Overview
The UK’s National Crime Agency (“NCA”), a member of the UK’s National Economic Crime Centre (“NECC”), has issued a Red Alert highlighting the sophisticated network facilitating Russian oil sanctions evasion. The alert outlines how Russian oil exports continue to fund Russia’s war in Ukraine, with oil and gas revenues accounting for approximately 30% of Russia’s federal budget in 2024. Several entities have been identified as key facilitators within this illicit network, including two Azeri nationals, two United Arab Emirates (“UAE”) incorporated companies, and one Hong Kong incorporated company. The alert offers guidance to financial institutions, insurers, professional services firms, and others on identifying potential evasionary practices, as well as encouraging the reporting of information pertaining to such practices to the NCA.
Sanctions Evasion Network
According to the alert, Russian oil trading companies are leveraging complex networks to bypass sanctions and access Western finance and services to sustain these revenue streams. Two UK-sanctioned Azeri nationals, Etibar Eyyub and Tahir Garayev, have been identified as central operators within this network, facilitating substantial volumes of Russian oil trades, including the majority of Rosneft’s exports, due in part to their personal connections with Rosneft CEO Igor Sechin, who is also sanctioned by the UK.
The alert describes the network as structured into two operational sides known as “blue” and “red” to its affiliated traders and brokers (the “Network”). The “blue” side of the Network interacts directly with Western financial institutions, insurers, and commodity exchanges and includes companies such as 2RIVERS DMCC and 2RIVERS PTE, UAE companies that were sanctioned by the UK in December 2024. The “red” side of the Network comprises opaque entities and front companies designed for easy replacement should they be targeted by sanctions. For example, the alert identifies Hong Kong company, Nord Axis, which was designated by the UK in May 2025 as a leading “red” side actor.
Finance and oil flow between these two sides of the Network. The “red” companies, with privileged access to Russian oil, combine to create a global trading network with the “blue” companies that offer access to Western rates of trade finance, insurance, and access to commodity exchanges, creating a resilient global network that generates billions of dollars in illicit trade. A common typology involves “red” companies purchasing oil from Rosneft, moving it via Shadow Fleet tankers to third-party terminals, and transferring the oil to “blue” companies for sale on the open market, a process that often involves the Russian origin of the oil being obscured from end buyers through the use of transshipment, ship-to-ship transfers deceptive shipping practices, reclassification, and mixing operations. The proceeds from the sale of the oil at a favourable price are then transferred back through the Network.
Key Red Flags
When assessing whether a particular customer or transaction may give rise to sanctions evasion risk, businesses should consider the relevant facts holistically. While no one red flag necessarily indicates illicit activity, businesses should be alert to the following potential red flags and should assess them as part of their due diligence efforts:
- Companies with minimal trading history that suddenly begin trading large volumes of oil;
- Limited information concerning a company’s ownership, directors, or beneficiaries;
- Transactions involving multiple transfers between obscure companies;
- The involvement of companies registered or operating in high-risk jurisdictions, including those where Shadow Fleet entities are known to operate; and
- Companies with little to no online presence or contact information, or that have generic websites that lack details of the individuals operating the company.
Reporting Obligations
Firms operating in the regulated sector that detect activity indicative of sanctions evasion may wish to file a Suspicious Activity Reports (SAR) using the usual channels that includes referencing alert code 0774-NECC. Reports of frozen assets or breaches of financial sanctions should also be submitted to HM Treasury’s Office of Financial Sanctions Implementation (“OFSI”) at OFSI@hmtreasury.gov.uk, while potential breaches of UK oil price cap sanctions should be reported to oilpricecap.ofsi@hmtreasury.gov.uk. The NCA also welcomes non-SAR intelligence in relation to Russian oil sanctions evasion, which can be submitted via NECC.PPP@nca.gov.uk.
The alert underscores the scale and sophistication of Russian sanctions evasion operations and the critical role of the private sector in detecting and disrupting illicit trade flows. Affected businesses should consider integrating the guidance and red flag indicators outlined in the alert into their compliance and reporting processes and remain vigilant as sanctions evasion tactics continue to evolve at pace. For more information on these developments, contact the authors of this post, Alexandra Melia or Elliot Letts, in Steptoe’s Economic Sanctions team in London.
