A recently announced £3.84 million forfeiture by an agricultural trading company offers a useful case study in what modern sanctions evasion and money laundering risk can look like.
On 27 August 2026, the National Crime Agency (NCA) announced that ENEX Premium Trading Limited had agreed to forfeit more than $5.2 million (£3.84 million) following a civil recovery investigation into suspected money laundering and sanctions evasion.
The case combines several issues compliance teams increasingly need to consider together: source of funds, adverse media, opaque international payment chains, sanctions screening, electronic money institutions and cryptocurrency. It also demonstrates why sanctions compliance cannot consist solely of checking whether a customer’s name appears on a sanctions list.
What happened in the ENEX case?
ENEX Premium Trading Limited is registered in St Kitts and Nevis and owned by Azerbaijani national Nadir Valiyev. The company describes itself as an agricultural trading and logistics business involved in grains, oilseeds and related commodities. According to the NCA, ENEX transferred significant amounts of money into recently opened UK accounts between July and September 2024.
When the accounts were opened, Valiyev stated that the source of the money was his personal wealth and retained earnings from previous trading structures, including UAE-registered Burston Trading FZE. That explanation would later become important.
Reports emerged during 2024 alleging that companies associated with Valiyev had been involved in shipping grain taken from Russian-occupied areas of Ukraine. The NCA subsequently obtained an Account Freezing Order over ENEX funds in November 2024.
Once investigators began tracing the money, the picture became considerably more complicated. The NCA says the frozen UK funds were traced back to ENEX bank accounts in China. During just July to September 2024, those accounts had received tens of millions of pounds from suspected front companies. Investigators also identified a network of suspected front companies and bank accounts being used to move transactions through UK electronic money institutions, before converting funds into cryptocurrency.
Companies that had made payments into the Chinese accounts were subsequently designated under US sanctions for facilitating illicit Iranian oil sales and revenue, including transfers connected with Iran’s Islamic Revolutionary Guard Corps Quds Force.
The NCA says it suspects the forfeited money represents the proceeds of money laundering. Valiyev has denied engaging in criminal activity. Importantly, the settlement does not constitute an admission of unlawful conduct by either Valiyev or ENEX and does not amount to evidence of criminal conduct.
The first warning sign: source of funds needs to be verified, not merely recorded
One of the most interesting details is the explanation given when the UK accounts were opened. The source of the money was reportedly described as personal wealth and retained earnings from previous trading structures. For compliance teams, there is an important distinction between recording an explanation and establishing whether it is credible.
Source of wealth is how somebody accumulated their overall wealth, while source of funds concerns the origin of the particular money being used in a business relationship or transaction. Establishing these as a way of assessing whether transactions are consistent with what a firm knows about its customer.
“Personal wealth” therefore tells a firm relatively little about the source of a particular multi-million-pound transfer. “Retained earnings” provides more information, although a higher-risk situation could require the firm to establish which company generated those earnings, through what activity, during which period and how the money subsequently travelled from that business to the account being funded.
That can require financial statements, contracts, invoices, tax information, banking records or other independent evidence depending on the risk. Tracing the flow of funds is particularly important where the immediate account sending the money is only one stage in a longer chain.
In the ENEX investigation, the NCA ultimately says it traced the UK money backwards to Chinese accounts that had themselves received tens of millions of pounds from suspected front companies. A plausible description of wealth at onboarding cannot substitute for understanding the provenance of the actual money moving through an account.
What were the AML red flags?
Taken individually, many characteristics described in the NCA announcement would not establish money laundering. Taken together, they illustrate exactly why firms need risk-sensitive monitoring rather than binary rules.
Potential indicators compliance teams should recognise include:
- substantial sums arriving in recently opened accounts over a relatively short period
- a corporate structure involving several jurisdictions, including St Kitts and Nevis, the UAE, China and the UK
- funds said to derive from previous trading structures rather than straightforward operating revenue from the account holder
- payments originating through companies suspected by investigators of acting as fronts
- transaction flows involving UK EMIs followed by conversion into cryptocurrency
- activity crossing several financial systems and asset types, making the economic trail progressively harder to follow
- adverse reporting concerning the customer or associated businesses
- counterparties later becoming subject to sanctions for alleged involvement in unrelated high-risk financial networks
None of those factors is proof of criminality. However their cumulative effect should affect the level of scrutiny applied.UK AML rules requires enhanced due diligence where transactions are unusually large or unusually complex relative to their context, where there is an unusual pattern of transactions or where activity lacks an apparent legal or economic purpose. Enhanced measures can include obtaining additional source-of-funds information and increasing ongoing monitoring.
