Category: News

By Joshua Clarke and Trevor Howe, Senior Operational Resilience Consultants

Multiple supply chain risks converged this week, with Hurricane Idalia spreading chaos in the Southeastern U.S. and a coup – over 6000 miles across the Atlantic – in Gabon threatening further disruption – particularly for the aerospace & defense sector.

Gabon’s military seized power yesterday following a controversial presidential election. Supply chain leaders are tracking the fallout as the country is the world’s second-largest producer of an essential material, manganese ore. The coup heralds both an uncertain time for industrial and commercial activity in the country and potential disruptions to global supply chains.

The Criticality of Manganese

Manganese is crucial for several industries including aerospace and defense, energy production and storage, and automotive – among others – because of its use as an alloying agent, metal coating additive, and as a cheaper, more ethically sourced alternative to cobalt. The shutoff of Manganese imports could impact everything from batteries to guns to automotive transmissions. Interos’ analysis identified over 155,000 US companies likely to be impacted.

According to the U.S. Geological Survey (USGS): “Because manganese is essential and irreplaceable in steelmaking and its global mining industry is dominated by just a few nations, it is considered one of the most critical mineral commodities for the United States.”

Between 2018 and 2021, 67% of manganese ore imported to the U.S. was from Gabon, compared with 19% from South Africa and 12% from Mexico. The U.S. is 100% reliant upon imports of manganese ore for apparent consumption.

Second African Coup in a Month Threatens Regional Stability and Vital Exports

This past Wednesday, Gabonese soldiers announced on national television they seized power in the African nation of Gabon and arrested recently re-elected President Ali Bongo, whose family has held power in Gabon since 1967. The soldiers behind the coup announced that they have canceled the recently certified election results.

The military announced that the country’s borders would be temporarily closed. This resulted in the anchoring of 30 commercial vessels off the coast of Gabon while they awaited the resumption of activity at the Port of Libreville.

Gabon’s top export is crude petroleum, accounting for 60.7% of its exports at approximately 200,000 barrels per day, making it Africa’s seventh largest oil producer. But there is more concern around manganese ore, which is Gabon’s other primary export.

The ore accounts for almost 23% of the country’s export activity, valued at $1.34 billion annually. The French mining firm Eramet, reportedly the top producer of manganese worldwide (having produced 7.5 mega tonnes of ore in 2022), announced shortly after the coup that it would temporarily halt all operations in the country, including the transportation of already-extracted ore.

A Flexible Transition Metal

Manganese ore is a key component in steel and alloy production because of its structure as a transition metal, which allows it to improve the strength, workability and wear resistance of partner metals. Manganese consumption in the U.S. is overwhelmingly focused on the production of iron and steel products, with 90% of manganese ore directed to this use. Beyond these applications, manganese is utilized for:

• Aluminum alloys – Manganese, alloyed with copper, silicon, tin, nickel and zinc, is used to create high-strength and lightweight structures in aerospace and defense applications.
• Stainless steel – Manganese, alloyed with silicon and nitrogen, is used to create oxidization-resistant steel.
• Batteries – Manganese oxide, usually a processed version of manganese, is utilized in dry-cell and alkaline batteries to prevent the formation of hydrogen in a battery, preventing possible combustion or explosion.
• Copper alloy – Manganin, an alloy of copper, manganese, and nickel, is utilized to create shunt resistors, with a low-temperature coefficient and resistance to sulfur, these resistors are useful for creating large currents.
• Potassium permanganate – Manganese is essential to the production of potassium permanganate, which is widely used in drinking water and wastewater treatment.
• Manganese phosphate – This type of metal finishing is mostly used within engines, transmission systems and gears to provide smoother overall operation while increasing the service life of treated components.

