Whitepaper

A new frontier in sanctions
awareness a nd compliance
In collaboration with:

U.S. Department of State’s Officeof Cooperative Threat Reduction

A new frontier in sanctions awareness and compliance | moodys.com/kyc

1

Contents
Executive summary

2

Current state of affairs

3

Improving sanctions implementation.
Case study 1: U nraveling a complicated procurement network

4

Evolving methods to capture the dynamic nature of sanctions.
Case study 2: Identifying shell company operations through a sanctioned byextension entity

5

Continuous tracking of sanctions risk exposure through robust due diligence.
Case study 3: U ncovering control and hidden influence8

Perpetual know your customer (pKYC) checks triggered by real-time risk events

11

Compliance course of action

12

Executive summary
After new economic sanctions were levied in the months
following Russia’s invasion of Ukraine, global financial
institutions needed clarity on the processes andpolicies they had in place. Recognizing the importanceof fostering dialogue and boosting awareness of criticalsanctions enforcement, the U.S. Department of State
and CRDF Global implemented a series of conferences
worldwide, with Moody’s Analytics providing its financial
crime experts, data, and solutions to conduct theworkshops.
Each workshop covered global sanctions frameworks,compliance, and risk management strategies, and at
least one case study of evasion techniques. In thispaper we share three of those case studies, as well as
the sanctions compliance program guidance attendees
have found most helpful. The use cases are basedon real life examples, but all names of individuals andentities shown in the case studies below are fictitious.

A new frontier in sanctions awareness and compliance | moodys.com/kyc

The collaboration among
Moody’s Analytics, the U.S.
State Department’s Office of
Cooperative Threat Reduction(CTR), and CRDF Global
exemplifies a successful publicprivate collaboration aimed
at increasing awareness andenhancing the effectiveness of
economic sanctions.

2Current state o f affairs
International communities are taking a multilateralapproach to economic sanctions against Russia
following its invasion of Ukraine in February 2022. The
measures, including extensive financial restrictions,were immediately imposed, and have continued to
evolve and strengthen. According to the Department ofJustice, this sanctions campaign aims to weaken anddisrupt Russia’s ability to wage war while stabilizing the
global economy1.
At publication, the United States and its allies havesuccessfully blocked or frozen more than $58 billion
in financial accounts and economic resources owned
by sanctioned Russians2, and about $300 billion of
Russia’s Central Bank assets3. The U.S. Department of
the Treasury’s Office of Foreign Assets Control (OFAC)
announced stricter measures and expanded sanctions
authorities at the 2023 G7 Summit in Hiroshima.

Assets are being concealed in a complex labyrinthof trusts, tax havens, shell companies, and othermeans aimed at circumventing sanctions, according toanalysis provided by financial crime experts to Moody’s
Analytics.
The number of entities and individuals on various
sanctions lists has grown rapidly, with parties
sanctioned by extension growing on an even larger
scale.
It is crucial for governments and institutions to have acomprehensive understanding of the legal framework,
implementation mechanisms, and risk-based
approaches to ensure the effectiveness of sanctions in
a new era of evasion. This requires continuous dialogue
and cooperation between government agencies,
financial institutions, and other key stakeholders
involved in the design and enforcement of sanctions.

In response to tougher sanctions implementation efforts
by allies, high-ranking political representatives, military,paramilitary persons, and entities operating in key
sectors in Russia and Belarus are employing increasingly
sophisticated sanctions evasion techniques.

Linked entities andindividuals NOT on
the sanctions list, but
sanctioned by extension

Entities and individuals ON the list covered by GRID screening

3
Sanctioned individuals

2

42

194

Connected
banks

Banks connected tosanctioned “Linked
Entities”

Additional entities“sanctioned
by extension”(ownership > 50%)

FIGURE 1: Going beyond sanctions lists to uncover entities and individuals sanctioned by extension⁴

1

Source: https://www.justice.gov/usao-edny/pr/five-russian-nationals-including-suspected-fsb-officer-and-two-us-nationals-charged

2

Source: https://home.treasury.gov/news/press-releases/jy1329

3

Source: https://ec.europa.eu/commission/presscorner/detail/en/STATEMENT_22_4232

4

Data is derived from Moody’s Analytics Grid screening tool as of February 2023.

