Sanctions, kleptocracy, and the malign influence of hostile states

In today’s geopolitically fragmented world, recent seismic events have led to shifts in the ways nations exert their influence.  

Military aggression by hostile regimes, such as the invasion of Ukraine by Russia, remains an enduring challenge to collective national security. For the aggressor this requires sustained funding and access to supply chains for resources such as weapons, technologies, and expertise. This presents an opportunity to respond, by targeting their access to financial and economic systems, trade, technology, and services. 

Below the threshold of armed conflict such hostile states also employ espionage, information operations, offensive cyber and malign economic activities, to influence democracies. Meanwhile oligarchs seek to safeguard their wealth and assets within the economies of those very same democratic nations.   

To combat these threats, traditional military, law enforcement and diplomatic capabilities are crucial. But equally important is disrupting the flow of funds, trade, and transport that enable hostile states to operate on the global stage with impunity.  

Therefore, in the past 18 months sanctions have increased in prominence, in recognition of their potential to achieve disruptive impacts against hostile actors. However, as these enforcement measures have evolved, so too have the strategies used to evade and circumvent them. 

Sanctions in recent context

After its departure from the EU, the UK had the imperative task of establishing a sovereign sanctions regime – a requirement that became especially urgent in the wake of Russia’s aggression.   

Consequently, the UK Government introduced the Economic Deterrence Initiative, aimed at strengthening the country’s economic capabilities to respond to hostile actions by both present and potential aggressors.  

The initiative focuses on improving implementation and enforcement of trade, transport, and financial sanctions, including by cracking down on evasion and, increasingly, circumvention.  

Financial sanctions include restrictions on designated persons, such as freezing their financial assets, and wider restrictions on investment or financial services.   

Transport sanctions impose restrictions on the ownership, registration, movement and use of ships and aircraft in certain countries.   

Trade sanctions include controls on the import, export, transfer, movement, making available and acquisition of goods, technology, and services.  

Earlier in my law enforcement tenure, we typically assessed hostile state threats through the lens of specific incidents like the Litvinenko and Skripal poisonings, or the activities of elite cyber-crime groups. However, the full-scale Russian invasion of Ukraine in 2022 prompted the expansion of law enforcement capabilities in this realm, to complement the efforts of intelligence agencies and the sanctions enforcement community. 

One exemplar is the creation of the National Crime Agency’s Countering Kleptocracy Cell, but it’s also worth noting recent discussions around strengthening the response to hostile state activities within UK policing as well. 

Beyond the paradigm of sanctions being used as a tool to counter hostile state activities and aggression, I have also been privileged during my career to observe firsthand the innovative use of sanctions in combating transnational serious organised crime. This included collaborative efforts with the US, resulting in the imposition of sanctions on fraudsters and global organised crime groups. 

The sanctions evasion and circumvention challenge

Driven by the motive to ensure their illicit operations remain concealed and unhindered, hostile state actors may choose to collaborate with intermediaries, including enablers such as corrupt professionals and other gatekeepers. Together, they employ a diverse range of tactics to evade or circumvent the sanctions imposed upon them.  

The challenge of proxies when investigating evasion and circumvention presents another complex and evolving problem for authorities. In recent years, it has become increasingly apparent that targeting individuals closely associated with sanctioned entities, such as family members or nominee holders of assets, is a contentious and intricate task. This challenge is highlighted by cases like Yevgeny Progozhin’s mother, whose sanctions imposed by the EU were successfully challenged on the grounds of her alleged lack of connection to her son’s activities.  

Proving such connections can be a formidable hurdle, as legal and evidential standards may differ. This underscores the need for more effective intelligence and investigative strategies, and cooperation at the international level, to combat proxies being used to evade sanctions and to ensure they achieve their intended impact. 

Meanwhile, the globalised nature of trade and finance further complicates matters for both legitimate businesses, including regulated sectors such as financial services, as well the enforcement agencies. And the utilisation of complex corporate structures, as well as multiple jurisdictional company registrations, creates additional layers of obfuscation. 