While the U.S. does maintain a domestic stockpile, disruption to manganese ore exports from Gabon could pose a material risk to American manganese refineries and manufacturers dependent on raw and refined manganese products. Manganese supply disruptions would most affect the following industries:

• Aerospace & defense – Safes, gun barrels and military helmets use steels with very high levels of manganese (up to 15%).
• Automotive manufacturing – Manganese is utilized as a safer, cheaper, and more ethical alternative to cobalt for use in electric vehicles.
• Manufacturing – In addition to iron and steel, manganese is used also as an alloy with metals such as aluminum and copper.
• Energy production and utilities – Manganese is widely regarded as one of the critical minerals for green transition technologies in the energy sector. It is essential for zinc-ion batteries, hydrogen fuel cells, and increased solar panel efficiency.

According to the USGS, manganese ore is consumed mainly by five companies at six U.S. facilities with plants principally in the Eastern and Midwestern States. Analysis by Interos suggests that these firms directly supply more than 200 U.S.-based customers and indirectly almost 155,000 as tier-2 suppliers.

Action That Affected Companies Need to Take

Since the coup, many countries in the international community have called for a return to Gabon’s elected government and to stability. Russia and China called for a peaceful resolution to the conflict, while France condemned the coup and called for a “commitment to free and transparent elections”.

Regardless of the coup’s ultimate outcome, the situation in Gabon – and the impact uncovered by Interos, is a stark reminder of how geopolitical turmoil (and a high degree of reliance on single/highly concentrated sources) can intersect with natural disruptions, like Hurricane Idalia, to threaten supply chains a world away.

At this time of uncertainty, companies can ill afford to sit idly by. Those that are dependent on manganese ore, particularly aerospace & defense organizations, need to identify where it is sourced within their extended ecosystem and understand their level of dependence on Gabon and suppliers operating in the country.

With its artificial intelligence-based software, Interos is well positioned to support supply chain risk management programs for companies around the world trying to address this issue. Interos provides continuous monitoring of suppliers with timely alerts so that companies can both get ahead of potential supply chain disturbances and be among the first to react to them.

The MOVEit computer virus recently surged back into the headlines with IBM and the Colorado Department of Health Care Policy & Financing confirming cyber-attacks that exposed the private health care data of millions of customers. The ensuing supply chain attacks have caused chaos for a growing number of victims spanning banks, hotels, energy giants and others. It’s no coincidence the events also saw the filing of five separate class-action lawsuits against Progress Software, the publisher behind the MOVEit file transfer application.

The breach, and the widening scope of damage, highlights the hidden risks posed by digital concentration risk – defined as high levels of dependence on massive, globally interconnected systems. In highly concentrated systems, a single vulnerability has the capacity to affect millions of entities. Various reports show at least 620 businesses and more than 40 million individuals have been impacted – over one-third via third party connections.

The incident underscores the constant battle to protect data and highlights the urgent need for a proactive approach to supply chain cybersecurity.

A Closer Look at the Attacks

Originating at IBM, the MOVEit attacks have affected hundreds of organizations, including the BBC, British Airways, Johns Hopkin’s University, multiple U.S.-based financial services firms, and even U.S. government agencies.

The breaches were carried out by exploiting SQL injection vulnerabilities, enabling hackers to access the server database. The CL0P ransomware gang was credited with the attack and has gone on a ransomware spree, contacting dozens of companies and demanding payments to prevent stolen information from being published online.

Six Steps to Respond Proactively

Though the situation is still unfolding, six key lessons have already emerged:

