Circumvention has a product code

Bottom line

Corridor exposure arrives in a firm’s data as a country, and it is written in the rules as a product code. The United States attaches a licence requirement to 53 six-digit tariff codes going to Russia, Belarus, the temporarily occupied Crimea region of Ukraine, and Iran. The European Union lists 50 codes in Annex XL to Council Regulation (EU) No 833/2014 and builds four separate obligations on that single list, among them the contractual prohibition on re-export that an EU exporter owes everywhere outside a short roster of partner countries. The Union’s dedicated anti-circumvention power, Article 12f, reaches a third country directly, and the annex carrying it has three columns: CN code, description, country. The country is a column. A jurisdiction risk score is the one instrument in a financial-crime program that holds none of these objects, and it is the instrument most programs reach for, because the country is the only one of the three that fills itself in. The control that matches the measures reads a code against the party that ordered it, in the direction it travels, through the product the firm is selling, and treats the jurisdiction as the thing that decides which evidence the firm goes out and gets.

1. The country is the evidence the firm already has

A payments or banking firm knows where its customer is registered, which bank sits on the other side of a payout, and which corridor the money runs down. Those fields arrive with the record. The goods arrive later, somewhere else, or by inference, and the counterparty’s real line of business arrives only when somebody looks it up.

FinCEN’s own analysis of what banks filed under the Russia export-control alerts states the problem plainly. Across 333 Bank Secrecy Act reports describing almost a billion dollars of suspicious activity, filed between 28 June 2022 and 12 July 2023, FinCEN records that in most cases the transaction details left the exported item unspecified, and that filers established the customer’s industry instead, through open-source research or their customer due diligence. The same report says the financial activity was flagged through customer due diligence, or through analysis of transaction information, bills of lading, and invoices, and through the filers’ own additional research. Every one of those is evidence a firm acquires on purpose.

So a program under time pressure answers the corridor question with the field it holds, and a jurisdiction score becomes the instrument of record. The score then carries a hidden claim: that exposure is distributed across countries the way the firm’s data is distributed across countries. The same FinCEN analysis supplies the counter-example. Of 1,795 subjects recorded in the fixed fields of those reports, the most frequently appearing subject country is the United States, with 976 references, followed by Russia with 322, China with 130, Hong Kong with 126, Turkey with 49, and the United Arab Emirates with 43. The United Kingdom, Canada, and Singapore each appear more often than any Central Asian state, while Armenia, Georgia, Kazakhstan, Kyrgyzstan, Tajikistan, and Uzbekistan all sit in the report’s footnote listing transshipment points. Part of that shape is structural, since the filers were US institutions and the exporter is US-based in nearly every matter. The rest of it is the point: the counterparties implicated in those reports were mostly resident in jurisdictions a country model scores as low risk, and a score steep enough to govern the corridor would have suppressed the population where the reports were actually filed.

A passport answers one question makes the mirror of this argument about a person: one country field asked to settle three separate sanctions tests. The failure here is the same economy of evidence applied to a counterparty’s trade.

2. What binds, and what advises

Read by layer, in the sense From rule to workflow gives the word.

