This blog was written by Tihomira Kostova, Martin Vladimirov, and Ruslan Stefanov from the Center for the Study of Democracy (CSD). The authors explore how the grey zone between illegal and illicit financial flows is being exploited to circumvent sanctions and sustain Russia’s war economy. Their analysis reveals how dual-use goods are rerouted via third countries, exposing critical enforcement gaps and calling for stronger IFF risk monitoring.
The global effort to fight financial crime and corruption increasingly depends on understanding the concept of illicit financial flows, or IFFs. It is often assumed that illicit equates to illegal but there are important distinctions between the two terms with major implications for policy, enforcement, and international cooperation. This has become even more pertinent in a geopolitically divided world with massive imposition of sanctions as well as state-capture driven evasion tactics.
The World Bank and the International Monetary Fund define IFFs as cross-border movements of money that are illegal in their source, transfer, or use. The United Nations Development Programme takes a similar but more development-focused approach. It includes IFFs generated from corruption, contraband, criminal activities, and tax evasion, particularly in the context of developing countries. The Organisation for Economic Co-operation and Development also sees IFFs draining capital from developing countries through methods like money laundering, bribery, or trade mispricing.
While illicit flows may include illegal activities, something can be illicit without being technically illegal — such as tax avoidance strategies, corporate ownership obfuscation practices, or the exploitation of regulatory loopholes. Illicitness captures a wider set of concerns than the law alone. IFFs do not always breach laws, but they undermine societal fairness, government accountability, democratic values or the international rule of law order. The challenge to understanding and, thus, countering illicit flows is that IFFs are context-dependent and shaped by societal norms and expectations.
Sanctions Evasion and Avoidance
A vivid example is the difference between sanctions evasion and sanctions avoidance. The former is seen as illegal in sanctioning legal systems, yet it could be considered legitimate in sanctioned countries. Sanctions avoidance takes advantage of different gaps in the legislation or accounting rules (like the accepted blending of sanctioned and non-sanctioned oil products). This means that certain activities may be considered illicit (yet not illegal) in sanctioning countries due to their harmful socio-economic impact, yet considered legitimate tactics in sanctioned or enabling countries. Hence, geopolitical rivalries between global standard setters, such as the EU, US, UN, and other international actors challenge the very understanding and meaning of what is illegal, and even more so, of what is illicit.
Accurately measuring IFFs remains a daunting challenge. Their hidden, cross-border nature – and the varying definitions – make consistent tracking difficult. In response, the United Nations Office on Drugs and Crime and UNCTAD have developed a statistical framework for identifying the generation of illicit income (such as through illegal mining or drug trafficking), and the management of that income (such as through offshore transfers, money laundering, or luxury asset purchases abroad).
This two-sided model provides a structured way to think about how IFFs are created, moved, and used. Yet measurement still depends on access to data, institutional capacity, and political will. It also has not been updated to reflect the impact of sanctions on a major world economy, like Russia.
Dual-Use Goods and the Russia Case
A clear example of this complexity is the trade in dual-use goods – sensitive products that have legitimate civilian uses but can also serve military purposes. Following Russia’s 2022 invasion of Ukraine, many countries have declined to impose sanctions on the export of dual-use technologies to Russia. As a result, many private actors have profited heavily from responding to increased Russian demand for such goods in its military industrial complex. In doing so, they have exploited the grey zone between “illegal” and “illicit” by channelling sensitive technologies through third countries that re-export them to Russia.
Western suppliers often fail to conduct adequate due diligence, such as “know your customer” procedures and end-use verification. This trend is visible in the notable increase in EU exports of dual-use items to third countries from Western Balkans, Black Sea and Central Asia regions, as well as their exports of such goods to Russia.
Monthly trade flows between 2022-2024 reveal that for every additional US dollar in EU exports to Armenia, Armenian exports to Russia increased by $2.58. This level of trade elasticity far exceeds what we see in Kazakhstan and Kyrgyzstan, and strongly suggests a systematic rerouting of dual-use goods to Russia. Our data shows that from 2021 to 2023, Armenia’s re-exports to Russia closely tracked its imports of dual-use items from the EU. The rapid (and probably illicit) redirection of EU technology into Russia’s war machine through third country-enablers during the same period is further seen in huge spikes in specific dual-use products. Examples of such products include static converters and printed circuits – essential for defence electronics, or electrical apparatus and data-processing machines, which are critical for military logistics and cyber operations. For instance, Armenia’s export of communication apparatus to Russia jumped 28,002%, from 2021 to 2022.
Kazakhstan has emerged as another key transit hub, with each US dollar rise in EU exports resulting in a $0.89 rise in Kazakh exports to Russia. Even more concerning is the speed of the trade adjustments, which outpaces both Armenia and Kyrgyzstan – often occurring within weeks. Kyrgyzstan follows a similar pattern, though on a smaller scale. Each US dollar increase in EU exports to the country results in an average $0.47 boost in Kyrgyz exports to Russia. Notably, 92% of these trade responses happen within one or two months after the imports from the EU, further suggesting a deliberate and well-coordinated redirection mechanism.
Among the Western Balkans, Serbia stands out as an exception, having maintained significant trade ties with Russia after the invasion of Ukraine. It has continued to export a range of critical dual-use items used in advanced industrial and military applications in Russia such as machine tools, various types of bearings (ball, tapered roller, spherical roller), static converters, telecommunication equipment, and so on. In contrast, the correlation between EU exports and onward trade to Russia remains relatively weak for the rest of the Western Balkans and Black Sea countries. This does not rule out the possibility of specific cases of (illicit) re-exports, especially given the sharp rise in imports of Western dual-use goods after 2022, which deviates from the typical consumption patterns of these products in those countries over the previous decade and the documented cases from investigative reporting.
Final Reflections: Sanctions Evasion, IFF Risks, and the Enforcement Gap
The data confirms that the three members of the Eurasian Economic Union – Armenia, Kazakhstan and Kyrgyzstan – play an important role in enabling EU dual use goods flows to Russia, underscoring their functions as key re-export hubs that facilitate evasion (illegal and illicit) and/or avoidance (illicit but not necessarily illegal) of sanctions. The evolving landscape of IFFs – especially those tied to cross-border illicit trade in dual-use items – highlight a growing gap between formal regulations and real-world enforcement. The EU companies either by exploiting the grey zone between “illegal” and “illicit” or by neglecting due-diligence measures (e.g., “know your customer”) are enabling Russia and third-country actors to take advantage of procedural loopholes. This, in turn, facilitates the supply of sanctioned dual-use items to Russia and contributes to the proliferation of IFFs through the circumvention of international sanctions.
To address sanctions evasion-related IFFs, the EU and the UK should seek to integrate appropriate IFFs risk monitoring into their sanctions enforcement strategies. This includes adapting the frameworks to address both explicitly unlawful transactions and those that exploit legal grey areas – especially in in trade and customs – and allocating resources for specialized IFF and Sanctions Circumvention Units within the EU Sanctions Envoy structure and the UK Office of Financial Sanctions Implementation (OFSI). Stronger supply chain transparency is also essential, including enhanced “Know Your Customer” and end-use verification obligations for exporters of dual-use goods in high-risk sectors. The EU and the UK should also seek ways of better engaging Global South partners into sanctions evasion risk understanding and monitoring through their respective aid and public diplomacy programs.
*** This blog draws on research from the GI ACE project and is based on CSD’s policy brief Illicit Financial Flows and Strategic Corruption. Find out more about the project [here]