1. Collaborate with Cybersecurity Teams & Identify Affected Third Parties: Engage procurement and cybersecurity teams to collaborate on guidance and developing vendor communications to determine which vendors use MOVEit. Unlike calls or surveys, automated platforms could identify likely affected vendors immediately and across sub-tier/extended supplier networks. Contact these critical vendors immediately and agree on mitigation strategies. If the enterprise maintains a legacy or manual systems, the only option may be issuing a manual questionnaire to vendors – which may take weeks to gather and analyze for vulnerability mitigation. If customer data has been exposed, take steps to notify them and review your vendor contracts for data breach notification requirements.
2. Segment Critical Third Parties: Identify and group third parties and supply chain partners based on their criticality to continued operations – and their level of instability.
3. Drill Deeper: Once critical third parties & supply chain partners have been identified, organizations need to drill deeper into risk sub-factors to understand their true vulnerability posture. When assessing vendors, it’s essential to consider everything from liquidity to cybersecurity breach history. Undertake exercises like threat modelling to further understand which vulnerabilities may pose the most risk to operations.
4. Take Action: Develop an action plan to address findings. Long-term and short-term risks may require different remediation measures, such as focusing InfoSec teams on addressing specific CVEs.
5. Perform Cybersecurity Due Diligence/Continuous Monitoring: In addition to immediate triage, it’s important to assess suppliers who furnish similar software to evaluate their cybersecurity practices as copy-cat attacks are a strong possibility. Again, automated risk assessment/monitoring applications will help here – provided they have insight across your supply chain.
6. Stay Updated with Official Information: Monitor official information from Progress Software and other sources for updates.

Emphasizing Resilience by Design^TM

In a world of escalating supply chain cyber-attacks, the MOVEit breaches have highlighted the dangers of digital concentration risk and the need for robust third-party risk management practices. This incident is only the latest to emphasize the importance of proactively and continuously assessing enterprise supply chain cybersecurity backed by a robust incident response plan.

More broadly, the attacks stress the need for organizations to take control of risk for competitive advantage by ensuring resilient design in supply chain cybersecurity strategies. Per Interos’ latest annual survey of procurement leaders, cyber-attacks were the second-greatest concern for supply chain leaders, after supply shortages – costing large companies $43M a year, on average. Additional survey risk insights can be downloaded here.

By embracing Resilience by Design^TM, organizations can overcome risks, simplify their business, and deliver results. It’s not about avoiding the inevitable but about planning and reducing the impact and the time and resources required to restore normal operational performance.

Cyber-attacks and ransomware are inevitable – every organization will be impacted by one at some point – but with continuous multi-tier monitoring, and comprehensive recovery planning, we can minimize the damage and maximize profitability.

 

By Kate Anderson, Scott DeGeest and Teddy DeWitt

Amid the coverage of the evolving U.S. banking crisis that has claimed Silicon Valley Bank (SVB), Signature Bank, and First Republic Bank (FRB), and is now threatening PacWest, one aspect has remained largely hidden – the potentially massive supply chain impact of these failures.

Make no mistake, a banking crisis is also a supply chain crisis.

Interos data suggests that, thanks to the supply chain ripple effect, over 600,000 U.S. firms will be indirectly affected by the collapse of SVB and FRB alone.

Our research also indicates that, by considering banks as part of a larger supply chain and monitoring specific risk indicators, organizations – and especially their procurement leaders – can anticipate potential problems and banking failures well in advance.

So why are these banks failing? What does it mean for the broader supply chain? And what can organizations do about it?

The Banking Sector: A Supply Chain of Capital

As banks experience greater volatility, a tougher business environment and fleeing depositors, it becomes more difficult for them to obtain capital to distribute to their customers.

Much as supply chain disruptions limit access to vital goods, disruptions in the banking supply chain limit access to vital capital. This, in turn, impacts a whole range of day-to-day banking services that businesses rely on, including liquidity management, accounts payable services, lines of credit, foreign exchange services, and lending.

As with SVB, capital supply chain failures ultimately extend far beyond the financial sector and into the wider economy. Even companies not directly reliant on the bank’s capital were affected when they discovered that suppliers and service providers that banked with SVB were at risk. For example, users of Rippling – a major payroll platform – suddenly discovered that their operations were threatened by that supplier’s reliance on SVB.

Despite these impacts, companies seldom view financial crises through a supply chain risk lens. This is an oversight that, if corrected, could enable them to anticipate and prepare for these significant disruptions, rather than simply reacting after the event.

