When a Big Four firm signs off on falsified financial statements hiding $672 million in sanctioned assets, the breakdown didn't start in the boardroom. It started at someone's desk, with a compliance check that got skipped, a red flag that looked routine, or a verification step that relied on the client's word.
The Cyprus Confidential investigation revealed that Deloitte Cyprus allegedly approved documents for Roman Abramovich that erased superyachts, mansions, and private jets from company accounts between 1999 and 2013. More than 500,000 leaked documents showed how these omissions persisted across years of audits and reviews.
These failures aren't unique to Cyprus or one firm. They're the predictable result of six recurring mistakes that compliance teams make when screening high-net-worth individuals and complex corporate structures. Here's what breaks down, why it happens, and how to fix it.
Why These Mistakes Keep Happening
Sanctions screening for politically exposed persons and designated individuals operates under three pressures. First, your team screens against incomplete information; beneficial ownership structures are deliberately opaque, and registries lag reality by months. Second, you're working with tools built for name matching, not for detecting asset concealment patterns. Third, compliance teams face asymmetric warfare: you need to catch every evasion tactic, while the client only needs one gap to succeed.
When you combine incomplete data, inadequate tools, and resource constraints, you get compliance processes that check boxes without catching risks.
Mistake 1: Treating Corporate Accounts as Self-Contained Entities
Why it happens: Your screening workflow treats each legal entity as a standalone customer. You verify the company's registration, screen its directors, and move on. You don't map the entity's role within a larger ownership structure because your customer due diligence process doesn't require it.
The consequence: Sanctioned individuals use shell companies because compliance teams screen them in isolation. When Abramovich's assets were held through corporate vehicles, each entity appeared clean on paper, no sanctioned names on the registry, no direct ownership links. The yachts and properties were real, but they weren't visible in any single entity's financial statements.
The fix: Build entity relationship mapping into your enhanced due diligence process for high-risk customers. When you onboard a corporate client controlled by a politically exposed person or located in a Grey List jurisdiction, document the full ownership chain and identify all related entities. Use Companies House filings, corporate registries, and leaked document databases (OpenCorporates, ICIJ databases) to verify what the client tells you. If the client discloses three related entities but public records show seven, that's your red flag.
Mistake 2: Accepting Client-Provided Documentation Without Independent Verification
Why it happens: Your team is under pressure to complete reviews quickly. The client submits audited financial statements from a reputable firm, and you accept them at face value. Audited statements feel authoritative, they carry a Big Four logo and a signed opinion.
The consequence: You've outsourced your verification responsibility to someone else's compliance process. In the Deloitte Cyprus case, the firm allegedly signed off on statements that omitted major assets. If you're a bank or payment company relying on those statements for your customer risk rating, you've just inherited that compliance failure.
The fix: Treat third-party audit opinions as one input, not as verification. For enhanced due diligence cases, cross-reference financial statements against public asset registries, vessel registrations, and property records. If a client's disclosed net worth is $50 million but open-source research shows ownership of a $150 million yacht, document that discrepancy and escalate to your MLRO. Use vessel tracking databases (Equasis, ShipSpotting) and aircraft registries (FAA N-Number Inquiry) to verify high-value assets.
Mistake 3: Screening Names Without Screening Asset Ownership Patterns
Why it happens: Your name screening tool flags matches against OFAC's Specially Designated Nationals List, the EU Consolidated List, and UN sanctions lists. When the client's name doesn't match, you clear the alert. Your workflow stops at name matching because that's what the tool is built to detect.
The consequence: Sanctions evasion doesn't rely on using a sanctioned name. It relies on hiding the beneficial ownership connection between the sanctioned individual and the asset. If Roman Abramovich doesn't appear on a company's shareholder registry, your name screening tool won't flag it, even if he controls the entity through nominees or trusts.
The fix: Add beneficial ownership verification as a mandatory step in your enhanced due diligence process. For high-risk customers, don't just screen the names on the incorporation documents. Identify and screen the natural persons who ultimately own or control more than 25% of the entity (or 10% for higher-risk cases). If the client can't or won't disclose beneficial ownership, that's grounds to decline the relationship or exit the customer under your AML/CFT framework.