A new frontier in sanctions awareness and compliance | moodys.com/kyc

3

Improving sanctions
implementation
CASE STUDY 1: 
UNRAVELING A COMPLICATED PROCUREMENT NETWORKWhen OFAC announced its crackdown on sanctions
evasion networks and Russian technology companies5,
it revealed a trend in sanctions evasion that arose as
early as 2014 to 2016, following the sanctions imposedin response to Russia’s annexation of Crimea6. Multiple
sanctioned individuals created overly complex corporate
structures to achieve ultimate control and influence overthe entity, even if the ownership structure, as well as direct
and indirect shareholdings, did not reflect a shareholder
ownership of 50% or more. These informal or hidden
formal coalitions were complicated to dissect and detect.

In the case study below, published by the U.S.
Department of the Treasury, an engineering company
with a global footprint engaged in proliferation activities
by means of a procurement network for acquiring
military applicable technology. According to a press
release distributed by the U.S. Attorney’s Office,Eastern District of New York, the engineering company
managed an extensive network of shell corporations andbank accounts worldwide, with the intent to conceal thetrue recipients of U.S.-sourced equipment7.

OOO S Engineering

FIGURE 2: 
The U.S. Department of theTreasury’s depiction of anengineering company with global
footprint procurement network8

Joint Operations

Front
Company

Front
Company

Associate

Front
Company

Facilitator

Front
Company

OOO S

M LLP

P P LLPMrs A

OOO RT

A Pte Ldt

IB Sl

Executive
Officer

Executive
Officer

Executive
Officer

Executive
Officer

Owner

Mr B

Mr C

Mr D

DG LP

SCI Griber

Owner

Owner

Owner

Executive
0Officer

Mrs E

Operator

Owner
M Ltd
OOO N-TTM

OOO PKOOO Pro LLP

Owner

Facilitator

Director

Source: https://home.treasury.gov/news/pressreleases/jy0692
5

Source: https://www.consilium.europa.eu/en/
meetings/european-council/2014/03/20-21/
6

Source: https://www.justice.gov/usao-edny/pr/
five-russian-nationals-including-suspected-fsbofficer-and-two-us-nationals-charged

DG H LtdS-F-C, Ltd

7

Source: This graphic was recreated from https://home.treasury.gov/news/press-releases/jy0692.
This is a real use case.

Mr F

Owner

8

A new frontier in sanctions awareness and compliance | moodys.com/kyc

MAL Ltd4

Evolving methods to capture
the dynamic nature of sanctions
CASE STUDY 2: 
IDENTIFYING SHELL COMPANY OPERATIONS THROUGH A SANCTIONED BY
EXTENSION ENTITY
With the increasing complexity and sophisticationof sanctions evasion techniques, direct screeningof entities against OFAC’s Specially DesignatedNationals and Blocked Persons list (SDN list) is nolonger adequate. There are instances where sanctioned
entities take advantage of loopholes to use legal
persons as a vehicle to evade detection.

For financial institutions to mitigate the potential
risks posed by the abuse of using legal persons, it isvital that their compliance teams discover potential
shell companies within their client portfolio, as wellas conduct due diligence on all counterparties intransactions.

X3X SINGAPORE PTE. LTD.
Bukit House, Singapore, Singapore
X3X12345

SANCTION RISK SUMMARY→ X3X Singapore Pte. Ltd. does not appear to be directly
sanctioned.
→ X3X Singapore Pte. Ltd. is not directly sanctioned but appears
to have sanctions risk exposure due to ownership and should be
reviewed.
→ X3X Singapore Pte. Ltd. has sanction risk exposure due to theentity’s leadership and should be reviewed.
→ X3X Singapore Pte. Ltd. has 1 sanctioned shareholders of 12
shareholders and should be reviewed.

DIRECT SANCTIONS

NF
Not found

Direct sanctions were notfound for this entity.