The importance of this kind of anticipation has become all too clear in the last few weeks and is likely to remain so given the prospect of additional volatility in the short to medium term – with regional bank stocks like PacWest continuing to slide.

So how can organizations use Interos’ data to understand the pinch in the capital supply chain that portended the collapse of FRB, for example?

Using Interos Supply Chain Data to Identify the Banking Capital Market Pinch

Volatility is a measure of how much a stock price moves over time. Increasing volatility indicates higher perceived risk, and can be an indicator that the overall risk, and potential vulnerability, of the business has increased.

Chart 1: Stock Volatility of Regional Banks

Source: Interos Analysis

In addition, an analysis of metrics from the Interos platform showed FRB’s liquidity access steadily decreasing from June 2022, driven by an increase in its use of non-financial trades (see chart 2).

Chart 2: Liquidity Access Score for First Republic Bank

Source: Interos Analysis

Identifying the Ripple Effects on the Wider Supply Chain

Capital constraints ripple through the broader supply chain ecosystem, as was evident during the collapse of SVB, and now FRB.

Interos’ resilience platform documents 3,000 direct (tier-1) business relationships for SVB and FRB. But it also shows almost 600,000 indirect (tier-2) connections. These are companies that don’t bank directly with SVB or FRB but have a supplier that does.

For example, suppose Acme Corp. banks with SVB and provides IT services to Bravo, Inc. A failure in SVB would potentially disrupt payroll for Acme Corp., which might limit the services that Acme can provide to Bravo.

Without visibility into its extended supply chain, Bravo would be unable to anticipate the ripple effects of this failure.

Once a firm at the center of a capital supply chain disruption has been identified, the Interos platform enables procurement professionals to identify which tier-1 and tier-2 suppliers rely on that firm for vital goods and services.

How Organizations Should Respond to Potential Bank Failures

To respond to a capital supply chain disruption and get ahead of future problems, procurement organizations should do the following:

• Identify essential tier-1 and tier-2 suppliers that use regional banks.
• Coordinate contingency plans with these suppliers to address liquidity crunch issues and concerns about inventory management in the event that their banking partners experience a credit pinch.
• Review the recent credit history of capital suppliers (regional banks) to look for signals of distress such as increases in non-financial trades.
• Monitor the financial situation of your own banking partner(s) for any declines in access to liquidity.

Network effects, high volatility, and liquidity crunch issues will continue to be a problem for regional banks – with PacWest just the latest example – in the near term.

Owing to their smaller and often more concentrated deposit bases, regional banks are more susceptible to supply chain disruption from capital flight.

Interos’ approach to this type of risk, as described here, integrates financial data with supply chain network data and news alerts to flag potential problems in advance and provide guidance on navigating the aftermath of a crisis.

By Klaudia Kokoszka and Geraint John

Companies doing business in France should expect further disruption to supply chain operations after the country’s Constitutional Council ruled today that controversial pension reforms could proceed into law.

The move by President Macron’s government to increase the state pension age from 62 to 64 has led to mass protests and strikes across France in recent weeks. The protestors include trade unions, political activists, and citizens opposed to the change.

Hundreds of thousands of people took part in demonstrations on Thursday, ahead of the council’s decision. One group of protestors stormed the headquarters of luxury goods giant LVMH in Paris.

The protests of the past month have impacted oil refineries, utilities, railways, and financial services firms, among others.

French Protests Are Spread Across the Country

France currently has one of the lowest retirement ages among developed economies. French people, on average, stop work four years earlier than in countries such as Germany, Spain, the U.K., and the U.S. Despite this, the proposed reforms have attracted strong opposition, some of it violent, in many parts of the country.

Interos analysis of data from the Armed Conflict Location & Event Data Project (ACLED) shows that protests have taken place in more than 450 different locations across France (see map). Numbers involved range from a few dozen people in small towns to tens of thousands in major cities such as Paris and Nice.

Examining the Supply Chain Impact of Protests

Source: Interos Insights using data from Armed Conflict Location & Event Data Project (ACLED), 2023. Image Copyright: © OpenStreetMap,Data is available under the Open Database License. 