Mistake 4: Running Sanctions Checks Once at Onboarding
Why it happens: Your compliance process treats sanctions screening as a point-in-time event. You screen the customer when they onboard, then rely on periodic reviews (annually or every two years) to catch changes. Between reviews, you assume the customer's risk profile stays static.
The consequence: Sanctions designations happen overnight. The EU sanctioned Abramovich in March 2022, but the assets revealed in the Cyprus Confidential leak were concealed for over a decade. If you onboarded a related entity in 2010 and didn't re-screen until 2024, you missed 14 years of changing risk indicators and two years of active sanctions.
The fix: Implement ongoing due diligence with event-driven re-screening. Configure your name screening system to run daily batch checks against your entire customer base, not just new onboarding. Set up alerts for adverse media, sanctions list updates, and politically exposed person status changes. When a customer's risk profile changes (new sanctions designation, criminal investigation, leaked document revelation), re-screen immediately.
Mistake 5: Ignoring Adverse Media That Doesn't Trigger Regulatory Action
Why it happens: Your team screens for sanctions matches and criminal convictions, but you don't have a clear process for evaluating reputational risk. Adverse media alerts pile up, leaked documents, investigative journalism, civil lawsuits, and you're not sure which ones require action. Without clear guidance, analysts dismiss alerts that don't involve a regulatory penalty or criminal charge.
The consequence: By the time a sanctions designation or enforcement action appears, the compliance failure has already happened. The Cyprus Confidential investigation analyzed documents from 1999 to 2013, but Abramovich wasn't sanctioned until 2022. If you ignored adverse media about asset concealment because it wasn't a formal regulatory action, you missed a decade of red flags.
The fix: Define adverse media escalation criteria in your AML/CFT framework. Require analysts to escalate alerts involving asset concealment, sanctions evasion allegations, leaked documents naming the customer, or investigative journalism from credible outlets (ICIJ, OCCRP, Financial Times). Don't wait for a regulator to act. If a leaked document investigation names your customer, treat it as a trigger for enhanced due diligence and consider exiting the relationship if you can't verify the customer's explanations.
Mistake 6: Separating Sanctions Compliance from Financial Statement Review
Why it happens: Your organization splits compliance functions by specialty. Sanctions analysts screen names, but they don't review financial statements, that's the credit team's job. The credit team reviews financial health, but they don't screen for sanctions risks, that's compliance's job. No one connects the two.
The consequence: Asset concealment lives in the gap between these functions. Financial statement omissions (missing yachts, undisclosed properties) are sanctions red flags, but only if someone is looking for them. When Deloitte Cyprus allegedly signed off on falsified statements, the compliance failure wasn't just the audit opinion, it was every downstream user who accepted those statements without questioning the omissions.
The fix: Integrate sanctions risk indicators into your credit and onboarding review process. Train your credit analysts and relationship managers to recognize sanctions red flags: unexplained wealth, asset omissions, complex ownership structures with no business rationale, and reluctance to disclose beneficial ownership. Build a handoff process where financial statement anomalies trigger a sanctions compliance review, and sanctions alerts trigger a financial statement audit.
Prevention Checklist
Use this checklist when conducting enhanced due diligence on high-risk customers, politically exposed persons, or complex corporate structures:
- Map the full ownership structure, including all related entities and beneficial owners
- Verify beneficial ownership through independent sources, not just client-provided documents
- Cross-reference financial statements against public asset registries (vessels, aircraft, real estate)
- Screen all beneficial owners and related parties, not just the named customer
- Configure daily batch screening for your entire customer base, not just new accounts
- Define adverse media escalation criteria that include leaked documents and investigative journalism
- Treat Big Four audit opinions as one input, not as verification
- Document asset discrepancies and escalate to your MLRO when disclosed wealth doesn't match public records
- Review financial statements for omissions that could indicate asset concealment
- Exit customers who can't or won't disclose beneficial ownership information
The Deloitte Cyprus case isn't a story about one firm's failure. It's a pattern that repeats wherever compliance teams treat screening as a checklist instead of an investigation. Your job isn't to verify what the customer tells you, it's to verify what they're hiding.
