Short answer: sanctions evasion works by hiding who owns, controls or benefits from a transaction, or where goods come from and go to. The red flags to know fall into three groups: ownership and structure, shipping and trade, and payment behaviour. The CGSS exam tests recognition and the right first step.
Sourcing note. These indicators summarise public advisories by authorities such as OFAC, the UK's OFSI and the US Departments of State and Commerce, which have published joint advisories on maritime and trade evasion. Check their latest advisories for new typologies.
1. Ownership and structure red flags
- Newly formed companies with no clear business, sharing an address or directors with other entities.
- Nominee shareholders or directors, or ownership split to stay under the 50 percent threshold. See the OFAC 50 percent rule.
- Transfers of ownership to relatives or associates shortly after a designation.
- Reluctance to disclose beneficial owners, or inconsistent ownership documents.
- Complex structures in secrecy jurisdictions without a business rationale.
2. Maritime red flags
| Technique | What it looks like |
|---|---|
| AIS manipulation | Vessel switches off its automatic identification system ("going dark") or transmits false positions |
| Ship-to-ship transfers | Cargo moved between vessels at sea, often away from ports, to disguise origin |
| Flag hopping and renaming | Frequent changes in flag, name or ownership |
| False flags | Registration in a fraudulent registry |
| Falsified documents | Bills of lading, certificates of origin or cargo documents that conceal the origin or destination |
| Opaque ownership | Single-ship companies registered in different jurisdictions |
3. Trade and goods red flags
- Routes through transshipment hubs that do not match the commercial logic.
- Goods whose description is vague, or which do not match the customer's business.
- Dual-use items (with civil and military uses) shipped to countries of concern or via intermediaries.
- Price inconsistent with market value.
- Last-minute changes of destination, consignee or payment terms.
- Customers unwilling to provide end-use or end-user information.
4. Banking and payment red flags
- Payments that do not match the underlying trade.
- Use of third-party payers or payees unrelated to the contract.
- Wire messages with missing, altered or stripped information, particularly data about parties.
- Payments in currencies or via routes that do not make sense for the parties.
- Rapid movement of funds through newly opened accounts.
- Use of cash, gold or cryptoassets to bypass the banking system. See crypto and VASP risk.
5. What to do when you see a red flag
- Do not process the transaction until you understand it, where the law or your policy requires holding it.
- Gather information: ownership, vessel identity (IMO number), trade documents, end-user.
- Screen all parties, including vessels, ports and beneficial owners.
- Escalate to sanctions compliance; do not clear a case alone if unsure.
- Decide: proceed, request more information, reject, block, or exit; report to the authority where required.
- Document the reasoning.
- Do not tip off the customer where reporting rules prohibit it.
6. Exam traps
- A red flag is not proof. The first step is to investigate, not to exit.
- Evasion is not just about names. A clean name match does not clear a transaction with a hidden owner.
- Private sector expectations. Authorities expect firms to use public information and typology advisories in their risk assessments.
- Mixing up AML and sanctions responses. A suspicion of evasion may need both a sanctions response (block, reject) and an STR/SAR.