Due diligence – Red flags

Some individuals and entities may attempt to circumvent Canada’s sanctions. This list of red flags is not exhaustive but may be helpful to detect suspicious transactions. If a transaction raises one or more red flags, there may be a risk of sanctions circumvention or violation. In this case, you may investigate further and seek legal advice to confirm if the transaction is permissible or not according to Canada’s sanctions legislation and associated regulations.

Business changes and ownership

Sudden changes in business activity after February 24, 2022, or after any subsequent changes in export controls or sanctions.

This is particularly the case if the customer has little or no prior history of purchasing the item in question.

Examining the company’s business dealings to date reveals inconsistencies, or a suspicious lack of business activity in the period following the date of incorporation.
Analyzing company sales data indicates a significant increase in exports of a specific product, for example, semiconductors or machine parts, to a third country.

Especially if trade in that product to that destination was previously limited or non-existent.

Anomalous increases in the volume or value of orders placed by existing customers.
The customer has little or no business background or has been recently established.
There has been a change of ownership of a corporate holding to reduce ownership stake below 50%.
There has been a change of ultimate beneficial owner shortly before or after sanctions were imposed.
There is potential control of an entity by a designated person despite apparent direct ownership being under the 50% threshold.
Significant changes to the company structure of an existing customer. For example, acquisition by another company or individual, change of location, change of operations, or a significant change in registered directors.
The transfer of shares from sanctioned entities to non-sanctioned entities incorporated by the same individuals or entity (often with registered offices at the same address).
The use of complex corporate or trust structures, or proxies such as relatives or other close associates to disguise the ultimate beneficial ownership of the company.

Designated person links

A party to a transaction or agreement has current or former links with a sanctioned entity or person, a branch office in Russia, or other connections of concern.
One or more of the transaction parties is linked to state-owned corporations in countries where governments are subject to restrictive Canadian measures.
A party to a transaction or agreement has previously entered into a joint venture or cooperation agreements with designated persons or entities, or maintains other connections with designated persons.
Any attempts by the person to bypass or avoid compliance checks, such as providing incomplete or misleading information during the application process.

Dual-use / High risk goods

The transaction involves sanctioned, dual-use, proliferation-sensitive or military goods (including goods on the Common High Priority Goods List, or Economically Critical Goods List where diversion to Russia is a risk).
A new customer whose line of business includes trade in military or dual-use goods, incorporated overseas after February 24, 2022.
The customer is, directly or indirectly, involved in the supply, sale, purchase or delivery of restricted or high-risk goods.
A customer with whom your company has no prior business relationship or knowledge thereof, or who is apparently new to the market and seeking a high-risk product.
Any indications or suspected attempts to record goods under a false Harmonized System (HS) code not subject to sanctions or export controls.
The customer is associated with companies that are suspected or known to be selling sanctioned goods or technology to Russia, based on publicly available sources.
The item ordered is incompatible with the technical level of the country to which it is being shipped, for example, semiconductor manufacturing equipment being shipped to a country that has no electronics industry.

End-user or end use of goods

The customer declines routine or customary installation, training, or maintenance services associated with the product.
The customer is reluctant to share information about the end use of a product, including reluctance to complete an end-user form.
Proposed end use of dual-use items is in industry sectors subject to minimal or less stringent oversight.
Using aliases for the identities of the intermediaries and end user.
In the case of purchases, the vendor is vague about the source of materials or country of origin.
The customer is reluctant to accept a “no re-export” or – where relevant – a “no export to Russia” clause in contracts.
The product’s capabilities do not fit the buyer or named end-user’s line of business, for example, an order of sophisticated computers for a small bakery.
The customer attempts to obfuscate the product’s ultimate destination and purpose by any means including being vague about details, providing incomplete information, or is evasive when further information is requested – especially information regarding:

the product’s end-use or end-user
whether the product is for domestic use or re-export
other third-party involvement in the transaction

The end-user or end-use is purportedly civilian, but research indicates that the customer or other parties to the transaction have military connections.
The customer is unfamiliar with the product’s performance characteristics but still wants the product.
Changes to standard letters of engagement that obscure the ultimate customer.
Use of personal email accounts instead of company email addresses.
Use of shell companies and other legal arrangements to obscure ownership, source of funds, or countries involved, particularly sanctioned jurisdictions.
Involvement of entities that have complex corporate or trust structures whose complexity is not justified by the business profile of the customer; or which uses trust arrangements or complex corporate structures involving offshore companies; or those with links to countries friendly to Russia.
A transaction involves parties with phone numbers or country codes that do not match the expected country.
The description of the goods on the trade/financial documentation is non-specific or misleading.
There is evidence or suspicion that documentation or some of its contents are fraudulent, false, inaccurate, or missing.
The item or service does not fit the purchaser’s line of business.
The customer utilizes complicated structures to conceal their involvement in transactions, for example, layered letters of credit, front companies, intermediaries, or brokers.