SANCTION BY EXTENTION

S%100.00

OFAC SSI

Sanctioned%100.00

UK

FIGURE 3: Sanction risk summary of the spa
and wellness company 99Data is derived from Moody’s Analytics Sanctions360 solution.

A new frontier in sanctions awareness and compliance | moodys.com/kyc

5

Moody’s Analytics used its database to unravel entityand ownership information for this Singapore-based
company, and identified a possible shell company
operation based on these common indicators:→ Questionable shareholder voting power: The
company operates a spa and wellness businessregistered in Singapore, but a look at theshareholders in Figure 4 shows there are multiple
overseas owners with significant voting power,
including two government agencies. This is acommon red flag for a financial institution to further
investigate the company’s operations.
→ Entity ownership: Using data to unwrap thelevels of ownership (Figure 5), we see the entity is
ultimately owned by sanctioned parties in Russia,
which may indicate they are concealing ownershipto circumvent sanctions. → Address of incorporation: A further perusalof this company’s information reveals the same
address of incorporation is used by more than 100
other entities, all rolling up to the same ultimate
beneficial owner, which is indicative of shellcompany risk.
 n entity with a similar ownership structure, company
A
information, and other shell company risk indicators
could easily bypass a financial institution’s risk alerts
if the institution does not have in-depth knowledge ofits client profiles. Besides opening financial institutions
to greater regulatory scrutiny, these banks may also
be fined for inadequate risk and detection controls
in the event of success sanctions evasion or money
laundering.

For compliance teams to understand the larger
interconnected network in which these sanctioned
entities operate, they need to synthesize global
datapoints that reflect the dynamic, real-timedevelopments in t hese networks.
Over the course of the Russia/Ukraine conflict,sanctions evolved from an initial emphasis on Russianand Belarusian entities to entities in other jurisdictions
that have current or previous trade and economic
activity with Russia, such as Switzerland, Cyprus,
United Arab Emirates, Singapore, Hong Kong, theCayman Islands, and Italy. Financial institutions cancalibrate their risk-based approaches on sanctions
compliance based on the location of these entities.

Drawing upon our decadesof experience operatinginternationally and our deep
commitment to mitigating
sanctions evasion, thisprogramming provides
tailored and effective
compliance training solutions
all over the world. As part ofour broader vision for a moresecure world, we take pridein strengthening institutions
by connecting individuals,
and empowering them withknowledge and due diligence
resources to use in theirprofessional capacity.
Tina Dolph
CRDF Global President and 
Chief Operating Officer

A new frontier in sanctions awareness and compliance | moodys.com/kyc

6

Entity name

Voting power

X3X SINGAPORE PTE. LTD.

Country

Direct sanctions

SingaporeAPAC

S Oil Company

100.00%Russian Federation

OFAC SSIR Invest

20.28%

Russian Federation

NONE FOUND

T Oil Invest

23.38%

Qatar

NONE FOUND

Q Investment Authority

23.38%

Qatar

NONE FOUND

Z Limited Liability Company

100.00%Russian Federation

NONE FOUND

Government of R

76.51%

Russian Federation

NONE FOUND

Government of Q

23.38%

Qatar

NONE FOUND

Federal Agency of R

66.45%

Russian Federation

NONE FOUND

R Investment authority

23.47%

United Kingdom

NONE FOUNDUK

FIGURE 4: Government of R has a 76.51% voting power in the spa and wellness company 10

MR X

MRS YM

RZ

RU

MR A

MR B

MR C

RU

0.01%

0.01%

0.13%

0.01%

0.01%

0.01%

Sanctioned
Sanctioned by extension
No sanctions found

RU

Global ultimate owner
S OIL COMPANY
9.6%

100%
100%

RU

RU

Z Limited Liability Company

R INVEST

9.6%

FIGURE 5: Ownership structure: 6 sanctioned
individuals and 1 sanctioned company
connected to the spa a
 nd wellness company 11
10Data is derived from Moody’s Analytics Sanctions360 solution.

11

Data is derived from Moody’s Analytics Sanctions360 solution.

SG.
X3X SINGAPORE PTE. LTD.

