Convenient divestments
Stakes passed to relatives, managers or new holding companies around a designation, while the former owner stays visible.
Sanctions Exposure and Evasion Investigations with OSINT
A sanctions evasion investigation starts when a counterparty passes list screening but something still does not add up: an owner who sold out a week before a designation, a distributor in a third country with no visible customers, a vessel that goes dark mid-voyage. We research the open record behind the names and show whether a designated person still sits behind the deal.
- Aggregate ownership tested
- Control without ownership flagged
- Intermediaries and transshipment
- Vessel and cargo red flags
Short answer
A sanctions evasion investigation uses public and licensed sources to find designated persons who own, control or benefit from a counterparty without appearing on its documents. Analysts rebuild ownership chains, apply the OFAC 50 Percent Rule in the aggregate, test intermediaries, trade routes and vessels against known evasion patterns, and grade each finding. Your compliance and legal teams decide whether to proceed, block or report.
Sanctions Exposure vs Sanctions Evasion
Exposure is a designated person behind your counterparty, whether or not anyone hid it. Evasion is a deliberate effort to hide that link. The research overlaps, but the questions differ.
Exposure cases ask a structural question: does a blocked person own enough of this company, alone or together with others, for the company to be treated as blocked, or do they control it in other ways? They arise in onboarding, trade finance and supplier reviews, often with no wrongdoing involved.
Evasion cases ask whether someone is hiding the link: ownership moved to relatives or new shell companies, goods routed through intermediaries, documents that leave out the real end user. They often start from a red flag or a match the PEP and adverse media screening review could not clear on identity alone.
The OFAC 50 Percent Rule in OSINT Ownership Research
Under OFAC guidance, an entity owned 50 percent or more, directly or indirectly and in the aggregate, by one or more blocked persons is itself blocked, even if it is not on any list.
OFAC's guidance of 13 August 2014 treats as blocked "any entity owned in the aggregate, directly or indirectly, 50 percent or more by one or more blocked persons" (OFAC 50 Percent Rule guidance). The rule covers ownership only: OFAC says it "speaks only to ownership and not to control", and it advises caution with non-blocked entities in which blocked persons hold significant ownership or that they may control by other means (OFAC FAQ 398).
| Typical scenario | Effect under the rule | What the research has to establish |
|---|---|---|
| Two designated persons each hold 25% | Aggregate 50%: the entity is blocked | Every shareholder in each layer, and whether each is designated |
| A blocked holding owns 60% of a parent, which owns 60% of your counterparty | Indirect ownership: the counterparty is blocked | The full chain, with the percentage at each step from registers and filings |
| A designated person holds 30% and chairs the board | Not blocked by ownership, but control is a risk to weigh | Board seats, signatory powers, management roles and public statements |
| Shares moved to a relative or new company around a designation | Depends on whether the transfer was real | Dates, prices, who the new owner is and whether the old owner still acts for the company |
Where registers are thin, ownership work runs alongside our beneficial ownership investigations.
Sanctions Evasion Red Flags OSINT Can Test
Most evasion patterns leave public traces: company records, trade data, websites, vessel tracking and media. Each red flag below is a question we test, not a conclusion.
New companies in the middle
New traders with residential or shared addresses, little web presence and no history in the goods they handle.
Shell company investigations →Missing or changed parties
End users, consignees or payers that differ between documents, or a sanctioned party left out of paperwork it clearly belongs in.
Third-country routing
Goods shipped through transit hubs with no commercial logic, or payments from a country or company not named in the deal.
Deceptive shipping practices
Gaps in vessel tracking signals, ship-to-ship transfers, recent changes of flag, name or manager, and opaque ownership of the ship.
Familiar faces, new names
Directors, phones, domains or addresses shared with designated entities: often the strongest link to a new front.
What US Agencies Say About Evasion Methods
US agencies describe the same patterns repeatedly: hidden parties in documents, third-country intermediaries and deceptive shipping. Non-US companies can be liable too.
- Non-US companies are in scope. A joint Tri-Seal Compliance Note from the Department of Justice, the Department of Commerce and OFAC (March 2024) says non-US persons can violate US sanctions by causing US persons to violate them, for example when a company "routes a prohibited transaction through the United States or the U.S. financial system" or "obscures or omits reference to the involvement of a sanctioned party or jurisdiction" (Tri-Seal Compliance Note, 2024).
- Shipping has its own list. The May 2020 maritime advisory from Treasury, the State Department and the US Coast Guard names seven deceptive shipping practices, including disabling or manipulating AIS, falsifying cargo and vessel documents, ship-to-ship transfers, false flags and flag hopping, and complex ownership or management (OFAC maritime advisory).
