.svg){kind=icon}
Learn
Sanctions evasion detection is the practice of identifying how sanctioned actors hide prohibited trade and finance - through shell and front companies, trade-based money laundering, and deceptive shipping - by correlating financial, corporate, trade, and maritime signals across fragmented data.
Last updated: October 23, 2026
Why it matters to your mission. Sanctions work only if evasion is caught. A sanctioned actor almost never moves prohibited oil, weapons components, or regime revenue through a single traceable transaction. They route it through a shell company in one jurisdiction, a front company in another, a mis-invoiced trade, and a tanker that goes dark at sea - each piece legal-looking in isolation and each in a different data system. The evasion becomes visible only when those pieces are connected, which is why detecting it is a data-fusion and entity-resolution problem before it is an enforcement one: the signal exists in the correlation across financial, corporate, trade, and maritime sources, not in any one of them.
Sanctions evasion detection is the practice of identifying how sanctioned actors hide prohibited trade and finance - through shell and front companies, trade-based money laundering, and deceptive shipping - by correlating financial, corporate, trade, and maritime signals across fragmented data. The core insight is that evasion is deliberately distributed: no single record exposes it, so detection depends on resolving when scattered entities and transactions describe the same hidden scheme.
Sanctions evasion itself is the set of techniques by which a party defeats or circumvents an economic sanction while appearing to comply. The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) administers and enforces U.S. sanctions, and its advisories describe evasion as a repeating pattern: sanctioned parties use "opaque legal structures, including trusts, straw owners, front businesses, and proxies, to conceal continuing interests" in assets and activity, as OFAC put it in its March 2026 advisory on sham transactions. Detection is the defensive discipline of seeing through those structures.
Key takeaways
Sanctions evasion is not one trick but a toolkit, and sophisticated schemes combine several at once. The recurring techniques are well documented across OFAC, FinCEN, and the Financial Action Task Force (FATF). Each technique has a characteristic way of hiding, and each leaves a detection signal that is visible only when the right sources are joined.
| Technique | How it hides | Detection signal |
|---|---|---|
| Shell companies | A paper entity with no real operations holds assets, receives funds, or signs contracts to break the chain of ownership | Corporate registrations with no physical presence, shared addresses, nominee directors, no independent economic activity |
| Front companies | A genuinely trading business acts as a normal counterparty while moving funds for a sanctioned party behind it | A real company whose trade partners, payment flows, or ownership resolve back to a sanctioned network |
| Nominees and proxies | A natural person or associate stands in as owner or director to keep the sanctioned party off the record | Ownership fragmented just below reporting thresholds; family or close-associate transfers; straw owners |
| Trade-based money laundering | Value moves through over- or under-invoiced trade so the payment misstates the goods | Invoice price, quantity, or quality that diverges from market value; circular or commercially illogical trade |
| Deceptive shipping | Vessels disable or spoof tracking, transfer cargo at sea, and falsify documents to disguise origin | AIS gaps or spoofed identity, ship-to-ship transfers, falsified certificates of origin, opaque vessel ownership |
| Shadow banking / exchange houses | Parallel payment networks settle transactions through third-country intermediaries | Exchange houses and front companies in hub jurisdictions making or receiving payments for sanctioned persons |
The defining property across the table is that every row is individually plausible. A mailing-address company is legal, a ship-to-ship transfer is often legitimate, and an invoice is just an invoice. The evasion exists in the combination, which is why OFAC, in its June 2025 action against an Iranian shadow-banking network, described "a parallel banking system in which settlements are brokered through Iran-based exchange houses that use front companies outside of Iran" to move value for sanctioned persons. Detecting that requires seeing the exchange house, the front companies, and the payments as one structure.
Trade-based money laundering (TBML) is the process of disguising the proceeds of crime and moving value through trade transactions to legitimize their illicit origin. The definition traces to the FATF's 2006 typology work and is carried in the Congressional Research Service report Trade-Based Money Laundering: Overview and Policy Issues (R44541), which describes TBML as moving value "through the use of trade transactions in an attempt to legitimise their illicit origins."
The mechanism is misrepresentation. By over- or under-stating the price, quantity, or quality of goods on an invoice, parties move value in the opposite direction of the stated trade. The CRS report notes that over- and under-invoicing is among the most common methods for shifting value across borders: under-invoicing an export moves value to the importer, because the importer receives goods worth more than the recorded payment. The goods provide cover; the mispricing does the laundering.