But it’s not only proxies or complex webs of ‘front’ companies that exacerbate the challenge. In early November, the National Crime Agency (NCA) issued an alert regarding the risk of the use of gold by Russia in undermining the impact of sanctions. Its source is easily disguised, and worth more than £20 billion to Russia’s economy, gold represents a significant source of funding for their war against Ukraine.  

In response to these continually evolving and complex challenges, across the UK’s sanctions framework, the different components are at varying stages of development. For instance, in my assessment financial sanctions implementation and enforcement is more advanced compared to trade or transport counterparts. However, I am aware that concerted efforts are underway to close this gap in capability. 

Meanwhile the repercussions of malicious actors evading and circumventing sanctions are profound and include a diminished diplomatic impact, erosion of trust in international financial and trading systems, and a waning confidence in the ability of democracies to effectively counter hostile activities. 

And whilst industry grapples with understanding sanctions and complying with them, their effects on adversaries may only be apparent to the agencies involved, through intelligence, which, by its very nature, cannot be publicly disclosed. Consequently, the policy objectives of a particular sanctions regime may be achieved, but conveying this to industries struggling under compliance burdens or to the broader public can be a challenge. 

The role of intelligence and investigations

Sanctions regimes impose substantial reporting requirements on affected sectors, particularly financial institutions. The frontline defences within these businesses play a critical role in early identification and reporting of sanctioned activity.   

In my experience, upon receiving these reports, the priority for regulators and enforcement agencies is ‘deconfliction’, to avoid the risk of ‘blue on blue’ with operational partners, or the compromise of more sensitive operations.  

Thorough triage and assessment of reports is also essential to ensure that intelligence is developed and moved to the investigations phase by the appropriate organisations, including law enforcement where criminal breaches are suspected.  

Therefore, organisations are fast developing their operational capabilities in this complex domain. And where kleptocracy and oligarchy are concerned, it is paramount to get ahead of targets who enjoy substantial security, public relations, professional and legal expertise, to guard their reputation and assets aggressively, including through the courts. 

Compliance-based reporting is of course not the only source of detection; second line of defence functions within organisations in regulated sectors provide an intelligence-led approach. In my experience they are well placed to take a view across the risk profile of the organisation, at enterprise level, to identify and mitigate threats including sanctions breaches.  

And of course, the sanctions regulatory and enforcement functions in government and law enforcement organisations also employ an intelligence-led strategy. That includes working with international partners and close collaboration within the national security ecosystem.  

In my assessment such an intelligence-led approach by industry, government and law enforcement can increase the likelihood of surfacing opportunities for more impactful disruption, including by targeting higher value breaches and, importantly, leading to the potential identification of enablers.  

Targeting and disrupting enablers of sanction evasion or circumvention, such as professionals including lawyers and accountants, is of course a vital task, both for the deterrent effect and because every enabler has the potential to facilitate multiple breaches for multiple clients.  

Across law enforcement, regulation, and the private sector, sanctions implementation and enforcement is a complex environment. Information leads and referrals from multiple sources must be registered, structured, linked and exploited for maximum operational impact. This can support effective intelligence-led strategies, which are crucial in identifying, disrupting, and prosecuting enablers, and thereby achieving a large-scale, ‘force multiplier’ effect on wider sanctions evasion operations.  

Countering sanctions evasion and circumvention also requires sustained collaboration across the public and private sectors, underpinned by robust intelligence and investigative tooling. Whilst best in class technologies and modern operational methods in the field of financial intelligence and complex investigations are also pivotal to future success.  

Finally, as my experience investigating global criminal networks has taught me, the importance of effective international coordination and intelligence sharing cannot be overestimated. 

The way forward

As the scale and complexity of the sanctions enforcement challenge increases, investment in intelligence and investigation capabilities across the public and private sector sanctions landscape will be vital for success. Technology is of course a crucial component of the operational toolset to address these challenges. 

And because of the global reach of the networks involved, we must do all we can to encourage and enable international cooperation, through intelligence, and information sharing, to combat evasion and circumvention effectively.  

From our experience working with clients operating at the heart of the sanctions and economic crime landscape, we are uniquely well positioned to support, advise and provide mission critical capability.   

If you would value a conversation on this subject, on wider economic crime, or intelligence and investigations capabilities, please book a call with me.