Tracked by Satellites, Defeated by Bills of Lading: Sanctions' Soft Underbelly

In February 2025, a bank raised a compliance query about a payment worth 3.6 million renminbi, about $510,000. The payment was for 500 night-vision scopes for a Russian client. The paperwork prepared for the bank said toughened glass.

Staff at A7, a Kremlin-backed payments company, debated the answer in an internal chat. Relabel the goods as footwear, one suggested. Another objected that earlier payments to the same beneficiary had been described as cameras and optical goods, and shoes might invite questions. "Fine then, leave it as glass," came the reply. 1

The chat survives inside hundreds of thousands of internal files obtained by the Financial Times, and it may be the single most useful document for understanding where Western sanctions actually break. 1 A7 moved more than $6.9 billion through the international banking system on behalf of Russian clients, using front companies and a forgery operation the FT describes as industrial in scale, complete with a library of thousands of corporate stamps. 1 Accounts at Standard Chartered in Hong Kong alone received $1.1 billion of it, between late 2024, when A7 was established, and August 2025. 1 Some payments covered war-related goods, including military equipment and purchases by Russia's security services. 1

The enforcement stack pointed at this traffic is genuinely sophisticated. Algorithms screen payments against watchlists. Compliance platforms digitize trade documents with optical character recognition and cross-check them against vessel-tracking data. 2 Commercial satellites and shipping databases now track the tankers leaving Russian ports. 3 None of it saw the scopes. The reason is not a shortage of sensors. It is that every checkpoint with the power to stop sanctioned trade, the bank, the customs post, the insurer, still does its job by reading a document, and the governing rules of trade were written, on purpose, to treat the document in front of them as a stand-in for the reality behind it.

How $6.9 billion moved on forged invoices

A7 was set up in late 2024 in Russia and Kyrgyzstan by Ilan Shor, a Moldovan oligarch, with support from Promsvyazbank, the Russian state bank with close ties to the defense industry. 1 After Russia's banks were cut off from Swift following the full-scale invasion of Ukraine, the Kremlin promoted A7 as its flagship channel for cross-border payments, and the company now claims to handle nearly a fifth of Russia's foreign exchange transactions. 1 Shor's pitch to the Russian state news agency Tass in July was unembarrassed: "We give companies and countries freedom, because our system is immune to sanctions." 1 In September 2026, Vladimir Putin and India's Narendra Modi discussed a "Russian-Indian payment system" with the chair of Promsvyazbank. 1

The plumbing beneath that pitch was old-fashioned. Front companies, a hundred of them found making payments in the leak with at least a hundred more named in the files, clustered in the UAE, Hong Kong, Kyrgyzstan and Indonesia, deposited cash into accounts inside the Swift system and used it to settle Russian bills abroad. 1 Seventeen of them held accounts at First Abu Dhabi, the largest bank in the UAE, and made more than $1.8 billion of outbound payments. 1 The single largest paying entity was the now-closed Trading Company of the Kyrgyz Republic, a Kyrgyz state body. One entity in Hungary appears to have served as the critical conduit into the EU, and just over half the flows ended in Chinese bank accounts. 1

What made it work was craft rather than code. A7 staff swapped the customs codes of sanctioned goods for the closest unsanctioned alternatives, built cover stories for buyers and sellers, and worked to strip what they called the "Russian trace" from documents. 1 Counterfeit invoices were prepared in advance to pass bank compliance, then kept internally consistent so the story would hold across payments. 1 The FT frames the banks as targets rather than accomplices: A7 "tricked its way into the global financial system." 1

The most telling detail is how it was found. Not by an algorithm. By a leak. Zach Tvarozna, a former U.S. government banking analyst who has studied A7 from an earlier leak, told the FT the new files show the network's true scale is "much bigger than anyone had previously realized," and that the case "should make us think again about how hard it is to keep traditional correspondent banking clean." 1

The system was built to trust paper

To understand why the forgeries worked, read the rulebook that governs the money.

A central instrument of trade finance is documentary credit: the buyer's bank undertakes to pay once the seller presents a specified set of documents, the bill of lading, the commercial invoice, the certificate of origin. The rules that govern this system, the International Chamber of Commerce's Uniform Customs and Practice for Documentary Credits, state its premise in plain terms. "Banks deal with documents and not with goods, services or performance to which the documents may relate," reads Article 5. Article 34 goes further, relieving a bank of "liability or responsibility for the form, sufficiency, accuracy, genuineness, falsification or legal effect of any document." 4

Courts tested that logic in United City Merchants v Royal Bank of Canada, a House of Lords case involving a steel shipment to Poland in which third parties doctored a bill of lading to show the cargo had been loaded on time. The bank had to pay anyway, because the documents complied on their face and the seller had not committed the fraud. [5] The precedent survives for a reason: finality is what makes trade possible. A bank in London cannot inspect a cargo in the Gulf; it can only read the papers, so the papers stand in for the cargo. A bill of lading is at once a receipt, a carriage contract and a document of title, the physical key to goods worth millions. A certificate of origin is a local chamber of commerce's word about where something was made. An end-user certificate is a promise about where it is going.

