When Sanctions Screening Is Not Enough: Why KYC and CDD Must Follow the Supply Chain

How can a microchip manufactured for an entirely legitimate civilian purpose ultimately end up inside a missile?

That uncomfortable reality sits at the heart of a recent investigation discussed on The Daily, The New York Times' podcast. In the episode, investigative reporter Jane Bradley describes how sanctioned and restricted technology appears to have continued reaching Russia through intermediaries and logistics networks despite extensive Western restrictions.

For KYC, AML and compliance teams, the story raises an important question: is checking whether your immediate customer appears on a sanctions list really enough? Increasingly, the answer to that is no.

What does sanctions due diligence actually require?

Effective sanctions due diligence means understanding more than whether a counterparty appears on a sanctions list. Organizations may also need to consider ownership, geography, intermediaries, end users, end use, transaction patterns and whether goods could be diverted through third countries.

This becomes particularly important for dual-use products: goods, software or technologies that have legitimate civilian applications but can also have military or strategic uses.

The organization selling the product may never deal directly with the sanctioned country or sanctioned entity, which is what makes diversion so difficult to identify.

What can The Daily's investigation teach compliance teams?

In the August 14, 2026 episode, The Daily describes an alleged Russian military intelligence procurement operation operating in Japan. According to the reporting, the network sought Japanese technology and used companies and logistics intermediaries to help acquire and move components towards Russia.

Bradley describes the Russian military intelligence unit involved as “a specialized spy unit that's entirely dedicated to evading Western sanctions.” The Daily, “The Secret Spy Network Feeding Russia’s War Machine,” August 14, 2026.

The broader concern is not limited to explicitly military equipment. The investigation focuses heavily on components with ordinary commercial uses, including microchips and other technology that can potentially be incorporated into drones, missiles and weapons manufacturing.

This is a recognised sanctions-circumvention risk. G7 guidance coordinated through authorities including the U.S. Bureau of Industry and Security warns that Russia uses transshipment agents and third-country networks to divert dual-use technologies and controlled goods. It specifically calls on participants throughout the supply chain to consider end users, end uses, unusual routes, inconsistent documentation and other diversion indicators.

The counterparty may look legitimate

One of the most important lessons from the podcast is how ordinary the companies involved can appear.

The investigation describes logistics businesses carrying out seemingly normal commercial activities. One business owner told Bradley that he transported medical equipment and cosmetics and denied knowingly shipping sanctioned goods.

But then, the story turns based on something remarkably simple: an invoice.

Bradley recounts leaving an interview with a partially redacted invoice. When she later held the document up to the light, the redactions could still be read. The receiver, according to the reporting, was a Russian pharmaceutical company whose founder had been sanctioned by several countries.

The discussion captures one of the recurring defenses Bradley says she has encountered while reporting on sanctions evasion: “we didn't know Russia was the final destination.” Another is that companies simply relied on documentation that later proved unreliable.

For compliance teams, this is the critical point: A counterparty can exist legally. It can have an office, employees, customers, invoices and apparently legitimate commercial activities. Traditional sanctions screening may therefore produce no immediate match. However, that does not mean there is no risk.

KYC needs to answer more than “Who are you?”

KYC is sometimes reduced to identity collection: company name, registration information, directors, beneficial owners and supporting documents, which are indeed fundamental. But good KYC is much more than mere data and document collection. Higher-risk situations require a deeper question:

Does what we know about this counterparty make sense in the context of the transaction?

Consider a company purchasing sophisticated electronic components that has little trading history in those products. Or an established distributor suddenly experiencing significantly higher volumes involving jurisdictions commonly associated with Russian transshipment. Or a logistics provider that cannot clearly explain the ultimate end user.

None of these circumstances automatically demonstrates wrongdoing. They are signals that may justify further due diligence.

European Commission guidance on Russian sanctions circumvention specifically recommends enhanced due diligence for high-risk sectors and complex supply chains. It highlights risks including third-country diversion, unusual increases in exports, changes in ownership or business activity and inadequate information about end users or destinations.

CDD should test the commercial story

Customer Due Diligence should enable compliance teams to build enough context to determine whether the relationship makes sense:

Who owns the company? Who controls it? Where does it operate? What products does it normally buy or sell? Who are its customers? What countries are involved? What is the stated end use? Are there intermediaries? Does the proposed shipping route make commercial sense?

Answers to these questions should prompt one important question to the KYC / AML / CDD team: Do the answers conflict with the “storyline”?

The G7 guidance identifies abnormal shipping routes, inconsistent trade documentation, incomplete end-user information, resistance to providing additional information and unexplained changes to shipping instructions as potential sanctions-evasion red flags.

