Sanctions Evasion: Concealed Origin, Ownership and Access to U.S. Payments

Sanctions evasion and money laundering use concealed ownership, altered payment messages and false trade documents to keep money moving through the financial system. A bank sees a payment after someone removes the customer’s name. An exchange sees a location that customer support helped disguise. The people inside those businesses may know what changed and why. That connection between the original transaction and the version allowed through is where an insider’s knowledge matters.

What Are Examples of Sanctions Evasion?

Examples of sanctions evasion include stripping identifying details from bank messages, hiding a sanctioned party behind front companies, disguising the origin of oil and helping customers bypass exchange restrictions. The concealment can happen at different points in the same transaction: who owns the account, what the payment says, where the goods came from or who can use the service.

Hidden Owners Behind Ordinary Company Names

A payment can carry a company’s correct name while concealing the person behind it. Ownership chains, nominee shareholders and intermediaries can put distance between the account holder and the person who ultimately owns or controls the business.

The Central European University thesis How Does Whistleblowing and Leaking Affect Anti-Money Laundering Policy Changes in the European Union examined this problem in 2019. Its discussion of shell companies and beneficial ownership describes how nominees and professional intermediaries help conceal the people behind corporate structures. Its broader finding is that insider information, including bank transfers and communications, helped expose laundering networks and influence policy.

For someone in onboarding or payments, the useful comparison is between the company presented to the bank and the ownership information held inside the business. The company name is the beginning of that inquiry. The ownership chain is what connects it to the person whose involvement was concealed.

The Customer Disappears From the Wire

Payment-message stripping removes information that a receiving bank uses to screen a transfer. The money continues downstream with fewer identifying details attached.

In its 2009 deferred prosecution agreements, Lloyds TSB accepted responsibility for criminal sanctions conduct. The Justice Department’s account of the court documents describes staff in the United Kingdom and Dubai deliberately removing customer names, bank names and addresses from outgoing payment messages. Those changes allowed transfers to pass undetected through filters at U.S. financial institutions.

The bank called the process repairing or stripping. What changed was the information the next bank received.

That makes the original payment instruction and the transmitted message a useful pair. A sanctions specialist may recognize the removed name. An operations employee may know who requested the change. Together, those records and that knowledge can explain how the payment reached the U.S. bank.

Oil With a Different Origin on Paper

Shipping concealment can join a real cargo to false documents and misleading movement data. The transaction has both a physical route and a financial route.

In the Suez Rajan case, the Justice Department’s account of its civil complaint alleged that participants disguised Iranian oil through ship-to-ship transfers, false automatic identification system reporting and falsified documents. The government also alleged that the vessel’s charterer used the U.S. financial system to facilitate transportation of the oil.

Suez Rajan Limited pleaded guilty in 2023 to conspiring to violate U.S. sanctions law. The civil complaint alleged an effort to sell and transport oil for interests affiliated with Iran’s Islamic Revolutionary Guard Corps to a customer abroad.

For a shipping or trading insider, the connection runs through cargo provenance, transfer records, invoices and payments. A false origin document and a payment for transporting that cargo can show different parts of the same arrangement. The person who knows where the oil came from may be far from the person who arranged its dollar payment.

A New Wallet or Location, the Same Access

Crypto sanctions evasion can conceal a service’s identity or a customer’s location while preserving access to an exchange. The records can include wallet changes, customer information and conversations with support staff.

In its March 2025 Garantex indictment announcement, the Justice Department alleged that the exchange changed operational wallets daily after its sanctions designation to avoid detection by U.S. exchanges. That alleged practice puts the relationship between old and new wallets at the center of the inquiry.

The alleged conversion route can also lead back into ordinary trade. In North Korean cryptocurrency indictments announced in 2023, prosecutors alleged that over-the-counter traders converted stolen cryptocurrency into dollar payments for goods through Hong Kong front companies.

Customer support supplied a different connection at Exodus Movement. In December 2025, the company agreed to a $3,103,360 civil settlement over apparent Iran sanctions violations arising from its support services. Exodus earned fees when customers used third-party exchanges through its wallet. The Office of Foreign Assets Control alleged that staff helped users in Iran access those exchanges, including by recommending VPNs to obscure their location.

