Most AML controls ask one question: where did this money come from? Proliferation financing can give a perfectly good answer. The funds may come from lawful trade, and the payment may be for a machine tool or a steel part. What is hidden is who will use it, and for what. That is why a programme tuned for criminal proceeds can miss it entirely.

A different kind of risk

Proliferation is the spread of nuclear, chemical and biological weapons, the systems that deliver them, and the materials and know-how used to build them. Proliferation financing (PF) is the money and the financial services behind that spread.

It does not behave like money laundering. Laundering starts with dirty money and tries to make it look clean. PF often starts with clean money. FATF guidance notes that it can be funded from legitimate trade, such as natural resources or dual-use goods, as well as from smuggling, drug trafficking and cyberattacks. If the funds are not the proceeds of crime, money laundering laws may not apply at all.

The FATF's 2008 typologies report put the problem plainly: the risk is greatest when the money is lawful and what is concealed is the buyer, or the true nature of the goods. By 2010 the FATF was also noting that PF has no financial pattern unique to it, that banks lack the technical knowledge to judge the goods, and that the trade cycle is broken into many pieces.

The stakes are also different. The FATF's 2021 guidance compares the potential harm with the loss of life seen in terrorism, not with ordinary financial crime.

Two definitions, and why the narrow one matters

There is no single international definition, and teams often talk past each other because the FATF uses the term in two ways.

  • The broad view. In 2010 the FATF described PF widely, covering funds or services used to make, acquire, move, broker, stockpile or use these weapons and related materials, including dual-use goods. The FATF itself called this definition provisional.
  • The narrow duty. Since October 2020, Recommendation 1 has required countries and institutions to assess and reduce PF risk. In that Recommendation the phrase means one thing only: the potential breach, non-implementation or evasion of the targeted financial sanctions in Recommendation 7.

The practical point: the FATF requirement is anchored to sanctions. A firm may choose to look at wider proliferation risk, and many should, but it needs to know which of the two it is assessing.

What the sanctions require

The UN works on two levels. Resolution 1540 (2004) applies to every state. It requires them to stop non-state actors from obtaining these weapons, including by financing them, and to control exports and the financing and services linked to them. Then there are country-specific sanctions. For the DPRK, resolution 1718 (2006) and later resolutions require states to freeze the assets of designated persons and entities.

FATF Recommendation 7 turns those sanctions into an operating rule. Assets of designated persons and entities must be frozen without delay, and no funds may be made available to them, directly or indirectly. Four details shape how a team works:

  • "Without delay" means, in the FATF Glossary, ideally within a matter of hours of a UN designation.
  • No warning. The freeze is made without prior notice to the person concerned.
  • It reaches past the name. It covers assets owned or controlled directly or indirectly, alone or jointly, and those of anyone acting on a designated person's behalf or at their direction.
  • It is rule-based. The freeze applies whatever the institution's risk rating. Risk assessment supports it; it does not replace it.

One further point surprises people: the FATF Standards themselves do not require a suspicious transaction report for PF, although many countries do.

How a sanctioned party reaches a bank through layers: a designated party works through a front company, an intermediary in a third country and a vessel with a changed identity, so the customer the bank sees looks ordinary and does not match any name on the list. WHERE A NAME CHECK STOPS Designated partyon the UN list Front companynew name · short life Intermediarybroker · third country VesselAIS off · new identity Your customerlooks ordinary THE NAME ON THE PAYMENT IS RARELY THE NAME ON THE LIST
Each layer changes the name a bank sees. Ownership, control and shared details are what link the customer back to the list.

How networks get around the list

Proliferation networks spread their activity across many countries on purpose. FATF guidance warns that a country with no cases of its own is not therefore low risk: UN investigators traced DPRK-linked payments through countries in Africa and Europe.

The methods fall into a few families:

  • Companies that come and go. Front and shell companies set up quickly and used briefly, sometimes a different one for each transaction. After a designation, networks re-register under new names.
  • Payments that hide their origin. Layering through correspondent banks, and wire stripping, where payment message details are removed or altered so screening misses them.
  • Trade paperwork. Forged documents, false end-use certificates and routing through transhipment hubs and free trade zones to hide the real destination.
  • Ships. The UN Panel of Experts' final report in March 2024, and a 2020 US Treasury, State Department and Coast Guard advisory, describe AIS transponders switched off or spoofed, ship-to-ship transfers, false flags, and vessel identity laundering, where a ship takes a new IMO number by posing as newly built.
  • Stolen crypto. The Panel said in 2024 it was investigating 58 suspected DPRK cyberattacks on cryptocurrency companies between 2017 and 2023, worth about US$3 billion. These are the Panel's estimates, not court findings.
Sanctions evasion rarely breaks the name check. It goes around it.

What good looks like in practice

The FATF's own cases show what a careful process can see. In one, a US medical-supply company exported nuclear power plant equipment without a licence, routed through the Netherlands and Cyprus towards Iran. Ten containers were declared at US$20,000, when shipping one empty container cost about US$2,000. The business did not fit the goods, and the value did not fit the freight. In another, a front company's account-opening papers used the same address and phone number as a company already designated. That link led to the front companies being designated too.

Five questions show how ready a programme is:

  1. Do we screen beyond names? Sanctions reach those owned, controlled or acting for a designated person, so beneficial ownership and control matter as much as the list.
  2. How current are our lists, and how fast do we act? FATF guidance names delays in screening, out-of-date lists and poor name matching as usual causes of breaches.
  3. Do we test fit? Does the customer's business match the goods, the destination and the declared value?
  4. What do we ask when risk is higher? End use and end user, source of funds, and export licences or end-user certificates.
  5. What happens next, and is it recorded? Consult the authorities, pause, refuse or exit, and keep the reasons. The guidance does not expect zero failures, which is why the record of what was checked matters.

Two cautions. Be realistic about what a bank can see: the FATF noted in 2008 that banks know far less about end users than exporters and customs do. And do not de-risk blindly. The 2021 guidance says avoiding risk is not the same as managing it.

The UN picture is also moving. In 2024 a Russian veto ended the Panel of Experts that monitored DPRK sanctions, though the sanctions remain in force. For Iran, a "snapback" process began on 28 August 2025, and the UN Secretariat and most Council members treated the earlier UN measures as restored from late September 2025. Russia, China and Iran dispute this. Always check the current UN Security Council Consolidated List and your national authority's instructions.

In Kenya, the 2022 ESAAMLG mutual evaluation rated Kenya non-compliant on Recommendation 7, finding no legal framework for proliferation sanctions. Kenya amended its laws in 2023 to cover PF. As ESAAMLG described in 2024, regulations made in 2023 define "without delay" as within 24 hours of a UN designation, and frozen assets must be reported within 24 hours. ESAAMLG re-rated Kenya partially compliant on Recommendation 7 in 2024. Check the current law and ratings.

Our free course Advanced: Proliferation Financing covers the framework, evasion methods, red flags and real cases in depth, with a knowledge check and a certificate.

Sources