A new frontier in sanctions awareness and compliance | moodys.com/kyc

7

Continuous tracking of
sanctions risk exposure throughrobust due diligence
CASE STUDY 3:
UNCOVERING CONTROL AND HIDDEN INFLUENCEEXTENSION ENTITY
There are three questions when it comes t o ownership:
1 Who controls the entity
2 How they control the entity
3 Where their customers are located
The case study highlighted in this section focuses on
economic sanctions intended to freeze the assets ofindividuals associated with the Russian regime.

Figure 6 reflects the sanction risk summary of aEuropean company in the manufacturing and logistics
industry. There are no sanctions exposures flagged forthe entity and its shareholders.
Figure 7 shows the ownership structure taken right after
the invasion of Ukraine. The ownership tree reflects fourfamily members at the top, with a combined ownershipof 49.2% – just under the threshold set by OFAC’s 50
Percent Rule12.

LIA STEEL INDUSTRIAL
R. KALANTOS. 100 KAUNO M., Lithuania
X3X123456

SANCTION RISK SUMMARY→ LIA Steel Industrial does not appear to be directly sanctioned.
→ LIA Steel Industrial is not directly sanctioned and no othersanctions exposure was currently detected.
→ LIA Steel Industrial does not have any sanctioned entities in its
leadership.
→ LIA Steel Industrial does not have any sanctioned shareholders
found among 12 shareholders.

DIRECT SANCTIONS

NF
Not found

Direct sanctions were notfound for this entity.

SANCTION BY EXTENTION

NF
Not found

Sanction by extension were
not found for this entity.

FIGURE 6: Sanction risk summary of the engineering company 13
12

Source: https://ofac.treasury.gov/faqs/401

13

Data is derived from Moody’s Analytics Sanctions360 solution.

A new frontier in sanctions awareness and compliance | moodys.com/kyc

8

FIGURE 7: 
Pre-invasion ownership tree reflecting asanctioned individual, Mr H Zycux, having
29.77% shares a
 t the engineering company 14

14

Data is derived from Moody’s Analytics.

A new frontier in sanctions awareness and compliance | moodys.com/kyc

9

One might conclude that the largest shareholder inthe family, Mr H Zycux, who owns 29.77%, has nocontrol over the company. However, Figure 8 shows
Mr H Zycux is associated with an OFAC designatedentity, and the power score calculated measures his
influence at 98.60%.
The risks associated with this company are also
highlighted by the following indicators:
→ Mr H Zycux is the board chairman of the
sanctioned company in question ( Figure 9).
→ There is circular ownership with anothercompany doing business in the embargoedoblasts of Donetsk and Luhansk.

For compliance teams
to understand the larger
interconnected networkin which these sanctioned
entities operate, they need tosynthesize global datapoints
that reflect the dynamic, realtime developments i n these
networks.

→ The company was also connected to a
sanctioned joint-stock company connected to
the Russian government. After the invasion,
there was a reshuffle, and ties with theRussian government were severed due to theappearance of a new Russian shareholder, Ms
VG ( Figure 10). However, red flags still warrant
careful due diligence.

Entity name

Voting power

LIA STEEL INDUSTRIALCountry

Direct sanctions

Lithuania

JCO CH Yutuku

1.26%

Russian Federation

NONE FOUND

Mrs I Zycux

1.33%

Mr H Zycux

98.60%

Russian Federation

NONE FOUND

LIA International

100.00%

Switzerland

NONE FOUND

ABC Company

1.47%

CyprusNONE FOUND

V holdings

1.30%

CyprusNONE FOUND

MECHEL MINING AO

1.26%

Russian Federation

NONE FOUND

LIA Mining

100.00%Russian Federation

NONE FOUND

S1234567

1.47%

NONE FOUNDNONE FOUND

FIGURE 8: 
Mr H Zycux has a voting power of 98.6% at theengineering company 15

15Data is derived from Moody’s Analytics Sanctions360 solution.