Law. In the United States, Supplement No. 7 to Part 746 of the Export Administration Regulations lists 53 codes from the Harmonized Tariff Schedule and makes them the trigger for licence requirements under sections 746.6, 746.7, and 746.8, for the temporarily occupied Crimea region of Ukraine, Iran, and Russia or Belarus respectively. The supplement extends those requirements to eight-digit and ten-digit codes that open with the same six digits, and it reaches modified or purpose-designed parts, components, accessories, and attachments regardless of their own classification, setting aside ordinary fasteners and similar hardware. In the European Union, Article 12g of Regulation 833/2014 obliges exporters, since 20 March 2024, to prohibit re-export to Russia by contract when they sell, supply, transfer, or export the goods in Annexes XI, XX, and XXXV, the common high priority items in Annex XL, or the firearms and ammunition in Annex I to Regulation (EU) No 258/2012 to any third country other than the partner countries in Annex VIII. Paragraph 3 requires adequate remedies in the agreement; paragraph 4 requires the exporter to tell its competent authority as soon as it learns of a breach. Article 12f prohibits the sale, supply, transfer, or export of the goods in Annex XXXIII, irrespective of where they originate, to any person in the third country that annex specifies, and paragraph 2(b) extends the prohibition to providing financing or financial assistance for any such transaction. Article 1(o) defines that term as an action by which the person concerned disburses or commits to disburse its own funds or economic resources, listing grants, loans, guarantees, suretyships, bonds, letters of credit, supplier credits, buyer credits, import and export advances, and insurance and reinsurance, and it places payment of the agreed price for a good or a service, made in line with normal business practice, outside the definition. Annex IV lists persons whose dealings carry stricter export restrictions, and says in its own opening lines that it includes persons in third countries other than Russia, and that including a person leaves responsibility for that person’s actions with the person rather than with the jurisdiction they operate in.
Guidance. Supplement No. 3 to Part 732 of the EAR carries BIS’s “Know Your Customer” Guidance and Red Flags, which states that it leaves the EAR itself unchanged and uninterpreted. Its six steps make the duty to inquire conditional: absent an abnormal circumstance, a firm may proceed on the information it holds, and once a red flag appears in information reaching the firm, the duty to check out the suspicious circumstances attaches. A further step asks a firm to keep the normal commercial flow of information open, and treats an affirmative policy of avoiding unwelcome information as an aggravating factor in an enforcement proceeding. The red-flag list that follows is built from mismatches: a product whose capabilities sit outside the buyer’s line of business, a product incompatible with the technical level of the destination, a freight forwarder given as the final destination, a shipping route abnormal for the product and destination. FinCEN and BIS published two joint alerts for financial institutions, FIN-2022-Alert003 on 28 June 2022 and FIN-2023-Alert004 on 19 May 2023, both filed under the key term FIN-2022-RUSSIABIS. The supplemental alert highlights nine high priority codes, states that those codes appear on commercial invoices, packing slips, airway bills, sea bills, and other trade documentation, and urges due diligence on encountering one of them to identify possible third-party intermediaries. The Commission’s FAQs on Article 12g supply a model clause, including a best-efforts obligation down the commercial chain, a monitoring mechanism, treatment as a material breach of an essential element, a stated penalty percentage, and a two-week right to information. The United Kingdom published its own no-Russia clause guidance on 7 January 2025, aimed at those exporting and making available common high priority items, and left the clause voluntary: the guidance states that the UK government stops short of requiring it, that the business sets its own wording, and that including one can reduce the risk of being drawn into a suspected breach.
Policy. Which code lists the firm loads and at what granularity. Which documents it requires before it releases a payment against a corridor it has classified as exposed. Which stated lines of business call for corroboration. What it does where the item stays invisible, which is most of the time. Each of these belongs in the policy with an owner and a reason.
Convention. The jurisdiction risk score, inherited whole from the anti-money-laundering program and pointed at a question it was built for other reasons. Section 4 is about why it misses.

3. Three shapes, and the country is a column

Every published circumvention measure takes one of three shapes. Each shape names an object, and each object sits in a different place in a firm’s evidence.

Shape	Where it is written	What the firm has to hold
An item	Supplement No. 7 to Part 746 of the EAR; Annexes XL, XI, XX, and XXXV to Regulation 833/2014; Annex XXXIII, paired with a country	A classification for the goods, read off a document or inferred from the counterparty’s line of business
A counterparty	The Entity List in Supplement No. 4 to Part 744 of the EAR; Annex IV to Regulation 833/2014; the asset-freeze and transaction-ban lists	A resolved identity for both sides of the trade, and the ownership arithmetic behind each
A contract term	Article 12g, with the model clause in the Commission’s FAQs	A copy of the executed clause, the remedy it carries, and the breach notification when it fires