Sanctions screening cannot stop at onboarding
Perhaps the most useful lesson from this case concerns the timing of sanctions. The NCA says companies which paid money into ENEX’s Chinese accounts have since been designated under US sanctions. In other words, a sanctions screening system looking only for an exact match at the moment a customer was onboarded could have produced a clean result.
That did not necessarily mean the risk was clean. Sanctions lists change constantly. Companies can be designated after a transaction has occurred. Previously unknown connections between businesses and designated persons can emerge. Ownership structures change. Governments publish new intelligence about front companies, intermediaries and circumvention networks.
This is why effective sanctions controls require re-screening. Customers and transactions should be screened against updated sanctions lists and that effective re-screening should identify activity that may indicate sanctions breaches. Risks also include corporate vehicles used to obscure ownership or source of funds, transactions inconsistent with customer profiles and the use of higher-risk crypto wallets as areas requiring particular attention.
For UK businesses, the relevant legal question will ordinarily begin with UK sanctions. A US designation does not automatically create a UK asset freeze obligation for every UK company, although organisations with a US nexus can face direct US obligations as well.
Even where US sanctions do not create a direct UK prohibition, an OFAC designation can still be highly significant financial crime intelligence. A counterparty being accused by a major sanctions authority of acting as a front for illicit Iranian oil revenue or transferring money connected to the Quds Force is information that should immediately feed back into AML risk assessment, transaction monitoring and, where appropriate, consideration of suspicious activity reporting.
Follow the transaction, not simply the customer
This case also demonstrates how sanctions evasion can occur several steps away from a designated person or entity. The customer facing the UK institution may appear legitimate. The immediate payer may be another apparently ordinary commercial company. The sanctioned connection may sit two or three entities further back in the transaction chain.
This is increasingly central to sanctions enforcement. In May 2026, the FCA published findings from its work examining sanctions controls across more than 150 financial firms. Among the evasion techniques it identified were the use of third parties and intermediaries to obscure sanctioned connections and the routing of funds through cryptoasset or e-money wallets.
That description bears obvious similarities to the typology identified in the ENEX investigation, even though there has been no finding that the UK EMIs involved breached their obligations. For higher-risk relationships, firms therefore need to consider whether they understand not only who their customer is, but also who is funding them, where that money originated and whether the transaction makes sense against the customer’s stated business model.
Crypto conversion is another reason to look more closely
The involvement of cryptocurrency is a strong reason to consider the translation as high risk. The FCA and other UK authorities have specifically warned that cryptoassets can be used in attempts to circumvent sanctions. Their guidance identifies transactions involving high-risk wallets, obfuscation techniques and activity inconsistent with a customer’s profile as potential warning signs.
The FCA has also demonstrated its willingness to take enforcement action where weaknesses in e-money controls expose firms to crypto-related financial crime risks. In 2024, CB Payments Limited was fined more than £3.5 million after failures resulted in thousands of customers classified as high risk receiving e-money services despite restrictions imposed on the firm. Those customers subsequently conducted hundreds of millions of dollars of cryptoasset transactions through other Coinbase entities.
An AML system monitoring fiat payments without understanding what happens when funds move into crypto can miss the very stage of a transaction that presents the greatest laundering or sanctions-evasion risk.
Screening technology also needs human judgement
Sanctions controls have become increasingly automated. Recent enforcement shows why firms cannot assume that purchasing a screening system solves the problem.
In January 2026, OFSI imposed a £160,000 penalty on Bank of Scotland after transactions involving a designated individual were processed because automated screening failed to identify a variation of the person’s name.
OFSI subsequently highlighted weaknesses in screening, escalation and training as practical lessons from the case and urged firms to consider whether systems could cope with spelling and transliteration variants.
The ENEX case presents the opposite problem. A sophisticated screening system may have worked exactly as designed and still not identified companies that had not yet been designated. That is why sanctions programmes need both list screening and broader risk intelligence.
