I. The premise: economic statecraft has become security policy
For three decades, sanctions, anti-money-laundering rules and export controls were treated as technical appendices to foreign policy, the province of compliance officers, not strategists. That separation is gone. The European Union made the shift explicit on 20 June 2023, when the Commission and the High Representative published the first European Economic Security Strategy, a document framed around reducing risks to supply chains, critical technologies and economic dependencies rather than maximising trade efficiency alone [1]. Commission President Ursula von der Leyen had set the doctrine in motion months earlier, on 30 March 2023, with her call to "de-risk, not decouple" from systemic rivals [2]. The vocabulary is new; the logic is old. A state's capacity to produce, finance and ship has always underwritten its capacity to fight. What has changed is that the instruments of pressure, and the surfaces of vulnerability, are now financial and commercial rather than purely military.
The decisive question of contemporary statecraft is no longer "who has the better army" but "who controls the chokepoints in finance, technology and logistics."
The Institute's reading is straightforward: economic intelligence, the disciplined collection and analysis of information bearing on economic decision-making, competitive position and exposure, has moved from the margins of corporate strategy to the centre of national security. The entities that hold the relevant data are frequently private: banks, freight forwarders, semiconductor distributors, classification societies. The state increasingly governs conflict by governing them.
II. The sanctions machine and its leak: circumvention as the central problem
The clearest expression of this shift is the Western sanctions response to Russia's full-scale invasion of Ukraine. By February 2025, the EU had reached its sixteenth sanctions package, adopted on the third anniversary of the invasion. That package alone added 83 listings (48 individuals and 35 entities), restricted a further 53 companies, 34 of them located outside Russia, for supporting the military-industrial complex or facilitating circumvention, and brought the EU's list of targeted "shadow fleet" and energy-revenue vessels to 153 by adding 74 more [3]. The United States moved in parallel. On 22 December 2023, Executive Order 14114 authorised secondary sanctions on foreign financial institutions facilitating transactions for Russia's military-industrial base, a deliberate decision to weaponise access to the dollar-clearing system against banks in third countries, not only against Russian entities [4].
The volume of measures is impressive; their leakage is the actual story. The binding constraint on sanctions is not their drafting but their enforcement across jurisdictions that never agreed to them. The Kyiv School of Economics, tracking flows of "Common High Priority" items, the goods most often recovered from Russian weapons on the Ukrainian battlefield, found that export controls had cut Russia's imports of such items by more than half in value terms, but had not stopped them; roughly 75% of reported Common High Priority exports to Russia now transit through China [5]. The leak is structural: a coalition of sanctioning states cannot legislate the behaviour of the non-aligned majority of the world economy.
A sanction is a hypothesis about other people's compliance. Russia's war machine has spent three years testing that hypothesis to destruction, and finding the seams.
III. The toolkit: lists, codes and the architecture of due diligence
To close the seams, sanctioning states have converged on a shared technical vocabulary. The centrepiece is the Common High Priority List, developed jointly by the US Bureau of Industry and Security with the EU, Japan and the United Kingdom. It identifies 50 items, defined by six-digit Harmonized System customs codes and grouped into tiers, that Russia most needs for its weapons programmes, from integrated circuits and radio-frequency transceiver modules to computer-numerical-control machine tools [6]. The list is a piece of intelligence translated into an operational instrument: it tells a distributor in Istanbul, Dubai or Almaty precisely which shipments warrant heightened scrutiny.
When a downed Russian missile or drone is recovered in Ukraine, its components are catalogued and traced to their manufacturers. Items that recur, and that Russia cannot make domestically, are matched to the six-digit Harmonized System codes used in global customs declarations. Those codes populate the Common High Priority List, against which exporters, banks and customs authorities are expected to run enhanced due diligence. The chain runs from a crater to a spreadsheet to a trade-finance decision. This is economic intelligence in its purest form: forensic, granular and actionable, but only as strong as the private compliance functions asked to apply it [6].
The EU has institutionalised the diplomatic side through David O'Sullivan, appointed International Special Envoy for the Implementation of EU Sanctions, whose mandate is to persuade third countries, through engagement, not coercion, to monitor and block re-exports of listed goods to Russia [7]. The 16th package itself sharpened the technical toolkit further, adding controls on chemical precursors, software for CNC machines and video-game controllers repurposed to pilot drones [3]. The pattern is consistent: as one channel is closed, the adversary substitutes another, and the controllers respond at the level of the specific component. It is attritional, iterative and never finished.
