11.2 Payment & Financial Channel Evasion
Key Takeaways
- Wire stripping is the deliberate removal, truncation, or alteration of sanctioned identifying data (names, addresses, vessel identifiers, BIC codes) from payment instructions to bypass automated filtering.
- U-turn transactions involving sanctioned jurisdictions (e.g., Iran) were historically authorized under 31 CFR 560.516 but were completely revoked by OFAC in November 2008 and are now strictly prohibited.
- Nested correspondent banking ('pass-through' accounts) enables high-risk respondent banks to conceal underlying originators and route prohibited transactions through global clearing systems without transparency.
- Informal Value Transfer Systems (IVTS) such as Hawala and Feichien bypass electronic interbank networks entirely, settling cross-border value through trust-based ledgers, trade misinvoicing, and commodity offsets.
- The global migration to ISO 20022 (e.g., pacs.008/pacs.009) introduces structured XML elements that limit field truncation but require updated filtering rules to prevent selective element omission.
11.2 Payment & Financial Channel Evasion
Core Principle: To move value across borders without triggering automated real-time payment filters, illicit actors systematically manipulate payment instructions, exploit multi-tiered correspondent banking relationships, and deploy non-bank informal transfer networks. Financial institutions must deploy robust message parsing, behavioral transaction monitoring, and nested account surveillance to detect financial channel evasion.
1. Financial Channel Evasion & Transaction Laundering Foundations
Sanctioned persons and state sponsors of proliferation cannot openly utilize the international electronic banking system. To access global currencies—particularly the US Dollar (USD) and Euro (EUR)—illicit actors exploit systemic vulnerabilities in international interbank messaging architectures, correspondent banking clearing chains, and non-bank informal transfer channels.
+--------------------------------------------------------------------------------------------------+
| FINANCIAL CHANNEL EVASION CONDUITS |
+--------------------------------------------------------------------------------------------------+
| 1. MESSAGE-LEVEL MANIPULATION (Wire Stripping & Omission) |
| • SWIFT MT103 / MT202 / ISO 20022 XML fields altered to remove sanctioned tokens. |
+--------------------------------------------------------------------------------------------------+
| 2. CORRESPONDENT CLEARING CONCEALMENT (Nested / Pass-Through Accounts) |
| • Downstream respondent banks aggregate illicit wires into opaque omnibus clearing accounts. |
+--------------------------------------------------------------------------------------------------+
| 3. NON-BANK INFORMAL CLEARING (Hawala / Feichien / IVTS) |
| • Value transferred via trust ledgers and trade-based offsets outside electronic banking rails.|
+--------------------------------------------------------------------------------------------------+
| 4. STRUCTURING & FRONT ENTITY MULTIPLEXING (Smurfing & Invoicing Networks) |
| • High-value payments split below screening thresholds and routed via third-party aggregators.|
+--------------------------------------------------------------------------------------------------+
2. Wire Stripping: Mechanics, Targeted SWIFT Fields & ISO 20022 Defenses
Wire stripping is the deliberate alteration, omission, abbreviation, or removal of identifying information regarding sanctioned individuals, entities, vessels, or embargoed jurisdictions from payment instructions before transmitting them across interbank messaging networks (e.g., SWIFT, Fedwire, CHIPS, TARGET2).