The item lists repay a careful reading, because there are four of them and they carry three different counts. BIS publishes the Common High Priority List, developed with the European Union, Japan, and the United Kingdom, as 50 items identified by six-digit codes in four tiers, of which the nine codes in Tiers 1 and 2 are prioritized. Those nine are the ones the FinCEN and BIS supplemental alert hands to financial institutions. Annex XL to Regulation 833/2014 holds 50 CN codes and serves Articles 2, 2a, 12g, and 12gb at once. Supplement No. 7 to Part 746 holds 53. The three extra US codes are 840710, 840890, and 840910, covering aircraft piston engines, compression-ignition engines, and parts for them; the other 50 match the EU annex code for code. Inside the EU obligation there is a further split, since Article 12g(2)(a) exempts the execution of contracts for five of its own Annex XL codes, the machine tools 8457 10, 8458 11, 8458 91, 8459 61, and 8466 93, from the clause requirement that the rest of the annex carries.

So a single six-digit code can stand in four places at once. Take 8457 10, machining centres for working metal. In the United States it triggers a licence requirement for four destinations. In the Union it sits in Annex XL, which Articles 2 and 2a refer to for their export prohibitions, and which Article 12g(2)(a) then exempts from the clause obligation the rest of the annex carries. And in the consolidated text of Regulation 833/2014 as it stood on 24 April 2026, it appears again in Annex XXXIII, the list of goods and technology and countries referred to in Article 12f, which has two rows, 8457 10 and 8517 62, each set against one third country, the Kyrgyz Republic.

That annex is the whole argument in one table. Article 12f is the Union’s country-level anti-circumvention power, available only where the Council identifies a third country as having systematically and persistently failed to prevent onward supply to Russia despite the Union’s prior outreach and assistance. It is the most country-shaped instrument in the regime, and the table it publishes has the product code as its primary key and the country as its third column. Because Article 12f(2)(b) reaches financing and financial assistance, that table binds a firm that puts its own funds behind the trade, at the level of a code it holds no field for.

The definition in Article 1(o) then adds a fourth dimension, and it is the one most useful to a fintech. The term covers an action by which the firm disburses or commits its own funds, and it places payment of the agreed price in line with normal business practice outside itself. So the same firm, on the same corridor, against the same code and the same counterparty pair, falls inside the prohibition when it advances funds against the trade and outside it when it settles the invoice. That is a distinction between two of its own products. A score attached to the customer’s registration country has nowhere to record it, and a register attached to the code, the pair, and the product has a column for it already. Where the prohibition stops, the general circumvention provision in Article 12 and the knowledge standard in the EAR keep running, which is the subject of Knowledge arrives after the payment.

A listing carries its own prohibition argues that the measure a record imposes decides which of a firm’s systems has to carry the control. The item lists extend that argument one step: the measure decides the system, and the object the measure names decides which evidence the system has to acquire before it can run at all.

4. The country model measures a different thing

By convention a firm’s jurisdiction risk score is the one its anti-money-laundering risk assessment already produces, and the clearest published account of what that score’s inputs measure sits in EU law. Annex III to Regulation (EU) 2024/1624 opens as a non-exhaustive list of factors and types of evidence of potentially higher risk referred to in Article 20, and its geographical factors read on: third countries under increased monitoring or otherwise identified by the FATF for compliance weaknesses in their systems for anti-money laundering and countering the financing of terrorism; third countries that credible sources such as mutual evaluations find lack effective systems; third countries with significant levels of corruption or other criminal activity; third countries subject to sanctions, embargoes, or similar measures; third countries funding or supporting terrorist activity; and third countries enabling financial secrecy. Annex II mirrors it on the low side, where the favorable facts are effective systems, low corruption, and requirements consistent with the revised FATF Recommendations.

Every one of those inputs describes the quality of a country’s own controls, or the country’s status as a target of measures. A corridor country is in a third position that the list has no slot for: a route to a target, with controls that may be adequate on their own terms, a government that may be cooperating, and a trade pattern that moves specified goods anyway. Factor (d) asks whether the country is sanctioned; the corridor question asks whether goods pass through it. The two questions have different subjects, and a score built from the first answers the second by coincidence.

That is a diagnosis rather than a complaint. The AML geography factor does its own job well, and the law frames it correctly as a factor among several, weighed with the customer, the product, and the channel. The error is a reuse: pointing an instrument calibrated on institutional quality at a question about the movement of listed items, and then treating its output as a decision.

