FIU [IMN] ¦ Typologies: Sanctions and Trade Based Money Laundering (TBML)

Sanctions Evasion and Trade-Based Money Laundering: Following the Predicate Offense Through Complex Transactions

Sanctions evasion and trade-based money laundering (TBML) often overlap. Both rely on concealment, misleading documentation and the movement of value through apparently legitimate commercial or financial activity. For regulated businesses, the central challenge is not only to identify a prohibited transaction, but also to understand the underlying criminal conduct that generated the funds, enabled the transaction or allowed a designated person to retain access to assets.

Effective detection depends on examining ownership, control, payment routing, trade documentation and the source of funds together. A transaction that appears routine in isolation may become suspicious when viewed against the customer’s wider relationships and activity.

Financial sanctions and the risk of indirect access

Financial sanctions can freeze the assets of designated individuals and organisations and prevent them from accessing funds or economic resources. Restrictions may also apply to particular countries, sectors, goods or services. Depending on the applicable regime, sanctions may prohibit payments, asset transfers, the provision of services or dealings with entities owned or controlled by a designated person.

The risk is not limited to direct transactions with a listed individual. Designated persons may use relatives, associates, nominees, shell companies, trusts or other intermediaries to retain control of assets or receive economic benefits. A change in the registered owner of a company, vessel or other asset does not necessarily change the underlying control arrangement.

This creates a direct connection between sanctions compliance and anti-money laundering controls. Beneficial ownership information, source of wealth, source of funds and ongoing transaction monitoring may reveal that an apparently independent party is acting for a designated person or is facilitating access to frozen assets.

Bastian Schwind-Wagner _Follow

"Sanctions evasion and trade-based money laundering often rely on hidden ownership, altered payment information, false invoices and complex transaction routes. These methods can conceal criminal proceeds, enable access to restricted assets or support the movement of prohibited goods.

Strong controls should connect sanctions screening with beneficial ownership checks, source-of-funds reviews and transaction monitoring. Financial institutions and other regulated businesses should assess the full payment and trade chain, identify the relevant predicate offense and report suspicions promptly through the appropriate channel."

How sanctions evasion is concealed

A common method is to alter or remove information from payment messages. References to a sanctioned person, country or entity may be deleted, replaced or obscured before a payment reaches another financial institution. Suspicious indicators include the use of financial institution details instead of customer information, inconsistent processing of payments and the resubmission of rejected transactions after identifying data has been changed.

Cover payments can serve a similar purpose. A payment may be routed through a different process or sent directly to an employee or branch associated with the customer relationship. The use of unusual correspondent banks, unexplained payment channels or different procedures for higher-risk customers should prompt closer review.

Special purpose entities and shell companies may also be used to disguise the true originator or beneficiary. Payments routed through an investment vehicle, holding company or other intermediary can appear to originate from that entity rather than from the designated individual controlling it. Multiple unrelated companies sharing an address, directors, service providers or payment patterns may indicate a common control structure.

Suspense accounts present another vulnerability. Funds may be routed through an internal account so that the originating party is not clearly identified in the final payment message. A transaction that identifies a financial institution as the originator, while failing to identify the underlying customer, requires careful investigation.

Highly layered payment routes are also significant. Complex transactions with no clear commercial rationale, especially those involving shell companies or multiple jurisdictions, may be designed to conceal the involvement of a sanctioned party. Complexity alone is not proof of criminality, but unnecessary complexity combined with weak documentation, unusual counterparties or altered payment details is a meaningful warning sign.

Trade finance as a channel for sanctions breaches

Trade finance can be misused to conceal sanctioned parties, goods or destinations. Similar to the manipulation of payment messages, references to a restricted customer, country or transaction may be removed from letters of credit, invoices, bills of lading and related instruments.

Inconsistent terms across trade documents can indicate that the transaction has been structured to avoid detection. Particular attention should be paid to vague descriptions of goods, unclear destinations, unexplained transhipments and trade routes that do not match the customer’s normal business. A transaction involving goods that are highly sensitive, dual-use or subject to export controls requires a clear understanding of the parties, end user and final destination.

The risk is especially high where the stated route appears unnecessarily indirect. Goods may be shipped through an intermediary jurisdiction to obscure their true origin or destination. A customer that has no established commercial reason to trade in a particular product or region may be using trade documentation to disguise the movement of value or restricted goods.

Cheques and other payment instruments can also be altered. Handwritten amendments, missing payment information and changes to transaction terms should be treated cautiously, particularly where they remove details that would identify a sanctioned party.

Trade-based money laundering and the underlying criminal conduct

Trade-based money laundering involves using trade transactions to disguise the movement of criminal proceeds or other value. The method may involve genuine goods, fictitious goods, false services or deliberately inaccurate descriptions of a transaction.

The predicate offense may be sanctions evasion, fraud, corruption, tax-related crime, organised crime or another form of unlawful activity. In some cases, the trade transaction is used to launder proceeds already generated by a crime. In others, it facilitates the underlying offense itself by moving restricted goods, financing prohibited activity or transferring value to an illicit network.

The principal mechanisms include over-invoicing and under-invoicing, misrepresenting the quantity or quality of goods, creating bogus trading arrangements and falsifying the origin or destination of products. These techniques can make an illicit transfer appear to be a normal commercial payment.