+---------------------------------------------------------------------------------------+
| WIRE STRIPPING MECHANICS |
| |
| ORIGINAL INSTRUCTION (Originating Foreign Bank): |
| Field 50K: Bank Melli Iran, Tehran, Iran |
| Field 59: Petrochemical Commercial Co, Dubai, UAE |
| Field 70: Payment for Crude Oil Cargo per MT Nirvana |
| |
| STRIPPED / ALTERED INSTRUCTION (Transmitted to US Correspondent Clearer): |
| Field 50K: BMI Ltd, P.O. Box 1122, Dubai, UAE <── (Stripped "Bank Melli" & "Iran") |
| Field 59: PCC FZE, Dubai, UAE <── (Abbreviated SDN Name) |
| Field 70: Commercial Goods Inv 8892 <── (Removed "Crude Oil" & Vessel) |
+---------------------------------------------------------------------------------------+
Targeted SWIFT MT Message Fields in Stripping Schemes
| SWIFT Field Tag | Message Component | Standard Content | Evasion / Stripping Technique Applied |
|---|---|---|---|
| Field 50K / 50F | Ordering Customer | Remitter Name, Account, Physical Address, City, Country | Stripping the remitter name; replacing with a generic intermediary bank name; omitting the sanctioned country (e.g., deleting "IRAN" or "SYRIA"). |
| Field 52A / 52D | Ordering Institution | Financial institution initiating the payment | Replacing a sanctioned state-owned bank with an offshore non-sanctioned correspondent or shell entity. |
| Field 59 / 59F | Beneficiary Customer | Ultimate recipient Name, Account, Address | Abbreviating sanctioned corporate names into obscure acronyms (e.g., "KGB", "BMI", "CVI"); omitting SDN addresses. |
| Field 70 | Remittance Information | Commercial invoice details, goods description, contract # | Deleting all references to sanctioned oil, minerals, dual-use equipment, or sanctioned vessel names and IMO numbers. |
| Field 72 | Sender to Receiver Info | Mandatory regulatory/routing instructions | Stripping special cover payment codes or compliance regulatory tags. |
| MT202 vs MT202 COV | Interbank Cover Payment | Underlying originator and beneficiary details | Deliberately utilizing legacy direct MT202 interbank messages (which omit customer details) instead of MT202 COV (which mandates Field 50/59 transparency). |
ISO 20022 XML Migration Impact: The transition from legacy SWIFT MT messages to the ISO 20022 XML standard (e.g.,
pacs.008for customer credit transfers andpacs.009for financial institution transfers) enhances sanctions transparency by replacing unstructured free-text fields with mandatory, discrete XML elements (e.g.,<Dbtr>,<Cdtr>,<UltmtDbtr>,<UltmtCdtr>). While this prevents accidental truncation, compliance systems must ensure that malicious actors do not suppress nested XML sub-tags or populate structured postal tags (<PstlAdr>) with fraudulent data.
3. The Evolution of U-Turn Transactions: Historical Authorization to Absolute Prohibition
Understanding the legal and historical evolution of U-Turn transactions is essential for mastering sanctions enforcement mechanics on the CGSS exam.
+--------------------------------------------------------------------------------------------------+
| THE HISTORICAL U-TURN TRANSACTION ARCHITECTURE |
| |
| [ Non-Sanctioned Foreign Bank A ] ──> (1. USD Payment Instruction) |
| │ |
| ▼ |
| [ US Correspondent Clearing Bank ] ──> (2. Clears USD through Fedwire/CHIPS for milliseconds) |
| │ |
| ▼ |
| [ Non-Sanctioned Foreign Bank B ] ──> (3. Disburses funds to underlying Sanctioned Party) |
+--------------------------------------------------------------------------------------------------+
Historical Context vs. Current Absolute Prohibition
- The Historical Authorization (Pre-November 2008): Under former provisions of the Iranian Transactions Regulations (31 CFR § 560.516), OFAC maintained a general license permitting "U-Turn" transactions. Non-Iranian foreign banks could initiate a USD wire transfer that passed through the US financial system (entering and exiting like a "U-turn") to clear in USD, provided that:
- The transaction originated from a non-Iranian foreign bank;
- The transaction terminated at a non-Iranian foreign bank; and
- No direct Iranian customer or bank had an account on the books of the US clearing bank.
- The Regulatory Revocation (November 10, 2008): Due to systemic abuse—where foreign banks used U-Turn authorization to clear billions of dollars for designated proliferation entities and covertly stripped wire fields—OFAC revoked the U-Turn general license in its entirety. Today, any USD transaction involving Iranian interests, Iranian financial institutions, or any SDN clearing through the US financial system is an absolute violation of US sanctions under IEEPA.
4. Nested Correspondent Banking Accounts ("Pass-Through" Risk)
Global clearing banks provide correspondent banking services to respondent banks worldwide. In a nested correspondent relationship, a foreign respondent bank allows its downstream respondent banks, money services businesses (MSBs), or corporate customers to utilize its master USD/EUR clearing account without the clearing bank's direct knowledge:
+---------------------------------------------------------------------------------------+
| NESTED CORRESPONDENT BANKING VULNERABILITY |
| |
| [ Downstream Sanctioned Bank / SDN ] |
| │ |
| ▼ (Maintains local account with Respondent Bank) |
| [ High-Risk Foreign Respondent Bank ] |
| │ |
| ▼ (Aggregates multiple wires into a single omnibus payment) |
| [ Global US/EU Correspondent Clearing Bank ] |
| • Sees ONLY "High-Risk Foreign Respondent Bank" as Ordering Customer (Field 50) |
| • Downstream Sanctioned Originator is completely invisible in clearing message! |
+---------------------------------------------------------------------------------------+
- Mechanics of Pass-Through Concealment: The high-risk foreign respondent bank acts as an opaque buffer. When initiating wire transfers, it inputs its own name in Field 50 (Ordering Customer) and lists an offshore shell entity in Field 59 (Beneficiary), settling the underlying customer funds across internal private ledgers.
