Skip to main content
FinCrime Institute
Category: Money Laundering Typologies

Sanctions Evasion Typologies

Also known as: Sanction Evasion Typologies, Sanctions Evasion Techniques
Simply put

Sanctions evasion typologies are the common patterns, methods, and schemes that individuals and entities use to get around financial sanctions. These can include tactics such as using front and shell companies, intermediaries or nominees, and routing goods or funds through third countries to disguise who is really involved. Compliance teams study these typologies to help spot and investigate activity that may indicate someone is trying to bypass sanctions.

Formal definition

Sanctions evasion typologies refer to the recurring methods and structural arrangements used by designated persons, their enablers, or third parties to circumvent financial and trade sanctions. Commonly cited techniques include the use of front and shell companies, intermediaries and nominees to obscure control, and transshipment or routing through intermediary jurisdictions to disguise the origin, destination, or ownership of funds or goods. Enabler complicity is sometimes assessed along a spectrum ranging from criminal complicity to wilful blindness (for example, deficient source-of-funds checks). A notable challenge is that leading typologies often rely on structural invisibility rather than technical sophistication, creating detection gaps for obliged entities. These typologies function as investigative and detection aids that inform red-flag indicators and risk-based screening; they are conceptual models of observed behaviour and do not, on their own, establish that any specific conduct constitutes an offence. Practitioners should map typologies to the specific sanctions regimes applicable to their business, as designations, prohibitions, and enforcement bodies vary by jurisdiction.

Why it matters

Sanctions evasion typologies matter because sanctions regimes are only as effective as the ability of obliged entities to detect attempts to circumvent them. When designated persons and their enablers succeed in obscuring their involvement, through front and shell companies, nominees, or routing funds and goods through intermediary jurisdictions, prohibited value can continue to flow despite formal designations. Studying recurring typologies helps compliance teams translate abstract prohibitions into practical red-flag indicators and risk-based screening approaches that inform detection and investigation.

A particular challenge is that leading typologies often rely on structural invisibility rather than technical sophistication. That is, the difficulty for obliged entities frequently lies not in decoding advanced concealment technology but in seeing through ordinary-looking corporate structures and layered ownership arrangements that disguise who is truly in control. This creates persistent detection gaps, especially where beneficial ownership is obscured or where intermediary parties sit between the obliged entity and the ultimately involved designated person.

Who it's relevant to

Sanctions compliance officers
Sanctions compliance teams use these typologies to design and calibrate red-flag indicators and risk-based screening controls. Understanding structural invisibility, the reliance on ordinary-looking corporate and ownership arrangements rather than technical sophistication, helps them target detection efforts at the concealment methods most likely to appear in their business, while mapping controls to the specific regimes that apply to their institution.
Financial intelligence analysts and investigators
Analysts and investigators draw on typologies as investigative aids when reviewing alerts and building cases, using patterns such as front and shell companies, nominees, and transshipment to guide inquiry. They should treat a typology match as a prompt for further examination rather than as evidence that an offence has occurred.
Professional enablers and gatekeepers
Legal, corporate services, and financial professionals whose services can be exploited in evasion schemes are relevant because complicity is sometimes assessed along a spectrum, from criminal complicity to wilful blindness, for instance in relation to source-of-funds checks. Robust due diligence, particularly around beneficial ownership and source of funds, helps mitigate the risk of unwittingly facilitating evasion.
Trade finance and correspondent banking teams
Because transshipment and routing through intermediary jurisdictions are commonly cited techniques, teams handling cross-border trade and correspondent relationships face heightened exposure to attempts to disguise the origin, destination, or ownership of funds or goods. Awareness of these patterns supports scrutiny of counterparties, routing, and underlying commercial rationale.

Inside Sanctions Evasion Typologies

Use of Intermediaries and Front Companies
Sanctioned persons or jurisdictions may route transactions through third parties, shell or front companies, or nominee arrangements to obscure the ultimate party in interest. This can defeat name-based sanctions screening because the sanctioned party does not appear directly on the transaction, making beneficial ownership identification central to detection.
Trade-Based Evasion
Techniques may include misdescription of goods, over- or under-invoicing, false end-user or end-use declarations, and manipulation of shipping documentation to move value or restricted goods while avoiding sanctions controls. These typically involve trade finance instruments and dual-use goods considerations that vary by regime.
Obscuring Origin, Destination, or Nexus
Actors may strip, alter, or omit identifying information in payment messages (sometimes described as 'stripping'), transship goods through intermediary jurisdictions, or falsify vessel and geographic data to conceal a sanctioned nexus. The specific prohibited conduct depends on the applicable sanctions program.
Layering Through Complex Structures
Chains of entities, accounts, or jurisdictions may be used to distance a transaction from the sanctioned party, echoing the layering concept from the conceptual money laundering model, though sanctions evasion is a distinct offence framework from money laundering.
Exploitation of Emerging Channels
Virtual assets, alternative payment mechanisms, and less-regulated intermediaries may be used to attempt to circumvent screening and reporting controls. The extent to which these fall within scope depends on how each jurisdiction extends sanctions obligations to such channels.
Regime and Attribution Considerations
Sanctions obligations derive from specific instruments and administering bodies, for example, OFAC-administered programs under US authorities, UK regimes administered by OFSI, and EU restrictive measures, and typologies must be assessed against the particular program and its ownership/control and prohibition rules rather than a single global standard.