Sanctions enforcement had no choice but to piggyback on this machinery. Financial-crime authorities have warned for years that trade-based money laundering lives in exactly this gap, through misinvoicing, phantom shipments and fabricated paperwork. 6 The industry response was to add technology to the reading: platforms now screen trade documents against watchlists of sanctioned entities, dual-use goods, vessels and individuals, track the ships carrying them, and flag prices that veer from benchmarks. 2 Those tools make paper machine-checkable. They do not make it true.

What satellites see, and what they cannot stop

The surveillance layer, by contrast, really is modern.

When the G7 and Australia capped seaborne Russian crude at $60 a barrel in December 2022, they did not send navies; they weaponized paperwork, requiring the Western companies that provide shipping, insurance, financing and flagging to verify that every trade complied. 3 Satellites became the audit. Researchers at Brookings, using Bloomberg's AHOY shipping database, found that in the three months to February 2025 tankers with no clear beneficial owner were carrying about 35 percent of the oil leaving Russian ports, up from roughly 6 percent in the years before the invasion, and that, by Kyiv School of Economics estimates, Russia had spent roughly $10 billion since 2022 buying tankers for the fleet. 3 The ownership trail was traced too: nearly 60 percent of a batch of recently sanctioned tankers had been sold into the shadow fleet by Western European owners, Greek operators foremost. 3 On January 10, 2025, the U.S. Treasury designated 183 Russian-controlled vessels, including 75 identified as shadow-fleet ships. 3

Yet the same research explains why watching is not stopping. The fleet obscures ownership through shell companies and repeated reflagging, moves cargo by ship-to-ship transfer, blends oil from multiple countries to mask its origin, spoofs location data or switches transponders off entirely. 3 Those transponders, the Automatic Identification System, are themselves self-reported data, the navigational equivalent of an invoice, and manipulating them appears on the U.S. government's own catalogue of illicit shipping practices alongside falsified documents and false flags. 7 The mainstream insurance market runs on paperwork checks of its own, which is why the price cap leaned on it as a chokepoint; shadow-fleet tankers simply exit the mainstream market, and Brookings describes the fleet as old and insured by disreputable companies, an environmental and fiscal hazard to the jurisdictions it passes. 3

The satellites document reality. Designation lists slowly turn it into law. What no satellite can do is refuse a payment, clear a customs post or verify a certificate of origin. Those decisions still happen at the paper checkpoints, which is where the adversary writes.

Clean documents, hidden end users

The German case shows the other half of the problem: paperwork that is accurate about the goods and misleading about everything else.

Police and customs officers spent hours parked outside the Radisson Blu Senator Hotel in Lübeck, engines off, watching the entrance. Shortly after 6 a.m. they moved in and arrested Nikita S., a 39-year-old businessman prosecutors suspect of turning a Lübeck trading company into a procurement arm for the Russian military industry. The raid ended a four-year investigation, and the material seized forms part of a case file reviewed by BILD and POLITICO. 8

As investigators describe it, Global Trade was a mid-sized company that exported directly to Russia until Western sanctions made that harder, after which its structure changed. At the top, investigators allege, sat a Moscow company called Kolovrat, also operating as Siderius, sanctioned by the U.S. for operating in Russia's manufacturing sector and described in the files as the operational core of a procurement network supplying Russian industry, including entities linked to the defense sector. Nikita S. became managing director at the end of March 2022 and, per the files, worked simultaneously for Kolovrat in Moscow, making him what investigators called the "binding link." 8

Nothing here required forged stamps. The documents were accurate on their face: a real German company ordered microcontrollers, sensors, converters, ball bearings, oscilloscopes and measurement equipment, and routed them, often through Turkey, with the gap between export from the EU and import into Russia often just five to 10 days. 8 According to the files, Kolovrat employees logged into Global Trade's email accounts, posed as German staff under aliases, and contacted suppliers across Europe, so the orders looked authentically local. In several cases, the files say, shipments were traced to Russian end users linked to defense or nuclear research. 8 The network's written instructions were about presentation, not fabrication. "Make it look clean. No Russian reference anywhere," Nikita S. reminded an associate. A logistics instruction read: "Remove all documents from the boxes before shipment." 8

Nikita S. is in custody while prosecutors gather evidence for an indictment; his lawyers did not respond to a request for comment, and Germany's Foreign Trade Act allows prison terms of up to 10 years for serious offenses. 8 A screening system looking for falsified documents would have been looking in the wrong place. The deception was not in the paperwork. It was around it.

