Beware the Robots: AI-Enabled Sanctions Evasion is Here

This past January, the US Federal Bureau of Investigation issued updated guidance about North Korea’s IT labour networks, noting that they ‘...have been observed using artificial intelligence and face-swapping technology during video job interviews to obfuscate their true identities.’ Iran, too, is finding success in augmenting its global spear-phishing and social-engineering campaigns with AI.

While banks and other financial institutions are increasingly supplementing their compliance and monitoring capabilities with AI, most are geared towards financial crime and sanctions evasion as it currently stands, not as it is heading.

What Once was a Question of Emerging Technology is Now a Real Threat

AI is reshaping entire sectors of the global economy and changing how the world conducts business. Healthcare, manufacturing and finance, to name a few, stand to benefit from AI-enabled solutions that can make quick sense of complex data. The banking and finance sectors have been some of the earliest adopters, deploying AI tools to detect fraud, money laundering, terrorist financing and sanctions evaders. According to one recent survey of financial leaders, nearly 77% of banks have adopted or plan to adopt AI tools to augment their fraud detection, risk and compliance functions.

The problem, however, is that criminals, too, are rapidly deploying AI-enhanced tools, and with promising results. A recent study, for example, found that AI-enabled spear-phishing campaigns were nearly as effective as those generated by humans. Although exact figures are unknown, another survey suggests that a growing and significant number of fraud schemes involve the use of malicious AI.

This rapidly evolving landscape presents a significant challenge for global sanctions implementation and enforcement. While financial institutions and governments have invested heavily in AI to detect illicit activities, the very same technology is now being weaponised by adversaries.

A Radical Evolution of Sanctions Evasion

For the past several decades, sanctions-evasion methods have generally followed similar patterns with little in the way of significant innovation. Both North Korea and Iran heavily rely on obfuscation methods like the use of shell and front companies, falsified documentation, such as end-user certificates, and third-party countries to get around US and international sanctions. Often these methods take advantage of legal and regulatory gaps in monitoring and enforcement (for example, the use of secrecy jurisdictions) or the adoption of novel technologies. North Korea, for example, has become prolific in its virtual currency theft operations that generate revenues for its nuclear weapons and ballistic missile programs.

So, How are Sanctions-Evaders Adopting AI?

For one, AI can automate complex tasks, generate realistic deceptive content, and create layers of obfuscation that are significantly harder to penetrate. Most importantly, this can be accomplished at a scale and speed that most monitoring and enforcement mechanisms are unable to handle.

While conventional methods of sanctions evasion, such as the use of shell corporations, document falsification, and exploitation of offshore jurisdictions, remain prevalent, AI introduces a novelty and level of obfuscation that make detection far more difficult. Manually establishing and managing hundreds of interconnected shell companies, each with unique and non-overlapping details, is a monumental task prone to human error, which investigators often exploit. AI, however, can generate and manage vast networks of synthetic entities, complete with varied digital footprints, making them appear more distinct and significantly harder to link back to a common controlling interest – overwhelming traditional investigative techniques and rule-based detection systems, which are often designed to identify known patterns of illicit behaviour.

Consider, for example, that one of North Korea’s largest sanctions-busting networks, Ocean Maritime Management, consisted of dozens of shell companies registered in jurisdictions across the globe. AI-enabled systems could feasibly create hundreds, if not thousands, of such networks – all mathematically optimised to avoid monitoring and enforcement.

It is not just shady corporate structuring – malicious AI threatens all aspects of sanctions-evasion, including trade-based sanctions and export controls. Falsifying the nature, origin or destination of goods is a common tactic in trade-based money laundering and sanctions evasion. AI can be used offensively to analyse customs codes, tariff schedules and regulatory frameworks across multiple jurisdictions to identify the most effective and efficient ways to misclassify sanctioned goods or dual-use items to avoid detection or minimise duties. Furthermore, falsifying key shipping documents, such as bills of lading, certificates of origin and packing lists is a well-established method of sanctions evasion. Generative AI – a type of artificial intelligence that creates new content, such as text, images, videos and code based on user input – can produce convincing and internally consistent sets of fraudulent documents.

Is Anyone Ready For This?

This past month, the Financial Action Task Force (FATF), which is the global standard-setter for anti-money laundering, counterterrorist financing, and counterproliferation financing standards – released a report that provides important updates on the methods that WMD proliferation networks use to source dual-use goods and technologies and access the global financial system in contravention of international sanctions. Although the report acknowledges the potential threat of AI-enabled sanctions evasion, it notes the topic is ‘too nascent to draw conclusions’. Unfortunately, this lack of forward thinking may impinge global counterproliferation financing efforts. According to FATF, only 16% of countries assessed are deemed to have effectively implemented recommendations related to proliferation financing.

The problem is that governments, international organisations and private sector institutions currently are building and deploying AI-enabled solutions to look for sanctions-evasion now, and not how it is expected to evolve. The focus must adapt from looking for established red flags and typologies to anticipating adaptive, AI-driven obfuscation strategies that can learn from detection attempts and modify their tactics accordingly (in other words, adaptive adversarial AI).

Currently, however, several significant obstacles stand in the way of getting ahead of AI-enabled sanctions evasion. One is contending with outdated compliance and monitoring infrastructure across disparate sectors. Some jurisdictions, for example, still maintain paper-based customs monitoring systems. Many financial institutions, especially those in the developing world, still rely on individual reviews of suspicious activity. Such methods are highly vulnerable to AI-enabled attacks that can scale to levels that utterly overwhelm compliance, monitoring and enforcement.

Another is finding a balance between data privacy and consumer protection on the one hand and regulations that may hamper rapid adoption of AI-enabled tools on the other hand. The Financial Action Task Force, for example, found that while the use of AI can help ‘public and private sectors improve the effectiveness of their risk-based implementation of the FATF Standards’ such tools must remain ‘compatible with international standards of data protection, privacy, and cybersecurity.’

In some jurisdictions, regulatory approaches tend to be more sectoral, relying on existing authorities to address AI-related risks within their domains. The US, for example, remains a patchwork of regulations – often inconsistent from state to state and lacking overarching Federal regulations. While critics have claimed this approach threatens consumers, others have claimed that over-regulation would stifle innovation and adoption speed, threatening America’s economic positioning with the AI sector. The European Union has taken a decidedly different approach, with its landmark AI Act, which essentially establishes a risk-based framework for AI across industries and categorizes AI systems by risk level.

Ultimately, the question for policymakers is whether regulation will hamper or enable the ability of monitoring and enforcement systems to keep pace with the evolution of sanctions evasion, driven by adversarial AI. What we know for sure is that the era of AI-enabled sanctions evasion is here, and those that police sanctions implementation and evasion need to fundamentally rethink how they respond.

© RUSI, 2025.

The views expressed in this Commentary are the author's, and do not represent those of RUSI or any other institution.

For terms of use, see Website Terms and Conditions of Use.

Have an idea for a Commentary you'd like to write for us? Send a short pitch to ;commentaries@rusi.org and we'll get back to you if it fits into our research interests. View full guidelines for contributors.