A transaction does not need to involve physical goods to present a trade-based laundering risk. False invoices for services that were never provided can create an apparent legal basis for payments between related companies. Repeated inter-company invoices, particularly where there is no evidence of delivery or performance, may indicate that companies are being used as vehicles for moving and layering criminal proceeds.

Fictitious trade and false invoicing

One important pattern involves companies raising invoices for services that do not exist. The payments may be described as consultancy, management, logistics, marketing or technical support, while the businesses have no employees, operational capacity or evidence of providing the services.

Repeated payments between companies under common ownership are particularly relevant. The use of several entities can create layers of apparently legitimate transactions and make it more difficult to identify the original source of funds. Where employees or service providers question the legitimacy of the invoices and receive dismissive or evasive responses, this may support a suspicion that the companies are being used for money laundering.

The absence of a clear commercial explanation is central. A financial institution should consider whether the services are necessary, whether the amounts are proportionate, whether the counterparties have the relevant expertise and whether there is independent evidence that the work was completed.

Asset ownership, control and designated persons

Vessels, corporate shares and other high-value assets can be held through layered structures involving trusts, corporate service providers and companies incorporated in different jurisdictions. These arrangements may obscure the identity of the true owner or allow a designated person to continue using or benefiting from an asset.

A formal change in registration or ownership does not, by itself, eliminate the risk. The relevant questions include who controls the asset, who pays operating costs, who receives income, who directs the service providers and who has authority over the asset’s movements.

Service providers may have limited operational control and may not be responsible for every action taken by a client or asset operator. They nevertheless remain exposed to the risk of facilitating a prohibited arrangement if they know, or have reasonable grounds to suspect, that a designated person retains an interest in the asset.

Regular due diligence is therefore essential. Ownership changes, alterations to corporate structures, new directors, changes in payment instructions and unusual asset activity should be assessed promptly rather than treated as routine administrative events.

Third-party transfers and attempts to defeat sanctions

A designated person may seek to transfer funds to an associate before a designation takes effect. Describing the transfer as a gift, loan or personal payment does not resolve the risk if the purpose is to place assets beyond the designated person’s control or preserve access through a third party.

The relationship between the parties, the timing of the transfer and the customer’s expectation of future designation are important factors. A large unexplained payment to an associate, followed by continued access to the funds by the original owner, may indicate an attempt to circumvent sanctions and conceal beneficial ownership.

Similar concerns arise when a customer attempts to deposit cash received from a designated person. Using a money services business to exchange foreign currency or transfer the funds to a bank account does not remove the significance of the original source. Intermediaries may create an additional layer, but they do not change the provenance of the funds.

Source-of-funds inquiries should therefore address the complete payment chain. It is not sufficient to record only the immediate sender or the institution that processed the final transfer. The underlying payer, purpose of payment, supporting invoice and relationship between the parties must be considered.

Reporting and investigation priorities

A suspected sanctions breach and a money laundering suspicion may arise from the same facts, but reporting obligations can differ depending on the applicable legislation and sanctions regime. Firms must identify which regime applies and use the appropriate reporting channel. A matter involving a foreign sanctions list may require a suspicious activity report under anti-money laundering legislation even where it does not constitute a breach of the local sanctions regime.

Timely reporting is important where a regulated business becomes aware of a connection between a customer, corporate structure or asset and a designated person. Failure to report a suspicion may itself create regulatory and criminal exposure where the relevant legal threshold is met.

Investigations should preserve payment messages, account records, invoices, contracts, shipping documents, ownership information and communications concerning the transaction. These records can help establish whether the conduct involved direct sanctions evasion, concealment of beneficial ownership, fraud, laundering of criminal proceeds or another predicate offense.

A risk-based response

No single red flag proves that money laundering or sanctions evasion has occurred. The strength of a suspicion usually comes from the combination of indicators. A complicated ownership structure may be legitimate, but the risk increases where it is combined with a designated relative, unexplained transfers, unusual payment routes or control over a high-value asset.

Trade activity should be assessed against the customer’s known business model. Payment flows should be compared with expected turnover, counterparties and jurisdictions. Documentation should be tested for consistency, and explanations should be independently assessed rather than accepted at face value.

The most effective controls connect sanctions screening with broader anti-money laundering monitoring. Screening only names may miss ownership and control concerns. Reviewing only payment data may miss fictitious trade or false invoicing. Combining customer due diligence, transaction analysis, trade scrutiny and source-of-funds verification provides a stronger basis for identifying both the prohibited conduct and the criminal proceeds connected to it.

Sanctions evasion and trade-based money laundering are not isolated compliance issues. They are methods for concealing ownership, transferring value and supporting predicate offenses. Understanding how those methods operate allows regulated businesses to identify suspicious activity earlier, report it more accurately and prevent financial systems from being used to preserve the proceeds or benefits of crime.

Dive deeper

• Isle of Man, Financial Intelligence Unit (FIU), Ellan Vannin Unnid Tushtag Argidoil ¦ Documents & Reports, Typologies: Sanctions and Trade Based Money Laundering, February 2023 ¦ Link