The loopholes that never needed a forger

Recent research suggests forgery is only the visible edge of the problem.

The sharpest accounting of how military-relevant goods actually reached Russia comes from economists Lisa Scheckenhofer, Feodora Teti, David Torun and Joschka Wanner, who matched Russian customs records, transaction by transaction, against the EU's export bans. The stakes are concrete: the 42 product categories they track, drawn from the EU's Common High Priority list, are goods repeatedly found in Russian weapons systems. 9 Their central finding is that the largest channel during the first years of the war required no deception at all. 9

The EU's early bans were text-based: they prohibited exports matching particular technical descriptions or destined for particular end uses, while leaving other variants of the same products legal, a design meant to spare legitimate European exporters. Full, product-code-level bans covering all 42 categories were not in place until January 2024. 9 Until then, trade in the uncovered variants was lawful. In 2022, Russian imports of partially sanctioned military-relevant goods from the EU averaged around $36 million a month, roughly a fifth of pre-war levels, and spiked to between 30 and 40 percent of pre-war levels from September through December 2022. The same flows appear in official EU trade statistics, so they are not an artifact of Russian data. 9

Two other channels did the rest: goods that claimed to be transiting Russia toward other destinations and could then "disappear" en route, and fully banned products rerouted through intermediary countries. 9 The authors argue that "the design and implementation of export bans deserve at least as much attention as their announcement." 9 The soft underbelly is not only forged paper. Sometimes it is paper nobody required in the first place.

An older playbook than the war

None of this began in 2022. The U.S. government's guidance on illicit shipping, published jointly by the Treasury, State and Coast Guard in May 2020, reads as a field manual drawn from earlier casework, in particular on Iran, North Korea and Syria: transponders switched off or spoofed, vessel names and flags manipulated, ship-to-ship transfers breaking the trail, documents falsified as to cargo and origin. 7 U.N. investigators on North Korea documented coal leaving port and petroleum arriving in tankers in breach of caps, moved through ship-to-ship transfers on the high seas with transponders dark. 10 In May 2019, U.S. authorities seized the Wise Honest, one of North Korea's largest bulk carriers, in a civil forfeiture action over sanctions-violating shipments. 11

Even the pre-2022 measures on Russia ran on the same documentary machinery, and the 2022 invasion triggered what the CEPR researchers call the most comprehensive export sanctions the EU and its allies had ever imposed. 9 What the customs data reveal is how gradually even that regime was assembled, and how much moved lawfully in the meantime. 9

When the paperwork gets caught

The fair counterpoint is that enforcement does land, on a delay.

The UK sanctioned A7 in May 2025. 1 The 183-vessel designation list shows the satellite era's tracking and ownership research maturing into legal force. 3 The Lübeck network was unraveled by officers waiting outside a hotel, not by a dashboard. 8 The legal trade the economists identified was visible in the EU's own statistics all along, and it closed when the rules were rewritten in January 2024, after which the remaining flows ran through the transit and rerouting channels. 9 North Korea's fleet lost a ship. 11 Screening is built to catch the naive cases, name matches and listed vessels and coded goods, which is precisely why serious networks put their effort into making the paperwork coherent rather than the payload obscure. 2

The pattern in every case is the same. Detection runs on humans, leaks and patient document work; by the time it matures into charges or designations, the goods have moved and the route has changed.

Fixing paper with more paper

Regulators have mostly answered the weakness of paper with demands for better paper. The price cap is policed through verification by service providers, 3 in practice written attestations that a cargo was sold at or below the cap, and the Price Cap Coalition's maritime advisory to the oil industry in October 2023 catalogued the deceptive practices used against the regime, falsified documents among them, while pressing firms for stricter diligence. 12 The vessel lists grow. The forms get longer.

The structural fix in progress is different: make the document itself verifiable. The major container lines, through the Digital Container Shipping Association, have committed to issuing bills of lading electronically by 2030, artifacts that are far harder to quietly backdate or counterfeit-stamp. 13 The ICC has issued parallel rules for presenting documents electronically, and banking groups such as the Wolfsberg Group have pushed for structured, machine-readable payment data so screening depends less on free-text fields. 414

Digitization removes the stamp library, and that matters. It cannot remove the deeper thing A7 was selling: a plausible statement. A perfectly valid electronic invoice for toughened glass is still a lie. What technology can protect is the integrity of the artifact. What it cannot verify is the attestation of physical fact, where a cargo was loaded, what it contains, who bought it, at what price, when the people making it have every incentive to shade the answer. The certificate of origin was always the exporter's word. Digitizing the word does not make it true.