Almost five million businesses have operations in the areas affected, according to Interos’ data. The biggest impacts of labor demonstrations so far have been property damage, disrupted operations, and transport problems. Some of these have already had ripple effects along supply chains.

Strikes at oil refineries owned by Esso and TotalEnergies had a negative impact on global markets in March. 500,000 barrels of daily processing capacity – 0.5% of global oil consumption – are thought to have been affected.

Disruptions at a lesser scale have occurred at nuclear, thermal, and hydropower plants operated by firms such as Engie and EDF. These disruptions have reduced French power capacity by 15.6 gigawatts.

This week, the transit of goods flowing on the Rhine river was disrupted for the second time during the protest period. Workers cut power to the Kembs lock south of Strasbourg, France and near the German and Swiss borders. This has halted all river traffic through the area since Wednesday evening. The Rhine remains one of Europe’s busiest rivers and a disruption of this type could heavily impede cross-border trade.

To illustrate the scale of supply chains at risk, according to Interos insights, the affected firms mentioned in this article have at least 360 direct customers, 68 thousand second-tier customers, and 18 million third-tier customers. Even small changes in supply chains of this magnitude may cause notable ripple effects.

French Action Part of a Global Pattern of Unrest

The events in France are part of a growing trend of labor strikes, public protests, and general civil unrest across Europe and around the world this year.

In Germany, protests and strikes have taken place in nearly 70 different locations since mid-March. They have been primarily concentrated in the airline, rail, postal, and public education sectors.

Industrial action has also taken place in the U.K. in these and other sectors such as healthcare in recent weeks. There workers are demanding substantial pay increases to counter high inflation and the cost-of-living crisis.

Italian trade unions, meanwhile, have organized a national rail strike today against what they see as worsening working conditions and insufficient pay.

In Israel, thousands of people continue to protest against judicial reforms initiated by the Netanyahu government. Political grievances have also been motivators for protests in Nigeria and Peru in recent months. These have created a moderate risk to global trade in commodities, particularly petroleum and precious metals.

How Organizations Should Respond to Supply Chains Disrupted by Protests

Procurement leaders and organizations with supply chain operations in France and other affected regions should:

• Ensure they have visibility of both critical direct (tier-1) suppliers and indirect (tier 2, 3+) suppliers that could be impacted by strikes and civil unrest.
• Keep communication lines open with key supply partners in order to get early notification of any disruptive events.
• Review alternative sources of essential materials, parts, products, and services from suppliers in other geographic areas.
• Monitor geopolitical events and risks in France and other strike-affected countries especially closely over the next few weeks.

With inflationary pressures stemming from Russia’s war in Ukraine and other sources continuing to be felt in many economies, it is possible that civil unrest could spread further across Europe in the near term. Organizations therefore need to be ready to respond quickly to additional disruption along their extended supply chains.

By Geraint John

Companies in critical industries on both sides of the Atlantic face more stringent cybersecurity regulations as governments seek to boost national security and operational resilience.

New laws passed in the U.S. and Europe call for rapid reporting of significant cyber attacks and ransom payments, improved cyber risk management practices, a greater focus on supply chain partners such as IT and cloud services providers, and stronger collaboration between the public and private sectors.

Crucially, the legislation also extends the range of firms covered from those operating core infrastructure. That includes everything from water and transport to services such as banking, telecommunications, and healthcare, along with manufacturers of food, chemicals, pharmaceuticals, medical devices, and other “essential” products.

White House and SEC Work to Improve U.S. Critical Infrastructure Cybersecurity

In the U.S., the Biden Administration published its National Cybersecurity Strategy at the beginning of March. The first of its five pillars is titled “Defend Critical Infrastructure.” The strategy is aimed at both federal agencies and private-sector companies.

The strategy document argues that “the lack of mandatory requirements has resulted in inadequate and inconsistent outcomes.”