- Compliance Vulnerability: The global clearing bank's real-time filters evaluate only the top-level message tokens. Because the direct respondent bank is not designated, the payment clears straight-through without generating an alert.
- Regulatory Expectation (KYCC): Regulators expect clearing banks to perform Know Your Customer's Customer (KYCC) reviews and comprehensive transaction monitoring on respondent accounts, demanding transparent sub-account structures or terminating correspondent ties with respondents that offer non-transparent downstream clearing.
5. Informal Value Transfer Systems (IVTS): Hawala & Feichien
Informal Value Transfer Systems (IVTS)—including Hawala (Middle East, South Asia), Feichien or Flying Money (China/East Asia), and Padala (Philippines)—operate outside the formal electronic banking system:
+--------------------------------------------------------------------------------------------------+
| HAWALA / IVTS VALUE TRANSFER CYCLE |
| |
| COUNTRY A (Sanctioned Origin) COUNTRY B (Destination) |
| [ Originator / Sanctioned Target ] [ Ultimate Beneficiary ] |
| │ (1. Hands cash/funds) ▲ (4. Receives local currency) |
| ▼ │ |
| [ Hawaladar A (Broker) ] ═════════════════════════════> [ Hawaladar B (Broker) ] |
| (2. Communication Token / Wire) |
| |
| ══════════════════════════════════════════════════════════════════════════════════════════════ |
| NETTING & LEDGER BALANCING (Settlement outside SWIFT): |
| • Trade-Based Offsets: Over-invoicing or under-invoicing of physical commodities (gold/textiles) |
| • Reciprocal Value Routing: Matching reverse financial flows between Country A and Country B |
+--------------------------------------------------------------------------------------------------+
Operational Hallmarks of IVTS in Sanctions Evasion
- Absence of Electronic Payment Messages: Value moves across borders without cross-border wire transfers, SWIFT messages, or physical cash transport. Real-time sanctions filters cannot intercept transactions that do not pass through electronic rails.
- Trust & Ledger Netting: Hawaladars maintain running accounting ledgers of debts and credits between one another. Balances are settled through periodic bulk netting, trade misinvoicing (e.g., shipping gold, electronics, or vehicles), or third-party business accounts in intermediary hubs (e.g., Dubai, Hong Kong, Istanbul).
- Sanctions Evasion Application: Extensively utilized by designated state actors (e.g., Iran, North Korea, Russia) and terrorist organizations to pay foreign suppliers, fund overseas procurement agents, and liquidate foreign assets.
6. Front Company Banking, Third-Party Processors & Split Structuring
To move funds through formal banking rails without triggering threshold-based investigation rules, illicit networks utilize layered structuring and commercial multiplexing:
+---------------------------------------------------------------------------------------+
| SPLIT STRUCTURING & SMURFING |
| |
| [ $5,000,000 Sanctioned Procurement Fund ] |
| │ |
| +----------------------------+----------------------------+ |
| │ │ │ |
| ▼ ▼ ▼ |
| [ Micro-Payment 1 ] [ Micro-Payment 2 ] [ Micro-Payment 3 ] |
| ($9,500 Wire) ($9,200 Wire) ($8,800 Wire) |
| Via Front Co Alpha Via Front Co Beta Via Front Co Gamma |
| (Bank in Turkey) (Bank in UAE) (Bank in Hong Kong) |
| │ │ │ |
| +────────────────────────────┼────────────────────────────+ |
| ▼ |
| [ Western Dual-Use Technology Supplier Account ] |
+---------------------------------------------------------------------------------------+
- Split Structuring / Smurfing: Breaking large transactions into smaller micro-transfers (e.g., below $10,000 in the US or €10,000 in the EU) to avoid mandatory CTR reporting and automated Large Value Payment screening rules.
- Third-Party Payment Processors (TPPPs): Routing illicit payments through commercial payment aggregators that process millions of daily e-commerce transactions, burying sanctioned wire flows within high-volume retail clearing.
- Multiple Invoicing & Trade Aggregators: Using foreign front companies in trading hubs to issue multiple commercial invoices for fractional amounts, obscuring the single high-value procurement contract.