Is the gap real, narrowing, or overstated?

Weighing the evidence, all three are partly true.

The gap is real. The governing rules of trade finance expressly separate banks from reality, 4 and the consequences recur at every scale: more than $6.9 billion cleared behind forged invoices, 1 years of dual-use components moving behind clean German documents, 8 sanctioned oil sailing behind ownership structures that no satellite can convert into a legal action before the cargo is delivered. 3

It is narrowing in measurable ways. A7 made it onto the UK sanctions list in May 2025, and what exposed how it actually worked were leaks from inside the company, not a monitoring system. 1 The legal channel closed when the rules did. 9 Designation lists now run into the hundreds of vessels. 3

And the strong version of the thesis is overstated in one respect: technology is not the weak link. The shadow fleet is visible, counted and increasingly named. 3 Screening does what it is built to do. 2 The binding constraint is that surveillance produces knowledge while documents still produce action, and the distance between the two is measured in years. The Lübeck case took four. 8

What nobody can size is the undetected remainder. The $6.9 billion describes one company, captured in a single leak. 1 The customs analysis covers 42 product categories. 9 The shadow-fleet share is an estimate built on a definition, tankers without a clear beneficial owner, that jurisdictions do not fully agree on. 3 Nobody audits the global forgery rate, so nobody can say how much else is moving. Honest analysis has to stop where the data does.

The February 2025 compliance query was, as far as the files show, a bank asking about paperwork that made internal sense. The answer from the other side was a committee of forgers worried about narrative consistency. That asymmetry will hold as long as every release point in the system, the payment, the cargo, the insurance cover, is triggered by paper. The satellites will keep counting the ships. The paperwork will keep deciding what the world pays for.

Sources

1. Anne-Sylvaine Chassany, "Kremlin-backed forgery scheme moved billions through banks," Financial Times, published via the Financial Post, 22 September 2026. https://financialpost.com/financial-times/kremlin-backed-forgery-scheme-global-banks
2. Eastnets, "SafeTrade: trade-based financial crime compliance," product documentation. https://www.eastnets.com/products/safetrade
3. Robin Brooks and Ben Harris, "Where did Russia's shadow fleet come from?", Brookings Institution, 27 February 2025. https://www.brookings.edu/articles/where-did-russias-shadow-fleet-come-from/
4. International Chamber of Commerce, Uniform Customs and Practice for Documentary Credits, ICC Publication No. 600 (2007), Articles 5 and 34, and the ICC eUCP rules for electronic presentation. https://iccwbo.org
5. United City Merchants (Investments) Ltd v Royal Bank of Canada [1983] 1 AC 168 (House of Lords).
6. Financial Action Task Force, "Trade-Based Money Laundering: Trends and Developments," 2021. https://www.fatf-gafi.org
7. U.S. Department of the Treasury, U.S. Department of State and U.S. Coast Guard, "Guidance to Address Illicit Shipping and Sanctions Evasion Practices," May 2020. https://home.treasury.gov
8. "Moscow's German front company: How the Russian military busted through sanctions," POLITICO and BILD, Axel Springer Global Reporters Network, 2026. https://www.politico.eu/article/russia-germany-sanctions-ukraine-smuggling-network/
9. Lisa Scheckenhofer, Feodora Teti, David Torun and Joschka Wanner, "Export bans that weren't really bans: How Russia kept importing military goods," VoxEU, Centre for Economic Policy Research, 24 February 2026. https://cepr.org/index%2Ephp/voxeu/columns/export-bans-werent-really-bans-how-russia-kept-importing-military-goods
10. United Nations Security Council, Report of the Panel of Experts established pursuant to resolution 1874 (2009) concerning the Democratic People's Republic of Korea, S/2019/171, March 2019. https://undocs.org/S/2019/171
11. U.S. Department of Justice, press release on the seizure of the North Korean cargo ship Wise Honest, May 2019. https://www.justice.gov
12. Price Cap Coalition, advisory to the maritime oil industry on deceptive price cap evasion practices, October 2023, U.S. Department of the Treasury. https://home.treasury.gov
13. Digital Container Shipping Association, ocean carriers' commitment to 100% adoption of the electronic bill of lading by 2030, 2022. https://www.dcsa.org
14. Wolfsberg Group, "Payment Transparency Standards." https://www.wolfsberg-group.org