The cost of the reuse runs in both directions. Raised high enough to catch a corridor, the score refuses customers whose trade the measures leave entirely open, and it refuses them wholesale, since a score applies to everyone sharing a registration country. Left where it sits, the score leaves the prohibited trade reachable through any country it scores below the threshold, which the subject counts in section 1 suggest is where much of it already runs.

5. What the jurisdiction decides

The jurisdiction holds real information, and the EAR red-flag structure shows where it belongs. The duty to inquire there attaches to an abnormal circumstance, and the circumstances the guidance lists are relational: the product against the buyer’s line of business, the product against the technical level of the destination, the route against the product and the destination. The country appears in each one as a term in a comparison rather than as a verdict on its own.

That gives a jurisdiction three operational jobs, all of them about evidence.

It sets what the firm asks for. On a corridor the firm has classified as exposed, the release of a payment requires a document that carries a classification, or a stated line of business corroborated against something outside the customer’s own file. On other corridors the firm proceeds on what it holds.
It sets which lists load. A firm with an EU entity, a UK entity, and US dollar clearing owes three different obligations on overlapping code sets, and the codes are only partly shared. The firm’s own footprint, rather than the customer’s country, decides which instruments apply.
It sets the review cadence. Code lists, annexes, and partner-country rosters all move. A corridor whose exposure the firm has accepted carries a date by which somebody re-reads the lists the acceptance was based on.

What the jurisdiction stops short of deciding is whether a particular payment is permitted. Nothing in any of the three regimes makes residence in a third country a prohibition, and Annex IV makes the converse explicit on its own face: listing a person established in a third country leaves the responsibility with that person rather than with the jurisdiction they operate in.

6. The pair, and the register that holds it

The unit the measures are written on is a pair with two qualifiers: an item and a counterparty, a direction of travel, and the product the firm itself is selling. A control shaped the same way has four parts, and a firm can build all four from public sources.

A code register. One row per controlled code, with the instrument that controls it in each regime, the obligation that follows, the firm’s own products that the obligation reaches, the destinations it attaches to, and the date of the version the row was read from. A single consolidated “high priority list” is the thing to avoid: the counts differ, the carve-outs differ, and the obligations differ. From recurring question to durable control is about the governance such a register needs to stay true.
A line-of-business map. Where the item stays invisible, the usable substitute is the one both FinCEN and BIS point at: the counterparty’s line of business against the goods in question. That requires the firm to hold a line of business specific enough to contradict something, which is a question about the onboarding form rather than about the screening engine.
A direction and history test. The supplemental alert’s three fact patterns all turn on the importer’s own trajectory: a company with no prior exports, a company that received exports without the listed codes before a control date, and a company that saw a significant spike afterwards. Its three diligence items read the same way, covering the date of incorporation, the consistency of the line of business with the items ordered, and whether a physical address and a public-facing presence hold up. All three are properties of a party and its history, and a firm’s own payment record holds most of them already.
A document trigger and a hold. Codes live on invoices, packing slips, airway bills, and sea bills. A firm that touches those documents can read them; a firm whose products keep it clear of them should say so in writing and rely on the other three parts. When a code does surface after settlement, the finding has to reach the next payment rather than a file, which is the argument of Knowledge arrives after the payment, and the point where the EAR’s knowledge standard starts to run.

Ownership resolution sits underneath all four, since an intermediary’s relevance often lies in who owns it rather than where it sits, and the arithmetic for that question has its own hazards, set out in One cap table, several answers.

A worked hypothetical

The following scenario is hypothetical and is included only to illustrate the framework. The firm, the customers, and the counterparties below are invented.

A cross-border payments company holds an EU payment institution licence and a UK entity, and clears US dollars through a correspondent. Its financial-crime program screens parties against sanctions lists and scores each customer’s registration country on a five-band jurisdiction model carried over from its AML risk assessment. Central Asia sits in band four, which applies enhanced due diligence at onboarding and a lower payment-review threshold. Four matters run through one month.

