Sanctions screening checks names, and names are the cheapest thing to change

A list of names, and a box to type names into

At the moment of execution, economic sanctions are a spelling test. A government publishes a list of designated companies, people and vessels. A bank compares the names written in a payment instruction against that list. If nothing matches, the money moves. That is very nearly the whole control.

The Financial Times has reported that A7, a fintech it describes as Kremlin-controlled, used that design to push billions of dollars of payments to Russian state companies through international banks that did not understand what they were processing. I have seen the summary of the investigation, not the underlying documents, and I make no claim about any particular transaction or any named bank. But the shape of the allegation is entirely plausible on the architecture alone, and that is the part worth arguing about. Nothing in the plumbing of correspondent banking is designed to stop it.

Swift does not move money

The summary says Swift’s controls were exploited. That framing is comforting because it implies a single chokepoint that somebody could tighten. Swift is a messaging network. It carries instructions between banks; the banks themselves debit and credit accounts, and the banks themselves apply the screening. “Swift controls” are mostly message standards — which fields exist, and what must be put in them — plus who is allowed to connect. The filter sits inside each institution.

That matters because of where knowledge sits. The bank that actually knows who a customer is, and who is ultimately being paid, is the first one in the chain. The bank carrying the enforcement risk for a dollar payment is the correspondent further along, which sees a message from another licensed institution and has no practical way to audit the truth of it. Trust travels down the chain. Information does not. A control placed at the end of a chain, fed by data created at the start of it, is a control in name.

The intermediary is the product

Designation is entity-specific. Incorporation is cheap. Once you accept that sanctions are enforced by matching names, the business opportunity is obvious: be the name that is not on the list. A trading company with a clean registration, a real bank account and plausible invoices converts a blocked payment into an ordinary one, and the correspondent screens exactly what it was given and finds nothing.

This is why adding designations, which is what governments mostly do when a scandal like this breaks, is the weakest available response. Each new name is a fact about the past. The evasion layer is rebuilt in weeks for the cost of a company registration and a new set of invoices.

What supervisors actually measure

Compare the week’s other enforcement. On Friday the Federal Reserve Board issued three consent prohibition orders against former bank employees — misappropriation of customer funds at one lender, misapplication of funds at a card company, check fraud at another bank. Those are real cases and the remedies are proportionate. They are also the easy kind: individual, documented, small.

The same week, the Fed’s vice chair for supervision set out potential changes to how stress-test losses are calculated and a review of the central bank’s own performance before Silicon Valley Bank failed. Regulators are plainly willing to reopen the mechanics of a test when the number it produces looks wrong. Nobody applies that thinking to sanctions screening. Examination of a financial crime programme asks whether a policy exists, whether lists are refreshed, whether alerts were dispositioned within a service standard. It does not ask the only question that counts: if a disguised payment goes in, does it come out the other side?

That question is answerable. Sanctions authorities and bank examiners could inject synthetic payment messages — obfuscated in the ways real ones are, with links that a diligent reviewer could find — and record how often institutions catch them. Penetration testing is routine for computer security and unremarkable in aviation safety. Payments compliance is audited on paperwork.

The case against this argument

The strongest objection is that banks cannot be the world’s beneficial-ownership registry. Every extra verification obligation raises the cost of a cross-border payment, and banks respond to unpriceable legal risk by withdrawing: closing correspondent relationships, abandoning whole corridors, making remittances and aid payments harder for people who have done nothing wrong. Cross-border payments are already a market where fintechs compete hard on price and speed. Load more diligence onto the chain and the legitimate traffic moves or stops.

I accept the mechanism and reject the conclusion. I am not asking correspondents to verify the world; I am asking that the institution which populated the originator and ultimate-beneficiary fields carry the liability for what it wrote there, and that structured data be mandatory rather than optional. That shifts cost onto the party with the knowledge, instead of the party with the exposure. And the alternative to precise controls is not freedom — it is the blunt instrument. When targeted enforcement fails visibly enough, governments cut off whole institutions and whole jurisdictions, and it is exactly the small, legitimate, low-margin payments that die first.

A control that catches nobody is not cheap. It is expensive and useless, and it makes the crude response inevitable.