As well as targeting critical infrastructure providers, it also pledges to “drive better cybersecurity practices in the cloud computing industry and for other essential third-party services” that these organizations depend on.

In March 2022, President Biden signed into law the Cyber Incident Reporting for Critical Infrastructure Act, which requires companies to report certain types of cyber attacks to the Cybersecurity and Infrastructure Security Agency (CISA) within 72 hours and ransom payments within 24 hours.

CISA is currently working on implementing the reporting requirements, which must take effect by September 2025 at the latest.

Separately, the Securities and Exchange Commission (SEC) is expected to finalize its Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure rules in April. These will require public companies to report “material” incidents within four business days. They must also provide updates on previous cyber attacks.

European Union Upgrades its Main Cybersecurity Directive

In Europe, the new Network and Information Security (NIS2) directive came into force on January 16th. It replaces the first-iteration NIS law, which has been operating since 2018. NIS2 is designed to strengthen security requirements, reporting obligations, and supply chain cybersecurity.

NIS2 also provides for stricter enforcement, with administrative fines of up to €10 million or 2% of global revenue for non-compliance.

Like the U.S. legislation, NIS2 expands its scope to a broader range of “critical sectors and services,” including information and communications technology (ICT) providers.

The new directive joins a raft of other new European Union laws, including the Digital Operational Resilience Act (DORA) for financial services and the Critical Entities Resilience (CER) Directive, which addresses physical security and terrorism, as well as cybersecurity.

E.U. member states have until October 17th 2024 to transpose NIS2’s measures into national law.

A European Parliament briefing document on NIS2 argues that companies need to invest more in cybersecurity. It cites study data suggesting that E.U. organizations spend on average 41% less on cybersecurity than their U.S. counterparts.

Interos Analysis: Cyber Risk Status in Energy and Healthcare Firms

To assess the impact of this spending gap, and to identify where cybersecurity practices are most in need of improvement, Interos conducted an analysis of cyber risk scores for the top 10 U.S. and European (E.U. plus U.K.) electric utilities, energy, and healthcare (pharmaceutical manufacturing) companies using our newly enhanced cyber risk model.

This analysis found that:

• Overall company cyber risk scores – calculated from 20 subfactors and 91 attributes at both a firm and country level – vary widely. They go from a low of 59/100 — in the case of a European oil company — to a high of 82/100 for a European renewable electricity generator. The median score of 66 equates to only a “medium” level of cybersecurity protection.
• At the firm level, U.S. and European companies are on a par, with both having a median score of 62/100. U.S. electric utility and energy companies score four points higher on average than their European counterparts, while in healthcare (pharma) the reverse is true. Again, all scores indicate medium levels of risk, which suggests plenty of room for improvement in cybersecurity practices.
• The weakest areas of firm-level cybersecurity are in software-as-a-service bill of materials (SaaSBOM) vulnerabilities (average score 35/100), advanced persistent threat (APT) group activities (43/100), and compliance with public cybersecurity standards and frameworks (47/100) – a key element in the new legislation. There is also a big variation of scores between companies in web application security, web encryption, network filtering, e-mail security, and software patching.
• At the country level, European firms score two points higher on average than those in the U.S. (82/100 against 80/100, indicating low cyber risk). The U.S. is rated significantly higher for its digital infrastructure (92 vs 65), and somewhat higher for cyber governance, resilience, and international collaboration. European countries score 20 points better on average on the risk of data access and manipulation in their business environment and as a geographic target for cyber attacks.

Transparency and Collaboration Vital to Manage Critical Infrastructure Cybersecurity

Cyber risk scores for critical infrastructure firms and their key suppliers, together with the new American and European legislation, are set to bring a new level of openness to cybersecurity.

Last week, during a webinar hosted by Interos, data partners BitSight and Equifax welcomed this development.

Commenting on the new SEC rules, Derek Vadala, chief risk officer of BitSight and a former chief information security officer at Moody’s, said the rules would bring much-needed transparency and culture change to the industry.