Matter	What the country model said	What the measures said	What the firm did
A three-year-old electronics distributor in a band-four country, paying a long-standing German supplier, invoices naming 8542.31 microcontrollers	Band four, enhanced due diligence applied at onboarding	8542.31 sits on every published item list, and the German exporter owes the contractual re-export prohibition on this sale	Released, since the alerts were clean and the diligence was complete
A band-two freight forwarder drawing an import advance from the firm against goods under 8457 10, destination recorded as the Kyrgyz Republic	Band two, standard handling	Article 12f prohibits the supply, and paragraph 2(b) reaches the advance	Released
A newly incorporated machinery trader in a band-four country whose stated business is construction materials, ordering 8458 11 lathes	Band four, enhanced due diligence applied	The ordered items contradict the stated line of business, which is the first relational red flag in the EAR guidance	Released after the enhanced file was completed with registration documents
A band-five customer running ordinary retail remittances to family accounts	Band five, flagged for exit review	No measure reaches the activity	Offboarded, and the corridor closed to new customers

Reading it through the framework.

The electronics distributor. The code on the invoice is one of the nine the US prioritized and the EU lists in Annex XL. The firm had the document and read it for the amount. The relevant fact sat in a field the program had no register to compare against, so the enhanced diligence the country score bought was spent on identity rather than on the item.
The freight forwarder. This is the expensive one. The advance commits the firm’s own funds against the trade, which is what Article 1(o) describes, so paragraph 2(b) reaches it directly; settling the same invoice at the agreed price would have sat outside that definition and inside Article 12’s circumvention provision instead. The code and the destination were both on the paperwork, the counterparty’s own country scored low, and the exposure arrived through the product rather than through the customer. A forwarder given as a destination is itself one of the EAR’s listed red flags.
The machinery trader. Caught by the score, resolved by the wrong test. The file closed because the registration documents were in order, where the available signal was the contradiction between lathes and construction materials, together with an incorporation date after the control date. A reviewer equipped the way A human in the loop needs a job description specifies would have been told which comparison to run.
The retail remittances. The cost side, and the one that stays off every dashboard. The firm gave up revenue and a customer relationship for exposure the measures leave untouched, and it recorded the outcome as a control working.

What would have caught it. A code register loaded from all four published lists, with the obligation per regime. The codes on trade documents the firm already receives, extracted at the point of receipt rather than at the point of dispute. A stated line of business specific enough to contradict an order, captured at onboarding. The counterparty’s trade history with the customer, measured against the control date, which the firm’s own payment record holds. And a jurisdiction band that buys evidence instead of spending refusals.

7. Failure modes

One consolidated item list. Four published lists merged into a single internal table. The firm then applies the US count to an EU obligation, or holds the clause obligation against five codes the Union exempts from it.
A country score used as a decision. Refusals recorded with a band as their authority. The record of the refusal then cites a number that appears nowhere in the measures, which is a defect both in the decision and in its documentation.
Line of business too coarse to contradict anything. “Wholesale trade” as a value makes the single most useful substitute test unavailable, and the fix sits in the onboarding form.
Codes read for price and discarded. Trade documents arrive, feed the amount, and leave nothing behind. The item was present and the firm chose to hold it for one purpose.
The clause treated as the exporter’s paperwork. A firm financing or settling a trade can ask for the executed clause, and the exporter’s own notification duty on breach makes it an evidence source the firm can plan around rather than a document belonging to somebody else.
An accepted corridor with no expiry. Code lists, annexes, and partner rosters move, and an acceptance grounded in the version current at the time quietly becomes an acceptance grounded in nothing.
A dashboard that counts refusals. Refused payments and offboarded customers both look like control activity. A program reporting volume rather than the authority cited will report the retail remittance exit and the band-two financing release as a good month.

What this changes operationally

A financial-crime owner publishes the code register, with each code mapped to the instrument that controls it in each regime, the obligation it creates, and the destinations it attaches to, and treats a code held without all three as an open finding with a date.

A product or onboarding lead makes the line of business a value specific enough to contradict an order, and places the trade-document fields the firm already receives where a control can read them.

A data owner extracts classification codes from the documents at receipt, stores them against the payment and the counterparty pair, and keeps the counterparty’s trade history with the customer in a form a control can query against a control date.

