The risk of sanctions evasion and money laundering has often been framed around embargoed states. Regulatory authorities, investigative journalists, and data providers have dedicated significant resources to mapping the networks of sanctioned state-owned entities, politically-exposed persons, procurement agents and their facilitators. Given the current geopolitical realities, the scrutiny is understandable. Iran, North Korea, Russia, and Venezuela have demonstrated an adept capacity to access the global financial system through shadow companies, commodity networks, and professional intermediaries.
This focus elides a parallel threat: the maturing capacity of non-state actors to penetrate the same system. These actors possess neither the infrastructure nor resources of sanctioned governments, yet they often enjoy a distinct advantage, obscurity. Operating in political vacuums and inside informal economies, often on the margins of larger geopolitical conflicts, their ability to evade regulators and launder proceeds relies as much on their ambiguity as on their sophistication.
For compliance professionals, defining non-state actors is less a legal exercise than a risk-management dilemma. Criminal organizations, militias, terrorist groups, cybercriminal syndicates, and proxy networks often possess contrasting beliefs, structures, and objectives. In practice, their financial behavior increasingly converges. An ideologically driven militant group and a transnational cartel may not share political goals, but both rely on similar financing schemes. Recent U.S. regulatory decisions have further blurred the distinction. The 2025 designation of Latin American cartels and transnational organizations as Foreign Terrorist Organizations underscores the extent to which criminal and terrorist risk overlap.
The organizational ambiguity of these varied groups is intentional. Non-state actors have learned from the past two decades of counterterrorism, sanctions, and anti-money laundering enforcement how to mask their financial operations. Façade groups tied to sanctioned criminal and terrorist organizations have proliferated in Latin Americaand the Middle East. Identifying a card-carrying member of an opaque militant group is a nearly impossible task. Financial institutions only encounter the organizations and individuals on the periphery: a logistics provider, a currency broker, or even an art dealer with no obvious sanctions’ nexus.
A process of decentralization is underway. In narcotics trafficking, cybercrime, and terrorist financing alike, discrete actors perform specialized roles, from sourcing goods, to arranging transport, to laundering revenue. Â As networks of contractors and sub-contractors grow, the organization overseeing illicit activity becomes harder to detect. Money laundering and sanctions evasion operations possess multiple nodes rather than a single source.
On the surface, this dynamic appears to conflict with the funding strategies harnessed by sanctioned states. While sanctioned states depend on sovereign infrastructure, bilateral ties, and energy exports, non-state actors operate through fragmented channels. They rely on diaspora networks, cash-intensive businesses, and local protection arrangements. This distinction, however, is collapsing. Criminal and terrorist networks increasingly borrow commercial sophistication from state-backed facilitators, and sanctioned regimes rely on illicit tradecraft honed by criminal organizations.
The most important laundering channel for non-state actors is ordinary commerce. Commodities, import-export firms, and real estate provide a crucial outlet for these groups to integrate their proceeds into the financial system. Trade-based money laundering is especially effective, because it hides illicit finance in the mundane movement of global commerce. Only when placed in a wider context of ownership, geography, and pricing will a shipment or invoice appear suspicious.
Digital assets have opened a new frontier. Stablecoins are particularly attractive to non-state actors because they offer stability, liquidity, and transferability. Funds can be layered through unhosted wallets and peer-to-peer transactions before re-entering the banking system. Although digital assets are traceable, the identity of the originator and beneficiary of the assets often remains obscured. FATF’s recent report on stablecoins elucidates these threats considering the uneven regulatory environment for digital assets.
The central challenge for financial institutions is that traditional controls are not designed to capture this level of ambiguity. Sanctions screening remains essential, but exposure to sanctioned non-state actors rarely originates from a direct name match. KYC data can identify a customer, but not always the associations behind that customer. Adverse media is an essential resource, but only in jurisdictions with robust press coverage and reliable government reporting. In many of the environments where non-state actors thrive, those conditions do not exist.
The absence of evidence is not the evidence of absence. A customer with clean documentation may still operate in a high-risk commercial ecosystem. A low-value remittance may carry risk even if it flows through a common corridor. A cryptocurrency is legible on a blockchain but may not clarify beneficial ownership. Risk is relational. Without broader context, compliance teams cannot stop sophisticated organizations from dodging regulatory enforcement.
The threat of non-state actors exploiting the global financial system is not going away. Ironically, the pressure created by sanctions regimes has accelerated the threat. Networks of criminal and terrorist organizations have adapted to the regulatory environment by developing amorphous structures. In turn, compliance processes must evolve from static screening toward analysis of local political economies, trade patterns, and sector-specific vulnerabilities.