While it will take time for companies to understand what the new rules require, those companies that are more open about how they manage cyber risks today – for example, by publishing annual reports – are in a better position than those that do the bare minimum, Vadala argued.

The credit reference agency Equifax is also following this approach. It has published a cyber strategy and roadmap report for the past three years. According to Zach Tisher, its vice president of security risk, strategy and communications, “Security should not be a trade secret.”

As well as more open disclosure, Tisher argued that:

• Employers need to bake cybersecurity into employees’ compensation plans to incentivize and reward good behavior.
• Training must move away from the one-hour annual compliance session and be tailored better to staff needs.
• Point-in-time questionnaires sent to suppliers and third parties aren’t sufficient; instead, real-time monitoring of cybersecurity controls is necessary.
• Better collaboration with partners and vendors is vital to manage growing supply chain threats and requirements.

Third-party risk management has been the biggest trend in cybersecurity during the past couple of years, Tisher noted. “Supply chain is a top threat vector and it’s increasing all the time.”

This means that companies need to focus their cyber risk management efforts as far upstream as their sixth parties (tier-4 suppliers), he added.

By Geraint John

North American and European companies have been urged to ensure that they are not inadvertently supporting Russia’s war effort in Ukraine by facilitating trade through third-party intermediaries.

A year on from its invasion, the U.S. government and the European Union (E.U.) are concerned that Russia is evading stringent sanctions and export controls by importing vital products through neighboring and “friendly” countries.

Earlier this month, the U.S. Departments of Commerce, Treasury, and Justice issued a joint compliance note asking multinational firms to “exercise heightened caution” and be “vigilant in their compliance efforts” to avoid items such as advanced semiconductors and other electronic components ending up in Russian hands.

The E.U., meanwhile, says it is investigating a surge in exports from European companies to customers in countries such as Armenia, Kazakhstan, and Kyrgyzstan, which have increased their trade with Russia since sanctions were introduced in March 2022. It is also reportedly planning to ask these countries to enhance their trade monitoring.

A new Interos white paper notes that the number of restrictions on Russian entities – around 2,500 currently active with more than 1,100 imposed in 2022 alone – are “unprecedented in their scale, scope, and breadth.”

Russia Import Restrictions Are Being Circumvented by “Friendly” Countries

Analysis of official trade data by three economists at the European Bank for Reconstruction and Development (EBRD) found “evidence suggestive of intermediated trade via neighboring economies being used to circumvent the sanctions.”

While E.U. and U.K. exports to Russia “dropped sharply” after the imposition of sanctions, exports to Armenia, Kazakhstan, and Kyrgyzstan (the CCA3) – part of the Eurasian Customs Union alongside Russia and Belarus – increased by between 15% and 90%.

Shipments to CCA3 countries covering almost 2,000 sanctioned products, including armaments, chemicals, dual-use technologies, and sensitive machinery, rose by an additional 30% relative to other goods, according to the EBRD. U.S. exports to Russia and the CCA3 followed a similar pattern last year, albeit at lower volumes.

At the same time, Armenia, Kyrgyzstan and Georgia all recorded “significant increases” in exports to Russia (see chart). This, says the EBRD paper, suggests that new supply chains have been set up to channel sanctioned products to Russia from these countries, “not necessarily with the knowledge of the Western exporter.”

But direct sales to Russia also remain a concern. This week, PBS News accused a major American machine-tool manufacturer of flouting export controls by supplying a Russian distributor with vital spare parts, which could be used for military purposes, for months after those controls were imposed last year.

Exports to Russia From Armenia, Kyrgyzstan, and Georgia – January 2020-August 2022

Separate analysis by the Silverado Policy Accelerator, a U.S. non-profit organization, published in January argued that former Soviet states “have become key transshipment points for goods that are ultimately sent to Russia.”