How an OSINT Sanctions Evasion Investigation Runs
Five steps, from the red flag your team raised to a graded memo your sanctions officer and counsel can rely on.
- Share the triggerThe counterparty, the transaction or shipment, the red flag and the decision that depends on the answer.
- Agree scope and dateCountries, ownership depth, vessels or routes in scope, a delivery date and a fixed quote, confirmed in writing.
- Rebuild ownership and controlEach layer traced in its home register, percentages aggregated, and officers, signatories and managers checked against the lists.
- Test the evasion patternsIntermediaries, trade and payment routes, vessel history and shared identifiers compared with the red flags agencies publish.
- Grade and reviewEach finding is marked confirmed, likely or possible with its source, and a senior analyst reviews the memo before delivery.
Deliverables, Timelines and Legal Limits
You receive a sourced memo with an ownership chart and a red-flag table. Focused cases take from 10 business days; the legal call stays with your counsel.
The memo gives the answer, an ownership chart with sources, a table of red flags tested and open questions for the counterparty. A single ownership question can sometimes be closed in a business day; a focused case takes from 10 business days, and a multi-country network up to about a month. Urgent work costs 50% more, and if we miss the agreed date the fee goes down.
- Not legal advice. Whether a transaction is prohibited, needs a license or must be blocked and reported is a decision for your sanctions officer and counsel.
- No contact. We never approach the counterparty, its staff or the vessel's operators.
- Lawful sources only. No hacking, no fake profiles, no purchased leaked data, and personal data kept proportionate under the GDPR and UK GDPR.
Counterparties that stay high risk can be watched for new designations and ownership changes through counterparty monitoring. Sanctions work is one of the OSINT services for compliance and trade teams that also cover third-party due diligence.
Send Us the Counterparty Your Screening Cleared but You Still Doubt
Share the names, the deal or shipment, the red flag and your deadline. We reply with a scope, a delivery date and a fixed quote.
Sanctions Evasion Investigation FAQ
Our new distributor passed sanctions screening, but its main shareholder sold his stake to his son a week before he was designated — can a sanctions evasion investigation tell us whether the sale was real?
We can test it against the record: transfer dates and any price in registers and filings, the son's age, career and means, and whether the father still acts as director, signatory or spokesman. The memo grades the evidence that control really changed. Whether to proceed is your counsel's call.
I'm a compliance officer at a bank and two different sanctioned people each own 25% of a corporate customer through separate holding companies — does the OFAC 50 Percent Rule apply, and how do you prove the percentages?
Under OFAC guidance ownership is aggregated, so two blocked persons holding 25% each reach 50% and the entity is treated as blocked. Our part is the evidence: each layer traced in its home register or filings, the percentage at every step, the date of each record and any gaps where a register is closed. Your legal team applies the rule to that chart.
We export industrial equipment and a new buyer in a transit hub wants to pay from a company in another country — what open-source checks would show whether the goods are heading somewhere they should not?
We check the buyer's age, address, website and trading history, who owns and runs it, and who the paying company is. We also look for directors, addresses or phone numbers shared with designated entities. The result shows which recognized red flags are present and how strong each one is.
We're a non-US company with no US offices — why would our lawyers ask us to investigate sanctions exposure in a deal that does not involve any US person?
Because US agencies say non-US companies can be liable for causing US persons to violate sanctions, for example by routing payments through the US financial system or leaving a sanctioned party out of documents. A dollar payment or a US-origin component can bring a deal into scope. Your lawyers decide what applies; we show who really stands behind the counterparty.
If your investigation finds that our customer is probably a front for a sanctioned group, will you report it to OFAC or tell the customer?
No. We report findings only to you. Blocking, rejecting and reporting decisions belong to your compliance team and counsel under your own obligations. We never contact the customer or anyone connected to it, so your options stay open.
Sources and Notes
- OFAC: Revised guidance on entities owned by persons whose property and interests in property are blocked (13 August 2014)
- OFAC FAQ 398: Entities controlled but not owned 50 percent or more by blocked persons
- DOJ, Commerce and Treasury: Tri-Seal Compliance Note on obligations of foreign-based persons (March 2024)
- Treasury, State and US Coast Guard: Sanctions advisory for the maritime industry (14 May 2020)
- Regulation (EU) 2016/679 (GDPR)
Sources checked 10 October 2026. Figures about third-party firms and tools are as published by them or by the cited source on that date.