For example, the use of indirect transactions, using intermediaries or shell companies, has no clear economic rationale.

All communications are routed via a representative who seems to possess general power of attorney, or senior management staff are never available for discussions when requested.
Transactions involving entities with little to no web presence. For example, the absence of company website or domain-based email account, or inconsistent information provided on any company websites or profiles that do exist.
Involvement of legal firms, including company service providers based in offshore financial centres that have historically specialized in clientele from sanctioned jurisdictions or in transactions associated with politically exposed persons (PEPs) and their associate(s).
Jurisdictions with low barriers to set up shell companies as general trading companies, limited liability corporations (LLCs) or free trade zone entities.

Location

The country of the stated end-user is not the same as the country from which the order was placed.
Operation of complex and/or international businesses using residential addresses or addresses common to multiple closely-held corporate entities.
IP addresses that do not correspond to a customer's reported location data.
A party to a transaction is located in a country adjacent to a country subject to Canadian sanctions or broader restrictive measures, including those related to national security.
A party to a transaction shares their premises or registered addresses with multiple companies or holding companies, particularly those dealing in comparable goods or with a sanctioned entity or person.

This may suggest the use of multiple front companies to obfuscate illicit trade in sanctioned and controlled goods.

The address of the customer is problematic, such as being residential, non-existent, or lacking a clear economic rationale.

Additionally, the customer or their address, personnel, or contact details (e.g., telephone numbers) may be identical or suspiciously similar to those listed on publicly available sanctions lists.

The customer is physically located in, adjacent to, or otherwise maintains connections with countries where Russia operates procurement networks.
The transfer of shares from sanctioned entities to non-sanctioned entities incorporated by the same individuals or entity (often with registered offices at the same address).
A new customer or transaction with companies located in countries subject to Canadian restrictive measures or known to be used by those seeking to circumvent sanctions.

Financial

Pattern of shell companies registered in traditional tax havens conducting international wire transfers, often involving financial institutions in jurisdictions distinct from the company's registration (non-resident banking).
Requests to use a non-standard payment route. For example, outside of SWIFT, via smaller overseas banks, or using cryptocurrency.
The customer is willing to pay cash for an expensive item when the terms of sale would normally require financing.
Dividing an invoice value into smaller amounts to remain under the export control limits, or an otherwise anomalous approach to structuring payments with the apparent aim of avoiding detection.
Customer pays significantly above the known market rate for those goods.
Payments or transfers to importers, exporters, agents or brokers that export to countries and ports near the border of sanctioned countries.

For example, any country that shares a land border with, and has not imposed sanctions on, a foreign state subject to sanctions will inherently be an attractive location for that state to source sanctioned goods.

Disproportionate delivery costs are charged without a clear or justified reason.
Payments from entities located in third countries that are not otherwise involved in the transaction, and which are not listed on the End-User Statement or other applicable end-user documentation.
A wallet has been linked to the activities of a cyber-criminal (i.e. ransomware payments).
Cryptoasset to fiat transactions (or vice versa) involving a sanctioned person’s family members or associates.
Transactions involving virtual currencies and other alternative financial channels.
Attempts to deposit large sums of cash without adequate explanation.

Shipping

A consignee of a shipment appears to be a mail centre, a logistics company, or a trading company.
Vague delivery dates, or deliveries planned for remote destinations.
Last-minute changes to shipping instructions that appear contrary to customer history or business practices, or to parties involved in the transaction from an entity in sanctioned country, such as Russia or Belarus, to an entity in another country.
Requesting that shipments of controlled items be divided into multiple, smaller shipments (which may be an indicator of an intent to avoid law enforcement detection).
Goods are delivered to, from or transit through certain transhipment points, also known as ‘’circumvention hubs’’, commonly engaged with a sanctioned country, and used to illegally redirect restricted items such as those destined for Russia.
Transactions where goods could be supplied to a 're-seller' in a transhipment hub and then on-sold to companies who have ties to designated persons or individuals.
Goods are delivered to, from or transit through a country subject to Canadian restrictive measures.
Using an unclear transportation route, or complex route involving multiple third countries.
Transaction involves individuals, companies or a shipment route located in a country with weak export control laws or weak enforcement of those laws.
The shipment or payment routing is inconsistent with normal geographical or trade patterns, or with the customer’s expected business activity. For example, the item does not fit the purchaser’s line of business.
The use of ship-to-ship transfers.
A freight-forwarding firm is listed as the product’s destination.
Transporting an item through Russia to a destination elsewhere.
Using multiple third-country freight forwarders or shippers on a single transaction.

Other resources

For more information on detecting suspicious transactions, see Thematic guidance and additional resources.

Date modified:: 2025-10-22

Language selection

Search