Sanctions Evasion Typologies: 9K Network Reference Manual ## Chapter 1: Corporate Obfuscation and Beneficial Ownership (BOI) Evasion. The primary mechanism for sanctions evasion involves the deliberate masking of the ultimate beneficial owner (UBO). Actors utilize complex, multi-jurisdictional corporate structures, including circular ownership models and off-the-shelf shell companies with no trading history [1]. By employing nominee directors and shareholders, sanctioned parties distance themselves from the financial footprint of the entity [1]. ## Chapter 2: Trade-Based Money Laundering (TBML) and Export Control Circumvention. TBML serves as a critical conduit for value transfer. Typologies include the use of suspicious consulting invoices at non-market rates to justify capital flight and the exploitation of open account trade mechanisms to bypass traditional banking scrutiny [1, 2]. Trade finance instruments are frequently manipulated by obscuring references to sanctioned jurisdictions or parties within shipping documentation [2]. Transhipment remains a high-risk indicator, where goods are routed through third-party jurisdictions to disguise the final destination [2, 3]. ## Chapter 3: Financial Intermediation and Fintech Exploitation. Sanctioned actors increasingly leverage Fintech platforms, Electronic Money Institutes (EMIs), and Payment Service Providers (PSPs) that exhibit weak AML/KYC controls or possess nexus to sanctioned regions [1]. Red flags include the use of suspense accounts to process transactions without identifying the originator and the layering of payments through multiple correspondent banks to break the audit trail [2]. ## Chapter 4: Maritime and Logistics Sector Exploitation. The maritime sector is exploited through the manipulation of vessel identities and the use of strategically located transit hubs [3, 4]. Evasion techniques include the disabling of Automatic Identification Systems (AIS) and the use of ship-to-ship transfers to obscure the origin of cargo [4]. ## Appendix A: Key Risk Indicators. 1. IP addresses inconsistent with reported customer location [4]. 2. Inconsistent terms within trade documentation [2]. 3. Significant shifts in banking relationships coinciding with new sanctions designations [2]. 4. Transactions involving entities with known enablers or PEPs [1].