7. Comparative Financial Evasion Matrix & Anomaly Detection Checklist
| Evasion Typology | Primary Mechanism | Targeted Financial Rail | Key Compliance Detection Control |
|---|---|---|---|
| Wire Stripping | Deleting/altering Field 50/59/70 tokens | SWIFT MT103 / MT202 / ISO 20022 | Real-time pattern validation; historical counterparty matching; mandatory address rules. |
| U-Turn Violation | Dollar-clearing via foreign intermediaries | US Correspondent Clearing (CHIPS/Fedwire) | Screening for sanctioned geographic origin/destination in underlying customer ledgers. |
| Nested Clearing Abuse | Pass-through clearing via respondent bank | Correspondent Omnibus Accounts | Downstream KYCC transaction profiling; sub-account transparency mandates. |
| Hawala / IVTS | Informal ledger netting and commodity offsets | Non-bank informal networks | Trade finance price discrepancy checks; unexplained third-party wire settlements. |
| Split Structuring | Multiplexing micro-wires across front entities | Retail & Commercial Wire Networks | Automated velocity rules; common beneficiary aggregation; behavioral clustering. |
Payment Anomaly Red Flag Checklist for Sanctions Compliance
- Systematic Field Truncation: Payment instructions originating from foreign correspondents that consistently omit originator addresses, provide only post office boxes, or abbreviate corporate names into non-standard acronyms.
- Sudden Surges in Correspondent Omnibus Velocity: Rapid, unexplained spikes in wire volume flowing through a respondent bank's clearing account without commensurate economic rationale.
- Unrelated Third-Party Settlement: Payments for commercial goods initiated by entities located in jurisdictions with no geographic or commercial connection to the underlying buyer or seller.
- Repetitive Round-Dollar Amounts: Clusters of repetitive, round-dollar transactions ($9,500, $50,000, $100,000) structured just below internal review thresholds.
- Embedded Maritime / Vessel References in Text Fields: Remittance information fields (Field 70) containing obfuscated vessel names, alphanumeric codes matching IMO numbers, or maritime coordinates.
8. Practical Compliance Case Study & Exam Warnings
Realistic Scenario: The Stripped Correspondent Payment Breach
A European correspondent bank receives a SWIFT MT103 wire transfer of $850,000 from a respondent bank in the Middle East. Field 50K (Ordering Customer) lists "AL-BURAQ COMMERCIAL ENTERPRISES, DUBAI". Field 59 (Beneficiary) lists a German industrial parts manufacturer. Field 70 (Remittance Info) reads "INVOICE 10492 - ROTATING PUMPS".
The European bank processes the payment in USD through its New York branch. Two months later, an internal audit reveals that the originating respondent bank had received the original payment instruction from a designated Iranian entity, "National Iranian Gas Company (NIGC)". The respondent bank deliberately replaced NIGC's name with its local front company "AL-BURAQ COMMERCIAL ENTERPRISES" to ensure the payment cleared the US financial system.
Regulatory Determination:
- The Originating Bank: Committed intentional wire stripping, criminal sanctions evasion, and conspiracy under US law (IEEPA).
- The US Clearing Bank: Processed a prohibited transaction involving a blocked entity, resulting in strict civil liability under OFAC regulations.
- Systemic Remediation: The clearing bank must deploy advanced counterparty anomaly filters, re-evaluate its correspondent relationship with the respondent bank, and submit a formal Voluntary Self-Disclosure (VSD) or regulatory report to OFAC.
Key Takeaways for the CGSS Exam:
- Wire stripping is an intentional compliance crime designed to bypass real-time filters.
- U-turn transactions involving Iran are completely prohibited; the historical general license under 31 CFR 560.516 was revoked in November 2008.
- Nested correspondent relationships create severe opacity; institutions must enforce KYCC and transaction profiling on respondent accounts.
A foreign respondent bank originates a SWIFT MT103 wire transfer clearing in USD through a New York correspondent bank. In the payment message, the respondent bank deliberately modifies Field 50K (Ordering Customer) by replacing the name of a sanctioned Iranian petrochemical company with the name of a newly formed UAE trading entity, while removing all references to Tehran from Field 70. Which sanctions evasion typology has been committed?
Which of the following correctly describes the historical status and current legal standing of 'U-Turn' transactions under United States sanctions regulations administered by OFAC?
A global clearing bank provides a master USD correspondent account to Bank A (located in a high-risk jurisdiction). Without Bank A disclosing it to the clearing bank, Bank A allows several smaller, unlicensed regional money exchange houses to route their international wire transfers through Bank A's master clearing account. What specific correspondent banking vulnerability does this scenario illustrate?
An illicit procurement network in an embargoed country needs to transfer $4,000,000 to an overseas equipment vendor without using electronic banking channels or generating SWIFT messages. The network delivers local currency to an in-country broker, who instructs an overseas counterpart broker via encrypted messaging to disburse funds to the vendor. The two brokers subsequently balance their internal debt ledgers through shipments of consumer electronics. Which value transfer mechanism was utilized?