Sanctions Digest: Combatting sanctions evasion

In our first blog of the series, we considered how the last year has dramatically changed the sanctions landscape, and the challenges it presents to business and financial institutions (FIs). With the challenge of meeting sanctions obligations heightened, naturally the vulnerability to malicious acts of sanctions evasions has also grown. However, many might argue the risk of evasion has always been prevalent, with inadequate controls readily exploited by those looking to circumnavigate the regulations.

This blog will consider the growing trends of sanctions evasion, with a particular focus on Russia and North Korea, by highlighting key methodologies that are being used, before providing guidance on how such risks can potentially be mitigated.

Russian evasion:

Prior to the recent sanctions, on a daily basis, Russian FIs conducted approximately $46 billion worth of foreign exchange (FX) transactions globally, 80 percent of which were in U.S. dollars. As the sanctions continue to impact Russia, alternate channels and instruments may be used to try and circumvent them to maintain this activity.

As highlighted by Organized Crime and Corruption Reporting Project (OCCRP), Russia already has a track record of sanctions. The OCCRP’s report into the ‘Global Laundromat’ scheme showed how Russian money was filtered into Western FIs through the use of shell companies to ‘loan’ money to each other. These companies then defaulted on this large fictitious debt. Corrupt judges in Moldova authenticated the debt – with billions transferred to Moldova and the Baltics via a bank in Latvia. Deutsche Bank was then used to launder the money via its corresponding banking network – effectively allowing illegal Russian payments to be funneled to the US, the European Union and Asia, with current estimates of the money moved ranging from $20bn to $80bn USD.

The above example provides insight into the potential methodologies being employed to circumnavigate the latest set of western restrictions. These methodologies include:

• Shell companies - Complex ownership structures created to conceal the ultimate originators, beneficiaries, and true business purpose of the transaction.
• Virtual currencies - Utilizing exchanges and other platforms offering cryptocurrencies to avoid Know Your Customer (KYC) rules, which include verifying clients’ identities.
• Unusual routing - Circuitous routing of payments to hide sanctioned institutions/jurisdictions with no economic purpose.
• Nested activity - Obscuring the ultimate originator and beneficiary of transactions to gain unauthorized access to the market through a respondent bank.
• Misuse of MT 202s - Omitting the identity of true originators, beneficiaries and/or third parties/vessels to not detect potential third parties.
• Trade finance - Intermingling of trade products and fictious supporting documentation (e.g., bills of lading) to legitimize the flow of funds.
• Capital markets - Engaging in trading activity (e.g., wash and cross trades) with no economic purpose.

North Korea evasion:

A recent paper from the Wolfsberg group has investigated North Korea’s long history of deceptive practices and highlighted some of the key challenges and methodologies used. These include:

• Complex transactions – movement of goods through networks of layered fronts, shell, shipping, and trade companies. Often, FIs face challenges identifying North Korean networks because FIs are only a small part of a larger, more complex end-to-end flow.
• Deceptive techniques - North Korean vessels seek to conceal their ties to North Korea through disabling the AIS transponders, or by manipulating transmitted data using falsified ship names and International Maritime Organization (IMO) numbers.
• Shell companies - In particular, the use of shell company addresses located in China and Hong Kong. These companies are often used to deposit funds through seemingly unrelated companies that share the same physical address, phone number, and/or email address.
• Proximity concerns - Increased activity with banks in proximity with North Korea (northeast China) or offshore financial centers.
• Digital currencies - Development of sophisticated hacking networks and digital currency operations which have successfully stolen or laundered millions of dollars.

Additionally, a report published earlier this year, by the Royal United Services Institute in London (RUSI), analysed 87 cases of North Korean sanctions evasion and found common use of regulatory ‘blind spots. The report highlighted that international standards often overlook activities related to “designated non-financial business and professions”. These included North Korea’s attempts to procure and sell precious metals and stones, its global property investments, and in one case its use of a casino “to obfuscate the traceability of funds”.

Responding to the challenge:

Considering the scale, severity and sophistication of evasion being conducted, FIs need to be vigilant and take proactive measures to identify transaction activity that may be indicative of attempts to circumvent regulations. Analytics is a key battleground for combatting evasion. FIs should consider rulesets that try to identify increases in the value and volume of activity across the following elements:

• Favoured trading partner relationships such as China, India, or the UAE;
• Geographic, social, political proximity to Russia such as Belarus, Kazakhstan, Serbia, and offshore locations;
• New account requests outside of the correspondent bank footprint;
• Dormant or low volume accounts demonstrating a change in behaviour although no apparent nexus to Russia;
• New products or activity that have been inconsistent (e.g., new affiliate or account) clearing through the Head Office; and
• Increased use of weak regulatory jurisdictions and/or unregulated products (e.g., virtual currency).

Furthermore, when considering the common methodologies, there are specific behaviour that FIs can identify to spot potential evasion.

• Shell companies – Use of known shell addresses, or business activity/purpose not appropriate for the stated address.
• Unusual routing – Transactions that transit through jurisdictions not associated with the originator/beneficiary, or any transaction with a high number of jurisdictions with no obvious economic reason.
• Nested activity – Formation of new accounts at Head office, or placement of third-party name or account data in SWIFT MT free text fields.
• Misuse of MT 202s - Low value payments not consistent with bank-to-bank transactions with placement of third-party name or account data in SWIFT MT free text fields.
• Trade finance - Payment originators or recipients that are not party to the underlying trade deal or mentioned in the underlying trade documentation.
• Capital markets - Executing trades to convert unstable currency denominated securities into globally used currencies, or settlements to third parties outside of the exchange platform.
  

Furthermore, FIs should consider expanding the scope of their investigation by working collectively to share data insights. These Public-Private and Private-Private information sharing relationships are an emerging tool that encourages governments and FIs to share case studies and transaction patterns through established intelligence exchange mechanisms. This helps build a more holistic picture of activity by increasing the ability to detect trends or patterns which could denote sanctions evasion. To supplement this, FIs should consider 3rd party data providers who can offer a broad range of bespoke data that can help identify sanctioned activity. This data should include control and ownership structures of sanctioned entities or geographical locations such as cities, towns, regions, or ports within sanctioned jurisdictions.

Conclusion:

Evasion will happen. As geo-political rifts around the world continue to grow, the scope of sanctions will escalate in parallel. Businesses and FIs must ensure they take proactive measures to prevent their services and products from becoming instruments of evasion or consequently, face the financial and reputational repercussions. Working cohesively, utilizing expanded data insights, and developing detection capabilities through bespoke analytics are some of the more advanced measures that can be taken as part of a wider and robust sanctions compliance framework to prevent endemic evasion, which could materialize into real world consequences if left unchecked.