A new frontier in sanctions awareness and compliance | moodys.com/kyc

10

PERPETUAL KNOW YOUR CUSTOMER (PKYC) CHECKS TRIGGEREDBY REAL-TIME RISK EVENTSIn a more recent snapshot of the same company, shown
below in Figure 10, we see Mr H Zycux now has a larger
ownership stake of 36.15%. The ownership structureis also more simplified, as one family member (Ms K
Zycux, Figure 7) has been removed as owner, removing
the apparent connection to the Russian government –this could potentially have been done to avoid sanctions
detection.

However, one of the new beneficial owners in the thirdlayer is a Russian national. Given this constitutes amaterial change in the risk profile of the business
relationship, it would be prudent for a financial
institution to conduct event-triggered screening as partof perpetual KYC efforts.

Mr H Zycux
Chairman of the Board of Direcrors (since 27/2009)

H ZYCUX

Chairman of the Board of Direcrors

WLT_Watch List / SAN Sanction, Date: 26/03/2022
This entity appears on the United States Treasury Department’s Office of Foreign Assets Control(OFAC) Non-SDN List. Appears on the Sectoral Sanctions Identifications, RUSSIA-E014024 Lists,
Approval Date: 04/07/2022
US Treasury Dept. OFAC Consolidated Non-SDN Sanctions List

FIGURE 9: 
Mr H Zycux is on the sectoral sanctioned list from theUnited States Treasury Department’s Office (OFAC)
Non-SDN list16

Source: This graphic was recreated from US Treasury Department’s Office of Foreign
Assets Control Non-SDN list. This is a real use case.
16

A new frontier in sanctions awareness and compliance | moodys.com/kyc

11

MR H ZYCUX | 36.15%

MRS I ZYCUX | 6.41%

MS J ZYCUX | 6.61%

RU

RU

RU

33.00%/n.a..

33.00%/n.a. .

34.00%/n.a. .

MO/n.a.

26.45%/n.a..
CYRU

S LIMITED | 5.07%

V HOLDINGS | 19.44%

18.90%/n.a.

4.93%/n.a. .

CY

RU
MS VG

18.90%/n.a..

-/n.a.
.

4.93%/n.a. .

RU
LIA MINING | 100.00%
n.a./100.00%

100.00%/100.00%

FIGURE 10: A material change in the risk profile of thiscompany’s business relationship, where theownership is now controlled by the siblings Mr H
Zycux, Mrs I Zycux, Ms J Zycux17

100.00%/100.00%
CH

LT

LIA INTERNATIONAL | 100.00%

LIA STEEL INDUSTRIAL

Data is derived from Moody’s
Analytics.
17

A new frontier in sanctions awareness and compliance | moodys.com/kyc

12

Compliance course of action
GOING BEYOND THE LISTThe linear screening method of matching names
against the official sanctions lists is insufficient. It
exposes organizations to significant risks as it does
not take into account entities owned and/or controlled
by sanctioned persons.
Today’s sanctions climate has engendered creative
sanctions evasion techniques that leverage shellcompanies, use of opaque jurisdictions, and false
divestment to family members and close associates toobfuscate ownership and control.
In order to identify entities that are consideredsanctioned by extension, extensive due diligence isrequired to protect organizations from sanctions risks.
Providing your organization access to comprehensive
data and intuitive investigative tools are crucial toensuring that sanctions risks are effectively andefficiently identified.

ESTABLISHING ROBUST INTERNALCONTROLS
To mitigate the risks posed by growing sanctions
evasion techniques, it is important to ensure staff
are adequately trained and have access to the rightdata and tools. Guidance should be provided aroundsanctions evasion trends and challenges, such as, but
not limited to, the following:→ Establishment of complex networks oforganizations to obfuscate ownership by adesignated entity.
→ Usage of shell companies – risk indicators
include unusual financial statements, registeredaddress and/or directors utilized by an unusuallyhigh number of companies, location in opaquejurisdictions, conflicting corporate purpose, lackof web presence.
→ De facto control by a designated individual
despite limited ownership. This may be done
through false divestment of ownership shares tofamily members and close associates, holding
directorship or other leadership positions, or
having significant voting power through theestablishment of voting coalitions.

