaways, it will be outlined how timely intelligence helps detect concealed exposure, improves due diligence outcomes, and supports defensible, well-documented decisions.

According to recent findings by national authorities, entities involved in sanctions evasion rely more and more on complex procurement networks. These networks often rely on intermediaries—such as front and shell companies, financial facilitators, offshore bank accounts, and transshipment hubs in third countries—to conceal the true end-users, the nature of transactions, and the final destination of goods.

A common method of concealment involves the establishment or utilization of shell and front companies in jurisdictions outside the sanctioned country. These entities are often dormant or superficially legitimate, conducting transactions that appear lawful on the surface. Their operations allow sanctioned actors to access international financial systems, misdeclare dual-use goods as civilian imports or exports, and obscure links to restricted end-users through misleading ownership and naming structures. High-risk sectors include electronics, chemicals, and industrial equipment—areas frequently associated with dual-use applications subject to export controls. Legal, financial, and shipping facilitators are frequently involved, adding to enforcement challenges.

Two case studies illustrate the operational methods and legal consequences of such evasion schemes. In Australia, a South Korean-born citizen was convicted in 2021 for violating sanctions against the Democratic People’s Republic of Korea (DPRK). The individual used offshore accounts and Australia-based front companies to broker a wide range of goods—including crude oil, coal, and missile-related technology—on behalf of the DPRK, marking the first prosecution of its kind in Australia.

A second, more recent case from the United States (2024) involved four Chinese nationals indicted for a prolonged conspiracy to unlawfully export U.S.-origin dual-use electronic components to Iran. The individuals operated front companies in China and Hong Kong, deliberately misrepresenting the end-users and destinations of the goods to U.S. exporters. The components were ultimately supplied to entities affiliated with Iran’s Ministry of Defense and Armed Forces Logistics (MODAFL) and the Islamic Revolutionary Guard Corps (IRGC), including Shiraz Electronics Industries and Rayan Roshd Afzar. These components supported the development of missiles and unmanned aerial vehicles (UAVs).

Another common tactic these networks use is exploiting global supply chains and falsifying documents to cover up the illegal purchase and movement of goods and technology. By sourcing components from multiple suppliers and routing shipments through free trade zones with limited oversight, they repurpose, re-label, and disguise the true nature and destination of cargo using falsified documents such as shipping papers and end-user certificates. For example, missile components may be disguised as industrial machinery. Sanctions evaders also target regional transit hubs and international financial centers near sanctioned countries to conceal their activities amid high commercial and financial volumes.

This method was demonstrated in a September 2022 case. Investigations revealed that two UAE-based shipping companies, linked to individuals supporting terrorist groups, used forged documents to facilitate oil shipments from a high-risk country. The proceeds—totaling approximately USD 70 million—were funneled through a network involving an intermediary company and ultimately supported a sanctioned entity linked to proliferation financing. All suspects were detained by law enforcement, and the operations of the implicated companies were suspended.

Moreover, efforts to bypass sanctions and proliferation controls increasingly rely on disguising the true owners or controllers of assets (Ultimate Beneficial Owners – UBOs), complicating oversight and enforcement. These concealment tactics are also extending into the digital realm, creating additional challenges for enforcement. Since targeted financial sanctions (TFS) apply to designated individuals, entities, and their controlled assets, accurately identifying the true beneficial owners is essential for effectively managing sanctions risks.

The DPRK serves as a prominent example of these evasion tactics, utilizing foreign-based front and shell companies, covert overseas representatives, and third-party facilitators to conceal the true originators and beneficiaries of illicit financial flows. These intricate schemes facilitate the movement of billions of dollars in illicit funds through the global financial system, often with the assistance of state actors such as the Russian Federation. These schemes move billions through the global financial system, often aided by state actors like Russian Federation. In 2024, the U.S. Treasury’s OFAC targeted a network in Russia and South Ossetia that used secret banking relationships to funnel funds to DPRK banks designated by UN sanctions. Russian banks acted as intermediaries for transactions, including fuel purchases, and helped repatriate frozen DPRK assets via shell companies, strengthening financial ties and expanding DPRK’s banking reach.

Beyond financial obfuscation and complex ownership schemes, recent intelligence and enforcement actions indicate a growing reliance on the maritime domain as a critical enabler of sanctions and proliferation financing evasion. The structural characteristics of the shipping industry—including jurisdictional fragmentation, limited transparency in beneficial ownership, and inconsistent regulatory oversight—render it particularly vulnerable to exploitation. Illicit actors exploit maritime routes to move restricted goods and bypass export controls, often using layered tactics that blur the origin, destination, and ownership of cargo.

Among the most common are: alterations to vessel identity—such as changing names, flags, or IMO numbers—to mask true ownership and operational history. Illicit actors also conduct ship-to-ship transfers in international waters to obscure the origin and final destination of cargo, a method frequently employed by the DPRK for petroleum and coal shipments. These transfers are often executed outside formal financial channels, using cash-based arrangements that leave minimal trace. Additionally, the deliberate disabling or manipulation of Automated Identification System (AIS) signals allows vessels to operate covertly, evading tracking mechanisms. In parallel, falsified shipping documentation—frequently facilitated by shell companies—serves to misrepresent the nature of cargo, its routing, or its end-users, completing a web of concealment that exploits structural weaknesses in maritime oversight. These methods often allow sanctioned actors, to move prohibited goods and generate illicit revenue streams while avoiding detection and enforcement. The ongoing use of maritime deception highlights the need for improved monitoring, intelligence sharing, and regulatory oversight in the shipping and trade ecosystem.

As this paper illustrates, the landscape of sanctions evasion and proliferation financing is no longer confined to obvious violations or straightforward actors. From opaque ownership structures and fraudulent procurement networks to deceptive maritime tactics, the methods employed are layered, adaptive, and increasingly difficult to detect with traditional compliance tools alone.

What emerges is a clear imperative: integration of advanced intelligence capabilities into organizations and adoption of a proactive, risk-informed mindset, especially in high-risk sectors and regions, is a strategic imperative. The identification of vulnerabilities before they are exploited is not only critical to safeguarding institutional integrity, mitigating reputational risk but also to maintaining credibility to meet the demands of today’s more vigilant regulatory environment.

Disclaimer: This report is prepared by Global Risk Intelligence for general information purposes only. The information contained herein is based on data believed to be accurate and reliable at the time of publication; however, no warranty, express or implied, is given as to its accuracy, completeness, or reliability. Any opinions or forecasts represent the views of Global Risk Intelligence at the time of publication. This report does not constitute investment, legal, tax, or other professional advice; recipients should seek independent advice before making any commercial decisions.