FinCEN identified China and Hong Kong as the highest risk countries. Other countries in the top ten were Turkey, the United Arab Emirates (UAE), the United Kingdom, Canada, Singapore, and Cyprus. Many of the examples of suspicious transactions involved entities, often intermediaries or subsidiaries, based in these countries and using complex corporate structures to hide the Russia nexus. In one example, a UAE company purchased goods for entities involved in disparate lines of business and located across at least six countries mostly near Russia. U.S. companies should look for warning signs that indicate potential circumvention, including complex corporate structures, entities in multiple different countries, and entities increasing orders for the high-risk countries.

FinCEN flagged the electronics industry as appearing frequently in the BSA reports. For example, microelectronic components, imaging technology, electronic filters, electromechanical instrumentation, and wireless radio products all appeared in the BSA reports. In addition, certain industrial machinery, including fluid transfer systems components, gas compressors, and tungsten rods were identified as potentially being diverted to Russia. U.S. companies selling these products should conduct additional diligence for circumvention risks.

The U.S. is not the only country urging vigilance against efforts to circumvent of sanctions against Russian aggression. On September 7, 2023, the EU published guidance for industry on how to enhance due diligence against the risk of Russia sanctions circumvention. The guidance lays out core steps for diligence, including a risk assessment, designing and implementing mitigation measures, and regularly updating procedures. Like FinCEN, the EU guidance identifies complex corporate structures and transit through countries that are “circumvention hubs” as red flags. The guidance also identifies high-risk products that are similar to those mentioned by FinCEN, namely microelectronics, wireless communications products, and electronic components. According to the guidance, the illegal re-export of a sanctioned item to Russia resulting from inadequate due diligence that, for example, fails to appropriately account for risk of diversion, may be regarded by Member States as a violation of EU sanctions law.

U.S. and EU companies who are transacting with high-risk countries or in high-risk sectors should ensure their compliance program is designed to identify and prevent circumvention of export controls and sanctions. Please contact our sanctions and export team for assistance in addressing these risks.

Sanctioned actors may try evade the reach of U.S. and allied sanctions measures by hiding behind non-sanctioned and third-country entities, FinCEN warns. They may obscure their identity by, for example, using shell companies to conduct wire transfers or transact with accounts to send or receive funds from a sanctioned institution, among other listed red flags. Further, with the proliferation of cryptocurrency, sanctioned actors may attempt to use convertible virtual currency (CVC) and anonymizing tools to protect their assets. By their very nature, virtual currencies may exist separate from any regulated financial system and the use of privacy coins and other measures can anonymize transaction participants in some cases. The FinCEN alert is the latest reminder that anti-money laundering, countering the financing of terrorism, counter proliferation (AML/CFT/CP), and sanctions compliance obligations apply equally to cryptocurrency as they do to fiat currency.

In addition to more traditional red flags of potential sanctions evasion, FinCEN highlighted the following red flags of identify suspicious cryptocurrency activities:

• Transactions initiated with IP addresses from non-trusted sources (i.e. VPNs), locations in Russia, Belarus, embargoed regions, or other FATF-identified jurisdictions with known AML/CFT/CP deficiencies.
• Transactions connected with crypto wallets listed on OFAC’s Specially Designated Nationals List (SDN List).
• Transactions with crypto exchangers or foreign-located money services business in high-risk jurisdictions with AML/CFT/CP deficiencies.

Should a transaction raise red flags of potential sanctions evasion, financial institutions are required to report the associated activity and should conduct appropriate due diligence in accordance with the Bank Secrecy Act, USA PATRIOT Act, and other authorities. FinCEN also encourages financial institutions to use the information sharing authorities under Section 314(b) of the USA PATRIOT Act.

Financial institutions should carefully review FinCEN’s alert and ensure that appropriate compliance controls are in place to detect, remediate, and report potential sanctions evasion.