Stopping A Sanctions Evasion Ring Across Three Continents
How RemitSo's multi-layered compliance engine detected a sanctioned network operating behind shell identities in Canada, Turkey and Syria.
- Fraudulent accounts
- 14
- Suspicious funds frozen
- $41K+
- Sanction records screened
- 40,000+
- Time to full detection
- 4 days
Caught before a dollar moved.
A licensed Canadian money services business identified an anomalous pattern: 14 separate accounts, registered over 48 hours, attempted to route funds through Turkey to sanctioned recipients in Syria. RemitSo's compliance engine flagged the activity within the first transaction cycle, froze $41,000+ in suspicious transfers, and let the MSB file regulatory reports, all before a single dollar crossed borders illegally.
Every layer added a piece.
Every sender and beneficiary screened against 40,000+ records across OFAC SDN, EU, UK HM Treasury and UN lists. Fuzzy matching and transliteration caught the Arabic-to-English name variations the network used.
All 14 accounts passed initial automated eKYC. The secondary forensic layer flagged 9 stolen or altered passports, 11 missing address proofs and 3 fabricated bank statements.
Each account got a risk score that rose with every suspicious signal. All 14 breached the critical threshold (85/100) within 4 days.
All 14 accounts funnelled through identical beneficiary clusters in Turkey, with recipients in sanctioned Syrian territory. Device fingerprints showed shared browsers and IP overlap.
| Sanction list | Records | Result |
|---|---|---|
| OFAC SDN (US) | 15,568 | Partial match: 3 beneficiaries linked to a Syrian alias |
| EU financial sanctions | 5,030 | No match |
| UK HM Treasury | 4,495 | Partial match: 1 beneficiary alias |
| UN Security Council | 875 | No match |
Four days, from sign-up to freeze.
- Day 1 · Registration burst
14 accounts registered within 48 hours from 3 IP clusters in the Greater Toronto Area. Risk score 15 (low).
- Day 2 · First transactions
All 14 accounts send CAD to Turkish lira, $2,500–$3,200 each, just below the reporting threshold. Risk score 38 (medium).
- Day 3 · Pattern lock
Second transactions target the same beneficiaries in Turkey. Screening returns partial matches on 3 Syrian-linked names. Risk score 62 (high).
- Day 4 · Full freeze
Critical threshold breached. All 14 accounts frozen, $41,000+ held, compliance team notified to file a SAR. Risk score 89 (critical).
Frozen, reported, blocked.
All 14 accounts frozen within 4 days of first registration. $41,000+ in pending transfers halted before settlement.
A suspicious activity report filed with FINTRAC with a full evidence package: transaction trails, document forensics and network maps.
IPs, device fingerprints and beneficiary aliases added to a permanent blacklist. Corridor risk ratings updated.
- Multi-layer screening is essential. Name-only screening would have missed this network. Document forensics, behavioural scoring and corridor analysis together connected the dots.
- Speed of detection matters. The 4-day window stopped funds reaching sanctioned territory. Manual reviews typically take 7–14 days.
- Structuring attempts are evolving. Transfers were kept below $3,000. Only pattern-based detection across the cluster revealed it.
- Automation reduces exposure. A complete evidence package cut manual investigation time by an estimated 85%.
RemitSo's compliance engine didn't just flag the risk. It connected the dots across borders before the first dollar could move.
Get the complete analysis, including detailed forensic findings, regulatory references and recommendations.
Download PDF of this case studyOperators like you, running on RemitSo.
Scale
6–8 months
to a bespoke platform
From white label to bespoke
A UK operator outgrew its white-label provider and moved, phase by phase, to its own platform.
Read the story
Scale
10,000+
monthly transfers
Past 10,000 transfers a month
A UK provider broke free of legacy bottlenecks by moving to RemitSo.
Read the story
Launch
6 weeks
to market
Veloxpays: licence to live in 6 weeks
A fully branded, compliant platform in Australia, with no compliance hires needed.
Read the storyBuilt by people who have helped MSBs for years.
The risk checks on every online transfer come from what they see every day.
- The person paying isn't the customer
- One bank account, several customers
- A disposable email address
- Sign-in from a high-risk location
- The same person signing up twice
- A name close to a sanctions list