Sanctions Evasion
Sanctions evasion is the deliberate circumvention of sanctions restrictions, carried out through a small number of recurring channels: trade-based manipulation, maritime concealment, financial message stripping, front companies, and increasingly, virtual assets. FATF’s own typology work identifies these as distinct, well-documented patterns, not a single generic category, and real enforcement cases across each show exactly how they work in practice.
Key takeaways
- Sanctions evasion is deliberate circumvention of restrictions, carried out through a recurring set of channels: trade, maritime, financial, and increasingly crypto.
- FATF’s 2006/2020 typology work identifies four core trade mechanisms: over/under-invoicing, multiple invoicing, over/under-shipment, and falsely described goods.
- Front companies remain a dominant technique, illustrated by OFAC’s 2020 designations of a Hong Kong/UAE/Malaysia network brokering Iranian oil.
- Maritime evasion (the dark fleet) and financial evasion (wire stripping) are two of the most consequential, well-documented individual channels.
- Virtual assets are a distinct, evolving vector; OFAC applies sanctions identically to crypto, and has directly designated mixing services like Tornado Cash.
- Enforcement reaches individually operated structures, not just major state-linked networks, as a 2021 Australian court sentencing shows.
- Effective detection requires typology-aware monitoring and entity network analysis, since evasion is specifically designed to defeat name-based screening alone.
On this page
What sanctions evasion actually meansFATF’s four core trade-based mechanismsFront companies and opaque ownershipMaritime evasion: the dark fleet connectionFinancial evasion: wire stripping and payment misdirectionThe crypto vector: mixers, tumblers, and VASPsA real, documented case closer to home“Shadow Finance 2.0”: how evasion keeps evolvingRed flags that cut across every evasion typeBuilding a detection programme around typologies, not just screeningWhere this connects across the whole compliance programmeFAQsRead more
4
Core trade-based evasion mechanisms identified in FATF’s 2006/2020 typology guidance
Source: FATF / Egmont Group
8 Aug 2022
Date OFAC designated the Tornado Cash mixing service directly under E.O. 13694
Source: OFAC
What sanctions evasion actually means
Sanctions evasion is the deliberate circumvention of restrictions imposed under a sanctions regime, carried out specifically to allow a sanctioned party, jurisdiction, or transaction to continue operating despite the restriction. It’s distinct from a genuine, good-faith compliance gap; evasion implies deliberate intent to defeat the restriction, using one of a recognisable, recurring set of techniques rather than any single universal method.
FATF’s four core trade-based mechanisms
FATF’s original 2006 typology report, updated with the Egmont Group in December 2020, identifies four core trade-based evasion mechanisms that account for a large share of documented cases: over- and under-invoicing goods relative to their genuine market value; multiple invoicing of the same shipment to generate duplicate, illegitimate payment flows; over- and under-shipment, including entirely phantom shipments that exist only on paper; and falsely described goods, misrepresenting what’s actually being shipped. These mechanisms overlap heavily with trade-based money laundering generally, since the same manipulation techniques used to launder criminal proceeds are equally effective at moving sanctioned value across borders undetected.
Front companies and opaque ownership
One of the most consistently documented evasion patterns involves shell companies and front entities specifically structured to obscure a sanctioned party’s involvement in a transaction. A well-documented example: following the May 2019 reimposition of secondary sanctions on Iranian petroleum under Executive Order 13846, OFAC’s January and October 2020 designations exposed a network of Hong Kong, UAE, and Malaysian front companies, including entities such as Triliance Petrochemical and Sage Energy HK, used specifically to broker Iranian oil sales while obscuring the National Iranian Oil Company’s and Islamic Revolutionary Guard Corps’ actual involvement. The same structural pattern, opaque beneficial ownership layered specifically to hide a sanctioned controller, recurs in DPRK proliferation financing networks documented by UN Panel of Experts reporting.
Maritime evasion: the dark fleet connection
Sanctioned oil and other commodities move by sea specifically because maritime evasion offers concealment options land-based trade doesn’t: AIS transponder manipulation, mid-ocean ship-to-ship transfers, and repeated reflagging under flags of convenience, the exact mechanics covered in depth on the dark fleet page specifically. A newer, related pattern worth flagging directly: what’s been termed “ghost fleet insurance laundering,” where ageing tankers flagged to opaque jurisdictions obtain insurance through intermediaries based in the EU or UK, layering the same beneficial-ownership obfuscation techniques used in corporate evasion structures into the maritime insurance market specifically.
Financial evasion: wire stripping and payment misdirection
On the payments side, wire stripping remains one of the most consequential documented evasion techniques: removing or altering identifying details from a payment message specifically to prevent a sanctioned party’s involvement from triggering automated screening before that screening ever runs. Standard Chartered’s repeated enforcement history, over $327 million in 2012 and $1.1 billion in 2019 for materially the same conduct, remains the clearest illustration of how this specific technique operates and how persistently it recurs even under direct regulatory supervision.
The crypto vector: mixers, tumblers, and VASPs
Virtual assets have become a distinct, actively evolving evasion channel. OFAC’s Sanctions Compliance Guidance for the Virtual Currency Industry, published 15 October 2021, confirms directly that IEEPA-based sanctions prohibitions apply identically to transactions denominated in Bitcoin, Ether, or any other virtual asset as they do to conventional currency. FATF Recommendation 15 and its June 2019 Interpretive Note extend the Travel Rule, requiring originator and beneficiary information on transfers above a defined threshold, specifically to virtual asset service providers. Mixing services designed to break the on-chain link between sender and recipient have themselves become direct sanctions targets: OFAC designated the mixer Tornado Cash on 8 August 2022 under Executive Order 13694, treating the service itself, not just individual users, as facilitating evasion at scale.