It also noted that Russia had significantly increased its imports from non-sanctioning countries such as China and Turkey. These included semiconductors (see chart), machinery, and heavy trucks, as well as consumer goods such as smartphones and domestic appliances.

Exports of Integrated Circuits to Russia From China and Hong Kong – January-November 2022

In recent months, U.S. officials have called on China, Turkey, South Africa, and the United Arab Emirates ( UAE), among other countries, not to help Russia evade its sanctions.

Together with their E.U. and U.K. counterparts they are also reported to have visited the UAE to express concern that it is becoming a key shipment hub for electronic components and other sensitive products being re-exported to Russia.

The E.U. recently imposed sanctions on a Dubai-based subsidiary of the Russian state-owned shipping company Sovcomflot, a key player in supporting the country’s energy revenues, as part of a new package of measures.

Russian Interests and Indirect Business Relationships

Russian ownership of foreign entities is one potential type of supply conduit of sanctioned goods into the country.

Interos’ global relationship platform highlights 166 entities based in the UAE that are wholly or partially owned by Russian interests.

Similar numbers are located in both Armenia and Hong Kong, according to the data, although these are dwarfed by the thousands of entities registered in European countries such as the Czech Republic, U.K., Germany, Latvia, Bulgaria, and Italy.

Another source of supply is links between Western firms and intermediaries in countries accused of supplying Russia’s war effort. Our analysis here reveals:

• Almost 700 relationships between Russian end customers and 170-plus distinct suppliers in China, Turkey, India, Uzbekistan, and other Central Asian countries.
• More than 8,100 relationships between these suppliers and over 1,750 distinct Western firms in the U.S., Canada, E.U., and U.K.

What this shows is that the global network to support deliberate or inadvertent illicit trade with Russia – so-called “supply chain washing” – is extensive and the risks of breaching sanctions and export controls are high.

“Red Flags” to Watch Out For

In their “tri-seal compliance note” published on 2 March, the U.S. Department of Commerce (DOC), Department of the Treasury and Department of Justice (DOJ) urged companies to be on the lookout for “warning signs of potential sanctions or export violations.”

It listed 13 common “red flags” to watch for, including:

• The use of shell companies to obscure ownership, origin, and funding sources
• A reluctance by customers to share information on product end-use
• Last-minute changes to shipping instructions
• The use of residential addresses and personal e-mail accounts
• Transactions with entities that have little or no web presence
• Routing of products through transshipment points in China, Turkey, Armenia, and other countries that have boosted trade with Russia.

The note emphasizes that the DOJ “has pursued criminal charges against those who it alleges are using front companies and intermediate transshipment points to evade Russia-related U.S. sanctions and export controls”.

Separately, the DOC’s Bureau of Industry and Security has published a compendium of its investigations into sanctions busting in several countries, including Russia, to illustrate the legal and financial penalties that can result from non-compliance.

A group of E.U. countries, including France and Germany, has also recently been pushing for tougher action against companies found to be circumventing sanctions and aiding Russia’s war effort.

A Call to Action to Uphold Russia Import Restrictions

In the light of these warnings and developments, procurement, supply chain, and business leaders at Western companies should:

• Screen both existing and new customers using the latest U.S., E.U. and other restrictions lists – information that is updated regularly on Interos’ Resilience platform.
• Understand the direct and indirect relationships their organizations have with firms in high-risk intermediary countries for sensitive and sanctioned products.
• Ensure that their due diligence and risk management programs empower staff to report any concerns and potential breaches of sanctions rules in a timely manner.

Although Russia has clearly been able to obtain many products from alternative sources in the year since Western sanctions were massively stepped up, there is little doubt it is paying a high price (literally) for Vladimir Putin’s actions.

Stories about microchips being removed from washing machines and other consumer products to supply its military machine suggest that its ability to weather the ever-growing list of restrictions has been limited so far.

However, as the war drags on further into its second year, alternate supply chains may begin to pick up more of the slack – hence the current focus and call to action by U.S. and European governments directed at companies around the world.