UK/JERSEY/GUERNSEY - RED ALERT focuses on the "Shadow Fleet Sanctions Evasion and Avoidance Network,"

The latest Red Alert, dated July 2025 and referenced as 0774-NECC, has been issued by the UK's National Crime Agency (NCA) and HM Treasury’s Office of Financial Sanctions Implementation (OFSI).

This alert is part of a collaborative effort with the Joint Money Laundering Intelligence Taskforce (JMLIT+), which aims to enhance cooperation between law enforcement and the financial sector.

The alert focuses on the "Shadow Fleet Sanctions Evasion and Avoidance Network," which involves a complex network of companies used to evade sanctions on the sale of Russian oil and gas.

This network allows Russian entities to access Western finance and professional services, thereby continuing to fund the Russian state despite sanctions.

Key indicators of potential sanctions evasion include:

• Companies with limited trading history suddenly trading large volumes of oil.
• Limited information on ownership, directors, or beneficiaries.
• Multiple transfers between obscure companies.
• Companies registered or operating in high-risk jurisdictions.
• Limited online presence or generic websites with no detailed contact information.
• "The sanctions evasion & avoidance network is resilient and consciously split between two sides & known to its affiliated traders/brokers as “blue” & “red”. The “blue” side works with entities in the Global West, incl. banks, insurers & trading platforms. The leading companies of this side of the network were 2RIVERS DMCC & 2RIVERS PTE, both sanctioned by the UK in December 2024. The “red” side of the network, with deliberately obscure ownership structures and numerous front companies designed to be easily replaced if they are subject to Western sanctions, trades in the Russian oil directly. The leading company on this side of the network was NORD AXIS, sanctioned by the UK in May 2025.

READ MORE

• "Finance & oil move between the different sides of the network.

RED AND BLUE

• Access to Western rates of trade finance, trusted insurers & key commodity exchanges utilised by ‘BLUE’ companies are combined with the special relationship with ROSNEFT’s CEO & privileged access to Russian oil of the ‘RED’ companies, to create a global trading network generating billions of USD.
• Money & oil move between the companies through tran[s]shipments of oil & mixing operations to hide the Russian origin.

• Etibar Eyyub & Tahir Garayev, both Azeri nationals, have emerged as central figures in the export of Russian oil post-2022, particularly as Western sanctions intensified.
• Tahir Garayev is identified as the founder of Coral Energy Group in 2010.
• Etibar Eyyub, described as a relatively unknown merchant who joined Coral Energy in 2014, quickly became Garayev's 2nd-in-command & was instrumental in establishing Coral's operations in Russia.
• Following the full-scale invasion of Ukraine, both individuals have been linked to a vast, clandestine trading and shipping enterprise that has reportedly moved significant volumes of Russian oil to new markets, including. China and India, often through a complex web of offshore entities and an assembled "shadow fleet" of ageing tankers.
• The UK sanctioned both Eyyub & Garayev in May 2025, alongside three associates, citing their alleged involvement in supporting Russia's energy sector & circumventing sanctions.
• 2RIVERS, formerly known as Coral Energy, has been at the forefront of facilitating Russian oil exports after 2022, despite claims by the company of winding down its Russian-origin business. Est. by Tahir Garayev, Coral Energy became a major purchaser of Russian oil, incl. from Rosneft, with Russian crude reportedly accounting for a significant portion of its trade turnover in 2021/22.
• It continued to trade Russian crude even after rebranding to 2RIVERS & following a 2024 MBO.

The alert emphasises the importance of vigilance and reporting any suspicious activities to the relevant authorities. Financial institutions are encouraged to use this information to enhance their existing processes and prevent sanctions evasion.

References

[1] Red ALERT Shadow Fleet Sanctions Evasion and Avoidance Network https://www.nationalcrimeagency.gov.uk/who-we-are/publications/753-red-alert-shadow-fleet-sanctions-evasion-and-avoidance-network/file

[2] NECC Red Alert 03 July 2025 - Government of Jersey https://www.gov.je/gazette/pages/NECCRedAlert03July2025.aspx