A sanctions evasion typology is a description of a recurring method by which sanctioned people, companies or states obtain funds, goods or services that sanctions are meant to deny them. Each typology sets out how the scheme works, who is typically involved and which warning signs, or red flags, may reveal it. Banks, payment firms, insurers, shipping companies and exporters use typologies to design controls and train staff, and governments publish them to help the private sector recognise evasion.
Typologies add depth to list-based controls. Sanctions screening checks names against a sanctions list, but most deliberate sanctions evasion is arranged so that no listed name appears in the transaction. Recognising it depends on knowing the patterns of behaviour, ownership, routing and documentation that such schemes tend to share.
Common typologies
Published guidance returns to a core set of methods:
- Front and shell companies. A shell company with nominee directors is placed between the sanctioned party and the bank, often in a jurisdiction with weak ownership disclosure, and replaced when it attracts attention.
- Ownership restructuring. A listed person's stake is cut to just below the level at which the sanctions ownership rule applies, or transferred to relatives and associates shortly before or after designation, while control continues in practice.
- Third-country transshipment. Controlled goods are sold to a buyer in a country that does not apply the sanctions and then re-exported to the real destination.
- Stripping and altered payment data. References to a sanctioned party or country are removed from payment messages, or cover payments are used so that intermediary banks do not see the underlying parties.
- Deceptive shipping. Vessels switch off or falsify location signals, transfer cargo ship to ship at sea, change flags and names repeatedly, and carry falsified cargo documents such as the bill of lading.
- Trade mis-description. Goods, values or end users are misstated on invoices, overlapping with trade-based money laundering.
- Informal and indirect channels. Value moves through hawala networks, cash couriers, exchange houses or small banks that reach the wider system through nested correspondent banking.
- Digital assets. Funds are moved through unhosted wallets, non-compliant exchanges or a coin mixer, and state-linked groups have stolen crypto assets to fund prohibited programmes.
Where typologies come from
Typologies are drawn from enforcement cases, intelligence and reports filed by firms. In the United States, OFAC issues advisories, sometimes jointly with other agencies, on topics such as maritime deception and export control evasion, and FinCEN publishes alerts listing red flags for banks. The UK's sanctions and financial crime authorities, the European Commission and United Nations panels of experts publish comparable material. The FATF addresses a related area through its work on the financing of weapons proliferation, which is the focus of a firm's proliferation financing risk assessment.
Published enforcement actions are also read as typologies. Settlements with large banks over payment stripping in the late 2000s and 2010s shaped current expectations on payment transparency, and more recent cases have involved trading firms, technology exporters and crypto businesses.
How firms use them
A typology becomes useful when it is translated into controls. Compliance teams map each relevant typology to their products and customers in the sanctions risk assessment, then build detection around the red flags. Examples are a transaction monitoring scenario for payments routed through known transshipment hubs, checks on vessel history in trade finance, and blockchain analytics for exposure to sanctioned wallet addresses.
Typologies also guide due diligence. Where a customer's structure resembles a known pattern, such as a newly formed trading company with opaque owners dealing in dual-use goods, firms carry out deeper beneficial ownership verification and ask for end-use and end-user evidence. Staff training built on real cases helps front-line and operations teams escalate what automated tools miss.
Limitations
Typologies describe what has already been detected, and evaders change methods once a pattern is published. Many red flags are also common in legitimate trade, so applying them mechanically produces false alarms and can push firms towards refusing whole categories of customers or countries. Requirements differ between sanctions regimes, which means conduct that is evasion under one may be lawful under another, and firms with a link to the United States must also weigh secondary sanctions risk. For these reasons typologies are treated as an aid to judgement, to be refreshed regularly, and not as a complete checklist.