THE INTEL ANALYST ACADEMY
Professional Intelligence Training
Printable Lesson
Sanctions Counter Terrorist Financing
The Intel Analyst Academy · Lesson Notes
Sanctions and counter-terrorist financing sit next to money laundering in the same briefings and obey different logics. Laundering is about proceeds of crime trying to look clean. Sanctions are about restrictions a government has imposed on dealing with named parties, places, or activities. Terrorist financing is about funds reaching a violent organization, and those funds are sometimes earned lawfully before they are sent.
If you brief them as one blob called "financial crime," you will miss the question the decision-maker actually has: is this a proceeds problem, a prohibition problem, or a funding problem. This lesson keeps them apart, and it stays on the analyst's side of the line. It is not legal advice, and it is not a description of how to get around a restriction.
Three tools get mashed together in casual speech. They are different jobs.
Sanctions restrict dealings with designated people, entities, sectors, or jurisdictions. The restriction is a legal instrument. Your list of names is a finding aid for that instrument. The instrument can change. A name can be added or removed. If your product will be read as "this party is sanctioned," cite the list, the authority, and the date you checked. "I think they are on a list" is a memory, not a source.
Some measures are aimed at a place or a sector rather than a single name: broad prohibitions on certain trade or finance with a jurisdiction. A party can be touched by a country measure without ever appearing as a highlighted name. The analytic tell is the nexus: nationality, location, ownership, or the route of the goods. Again, the legal conclusion belongs to counsel or to the competent authority. Your contribution is the nexus, documented.
Export controls restrict who may receive certain goods and technology. A misdescribed shipment can be a sanctions problem, a control problem, both, or a sloppy invoice. Quote the goods as each document describes them and hand the classification question to the people who own it. Do not freelance a control determination because two descriptions failed to match. Mismatch is your finding. The licensing answer is someone else's.
Screening is looking up a name. It is necessary and it is not sufficient.
Transliteration, spelling variants, patronyms, trading names, and married names produce false negatives and false positives. A near match is a lead to resolve, not a hit to announce. Record the string you searched, the string the list shows, and the other identifiers that agree or disagree: date of birth, address, nationality, registration number. Two Ahmeds and a similar year of birth are not a designation.
Many sanctions regimes also restrict entities that are owned or controlled by designated persons, even when the entity has its own innocent-looking name. A widely published example is the U.S. Treasury rule of thumb that an entity owned 50 percent or more, in aggregate, by one or more blocked persons may itself be blocked even though it is not named on the list. That is a specific regime's rule. Other countries write ownership and control differently. Check the rule that applies to your problem, and let counsel own the arithmetic if the percentages are messy.
Your job in the meantime is the factual one: who owns this company, in what shares, on what date, from which registry or filing. The shell-company lesson is the method. The sanctions lesson is why the method suddenly has a lawyer in the room.
"They are sanctioned because a subsidiary once had a director who knew a designated person" is how careers get short. Proximity is not ownership. A commercial relationship is not control. If you cannot show the share, the voting right, or the practical control, brief the relationship you can show and stop.
Counter-terrorist financing asks where the money is going, and whether that destination is a terrorist organization or an operative. Anti-money laundering usually asks where the money has been, and whether it is the proceeds of a crime.
The uncomfortable part: the salary, the donation, or the small business profit can be real. The offense, if there is one, may be the transfer onward, not the earning. If you hunt only for "dirty" origin, you will clear a file that was never dirty at the source. Ask both questions. Where did this value come from. Where is it going. Which of those is the requirement.
Terrorist operations are sometimes cheap relative to fraud or trafficking schemes. A modest transfer can matter if the destination matters. A large transfer can be meaningless if the destination is a documented family expense. Do not use amount as a substitute for nexus.
Charitable giving is lawful and common. Some cases involve the abuse of a charity's name, account, or collection network. The analytic standard is specific: funds diverted, a named facilitator, a transfer that bypasses the charity's stated purpose, a false campaign. "This organization is a faith-based charity" is not a red flag. Write the diversion or do not write the suspicion.
Hawala and other informal value-transfer systems move obligations through trust and settlement between brokers, often with little or no payment that matches the underlying transfer in a bank you can see. People use them for ordinary remittances in places where banks are slow, costly, or absent. They are also used to move funds that someone does not want on a bank rail. Brief the mechanism only if you have evidence of it: a broker, a token, a settlement between known dealers. Do not label every cash-heavy community a network. That is prejudice with a diagram.
You will be asked whether someone is "evading" a measure. Keep the answer tied to documents.
Patterns analysts are allowed to notice, because they appear in open typologies and in real case files:
Noticing a pattern is not the same as teaching anyone to build one, and it is not a finding of evasion. Evasion is a conclusion about intent and about the legal measure. You can be ready to say: "The consignee changed after the goods were loaded, the new consignee was formed last month, and we cannot find a commercial reason in the file." Let the authority that owns the regime decide what that is called.
Separate the sentences by owner.
A form that survives contact with counsel: "As of [date], [name] appears on [list] under [identifier]. Company B is wholly owned by that person according to the [registry] filing dated [date]. We do not assess the legal effect. The ownership fact is for counsel and the competent authority."
That feels fussy. Fussy is what keeps a financial-intelligence note from pretending to be a court.
Scenario. A trading company in your portfolio, quiet for two years, receives a wire described as "final payment for generators" from a buyer you have not seen before. The buyer was incorporated six weeks ago. A public sanctions list, checked today, has no exact match for the buyer. A designated entity in the same sector uses a director whose surname and year of birth match the buyer's listed manager, and the match is not unique: you can find two other people with that surname and year in open records. The invoice describes "industrial generators." A packing list in the same email thread describes a different model number than the invoice.
Sort it:
If the surname is doing all the work, the surname is not ready for the headline.
Continue your training
This lesson is part of The Intel Analyst Academy — professional intelligence analysis training built for analysts. Explore the full course library, structured learning paths, and practical tools at theintelanalystacademy.com.