A sanctions or trade lead asks what the firm’s position in each chain actually lets it see, and writes down, for each product, whether the item evidence is available, substitutable, or absent, and whether that product commits the firm’s own funds or settles an agreed price, since the two sit on different sides of the EU financing prohibition. A product where the item evidence is absent gets its controls from the pair and the paper instead, stated as such.

A commercial owner signs the corridors the firm has decided to leave, with the exposure named and dated, since a corridor closure is a revenue decision and a corridor acceptance is a risk decision, and the same person should hold both.

An operations lead reads each month’s refusals by the authority cited, and treats a refusal whose only authority is a jurisdiction band as a defect in the control design rather than in the analyst.

Limitations

This concerns where circumvention exposure is written down and which evidence a control therefore has to acquire. It offers no legal view on any counterparty, corridor, code, or listing, no thresholds, and no screening configuration, and it describes no institution’s program. Whether a given item falls inside a classification, whether a firm’s activity falls inside a prohibition, and which regimes bind which of its entities are questions for counsel and turn on where the entities are established and how they are licensed. Code lists and annexes change continually: the counts here reflect Supplement No. 7 to Part 746 as published in the current eCFR, the BIS Common High Priority List page dated 23 February 2024, and the consolidated text of Regulation 833/2014 as it stood on 24 April 2026. The subject-country counts from FinCEN’s trend analysis describe one dataset of 333 reports filed by mostly US depository institutions over roughly a year, and they measure where filers recorded addresses rather than where diversion occurred; they are used here only to show that the population is reachable through low-scoring jurisdictions. Belarus, Iran, and other regimes carry their own item lists and their own anti-circumvention structures, which resemble these without matching them.

A code register solves an evidence problem and leaves a judgment problem standing. Whether an order is consistent with a line of business, and whether an explanation resolves a mismatch or merely restates it, stays a question a reviewer decides on the facts, equipped the way A human in the loop needs a job description sets out. The design records which comparison the reviewer ran and on what evidence, so a later reader can see what the decision knew.

Primary sources

US Department of Commerce, Bureau of Industry and Security. Supplement No. 7 to Part 746 of the Export Administration Regulations, Items That Require a License Under § 746.6 When Destined to the Temporarily Occupied Crimea Region of Ukraine, Under § 746.7 When Destined to Iran, and Under § 746.8 When Destined to Russia or Belarus, paragraphs (a) and (b) and the HTS-6 table.
US Department of Commerce, Bureau of Industry and Security. Supplement No. 3 to Part 732 of the EAR, BIS’s “Know Your Customer” Guidance and Red Flags, steps (a)(1) to (a)(6) and the red-flag list; and Supplement No. 4 to Part 744, the Entity List.
US Department of Commerce, Bureau of Industry and Security. Common High Priority Items List (CHPL), 23 February 2024, and the Commission’s parallel list of common high priority items.
FinCEN and the Bureau of Industry and Security. Joint Alert FIN-2022-Alert003, 28 June 2022, and Supplemental Alert FIN-2023-Alert004, 19 May 2023, including the nine-code High Priority Items List, the three fact patterns, and the trade-finance due-diligence items.
FinCEN. Financial Trend Analysis: Trends in Bank Secrecy Act Data: Suspected Evasion of Russian Export Controls, including the scope and methodology section, Figure 1, and footnotes 10 and 12.
Council of the European Union. Council Regulation (EU) No 833/2014, consolidated text as at 24 April 2026, Articles 1(o), 12, 12f, 12g, and 12ga, with Annexes IV, VIII, XXXIII, and XL.
European Commission. “No re-export to Russia” clause: Frequently Asked Questions (as of 18 December 2024), Questions 1 to 6 and 11 to 13.
European Parliament and Council. Regulation (EU) 2024/1624, Annex II point (3) and Annex III point (3), on geographical risk factors, and Article 20.
United Kingdom, Department for Business and Trade and the Office of Trade Sanctions Implementation. No Russia clause guidance, 7 January 2025, and the UK Common High Priority Items list.