Control without ownership in sanctions screening: the companies nobody owned on paper
The clean result means no designated owner was found. It does not mean no designated party is in control.
Avihu Marom · · 4 MIN READ
Picture a payment company in a third country. It has a website, a bank account and a director, and its filings name no sanctioned shareholder. A screen run on it comes back clean.
Every working day, someone employed by a different organisation logs in to that bank account. They come in through a private network built to hide where the login starts.
What Treasury described on 1 October 2026
That company is not an invention of mine. It is the shape of what the US Treasury described on 1 October 2026, in release sb0644, about the A7 Network: in Treasury's words, "a shadow banking network with ties to Russia used by the Iranian regime to evade sanctions".
Three actions arrived together. FinCEN "proposed a rule that would prohibit transmittals of funds regarding transactions involving the A7 Network's Sub-Agents". FinCEN "issued an Alert". OFAC "sanctioned the A7 Network as a significant transnational criminal organization".
The sentence that matters to anyone who screens counterparties is this one: "The A7 Network's Sub-Agents are wholly controlled by A7 Network individuals. A7 Network Sub-Agents' websites and bank accounts are controlled by A7 Network staff, who access Sub-Agent financial accounts using custom-built Virtual Private Networks that mask their true location and permit the rapid execution of payments."
The figures are Treasury's own, and so are the allegations. FinCEN's investigation found that Sub-Agents "processed more than $17 billion between January 2025 and June 2026, aggregated globally". One Sub-Agent and its sister company "received nearly $140 million from entities involved in Iranian sanctions evasion".
Why an ownership screen passes it
Most sanctions screening starts from ownership: who holds the shares, who the register names, and whether blocked persons together reach the threshold. That rule is real and it is useful. Treasury restated it in a release the next day, sb0647: it reaches entities "owned, directly or indirectly, individually or in the aggregate, 50 percent or more by one or more blocked persons".
A Sub-Agent as Treasury describes it can sit outside that test entirely. Nobody designated needs to hold a share. The company is controlled through its operations: the website, the bank access, the paperwork. Treasury names the paperwork too: "falsified trade documents, falsified import-export records, and misleading goods descriptions".
So a screen built on ownership answers the question it was asked, correctly, and returns clean. The clean result means no designated owner was found. It does not mean no designated party is in control.
Where the measures reach
The release deals with this directly. Transactions "involving Sub-Agents acting for or on behalf of the A7 Network" are blocked. That reaches past the ownership percentage to the question of who the company acts for.
The FinCEN measure is a proposal, made under "section 9714(a) of the Combating Russian Money Laundering Act", and Treasury says it "is not limited to Russian sanctions evasion". Its comment period "will close 30 days after the NPRM is published in the Federal Register". It was published in the Federal Register on 5 October 2026 as document 2026-20371, and comments close on 4 November 2026.
Neither instrument hands a compliance function a list of every company the network runs, and it could not. The inventory is the network's own and it changes. The measures are written to reach it by conduct.
What a file can ask instead
A record that will survive a hostile reading later asks control questions as well as ownership questions, and says plainly which ones it could answer.
Who operates the bank account day to day, and from where.
Who controls the domain and the website.
Whether the trade documents match the goods, the routes and the counterparties the payments describe.
Whether the company's activity makes sense for its size, its age and its declared business.
Some of those can be answered from public records. Some cannot, and a good report names which. A clean result can mean the owner checked out, or it can mean the question that mattered was never asked. The file should say which it was.
What this changes
None of this needs a new rule to be useful. The 50 per cent test stays where it is. What changes is how a clean ownership result is read: it is a statement about shares, and a sanctions exposure can live in the logins.
Our specimen Counterparty Screen shows how a report records what it checked, what it found and what it could not establish: avihumarom.com/specimen