The sanctions job has changed – and it’s not going back any time soon

Lucie Rehakova, AML Solution Engineer, Resistant AI

Since the Russian invasion of Ukraine in February 2022, there have been an array of international sanctions against the state and its actors, with increasing degrees of intensity stepped up over time against trade with Russia. In a world with numerous methods and routes to passing money between people and across borders, the use of money mules, and falsified identities or documents, those companies handling payments, trade financing, or insurance face an ever-changing challenge to ensure that they abide by relevant sanctions as they shift and expand.

The requisite function of monitoring and enacting sanctions has changed, and it is not going back to what it used to be any time soon. It has been quite some time since mere list screening alone has been a sufficient exercise for (most) obliged institutions to ensure sanctions compliance. Sectoral, thematic, price-based, and other types of sanctions have significantly expanded the kind of data, knowledge, experience, and technology needed to comply with legislation.

This development goes hand in hand with the broader trend of connecting all financial crime endeavors and breaking down silos between Anti-Money Laundering, Anti-Fraud, and Sanctions Compliance. As a result, the toolkit and general resources available to sanctions teams need to expand accordingly. Firstly, it is breaking down data and information silos (where possible and permitted by law…) among internal teams.

The discipline will continue to see growing numbers of designated entities, as well as complexity of the scenarios where sanctions apply. Now, combine this with the increasingly more restricted access to beneficial ownership (BO) information, which we see across the EU and US, and the differing legal requirements guiding this (sanctions designation propagates above 50% of ownership stake, while AML risk is set at 25% or above ownership stake in the US, and above 25% of ownership OR control across the EU and UK).

A thorough and multi-layered check for sanctions evasion & circumvention becomes a nearly impossible task. Many institutions already limit their BO checks to one or two layers of ownership beyond the designated entity, while a dense network of obscure corporate structures and carefully calculated aggregate ownership stakes are common practice and easily attainable for evaders. But who has the time and data to go back ten, twenty, or even thirty layers of ownership?

The ideal sanctions toolkit looks something like this:

• The foundation: An experienced team of professionals who know what typologies are common, as well as what kind of emerging behavior warrants a reasonable suspicion. A comprehensive and high quality database, updated in a timely manner (near real-time). And a wealth of open source intelligence (OSINT) such as vessel GPS tracking, commodity or other product pricing, and many other data points.
• The first layer: A robust, real-time sanctions screening solution that can ingest all of the data the institution is paying (a lot of money) for and screen customers, counterparties, and transactions accordingly. Preferably one can make sense of different date-of-birth formats…
• The second layer: A document forgery control to detect fake or manipulated invoices, product documentation,  import/export permits, sanction exemption licenses, and other legitimizing documentation. Bonus: advanced detection tools can also help you detect re-used invoices, which perhaps have not been forged or manipulated, but have been used a number of times for illicit purposes.
• The third layer: A smart transaction monitoring tool, which is capable of incorporating new detection scenarios to capture emerging evasion practices. This means not only monitoring and alerting us to the activity we dosee, but also changes thereof (e.g. export re-routing from Russia to Kyrgyzstan), and the activity or information that we suddenly donot see (e.g. disappearing designated counterparties or product codes, while the activity remains very much the same). It also means leveraging all of the data available to the institution, including device and session data such as IP addresses, and clustering seemingly unconnected accounts together based on their static and behavioral characteristics.

The sanctions job is much bigger than it used to be. While many sanctions teams rely on rudimentary screening tools which still struggle with date formats, acronyms, and aliases. The sophistication of the technological toolkit available to sanctions investigators needs to grow proportionately to the complexity of sanctions regimes, and the skills and tools available to criminals or designated entities (such as crypto). Whilst this approach can be modular – and it may not be possible to attain all of the layers – it is the ideal state and each layer will add huge benefit to the company.