When I worked at the Treasury Department, we always referred to efforts to deter sanctions evasion as “playing whack-a-mole.” For those who don’t understand the reference, the game consists of a play area that has several holes, a display screen, and a large, soft mallet. The cabinet underneath the holes is filled with toy moles, which pop up at random. Points are scored by, as the name suggests, whacking each mole on the head as it appears.
The moles appear in a different hole each time you hit it.
Sound familiar?
Illicit financial actors resemble these moles when working to evade global sanctions. Every time a new methodology is discovered, they develop something new. Sometimes their new techniques are effective, other times… not so much.
Early this year, we saw some reporting suggesting that the Russian government was going to purchase shell companies in Uzbekistan to circumvent sanctions and trade restrictions. Ukraine’s National Resistance Center reported that Moscow had a plan to finance the creation of shell companies through which it will buy electronics for unmanned aerial systems (UAS).
On December 26, 2023, within the framework of a meeting of the leaders of the CIS countries, Putin discussed the terms of cooperation with the top military and political leadership of Uzbekistan. In particular, preliminary agreements have been reached regarding the creation of a number of shell companies on the territory of Uzbekistan, which will be financed by the Russian government.
The use of shell and front companies to evade sanctions is not a new trick. But as jurisdictions such as Cyprus—a favorite of Russians seeking to hide their assets—tighten regulations in an effort to protect themselves from abuse and defend their reputations as havens for the creation of shell entities and illicit finance, Russia is adjusting and apparently pouring money into neighboring countries in Central Asia to continue getting access to restricted goods and technologies.
OFAC’s recent designation of nearly 400 individuals and entities in Central Asia, Europe, and the Middle East that help Russia violate sanctions sheds some light on these tactics.
Treasury is targeting numerous transnational networks, including those involved in procuring ammunition and military materiel for Russia, facilitating sanctions evasion for Russian oligarchs through offshore trust and corporate formation services, evading sanctions imposed on Russia’s cyber actors, laundering gold for a sanctioned Russian gold company, and supporting Russia’s military-industrial base by procuring sensitive and critical items such as advanced machine tools and electronic components. Today’s sanctions further limit Russia’s future revenue from metals and mining. Treasury is also targeting Russian financial technology companies that provide necessary software and IT solutions for Russia’s financial sector.
Treasury on Friday also sanctioned more than 60 Russia-based technology and defense companies that are “critical for the sustainment and development of Russia’s defense industry, including entities involved in weapons development and modernization, automation and robotics, development and acquisition of dual-use electronics, digital surveillance, Internet of Things, and artificial intelligence.”
Included on the list are Russian financial technology companies aimed at curtailing Russia’s access to the international financial system to further its war against Ukraine. Payments services developer Atol, Russian software company Centre of Financial Technologies Group, which provides software products for banking, and Diasoft, which develops and supplies solutions for Russia’s financial sector have been sanctioned pursuant to EO 14024, making transactions with these companies a secondary sanctions risk.
An Italian national has been designated for his involvement in a procurement network involving a Türkiye facilitator to purchase more than $150 million worth of military equipment, ammunition, and ordnance for the Russian military from potential suppliers in Africa, Asia, the Caucasus, Central Asia, and Iran. Giulio Sfoglietti and his pals Türkiye national Hayri Tahirbeyoglu—the Chairman of the Board of Directors of Türkiye-based ammunition, weapons, and military materiel company Taha Savunma Sanayi Ve Ticaret Anonim Sirketi—who has worked with Sfoglietti on the procurement of ammunition and weapons for likely Russian end-use and US-designated ROSTEC employee Marat Gabitov have been sanctioned pursuant to EO 14024.
US-designated Russia-based military company Promtekh has used a network of companies located in Türkiye, France, and Hong Kong to send high priority goods to Promtekh’s subsidiaries. These companies have been sanctioned, as has Russia-based military procurement firm Aspectriym Limited Trade Development—a subsidiary of Promtekh.
Treasury on Friday also targeted Switzerland- and Liechtenstein-based trust and corporate services providers (TCSP) for enabling Russian cash flows and facilitating sanctions evasion schemes for Russian clients. These TCSPs are located at the same address—major red flag—and advertise their services in Russian.
Next, we have entities based in China and Hong Kong that are operating in the Russian technology sector and are facilitating Moscow’s access to microchips, integrated circuits, and other electronics Russia needs to conduct its war in Ukraine. The supply of electronic components via Cyprus- and Russia-based companies has also been targeted, as well as a Swiss-Russian national Alexandre Orloff, who has been working with a Russian government covert procurement network to acquire high-value, foreign-made semiconductor-related equipment and technology for Russian military end-users.
Other designations target Russia’s evasion of cyber sanctions, an Italian machine tool manufacturer—Fagima Fresatrici SPA—companies involved in Russian illicit gold trade, and other procurement networks. One of the entities sanctioned on Friday has a location in Uzbekistan, but InTheme, which specializes in the digitalization of logistics processes and provides business process automation services to several US-designated Russian entities, doesn’t seem to be a shell company that Russia has discussed creating to evade sanctions in the country.
The list is extensive, and provides insights into new networks and methodologies that Russia uses to gain access to restricted tools, technologies, and machinery. As the US Treasury and its allies continue to thwack these evasion networks, more are popping up, and as is evident from this latest tranche of designations, they’re not just in countries generally considered as high-risk for Russian sanctions evasion, such as Türkiye, the UAE (which has recently been removed from the FATF grey list and needs to be extra diligent in detecting and deterring sanctions evasion), and jurisdictions in Central Asia.
Russia has also been opening new overseas branches and subsidiaries of Russian financial institutions in an effort to evade sanctions. Treasury warns foreign regulators and financial institutions to be cautious and monitor Russia’s spate of new branches or subsidiaries of Russian financial institutions that are not themselves sanctioned.
Sometimes the game of whack-a-mole feels futile, as Russia continues to develop new ways to circumvent restrictions. That’s why intelligence is so critical in this game. Not only is it vital to detecting new Russian strategies to evade sanctions, but analysts should also work to identify possible new avenues that Russia has not accessed yet.
Illicit actors always work to find new ways to commit crimes. That doesn’t mean that efforts to stop them are ineffective. It just means that strategies to detect them need to evolve alongside these criminals.
Yes, we know the jurisdictions that are high-risk for evasion. But we should look further and deeper.
Yes, we know sanctioned Russians use shell companies to evade sanctions. But we should not limit our enhanced due diligence to jurisdictions in which it’s easy to establish these entities or countries with a large TCSP sector.
Yes, we know Russian evade sanctions by transacting through family members and close associates. But we should dig deeper into ownership and control structures of entities involved. Are the owners and leaders of the company linked to politically exposed persons? Have they been cited in adverse media reports as having connections to designated individuals or supportive of Russia’s aggression?
The game of whack-a-mole is getting more complex. Firms and financial institutions should adjust accordingly.
Clearing most of the Russians out from Malta, Cyprus and Turkey means that it is now easier to not accidentally do business with a sanctioned entity. To my mind that means that companies who now report large growth in trade with any (something)stan are now knowingly doing business that evades sanctions.
BTW this Xitter thread on trying to stop doing business in Russia if you are a foreign company ought to be widely read by anyone thinking about doing business there (or in the PRC if you ask me, I bet they'll pull similar tricks)
https://threadreaderapp.com/thread/1827476371955970068.html