The unseen risks of proliferation financing in financial institutions

Proliferation financing is of significant concern to every business in the regulated sector. A series of amendments to the UK Money Laundering Regulations 2017 came into force 1 September 2022. The Money Laundering and Terrorist Financing (Amendment) (No. 2) Regulations 2022 include an obligation for regulated entities to identify, assess and mitigate the risk of proliferation financing (PF). We have further detailed guidance on these amendments here.

 

 

What do regulated entities have to do on proliferation financing?

Regulated entities have the flexibility to create a new risk assessment on PF, or to incorporate proliferation financing into their existing money laundering and terrorist financing risk assessments. The Legal Sector Affinity Group (LSAG) has also updated its guidance on the anti-money laundering (AML) regulations to incorporate PF. Guidance on the new requirement to carry out proliferation financing risk assessments, either as part of the firm’s existing practice-wide risk assessment or as a standalone document.

VinciWorks has created a number of tools to assist with proliferation financing compliance. This includes dedicated training modules on proliferation financing. VinciWorks have also produced guidance on high risk jurisdictions on PF, incorporating the latest 2024 US National Proliferation Financing Risk Assessment prepared by the US Treasury.

 

 

What does proliferation financing look like in finance and banking?

Despite a definition in law and a requirement to treat PF with the same seriousness as money laundering or terrorist financing, financial institutions are responsible for determining their approach to understanding, identifying, and mitigating these risks.

Unlike money laundering, where illegal funds are the focus, proliferation financing may involve funds obtained legally, such as donations or legitimate business transactions. For example:

  • Example: A seemingly legal charity raises funds for humanitarian aid but diverts a portion to procure dual-use goods for WMD programs.
  • Example: An exporter of high-precision tools in Europe unknowingly ships equipment to a front company in Asia linked to missile development.

 

This dual nature of legal and illegal transactions makes proliferation financing harder to detect and often places financial institutions at risk of unwittingly facilitating these activities.

 

Proliferation financing case: Military-grade dual-use technology

Two US nationals and five Russian nationals, including Russian FSB agents, were charged with conspiracy as part of a global proliferation financing and money laundering scheme on behalf of Russia. The defendants conspired to obtain military-grade and dual-use technology directly from US corporations. This included ammunition, regulated electronics, quantum computing, and other electronics which can be used in the development of nuclear and hypersonic weapons systems. The sanctioned Russian entity based in Moscow received the exports from the US-based defendants who used shell companies and associated bank accounts to reroute shipping and obscure their financial transactions. Shipping documents and invoices were fabricated, and items were repackaged and relabelled, being sent around the world before arriving in Estonia and other neighbouring countries. The goods were then smuggled across the border, and the money sent to different bank accounts around the world.

 

Understanding customers and jurisdictional risks

To manage proliferation financing risks, financial institutions must thoroughly understand their customers, their businesses, and the jurisdictions they operate in. The UK’s National Risk Assessment of Proliferation Financing, published by HM Treasury, offers valuable insights into these risks. Key exposure areas include:

  • Sensitive jurisdictions: Countries with porous borders or weak enforcement mechanisms, such as regions in Southeast Asia, can be exploited for smuggling.
  • Conflict zones: Customers operating near regions of geopolitical tension, like the Middle East or the Korean Peninsula, are high-risk.
  • Dual-use goods: Businesses dealing with items that can serve civilian and military purposes (e.g., electronics, sensors).
  • Complex networks: Entities with obscure ownership structures in jurisdictions such as Hong Kong, Cyprus, or the UAE may conceal illicit connections.

 

Example: A shipping company with frequent deliveries to ports near North Korea might appear legitimate but could serve as a cover for transporting materials for missile production.

Enhanced due diligence (EDD), including network analysis and the verification of customer connections, is essential when red flags arise.

 

 

Identifying and managing dual-use goods

Dual-use goods—products with both civilian and military applications—pose a significant risk. Examples include:

  • Electronics: Silicon chips used in commercial devices that can also be used in missile guidance systems.
  • Machinery: High-precision machine tools for aerospace manufacturing.
  • Chemical Products: Industrial chemicals used to produce explosives.

For example, laser sensors exported to a medical equipment company could be repurposed for WMD development.

Financial institutions should scrutinise transactions involving dual-use goods by:

  • Verifying the legitimacy of the end-user.
  • Reviewing export licenses and conducting destination risk assessments.
  • Investigating the online presence and reputation of involved parties.

 

Testing and improving screening tools

Screening tools are critical for identifying sanctioned entities and suspicious activities, but their effectiveness depends on:

  • Regular updates: Ensuring sanction lists and watchlists are current.
  • Quality control: Verifying the accuracy of flagged entities to avoid false positives and negatives.
  • Comprehensive coverage: Including multiple global sanction lists to capture diverse risks.

 

For instance a bank’s failure to update its screening tool led to missed connections with a sanctioned Iranian entity operating under a different name. Periodic testing of screening tools helps institutions identify gaps and improve their effectiveness.

 

 

Let VinciWorks help with your proliferation financing compliance. Download our guide now.

 

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.