As discussed in the previous part of this white paper series, the sanctions landscape is becoming increasingly complex. Regulatory bodies are not only intensifying enforcement efforts but are also placing growing emphasis on individual accountability alongside corporate responsibility. In this heightened environment, legal and compliance teams are expected to move beyond reactive measures and adopt a forward-looking, risk-aware posture.
At the same time, sanctioned actors are evolving their methods. There has been a notable shift toward more sophisticated evasion tactics, including obscured ownership structures, the use of third-party intermediaries, and deceptive shipping practices, all designed to bypass conventional compliance systems and undermine standard screening protocols.
The second part of this paper series delves into some of the most common evasion techniques used today, as well as real-world examples and explains how legal teams can strengthen their risk posture by integrating private intelligence into their compliance processes. Through the examples and practical takeaways, it will be outlined how timely intelligence helps detect concealed exposure, improves due diligence outcomes, and supports defensible, well-documented decisions.
According to recent findings by national authorities, entities involved in sanctions evasion rely more and more on complex procurement networks. These networks often rely on intermediaries—such as front and shell companies, financial facilitators, offshore bank accounts, and transshipment hubs in third countries—to conceal the true end-users, the nature of transactions, and the final destination of goods.
A common method of concealment involves the establishment or utilization of shell and front companies in jurisdictions outside the sanctioned country. These entities are often dormant or superficially legitimate, conducting transactions that appear lawful on the surface. Their operations allow sanctioned actors to access international financial systems, misdeclare dual-use goods as civilian imports or exports, and obscure links to restricted end-users through misleading ownership and naming structures. High-risk sectors include electronics, chemicals, and industrial equipment—areas frequently associated with dual-use applications subject to export controls. Legal, financial, and shipping facilitators are frequently involved, adding to enforcement challenges.
Two case studies illustrate the operational methods and legal consequences of such evasion schemes. In Australia, a South Korean-born citizen was convicted in 2021 for violating sanctions against the Democratic People’s Republic of Korea (DPRK). The individual used offshore accounts and Australia-based front companies to broker a wide range of goods—including crude oil, coal, and missile-related technology—on behalf of the DPRK, marking the first prosecution of its kind in Australia.
A second, more recent case from the United States (2024) involved four Chinese nationals indicted for a prolonged conspiracy to unlawfully export U.S.-origin dual-use electronic components to Iran. The individuals operated front companies in China and Hong Kong, deliberately misrepresenting the end-users and destinations of the goods to U.S. exporters. The components were ultimately supplied to entities affiliated with Iran’s Ministry of Defense and Armed Forces Logistics (MODAFL) and the Islamic Revolutionary Guard Corps (IRGC), including Shiraz Electronics Industries and Rayan Roshd Afzar. These components supported the development of missiles and unmanned aerial vehicles (UAVs).
Another common tactic these networks use is exploiting global supply chains and falsifying documents to cover up the illegal purchase and movement of goods and technology. By sourcing components from multiple suppliers and routing shipments through free trade zones with limited oversight, they repurpose, re-label, and disguise the true nature and destination of cargo using falsified documents such as shipping papers and end-user certificates. For example, missile components may be disguised as industrial machinery. Sanctions evaders also target regional transit hubs and international financial centers near sanctioned countries to conceal their activities amid high commercial and financial volumes.
This method was demonstrated in a September 2022 case. Investigations revealed that two UAE-based shipping companies, linked to individuals supporting terrorist groups, used forged documents to facilitate oil shipments from a high-risk country. The proceeds—totaling approximately USD 70 million—were funneled through a network involving an intermediary company and ultimately supported a sanctioned entity linked to proliferation financing. All suspects were detained by law enforcement, and the operations of the implicated companies were suspended.
Moreover, efforts to bypass sanctions and proliferation controls increasingly rely on disguising the true owners or controllers of assets (Ultimate Beneficial Owners – UBOs), complicating oversight and enforcement. These concealment tactics are also extending into the digital realm, creating additional challenges for enforcement. Since targeted financial sanctions (TFS) apply to designated individuals, entities, and their controlled assets, accurately identifying the true beneficial owners is essential for effectively managing sanctions risks.
The DPRK serves as a prominent example of these evasion tactics, utilizing foreign-based front and shell companies, covert overseas representatives, and third-party facilitators to conceal the true originators and beneficiaries of illicit financial flows. These intricate schemes facilitate the movement of billions of dollars in illicit funds through the global financial system, often with the assistance of state actors such as the Russian Federation. These schemes move billions through the global financial system, often aided by state actors like Russian Federation. In 2024, the U.S. Treasury’s OFAC targeted a network in Russia and South Ossetia that used secret banking relationships to funnel funds to DPRK banks designated by UN sanctions. Russian banks acted as intermediaries for transactions, including fuel purchases, and helped repatriate frozen DPRK assets via shell companies, strengthening financial ties and expanding DPRK’s banking reach.
Beyond financial obfuscation and complex ownership schemes, recent intelligence and enforcement actions indicate a growing reliance on the maritime domain as a critical enabler of sanctions and proliferation financing evasion. The structural characteristics of the shipping industry—including jurisdictional fragmentation, limited transparency in beneficial ownership, and inconsistent regulatory oversight—render it particularly vulnerable to exploitation. Illicit actors exploit maritime routes to move restricted goods and bypass export controls, often using layered tactics that blur the origin, destination, and ownership of cargo.
Among the most common are: alterations to vessel identity—such as changing names, flags, or IMO numbers—to mask true ownership and operational history. Illicit actors also conduct ship-to-ship transfers in international waters to obscure the origin and final destination of cargo, a method frequently employed by the DPRK for petroleum and coal shipments. These transfers are often executed outside formal financial channels, using cash-based arrangements that leave minimal trace. Additionally, the deliberate disabling or manipulation of Automated Identification System (AIS) signals allows vessels to operate covertly, evading tracking mechanisms. In parallel, falsified shipping documentation—frequently facilitated by shell companies—serves to misrepresent the nature of cargo, its routing, or its end-users, completing a web of concealment that exploits structural weaknesses in maritime oversight. These methods often allow sanctioned actors, to move prohibited goods and generate illicit revenue streams while avoiding detection and enforcement. The ongoing use of maritime deception highlights the need for improved monitoring, intelligence sharing, and regulatory oversight in the shipping and trade ecosystem.
As this paper illustrates, the landscape of sanctions evasion and proliferation financing is no longer confined to obvious violations or straightforward actors. From opaque ownership structures and fraudulent procurement networks to deceptive maritime tactics, the methods employed are layered, adaptive, and increasingly difficult to detect with traditional compliance tools alone.
What emerges is a clear imperative: integration of advanced intelligence capabilities into organizations and adoption of a proactive, risk-informed mindset, especially in high-risk sectors and regions, is a strategic imperative. The identification of vulnerabilities before they are exploited is not only critical to safeguarding institutional integrity, mitigating reputational risk but also to maintaining credibility to meet the demands of today’s more vigilant regulatory environment.
Disclaimer: This report is prepared by Global Risk Intelligence for general information purposes only. The information contained herein is based on data believed to be accurate and reliable at the time of publication; however, no warranty, express or implied, is given as to its accuracy, completeness, or reliability. Any opinions or forecasts represent the views of Global Risk Intelligence at the time of publication. This report does not constitute investment, legal, tax, or other professional advice; recipients should seek independent advice before making any commercial decisions.