Common questions

Answers to the questions practitioners most commonly ask about Sanctions Evasion Typologies.

Does identifying a sanctions evasion typology in a customer's activity prove that sanctions evasion has occurred?
No. Typologies describe patterns and methods that have been observed in past evasion schemes; they are analytical and operational tools to help detect and assess risk, not legal tests of wrongdoing. The presence of a typology-consistent pattern may warrant further review, escalation, or investigation, but it does not by itself establish that any breach or criminal conduct has taken place. Determinations of actual violations rest with competent authorities and, where relevant, courts, applying the specific legal standards of the applicable sanctions regime.
Is there a single, exhaustive global list of sanctions evasion typologies that firms can screen against?
No. Typologies are illustrative rather than exhaustive, and they evolve as evaders adapt their methods. Different bodies and authorities publish guidance describing observed techniques, and these can vary in emphasis by jurisdiction and by the sanctions program in question. Treating any published set of typologies as a complete checklist risks creating blind spots. Firms generally use typologies to inform a risk-based approach rather than as a fixed, closed catalogue, and should confirm relevant guidance against the sources applicable to their operations.
How can sanctions evasion typologies be operationalized within a transaction monitoring program?
Typologies are commonly translated into risk indicators, scenarios, or rules that flag activity for review, for example, patterns involving unusual routing, use of intermediaries, or inconsistencies between stated and apparent activity. The aim is to detect and manage risk, not to guarantee prevention. Effective implementation typically involves calibrating scenarios to the firm's risk profile, testing for false positives and coverage gaps, and combining automated detection with analyst judgment. Because typologies evolve, monitoring logic generally requires periodic review and tuning. Scope and expectations may differ depending on the obliged entity and applicable regime, which should be confirmed against relevant regulatory guidance.
How do sanctions evasion typologies relate to sanctions screening, and are they the same control?
They are distinct but complementary. Sanctions screening generally compares names and other data points against designated-party and related lists to identify direct matches or near-matches. Typology-based analysis instead looks for behavioral patterns and structuring methods that may indicate an attempt to circumvent those controls, for instance, obscuring a connection to a designated party rather than naming it. Screening addresses known designated parties; typology analysis helps address concealment and indirect exposure. Both are measures to detect and mitigate risk and neither, alone, eliminates it.
What should an analyst consider when escalating activity that matches a sanctions evasion typology?
Escalation practices vary by firm and regime, but analysts typically document the specific indicators observed, gather relevant context (such as counterparties, routing, underlying purpose, and any explanations obtained), and assess whether the pattern is consistent with legitimate activity. A typology match is an input to analysis, not a conclusion. Depending on the findings and the applicable framework, outcomes may include further inquiry, internal escalation, or reporting to the relevant authority. Firms should follow their own procedures and the requirements of the sanctions and reporting regimes to which they are subject.
How should typology knowledge be maintained and refreshed over time?
Because evasion methods adapt, typology awareness is generally treated as an ongoing process rather than a one-time exercise. Firms commonly incorporate updates from applicable regulatory and enforcement guidance, industry information-sharing where permitted, and lessons from their own case reviews into training, monitoring scenarios, and risk assessments. The objective is to keep detection measures reasonably current so they continue to help manage risk. The frequency and formality of updates may depend on the firm's risk profile and applicable obligations, which should be confirmed against the relevant rules.

Common misconceptions

Sanctions evasion is the same as money laundering, so an AML program automatically covers it.
Sanctions compliance and anti-money laundering are related but distinct disciplines with different legal bases and objectives. Sanctions prohibitions are generally strict, often status-based rules tied to specific programs and administering bodies, whereas money laundering concerns the handling of criminal proceeds. Controls, screening logic, and reporting obligations differ, and coverage of one does not guarantee coverage of the other.
If a party's name does not match a sanctions list, there is no sanctions risk.
Many evasion typologies are specifically designed to defeat name-based screening through front companies, nominees, intermediaries, or ownership and control structures. In many regimes, entities owned or controlled by sanctioned persons may be caught even if not listed by name, so screening a name alone is not a complete control.
The listed typologies are an exhaustive checklist, and matching one proves evasion.
Typologies are illustrative indicators drawn from observed patterns, not an exhaustive list or a legal test. The presence of a typology or red flag may warrant further review but does not by itself establish that sanctions evasion or any wrongdoing has occurred; that is a matter for investigation and, where applicable, competent authorities.

Best practices

Screen not only transaction-party names but also beneficial ownership and control relationships, applying the ownership and control rules specific to each applicable sanctions program rather than assuming a single global standard.
Integrate sanctions typologies into transaction monitoring and trade finance review, paying particular attention to intermediaries, front companies, transshipment through third jurisdictions, and documentation inconsistencies.
Confirm exact prohibitions, thresholds, and scope against the applicable regime and administering body (for example, OFAC, OFSI, or EU measures) before relying on any specific rule, as these diverge across jurisdictions.
Treat typology matches and screening alerts as triggers for further review and escalation, not as proof of wrongdoing, and document the risk-based rationale for dispositions.
Extend controls to emerging channels such as virtual assets and alternative payment mechanisms where they fall within the entity's regulatory scope, and identify gaps where they do not.
Maintain clear escalation and reporting pathways to competent authorities in line with the obligations applicable to the obliged entity, treating detection and mitigation as measures to manage risk rather than guarantees of prevention.