A new frontier in sanctions awareness and compliance | moodys.com/kyc

Continuous monitoring of an organization’s
customers, suppliers, and other relevant
counterparties such as owners, directors, andshareholders are imperative. However, due to thevolume and breadth of due diligence that must be
conducted, more sophisticated organizations have
utilized curated datasets, intuitive investigation tools,
and artificial intelligence to help them effectively
detect sanctions e
 vasion risks.

FOSTERING A GLOBAL APPROACH TO
SANCTIONS COMPLIANCE
The collaboration among Moody’s Analytics, the U.S.
State Department’s Office of Cooperative Threat
Reduction (CTR), and CRDF Global exemplifies
a successful public-private collaboration aimed
at increasing awareness and enhancing theeffectiveness of economic sanctions.
These workshops aim to enhance the understandingof the legal and regulatory framework governing theapplication of economic sanctions, including relevant
US and international laws, local regulations, andguidelines. Secondly, we aim to provide practicalguidance on the implementation of sanctions,
including best practices for compliance and risk
management, as well as strategies for identifying andaddressing potential sanctions evasion.
The program acknowledges that access to the rightdatasets and understanding exposure to complex
corporate structures can be challenging. By combining
risk-relevant sanctions data with ownership andcontrol information, financial institutions can ensurecompliance with applicable regulations.
Finally, the program aims to facilitate the exchange
of information and experiences between government
officials, financial institutions, and other stakeholders
involved in the design, implementation, andenforcement of sanctions.
The workshops took place in 2022 and 2023 in AsiaPacific, Britain, Europe, and the British Virgin Islands.

13

ABOUT CRDF GLOBALCRDF Global is an independent nonprofit organization that provides international training
and capacity building programming to advance safety, security, and sustainability. With
offices around the world, the company promotes international research integrity andknowledge security, data and IP protection, and cyber and information security globally.
CRDF Global collaborates with government agencies, academia, and the private sector
to strengthen connectivity among experts and tailor the application of international bestpractices that allow for transparent scientific discovery and applications of research andtechnology.
https://www.crdfglobal.org/

ABOUT U.S. DEPARTMENT OF STATE, OFFICE OF
COOPERATIVE THREAT REDUCTION
The Office of Cooperative Threat Reduction (CTR) is funded by the nonproliferation, antiterrorism, demining and related programs (NADR) account, and manages the Global Threat
Reduction program. CTR efforts include disrupting the funding, transport, and acquisition of
WMD material, technology, and expertise by proliferator states such as China, DPRK, Iran,
Russia, and Syria, as well as preventing WMD attacks by ISIS and other t errorist actors.
https://www.state.gov/bureaus-offices/under-secretary-for-arms-control-and-international-security-affairs/
bureau-of-international-security-and-nonproliferation/office-of-cooperative-threat-reduction/

ABOUT MOODY’S ANALYTICS
Moody’s Analytics Compliance & Third-Party Risk Management enables sanctions
screening and perpetual monitoring of all relevant ultimate beneficial ownership andstakeholder information in near-real time. By integrating sanctions data, watchlists, andadverse media news in automated workflows to assess risk and calculating ownership froman entity to its ultimate beneficial owner, Moody’s solutions help organizations understandrisk in their business network and make decisions about the mitigating action needed.
We continue our support throughout the relationship lifecycle by enabling the perpetualmonitoring of counterparty risk across global business networks in near real-time. Moody’s
Analytics is helping customers automate onboarding journeys in 197 countries, across 211
jurisdictions: completing +800 million new customer and third-party checks each day on
average in 2022, including screening against our database of +19 million risk profiles, +462
million entities, and +34,000 sanctioned entities.https://moodys.com/kyc

A new frontier in sanctions awareness and compliance | moodys.com/kyc

14

Contact information
DISCOVER MORE
MOODYS.COM/KYC

AMERICAS+1.212.553.1653
clientservices@moodys.com
EMEA+44.20.7772.5454
clientservices.emea@moodys.com
ASIA (Excluding Japan)+852.3551.3077
clientservices.asia@moodys.com
JAPAN+81.3.5408.4100
clientservices.japan@moodys.com

BX_139