A real, documented case closer to home
Sanctions evasion enforcement isn’t limited to major state-linked networks. On 23 July 2021, the New South Wales Supreme Court in Australia sentenced a South Korean-born Australian citizen to three years and six months’ imprisonment for using an Australia-based corporate structure specifically to violate sanctions, a documented, court-adjudicated case illustrating that evasion prosecution reaches individually operated structures, not only large, state-connected commercial networks.
“Shadow Finance 2.0”: how evasion keeps evolving
Compliance analysis increasingly describes a shift toward what’s been termed “Shadow Finance 2.0”: sanctioned actors combining secondary fintech providers, embedded-finance platforms, crypto-mixing services, and AI-assisted mule networks into evasion structures considerably more layered than the single-technique schemes typical of a decade ago. Related trade-side evolution includes informal value-transfer arrangements and “drop-shipping” through third-party intermediaries specifically to route dual-use goods, high-performance chips among them, through supply chains that look entirely ordinary at every individual step.
Red flags that cut across every evasion type
Despite the genuine diversity of technique, FATF’s own risk-indicator guidance points to a recurring set of signals that apply across trade, maritime, financial, and crypto evasion alike: use of shell companies or intermediaries with no clear commercial purpose beyond the transaction itself, routing through third countries or transshipment hubs with weak enforcement, IP addresses or documented locations inconsistent with a customer’s stated business, repeated transactions with sudden, unexplained counterparty changes, and documentation, trade invoices, KYC records, transaction data, that doesn’t internally reconcile.
Building a detection programme around typologies, not just screening
Because evasion is specifically designed to defeat name-based screening, effective detection requires building typology awareness directly into monitoring design, not relying on list-matching alone: current, regularly refreshed knowledge of FATF, OFAC, and EU typology advisories built into rule engine logic, entity network analysis capable of surfacing shell-company clustering rather than assessing counterparties in isolation, and export-control literacy for dual-use goods, since a genuinely dangerous shipment can look, on the surface, like an ordinary industrial component transaction.
Where this connects across the whole compliance programme
Sanctions evasion sits at the intersection of nearly every discipline covered elsewhere in a mature compliance programme: beneficial ownership analysis to unwind front-company structures, customer due diligence to catch inconsistencies between a customer’s stated and actual business, and name and watchlist screening tuned specifically to catch the aliases and reflagging patterns evasion schemes rely on. Treating sanctions evasion as a single, separate risk category, rather than the point where these other disciplines have to work together, is exactly the gap sophisticated evasion structures are built to exploit.
Detect evasion patterns beyond name screening
Check counterparty networks and trade routes against known evasion typologies.
Frequently asked questions
What is sanctions evasion?
Sanctions evasion is the deliberate circumvention of sanctions restrictions, carried out specifically to allow a sanctioned party, jurisdiction, or transaction to continue operating despite the restriction, distinct from a genuine, unintentional compliance gap.
What are FATF’s four core trade-based evasion mechanisms?
Over- and under-invoicing, multiple invoicing of the same shipment, over- and under-shipment (including phantom shipments), and falsely described goods, identified in FATF’s 2006 typology report and its December 2020 update with the Egmont Group.
How do front companies actually get used in sanctions evasion?
They’re structured specifically to obscure a sanctioned party’s real involvement, as seen in OFAC’s 2020 designations exposing a Hong Kong, UAE, and Malaysian company network brokering Iranian oil sales on behalf of sanctioned entities.
How does virtual currency factor into sanctions evasion?
OFAC’s October 2021 guidance confirms sanctions apply identically to virtual asset transactions as to conventional currency. Mixing services designed to obscure fund origin, such as Tornado Cash, have themselves become direct sanctions targets.
What is “Shadow Finance 2.0”?
A term describing the shift toward more layered evasion structures combining secondary fintech providers, embedded-finance platforms, crypto-mixing, and AI-assisted networks, considerably more complex than single-technique schemes typical a decade ago.
Is sanctions evasion enforcement limited to large state-linked networks?
No. A 2021 Australian court case sentenced an individual to three and a half years for using a personal corporate structure to violate sanctions, showing enforcement reaches individually operated schemes too.
What red flags apply across different evasion types?
Shell companies with no clear commercial purpose, routing through weak-enforcement transshipment hubs, location or IP inconsistencies, sudden counterparty changes, and documentation that doesn’t internally reconcile.
How should a compliance programme actually detect evasion?
By building current typology knowledge into monitoring rule logic, running entity network analysis to catch shell-company clustering, and maintaining export-control literacy, rather than relying on name-based screening alone.
Read more: our ultimate guides, whitepapers and templates
Related guides and resources to help you act on what you just read.
Last reviewed July 19, 2026 · 12 min read · Written for compliance and risk professionals · By the WhoWiki editorial team
Key takeaway: Sanctions evasion is the deliberate circumvention of sanctions restrictions, carried out through a small number of recurring channels: trade-based manipulation, maritime concealment, financial message stripping, front companies, and increasingly, virtual assets. FATF’s own typology work identifies these as distinct, well-documented patterns, not a single generic category, and real enforcement cases across each show exactly how they work in practice.