A company was established in Abuja. Fifty-six days later, OFAC sanctioned it.

The Vanguard Tactical Supply case shows why list-based screening is inherently reactive, and why newly formed entities need more than a name match.

OFAC records Vanguard Tactical Supply Limited as established in Abuja on 20 May 2026.

On 15 July, the US Treasury added it to the OFAC Specially Designated Nationals and Blocked Persons List, describing it as an intermediary in efforts to procure weapons for Iran's Islamic Revolutionary Guard Corps.

Before that designation, a sanctions search against the company's legal name would probably have returned no direct match.

That does not mean there were no risk signals. It means sanctions lists and risk detection are not the same control.

And that distinction should concern every compliance team onboarding newly formed companies in Africa.

Fifty-six days. Hold that number, because I have not been able to put it down.

The list comes last

A sanctions list is mostly a record of entities that authorities have already identified. It is not a prediction of which entities will become dangerous next.

Most names reach a list only after a long sequence has already run its course. An entity is formed or begins operating. Authorities identify a concern. An intelligence or investigative process follows. A designation is approved and published. Financial institutions ingest the update and rescreen their customers.

Every day inside that gap is a day the entity can operate while a name-only screen says nothing.

The people who build front-company structures understand that lag. They build around it.

A front company does not need to fool you forever. It needs to fool you once, before the risk attached to its name becomes public.

That is the whole game.

This is a documented pattern, not a one-off

In an alert issued in May 2026, the US Financial Crimes Enforcement Network warned institutions about recently incorporated entities that move unusually large or rapid sums, make large round-value payments, or operate with a limited online footprint and an unclear business purpose.

Vanguard's age fits one part of that profile.

The public record does not establish that it displayed the other indicators, and FinCEN is explicit that no individual red flag proves illicit activity. The indicators have to be assessed together, and in context.

A separate FinCEN advisory issued in June 2025 described how Iranian procurement networks use front companies to obscure the source of funds, the jurisdictions involved and the ultimate end user. It also reminded institutions to understand the purpose of customer relationships, identify beneficial owners and conduct ongoing monitoring.

Read together, the guidance exposes a specific blind spot. Newly formed entities can become operationally dangerous before they have accumulated enough history to look dangerous.

Those are precisely the entities a sanctions list cannot describe in advance.

The uncomfortable part for Africa

Let me be clear about what this is not. It is not an argument against fast and accessible company formation.

The existence of a Nigerian node does not mean Nigeria's company-registration system caused the alleged conduct. But it does mean Nigerian institutions carry part of the detection and monitoring burden, across trade-finance desks, correspondent banking relationships and fintechs onboarding business customers at speed.

A newly formed supplier is one of the most ordinary customers in a growing economy.

It is also a shape that risk can take.

That is the hard part. We cannot treat every new company as suspicious. But we cannot assume that the absence of history means the absence of risk either.

What materially reduces the risk

No control can guarantee that every newly formed front company will be identified. But the problem divides into two parts, and each one needs a different answer.

Before designation, detect risk. A direct match against the company's legal name could never have found a designation that did not yet exist. What helps is assessing the entity itself:

• its age and stated business activity;
• its directors, owners and controllers;
• its registered address, telephone numbers, email domains and related entities;
• its expected transaction values and geographies;
• its customers, suppliers and counterparties;
• its trade documents and stated end-use;
• and whether its actual activity matches the purpose it gave at onboarding.

Beneficial-ownership and control checks can reveal connections that a legal-name search misses. They are necessary, but not sufficient. And to be clear, the public information does not establish who owned or controlled Vanguard Tactical Supply, so ownership checks cannot be sold as something that would certainly have caught this particular company.

None of this requires knowing in advance that an entity is dangerous. It requires a risk-based posture that looks harder at combinations of indicators: recent formation, sensitive or dual-use activity, opaque ownership, unexplained counterparties, higher-risk trade corridors, unusual values, and behaviour that does not fit the stated purpose.

A company's name is not evidence of wrongdoing. But a weeks-old entity, whose declared goods, counterparties and expected flows create credible sanctions-evasion or proliferation-financing exposure, is exactly the sort of file where enhanced due diligence should begin early and continue for the life of the relationship.

That would not guarantee detection. It would materially improve the odds of spotting the inconsistencies before a sanctions list ever provides the unambiguous answer.

Ongoing due diligence cannot stay a luxury

The usual objection is cost.

Enhanced due diligence has traditionally been slow and expensive, reserved for the highest-risk relationships and repeated infrequently, sometimes only at an annual review or after something has already gone wrong.

That model is getting harder to defend by the month.

Integrated automation can take the operational weight out of repeated screening and review. When ownership resolution, sanctions screening, transaction monitoring and event-driven rescreening run together, an institution can revisit its higher-risk relationships far more often without treating every customer as equally risky.

Automation does not replace analyst judgement. It makes ongoing, risk-based review actually feasible.

After designation, eliminate latency. Once a name is published, the gap before it goes live in your screening environment should be measured in hours, not weeks. That means:

• same-day sanctions-data ingestion;
• continuous or event-driven rescreening;
• screening of connected entities and counterparties;
• immediate alerting and appropriate account controls;
• clear escalation and investigation;
• and regulatory reporting, including restrictions where applicable law requires them.

For a 56-day-old company, the day the designation lands may be the first unambiguous warning the screening system ever receives.

Before designation, detect risk. After designation, eliminate latency.

The model, not the analyst

I keep coming back to the analyst who would have reviewed a company like this before the designation.

A legal-name search might have returned no direct match. That would not make the analyst careless. It would expose the limits of the control they were handed. The data vendor might not have been slow by the standard the industry has quietly accepted. The institution might have followed its process to the letter.

The problem is that the process was built to recognise known names, not to weigh every emerging relationship whose risk has not yet become public.

An entity can now matter to your risk exposure long before it develops any meaningful public history. And a name-only screen can stay silent through the whole of that window.

This is the problem we built Youverify to address

Current, multi-jurisdictional screening. Beneficial-ownership and control checks. Risk-based KYB. Event-driven rescreening and transaction monitoring, in one operating environment.

Lists remain essential. They are one layer of the control, not the whole of it.

You can keep screening against yesterday, and hope the gap never opens on your desk.

Or you can build to see today, because today is where the newest names live.

#Sanctions  #AML #FinancialCrime  #Nigeria  #RegTech

Sources

• OFAC Recent Actions, 15 July 2026: https://ofac.treasury.gov/recent-actions/20260715
• US Treasury press release (SB0564): https://home.treasury.gov/news/press-releases/sb0564
• OFAC Sanctions List Search (verify the establishment date here): https://sanctionssearch.ofac.treas.gov
• FinCEN alert on IRGC front companies, May 2026: https://www.fincen.gov/news/news-releases/fincen-issues-alert-stop-money-laundering-iranian-revolutionary-guard-corps
• FinCEN advisory on Iran sanctions-evasion red flags, 6 June 2025:https://www.fincen.gov/news/news-releases/fincen-issues-advisory-iranian-regimes-illicit-and-malign-activities-and