11 December 2023

The National Crime Agency (NCA) has issued a warning that Russia is attempting to circumvent sanctions by purchasing UK good and services through intermediary countries.

Payroll services can be a key financial service that could be targeted by such activity. In the warning document, issued jointly with other agencies, 14 red flags are identified. Note that activity showing a red flag does not necessarily indicate illegal activity is taking place but can raise suspicions and prompt to investigate further.

The 14 flags identified are:

  1. Transactions related to payments for goods on the Common High Priority list, from a company incorporated after 24 February 2022 and based in known diversionary destinations.
  2. A customer who lacks or refuses to provide details on banks, shippers, or third parties, including about end users, intended end-use, or company ownership.
  3. Transactions involving smaller value payments, all from the same end user’s foreign bank account, to multiple, similar suppliers of Common High Priority list items.
  4. A customer that significantly overpays for a Common High Priority list item, compared to known market prices.
  5. Purchases under a letter of credit that are consigned to the issuing bank, not to the actual end user. In addition, supporting documents, such as a commercial invoice, do not list the actual end-user.
  6. Transactions involving entities with little to no web presence, such as a website or a domain[1]based email account.
  7. Transactions involving customers with phone numbers with country codes that do not match the destination country.
  8. The item or service (commodity, software, service or technology) does not fit the purchaser’s line of business.
  9. The customer’s name or its address is similar to one of the parties on the OFSI consolidated list.
  10. Transactions involve a purported civil end-user, but research indicates customers with counterparties with connections with the military, such as an address that is a military facility or is co-located with military facilities in a country of concern.
  11. Transactions involving companies that are physically co-located, or have shared ownership, with an entity on the OFSI consolidated list.
  12. Transactions that use open accounts/open lines of credit when the payment services are conducted in conjunction with known diversionary destinations.
  13. Transactions involving a last-minute change in payment routing that was previously scheduled from a country of concern, but now routed through a different country or company.
  14. Transactions involving payments being made from entities located at known transhipment points or involve atypical shipping routes to reach a destination.

The NCA are on hand to assist if you have any specific queries about a situation.


Information provided in this news article may be subject to change. Please make note of the date of publication to ensure that you are viewing up to date information.