Counter Proliferation Financing

What Is Counter Proliferation Financing?

Most anti-money laundering (AML) controls are built to find dirty money. Proliferation financing works the other way around. The funds look clean, the paperwork is complete, and the payment clears without triggering meaningful scrutiny.

Counter proliferation financing refers to the controls that stop funds from supporting weapons of mass destruction (WMD) programs, their delivery systems, and the procurement networks supplying them. In addition to export control, interdiction, and diplomatic action, FATF focuses on measures and methods to prevent funds from being used to circumvent, evade, or otherwise abuse targeted financial sanctions, under Recommendation 7.

The FATF highlighted the gap in June 2025. Across its Global Network, just 16% of jurisdictions assessed achieved substantial effectiveness on Immediate Outcome 11, which concerns the effectiveness of targeted financial sanctions in practice.

For financial institutions, counter proliferation financing is primarily about complying with targeted financial sanctions under FATF Recommendation 7 rather than broader non-proliferation policies.

Why Proliferation Financing Requires More Than Traditional AML Controls

October 2020 amendments to FATF Recommendation 1 changed how firms assess proliferation financing risk. Financial institutions and virtual asset service providers must now assess proliferation financing risk in their own right. Designated non-financial businesses and professions are subject to the same duty. A generic sanctions screen no longer meets an assessor’s requirements.

Coordinated action between competent authorities and the private sector is needed for a consistent implementation of sanctions under Recommendation 2. Immediate Outcome 11 assesses whether asset freezes actually occur in practice. Recommendation 7 implements United Nations sanctions through two main frameworks. UNSCR 1540 deals with non-state actors obtaining WMD capabilities, and country-specific resolutions like UNSCR 1718 for North Korea and UNSCR 2231 for Iran include specific financial sanctions that companies have to observe.

The Iran sanctions regime underwent a dramatic transformation in late 2025. On 27 September 2025, the snapback mechanism took effect again, allowing for the re-imposition of six pre-2015 resolutions against Iran. The European Union and the United Kingdom reimposed parallel measures within days. Names retired after the nuclear deal became live obligations again.

A Counter Proliferation Example: How the Money Moves

North Korea remains the most significant actor in FATF’s current assessment. The overseas IT worker schemes raised nearly $800 million in 2024 alone. One such theft from the Bybit exchange in February 2025 brought in an additional $1.5 billion.

A recent OFAC designation offers some examples of how they work. The OFAC added six persons and two entities from Vietnam, Laos, and Spain to its sanctions list on 12 March 2026. One named company managed overseas IT worker delegations while procuring military and commercial technology.

Common proliferation financing typologies identified by FATF include:

• Intermediaries and cut-outs are placed between the buyer and the real end user
• Beneficial ownership structures are deliberately obscured to open bank accounts
• Virtual assets and related technology are used to move value across borders
• Maritime and shipping abuse, including cargo manipulation and vessel identity fraud

Trade-based procurement schemes often follow the same pattern. A newly registered firm orders precision valves described as water-treatment components. The letter of credit settles cleanly, leaving nothing on the payment record. But the buyer has no trading history, and the route crosses a known diversion hub.

Proliferation Financing Red Flags in Customer and Trade Data

Individual indicators rarely justify suspicion on their own. When a number of red flags coincide for counterparty, trade documentation, shipping routes, and payment activity, the risk is more believable. Good screening, however, involves using a combination of trade and payment data, rather than analyzing each signal individually.

• Dual-use items listed in export control regimes but not aligned with the customer’s business activity.
• Intermediaries incorporated recently, with no trading history, sit between the buyer and the end user
• Shipping routes or transshipment points with no commercial reason whatsoever
• Ambiguous, inconsistent, or incomplete information on end-user information in trade documentation
• Ownership layers that hide the ultimate beneficial owner behind nominee directors
• IP addresses that overlap with the customer’s stated location

How AML Watcher Supports Counter Proliferation Financing Controls

Proliferation financing detection requires more intelligence than simply applying traditional sanctions screening. AML Watcher monitors names, aliases, entities, vessels, aircraft, and relationships among beneficial owners from 215+ sanctions lists, which are updated every 15 minutes. The secondary sanctions screening is increased by screening counterparties dealing with designated entities, and the crypto wallet screening covers over 415 risk categories. Ongoing monitoring automatically rescans existing customers whenever sanctions data changes.

False positives remain a major operational challenge. Industry studies estimate that around 90% of AML alerts are false positives. That noise buries the few genuine procurement signals worth investigating. TruRisk reduces false positives by 95% and documents the rationale for each retained match.

Proliferation networks need one screening gap to reach the financial system. The consequence of missing that gap is not only regulatory action. It can also mean unknowingly supporting procurement networks tied to weapons of mass destruction.

Request a demo to see how AML Watcher can strengthen the detection of proliferation financing risk across the customer lifecycle.