TBML matters for sanctions evasion because legitimate trade finance is exactly where a sanctioned actor wants to hide. Letters of credit, bills of lading, and wire settlements process enormous volumes of real commerce, and a mis-invoiced transaction blends in. The detection signal is a divergence between the documented trade and the economic reality of it, which only appears when trade records, corporate ownership, and payment flows are correlated rather than reviewed one document at a time. This is the counter-threat-finance problem in trade form, and it connects directly to illicit finance analysis and counter-threat finance.
Dark shipping is the practice of concealing a vessel's identity, location, or cargo to move sanctioned goods by sea, most often by manipulating the Automatic Identification System (AIS) that ships use to broadcast position and identity. It is the maritime face of sanctions evasion, and OFAC treats it as a core deceptive shipping practice.
OFAC's April 16, 2025 Sanctions Advisory, "Guidance for Shipping and Maritime Stakeholders on Detecting and Mitigating Iranian Oil Sanctions Evasion," enumerates the tactics precisely. Vessels "have been known to intentionally disable their AIS transponders or modify transponder data to mask their movements, including port calls and STS transfers." The advisory describes identity spoofing in which "Iranian vessels reporting the Maritime Mobile Service Identity (MMSI) number of a different, non-sanctioned vessel or the International Maritime Organization (IMO) number of a vessel that has been scrapped." The tactics named in the advisory include:
A "shadow fleet" of tankers operating outside standard maritime regulation strings these tactics together. OFAC's advisory points to concrete cases - the vessel CORONA FUN "had manipulated its AIS transponder data to disguise its efforts to ship Iranian oil" - and stresses that detection requires researching "all involved vessels not only by name but also using multiple identification and location data points." That is an entity-resolution instruction: the same physical ship wears many names, so you have to resolve identity across signals. The same discipline underlies maritime domain awareness.
Sanctions evasion is detected by resolving hidden connections: taking signals from financial, corporate, trade, and maritime sources and determining when separate records point to the same concealed actor or scheme. List-based screening - checking a counterparty against a sanctions list - is necessary but catches only the obvious. Evasion is designed to defeat it, which is why OFAC's 50 Percent Rule blocks entities owned in the aggregate by sanctioned persons, forcing evaders to fragment ownership below the threshold and use nominees who are not themselves listed. When the name is clean by design, name screening alone fails.
Detection therefore shifts from the name to the network. The practical work is threefold. First, entity resolution: deciding when a company in a corporate registry, a counterparty on a wire, a shipper on a bill of lading, and a vessel owner are in fact the same actor, despite different names, spellings, and jurisdictions. Second, relationship analysis: assembling those resolved entities into a graph that exposes the chain of shells, front companies, and intermediaries a sanctioned party hides behind. Third, anomaly correlation: surfacing the combinations that are individually legal but collectively suspicious - a front company trading with a flagged network, a vessel whose AIS gap aligns with an unexplained cargo, an invoice that does not match the goods.
FinCEN frames the detectable artifacts this way, defining shell companies as "non-publicly traded corporations, limited liability companies (LLCs), and trusts that typically have no physical presence (other than a mailing address) and generate little to no independent economic value." Its advisories direct financial institutions to screen for front- and shell-company red flags, which are only actionable when the underlying records are connected. That is where detection becomes a data and reasoning problem, built on entity resolution for intelligence analysis and link analysis for intelligence.
From a clean name to the hidden network
List screening catches only the obvious; OFAC's 50 Percent Rule pushes evaders to fragment ownership and use unlisted nominees. Detection resolves entities, maps their relationships, and correlates anomalies across sources.
Each step joins sources never designed to interoperate, and every link in the resolved network must trace back to its authoritative source so a detection conclusion can be defended.
Sanctions-evasion detection is a data-fusion problem because the evidence of a scheme never lives in one place. A single evasion network can span a corporate registration in one country, a trade invoice in another, a wire settlement through an exchange house in a third, and a tanker tracked by maritime data over international waters. No individual source exposes the scheme. The exposure exists only in the correlation across all of them, and correlating fragmented, multi-format, multi-owner data at the speed money moves is a data infrastructure challenge, not a policy one.
Two properties make this specifically an AI and data problem.
First, the data is fragmented and heterogeneous. Financial transactions, corporate-registry filings, trade and customs records, and maritime tracking each have different formats, identifiers, languages, and owners. The same company appears under variant spellings across registries; the same vessel reports different identities across voyages; the same beneficial owner hides behind nominees. Making these align requires resolving entities across sources that were never designed to interoperate - the same cross-source reasoning that multi-INT fusion applies to intelligence and that counter-threat finance applies to money.