This demonstrates why sanctions compliance cannot be treated simply as a list-matching exercise. Screening tells you something important. KYC and CDD provide the context needed to understand what that screening result actually means.

Dual-use products require a risk-based approach

Dual-use goods are products, software or technologies that have a legitimate civilian application but can also be used for military or strategic purposes. The concept is not always intuitive. Some items are clearly sensitive, while others sit in a grey zone where their potential misuse only becomes apparent in context.

Traditional examples include fertilisers and certain chemicals, which are widely used in agriculture but can also be repurposed in the manufacture of explosives. Similarly, industrial machine tools can be used for standard manufacturing processes but may also be used to produce components for weapons systems. Even navigation or imaging technologies can fall into dual-use categories depending on their specifications and end use.

Increasingly, however, the dual-use nature of products is not obvious at all. Semiconductors are a good example. In everyday commercial settings, they are embedded in consumer electronics, vehicles, medical devices and industrial systems. Yet the same components can also be used in advanced military systems, including drones, missile guidance systems and surveillance technologies. Whether a semiconductor is considered dual-use may depend on its performance characteristics, its configuration and, critically, who is buying it and for what purpose.

Thus, this issue is particularly significant for companies manufacturing or distributing dual-use goods - whether that is obvious or not.

A semiconductor, sensor, machine tool or electronic component may be completely legitimate in isolation. The risk emerges from the combination of product, counterparty, jurisdiction, end user and end use.

Japan itself participates in the Wassenaar Arrangement, which exists partly to promote greater responsibility around transfers of conventional arms and dual-use goods and technologies.

For companies operating internationally, this means product risk and counterparty risk increasingly need to be considered together.

A sophisticated compliance program should be capable of escalating due diligence where particular products, counterparties, routes or jurisdictions create a higher risk of diversion.

KYC is not a substitute for export controls, but it is part of the defense

KYC platforms cannot determine export-control obligations on behalf of a company, and KYC should never be treated as a substitute for specialist sanctions or export-control analysis.

But strong KYC processes can provide the information needed to identify when further investigation is warranted, which is equally important.

Structured KYC collection can help organizations document ownership information, expected activities, geographic exposure, counterparties and supporting evidence. Screening can identify sanctions, PEP, adverse media and other risk indicators. Ongoing due diligence can then help identify whether something meaningful changes after onboarding.

For high-risk and dual-use corporates, that combination is key, since the objective is not to prove that every counterparty is risk-free (which is impossible). The objective is to understand enough about your counterparties and their activities to recognize when the facts no longer fit the expected story.

Sanctions effectiveness ultimately depends on what happens beyond the list

The story told by The Daily is compelling because it takes sanctions policy out of the abstract.

Investigators are reportedly finding commercially manufactured components inside weapons recovered after attacks in Ukraine. Networks of intermediaries can potentially separate the original manufacturer from the ultimate destination by several transactions, companies and countries.

It shows that due diligence matters, and sanctions lists remain essential. Sophisticated sanctions evasion is designed to avoid obvious matches, so the next stage of sanctions compliance therefore requires organizations to connect screening with KYC, CDD, product risk, geographic risk and ongoing monitoring.

“Is this counterparty sanctioned?” is not the only question anymore - especially for companies operating in complex global supply chains. It's also: “Do we understand who we are really doing business with, what they are doing with our products and where those products could ultimately end up?” which is a distinction couldn't be more important in today's geopolitical environment.

‍

Sources

The New York Times, The Daily, “The Secret Spy Network Feeding Russia’s War Machine,” August 14, 2026. https://www.nytimes.com/2026/08/14/podcasts/the-daily/secret-spy-network-russia-war-machine.html

The New York Times, “How Putin Turned Japan Into a Den of Spies,” July 12, 2026. https://www.nytimes.com/2026/07/12/world/asia/russia-spies-japan-war-drones-electronics.html?unlocked_article_code=1.xFA.7zb4.zlPy49Pat_Ys&smid=url-share

G7 Export Controls Sub-Working Group, Preventing Russian Export Control and Sanctions Evasion: Updated Guidance for Industry. https://www.g7germany.de/g7-en/issues/export-controls

European Commission, Guidance for EU operators: Implementing enhanced due diligence to shield against Russia sanctions circumvention. https://finance.ec.europa.eu/publications/guidance-eu-operators-enhanced-due-diligence-russia-sanctions-circumvention_en

U.S. Bureau of Industry and Security, Russia and Belarus Resources. https://www.bis.gov/russia-belarus-sanctions

Ministry of Foreign Affairs of Japan, Wassenaar Arrangement, January 2026. https://www.mofa.go.jp/policy/economy/wassenaar/index.html