IV. Finance: the price cap, the shadow fleet and the limits of leverage
Nowhere is the contest between enforcement and evasion sharper than in energy finance. The G7 and EU oil price cap, set at USD 60 per barrel in late 2022, sought to keep Russian crude flowing to world markets while capping the Kremlin's revenue, using Western dominance of shipping insurance as the enforcement lever. Russia answered with a "shadow fleet" of ageing tankers operating outside Western insurance and ownership structures, using flag-of-convenience registration, ship-to-ship transfers and disabled transponders to obscure cargo origin [8]. The EU has been forced to chase the fleet vessel by vessel, hence the 153 ships listed by the 16th package, and, on 18 July 2025, to lower the crude price cap to USD 47.60 per barrel with a dynamic adjustment mechanism, alongside a full transaction ban on the Nord Stream pipelines and 22 additional Russian banks [3][9]. (The 2025 measures are recent; their revenue impact is still being assessed and should be treated as provisional.)
The price cap was an elegant idea: keep the oil flowing, cap the profit. The shadow fleet was the inelegant answer: if you control the insurers, I will sail without insurance.
The deeper lesson reaches beyond Russia. Illicit finance is a permanent structural feature of the global system, not a wartime aberration. The Financial Action Task Force, the inter-governmental standard-setter for anti-money-laundering, estimates that the amount of money laundered globally each year sits between 2% and 5% of world GDP [10]. The UNODC's most-cited modelling put criminal proceeds available for laundering at around USD 1.6 trillion, or 2.7% of global GDP, in 2009, while concluding that "much less than one per cent" of illicit financial flows is ever seized or frozen [11]. The interdiction rate is the indictment: a control regime that recovers under one percent of the flow it targets is, on its own terms, failing, and the same compliance architecture now carries the weight of national-security sanctions enforcement.
V. The soft target: jurisdictions, due diligence and contested markets
The system's weakest points are jurisdictional. The FATF's grey list, formally, the list of "jurisdictions under increased monitoring", is the clearest public map of where the controls are thin. At its plenary on 25 October 2024, the FATF added Algeria, Angola, Côte d'Ivoire and Lebanon to that list, citing recurring deficiencies: weak risk-based supervision, opaque beneficial-ownership registers, and inadequate investigation and prosecution of money laundering; it removed Senegal in recognition of reform [12][13]. Grey-listing is consequential because it raises the cost and friction of cross-border finance for every institution touching the named jurisdiction, a reputational and operational tax imposed by a standard-setter with no army.
For an analyst, the FATF grey list is not a moral verdict but an operational signal: it flags where beneficial ownership is opaque, where supervision is weak, and therefore where sanctioned goods, illicit proceeds and front companies are most likely to find cover. Cross-referenced with the Common High Priority List and known circumvention hubs, it becomes a targeting tool for due diligence in contested markets, telling a firm not where it may not trade, but where it must look hardest before it does [12].
This is where economic intelligence does its real work, in due diligence in contested markets. A firm operating in a high-risk jurisdiction cannot outsource its exposure to a government list. It must build its own picture: ultimate beneficial owners, the true end-use and end-user of dual-use goods, the genuine routing of payments through correspondent banks. The state can publish lists; only the firm sees the transaction. That asymmetry is why governments have shifted from prescribing rules to demanding that private actors understand their own risk, and why the compliance function has become a quasi-sovereign instrument of security policy.
VI. Conclusion, the frontier is the compliance department
The strategic picture that emerges is coherent and uncomfortable. Economic security has become national security, and the contest is being fought on three fronts the traditional security establishment was slow to recognise: compliance, supply chains and finance. The instruments, sanctions lists, Harmonized System codes, secondary-sanctions threats, grey lists, price caps, are wielded by states but executed by private firms, which means the effective frontier of national security now runs through banks, distributors and freight forwarders. The adversary understands this perfectly: every circumvention network is, in essence, a bet that some compliance function somewhere will not look closely enough.
The Institute's conclusion is that states and serious firms must treat economic intelligence as a core security discipline, not a compliance overhead. That means investing in the analytical capacity to trace beneficial ownership, map supply chains to the component level, and read the financial system as a contested space. The sanctions of the last three years are not a temporary response to one war; they are a rehearsal for a durable condition in which commerce and conflict are no longer separable. The crater and the spreadsheet are now points on the same line.