Second, defending a detection conclusion requires the data to be trustworthy and traceable. A sanctions case or a bank's risk decision has to withstand scrutiny, so every link in the resolved network must trace back to its authoritative source; you cannot assert that two entities are the same from data you cannot audit. This is where evasion detection connects to data provenance for AI, which keeps every input traceable, and why it depends on reasoning you can inspect rather than a black-box score. The through-line is that catching evasion depends on connecting and trusting fragmented financial, corporate, trade, and maritime data at machine speed - a reasoning infrastructure problem before it is an enforcement one.
Torch.AI does not administer sanctions or issue designations, and this page is not a claim to an enforcement authority. What Torch.AI builds is the government-owned reasoning infrastructure that the data-driven side of evasion detection depends on: the ability to connect fragmented, multi-source data into a coherent picture at machine speed while keeping every element traceable to its source.
The relevant capability is entity resolution and relationship analysis you can trust and govern. Finding a hidden network means pulling candidate entities out of financial, corporate, trade, and maritime data, resolving when separate records describe the same actor, and surfacing the chain of shells and front companies that connect a clean-looking counterparty to a sanctioned party - all without pooling data in ways policy forbids. ORCUS provides the data-availability layer that connects to sources and preserves provenance. NEXUS applies semantic representation so unstructured records like filings, invoices, and shipping documents become something a system can correlate. HALO fuses resolved entities and relationships into a graph an analyst can inspect and trace. Because this runs as a system of reason on top of existing systems of record, the authoritative sources stay intact, and in a government-owned deployment the customer keeps control of the layer where fragmented data becomes understanding. See how this is packaged on the Torch.AI software page.
For evaluators, the fit is specific: if your evasion-detection challenge is that the signals are scattered across financial, corporate, trade, and maritime systems faster than anyone can correlate them, that is a data and reasoning problem, and it is the one this infrastructure is built for. Request a technical walkthrough and we will run it against a representative slice of your own multi-source data, with provenance traced end to end.
Sanctions law and the typologies are well established. The modern gap is the data capability underneath detection. If you are evaluating infrastructure to support evasion detection and counter-threat-finance analysis, require:
Evaluating a capability? Bring these six requirements to a scoping call and we will walk each one against your environment: request a technical walkthrough.
The recurring techniques are shell companies and front companies, nominees and proxies, trade-based money laundering through mis-invoiced trade, deceptive shipping including AIS manipulation and ship-to-ship transfers, and shadow banking through third-country exchange houses. Sophisticated schemes combine several at once, because each technique is individually plausible and the evasion exists in the combination.
Trade-based money laundering is the process of disguising the proceeds of crime and moving value through trade transactions to legitimize their illicit origin, as defined by the FATF and cited in Congressional Research Service report R44541. It typically works by over- or under-invoicing the price, quantity, or quality of goods, so that value moves in the opposite direction of the stated trade while legitimate trade finance provides cover.
Dark shipping is concealing a vessel's identity, location, or cargo to move sanctioned goods by sea, most often by disabling or spoofing the Automatic Identification System. OFAC's April 2025 maritime advisory describes vessels that turn off their AIS transponders or broadcast another ship's MMSI or a scrapped vessel's IMO number, conduct multiple ship-to-ship transfers, and use shell-company vessel ownership to disguise cargo origin.
Sanctions evasion is detected by resolving hidden connections across financial, corporate, trade, and maritime data rather than by name screening alone, which evasion is designed to defeat. The core work is entity resolution to determine when separate records describe the same actor, relationship analysis to expose the chain of intermediaries, and anomaly correlation to surface combinations that are individually legal but collectively suspicious.
Because the evidence of a scheme spans corporate registries, trade records, financial settlements, and maritime tracking, and no single source exposes it - the exposure exists only in the correlation across all of them. Making fragmented, differently formatted, differently owned data align at machine speed, with every link traceable to its source, is a data and reasoning infrastructure problem before it is an enforcement one.
A shell company exists only on paper, with no real operations, and is used to hold assets, receive funds, or sign contracts; FinCEN defines shell companies as entities with no physical presence beyond a mailing address and little independent economic value. A front company is a genuinely trading business that acts as a normal counterparty while moving funds for a sanctioned party behind it, which makes it harder to detect because its activity and documents are partly real.
Describe the problem.
Define the constraints. We will structure the session.
No demo.
No slide deck.
Real work.
Describe the network you are chasing. We will scope sanctions evasion detection around your multi-source data. No list-screening demo. Your multi-source data. Real work.
