In July 2026, shipping data revealed that more than $1.6B of Russian diesel, fuel oil, and other petroleum products had flowed through a storage hub on Indonesia's Karimun island, just 23 miles from Singapore – blended with other crude to disguise its origin before re-entering global markets [1]. 

That same hub's connection to Singapore isn't incidental: the island forms part of Indonesia's Batam-Bintan-Karimun Free Trade Zone, a region closely connected to Singapore through trade, investment, and supply chains. Roughly 40% of the hub's total exports between October 2025 and April 2026 went to Singapore's Jurong Island [2].

For financial institutions in Singapore, the case illustrates how sanctions exposure can emerge through activity beyond national borders and within interconnected commercial networks.

Hong Kong faces a similar challenge. Weeks after the Karimun revelation, the US Treasury sanctioned a Hong Kong-registered firm alongside an Iranian bank official, unwinding part of an Iranian money-laundering network that had used the territory's financial infrastructure to move funds [3].

Neither case can be understood through name screening alone. Singapore and Hong Kong sit at the intersection of capital flows, commodity movements, and correspondent banking corridors exposed to this kind of evasion – and modern sanctions compliance increasingly depends on understanding structure and movement, not just matching names against a list.

The Structural Nature of Modern Sanctions Risk

Modern sanctions regimes increasingly create structural forms of exposure. Sectoral restrictions, export controls, price caps, dual-use goods constraints, and activity-based prohibitions mean exposure often arises from participation in a transaction chain rather than direct interaction with a designated person. 

The Karimun blending operation is a case in point: individual shipments may not present an obvious direct connection to a sanctioned entity, while the pattern, viewed in aggregate, can indicate potential sanctions circumvention.

Transshipment, rerouting through third countries, and the use of intermediary trading entities are not inherently suspicious – they are features of global commerce. The supervisory challenge is distinguishing legitimate structuring from deliberate evasion.

Detecting Behaviour That Never Touches a List

Modern evasion strategies rely on indirection: proxy buyers procuring restricted goods through unrelated trading firms, front companies incorporated in low-risk jurisdictions while beneficial control stays opaque, shipping routes altered mid-voyage, and payment flows fragmented across correspondent chains.

Behaviour-based sanctions detection identifies these patterns through signal aggregation rather than isolated red flags. Relevant indicators in trade-centric jurisdictions include:

• Newly incorporated trading entities repeatedly involved in high-risk commodity flows.

• Business profile inconsistencies between a customer’s stated activities and the goods being financed.

• Unusual routing patterns that repeatedly divert through known transshipment jurisdictions.

• Complex ownership structures, including circular or unusually layered corporate relationships.

• Concentrated payment corridors through sensitive trade routes without a clear commercial rationale.

None of these signals independently prove evasion. Collectively, they may indicate elevated exposure – the analytical task is correlating weak signals across trade, payment, and corporate data without overwhelming operational teams.

Data Architecture for Behaviour-Based Surveillance

To detect structural evasion of the kind seen at Karimun, banks must look beyond names and addresses. 

The most material data enhancements in both jurisdictions include:

• Shipping and logistics intelligence – vessel tracking, port call histories, and bill of lading data that can expose inconsistencies between declared and actual routing.

• Corporate network analysis – graph-based modelling to uncover beneficial ownership links and relationships between entities.

• Geospatial mapping – mapping transaction flows against sanctions-sensitive regions and trade routes.

• Device and IP intelligence – identifying coordinated account access or connections between seemingly unrelated entities.

• Payment corridor metrics – tracking concentrations of activity through specific correspondent banks or higher-risk routes.

The challenge in both jurisdictions is not the availability of data but its integration. Large banking groups often operate across multiple booking centres and legacy platforms; without architectural alignment, signal fragmentation undermines analytical value.

Risk Scoring Cross-Border Corridors

In today's sanctions environment, corridor risk increasingly needs to be assessed dynamically rather than treated as static. A sanctions-sensitive corridor may be defined by a combination of factors, including:

• Controlled or dual-use trade volumes – significant movement of commodities subject to restrictions or heightened scrutiny.

• Intermediary jurisdictions – routing through locations associated with transshipment or rerouting.

• Correspondent concentration – flows concentrated through particular correspondent institutions.

• Exposure to restricted sectors – links to industries or commodities subject to measures such as price caps.

• Historical enforcement patterns – previous sanctions cases involving similar routes, entities, or transaction structures.

Recalibration frequency should reflect risk volatility, with event-driven reviews following material developments – the Karimun revelations being a clear trigger point for institutions with Singapore-linked commodity exposure.

Transitioning Without Disrupting Production

A central tension for institutions in Singapore and Hong Kong is introducing behavioural analytics without destabilising established screening operations. Abrupt shifts that generate alert surges or model opacity can create supervisory concern.

A hybrid model offers a practical path: traditional list screening remains the primary control for direct exposure, while behaviour-based analytics operate in parallel as intelligence layers prioritising enhanced due diligence.

Over time, as calibration improves, behavioural outputs can inform risk scoring and escalation pathways more directly. Critical safeguards include clear documentation of model logic, defined escalation thresholds, independent validation, and transparent communication with supervisors where material changes occur.

Explainability and Supervisory Confidence

The Monetary Authority of Singapore (MAS) and Hong Kong Monetary Authority (HKMA) place significant emphasis on model governance and technology risk management. MAS's most recent quarterly enforcement disclosures underline a continued focus on systems and controls failures, not just individual breaches [4].

Behaviour-based sanctions models must be explainable in practical terms. It is insufficient to demonstrate predictive accuracy – institutions must articulate why specific patterns indicate elevated sanctions exposure and how decisions remain subject to human oversight. 

Documentation should address data provenance, feature selection rationale, testing methodology, escalation and override mechanisms, and ongoing recalibration.

Measuring Exposure for Boards and Senior Management

One of the most persistent gaps in sanctions governance is reliance on alert volumes as a proxy for risk. 

Behaviour-based frameworks enable more meaningful metrics, including:

• High-risk corridor exposure – the proportion of trade flows passing through higher-risk routes.

• Sensitive commodity exposure – the concentration of indirect exposure to controlled or sanctions-sensitive goods.

• Network anomalies – the frequency of unusual connections involving newly incorporated intermediaries.

• Detection responsiveness – the time between the emergence of new evasion typologies and their identification within the institution.

• Escalation outcomes – the proportion of behavioural escalations that result in enhanced due diligence.

Boards increasingly ask not how many alerts were processed, but whether the institution can evidence control over evolving sanctions risk. Behavioural metrics offer a more meaningful view of exposure.

A Regional Imperative

Singapore and Hong Kong occupy pivotal roles in global commerce, and with that position comes exposure to evolving sanctions evasion techniques – as this summer's Karimun blending scheme and the Iranian laundering case both demonstrate. 

Behaviour-based surveillance is not a rejection of list screening; it is a necessary extension of it.

Institutions that integrate behavioural detection thoughtfully, with robust governance and clear supervisory engagement, will be better positioned to demonstrate resilience. Those that rely solely on static list screening may find that changes in sanctions risk continue to outpace their controls.

The evolution towards behaviour-based sanctions surveillance is therefore less about technological ambition and more about aligning control frameworks with the realities of modern risk. 

In trade-intensive financial centres, that alignment is becoming central to credible compliance

Silent Eight's Iris 7 AI Agents for financial crime compliance help institutions put these principles into practice. 

Across customer and payment screening, AI Agents investigate sanctions alerts using wider context, apply institutional policy consistently, and produce explainable, auditable decisions – helping teams look beyond isolated list matches while keeping human expertise focused on genuine risk.