The agency’s enforcement release quotes a support employee explaining the workaround:

The email carried both the knowledge of the restriction and the proposed means of avoiding it. The Office of Foreign Assets Control said the VPN recommendations undermined exchange partners’ efforts to enforce their restrictions. According to the agency, the business earning fees from those exchanges helped users get around the block.

Correspondent Accounts and Concealed Payments

Correspondent banking lets a foreign financial institution use another bank to receive deposits, make payments or process transactions. Lloyds used that access to send altered payment messages through U.S. banks’ filters.

In a nested relationship, the foreign bank also provides access to other banks through that account. The U.S. bank’s immediate customer and the business behind an underlying payment can be different parties. Customer due diligence, payment instructions and ownership information answer different parts of the question.

For sanctions evasion involving a concealed beneficial owner, dollar clearing evidence connects the ownership chain to the account and the payment that reached the U.S. bank. We examine the customer file alongside correspondent questionnaires, source-of-funds information, payment-message versions and internal warnings. The point is to establish what the business knew about the customer and what it told the institution supplying access.

Ownership Chains and Blocked Entities

The Office of Foreign Assets Control’s ownership rule treats an entity owned at least 50% in aggregate, directly or indirectly, by blocked persons as blocked even if the entity is not separately named on the sanctions list. The ownership chain matters alongside the company name.

We connect the identified owners, their interests and the transaction to the sanctions restrictions that applied at the time.

Sanctions Evasion and Internal Exceptions Approved by Management

In sanctions evasion, internal exceptions approved by management can connect a warning to the decision to keep a payment or customer relationship moving. The useful evidence is the warning, the reason given for clearing it and the transaction that followed.

The Exodus release illustrates why internal communications matter. The Office of Foreign Assets Control said the chief executive recognized that an exchange partner was likely blocking Iranian users to comply with U.S. sanctions. Management shared that understanding with customer service staff. The agency nevertheless described later support messages recommending VPNs to users in Iran.

Exodus’s terms barred use in embargoed countries, while its support staff explained how to disguise a location in Iran. The Office of Foreign Assets Control alleged that the company failed to train staff adequately or put practical controls behind those terms. The customers themselves had told support where they were.

An analyst may see the screening result. A manager may see the exception request. Customer support may hold the customer’s own explanation. We connect those records with the approvals, training and testing behind the control, so the decision can be understood in the context of the business it kept open.

What Connects the Transaction to U.S. Sanctions?

The connection may be a U.S. bank processing the payment, a U.S. company providing the service or another activity covered by the relevant sanctions program. The Office of Foreign Assets Control’s explanation of sanctions coverage includes foreign parties that cause U.S. parties to violate sanctions or engage in evasion.

The applicable restriction, transaction date and any license belong beside the transaction records. We examine what the authorization covered and what the business actually did.

Why the Information Between Systems Matters

The infrastructure used to detect money laundering also serves sanctions enforcement. Anti-Money Laundering: Opportunities for Improvement, published by the Wharton Initiative on Financial Policy and Regulation in 2024, explains that institutions often use the same compliance infrastructure for both purposes.

The paper points to the response to Russia’s invasion of Ukraine: existing anti-money laundering infrastructure and relationships helped institutions respond to sanctions, while guidance from the Financial Crimes Enforcement Network helped identify patterns involving shell companies, family transfers and high-value assets.

For an insider, the useful question is specific. What information did the business have, what reached its controls and what happened after someone recognized the problem? The removed bank name, the customer’s message from Iran and the false cargo document each show a place where information was concealed or disregarded.

Can a Whistleblower Report Sanctions Evasion?

Yes. The Financial Crimes Enforcement Network’s whistleblower program covers Bank Secrecy Act violations and specified sanctions violations. Its program description explains that qualifying information can lead to an award following a successful Treasury or Justice Department enforcement action. We assess the sanctions conduct, the evidence and the appropriate whistleblower route with you.

The program’s statutory award range is 10% to 30% of eligible amounts the government collects. The False Claims Act has a separate reward system. A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. The sanctions route has its own requirements, which we work through with you and sanctions whistleblower counsel.

When You Know What Was Removed

If you know who ordered a payment changed, approved an ownership exception or helped a restricted customer regain access, speak with our whistleblower experts about the decision behind the transaction. We build the case with you and bring in sanctions whistleblower lawyers who understand bank payments, trade and digital assets. We stay beside you from the first conversation through the case.