On 27 August 2026, the National Crime Agency announced that ENEX Premium Trading Limited had agreed to forfeit more than $5.2 million (£3.84 million) following a civil recovery investigation into suspected money laundering and sanctions evasion. The case is not a criminal conviction. No charges have been filed. Nadir Valiyev, the Azerbaijani national who owns ENEX, has denied engaging in criminal activity. The settlement does not constitute an admission of unlawful conduct.
What it does constitute is a detailed map of a layered financial structure that moved funds across four jurisdictions before landing in UK accounts opened with Electronic Money Institutions. The companies that paid into those accounts have since been designated by the US for facilitating illicit Iranian oil sales and transferring funds to the Iranian Qods Force. For compliance teams at financial institutions and EMIs, the pattern the NCA uncovered is one worth understanding in detail.
How the Money Moved
The Structure at Onboarding
ENEX Premium Trading Limited is registered in St Kitts and Nevis and described as an agricultural trading company. Between July and September 2024, the company opened accounts with UK Electronic Money Institutions and transferred significant funds into them. When opening those accounts, Valiyev stated that the source of funds was his personal wealth and retained earnings from previous trading structures, including UAE-registered Burston Trading FZE.
That explanation was recorded. It was not adequately verified. The NCA's subsequent investigation produced a different picture.
What the Investigation Found
The funds frozen in the UK were traced back to Chinese bank accounts held by ENEX. Those accounts had turned over tens of millions of pounds from suspected front companies during the same July to September 2024 window. The NCA also found that the funds were being routed through UK EMIs to be converted into cryptocurrency before moving elsewhere.
The critical link came after the account freezing order. The companies that had made payments into ENEX's Chinese accounts were subsequently designated by the US Treasury under sanctions for their involvement in facilitating illicit Iranian oil sales and for channelling revenue to the Iranian Qods Force, a unit of the Islamic Revolutionary Guard Corps designated as a terrorist organisation by the US.
"NCA officers worked diligently to track the source of these funds, uncovering evidence that payments made into ENEX's accounts had been made by US-sanctioned companies. The NCA will continue to use all powers at our disposal to identify, pursue and recover cash used in crime."
Head of the NCA's Combatting Kleptocracy Cell, August 2026
Additionally, media and investigative reporting in 2024 had alleged that Valiyev's companies were involved in the shipment of grain from Russian-occupied areas of Ukraine. It was those reports that originally triggered the NCA's interest in the accounts. The civil recovery settlement resolves the financial element of that investigation.
Three Compliance Lessons the Case Illustrates
Recording a source of funds explanation is not the same as verifying it.
When ENEX opened UK accounts with EMIs, Valiyev stated the source of funds was personal wealth and retained earnings from named previous trading structures. That explanation was accepted at face value. The NCA investigation found it did not reflect where the money actually came from. This is one of the most consistently cited gaps in AML enforcement actions: a customer provides an explanation for source of funds, the institution records it, and treats recording as verification. For high-risk customers, specifically those with multi-jurisdictional corporate structures, offshore registrations, and recently opened accounts receiving large inflows, source of funds verification requires evidence, not just explanation.
Counterparties designated after the transaction cleared still create compliance exposure.
At the time the funds moved through ENEX's Chinese accounts, the companies making those payments had not yet been designated by the US. They were designated later, after the NCA's investigation had already identified them as suspected front companies. This creates a category of sanctions risk that point-in-time screening cannot catch: a counterparty who is not yet designated but whose connections, structure, and transaction behavior are consistent with sanctions evasion typologies. Continuous customer monitoring and ongoing screening are specifically designed for this scenario, generating alerts when the sanctions landscape changes in relation to existing customers and their known counterparties. Notably, this mirrors the Deutsche Bank OFSI case, where the ownership link to a newly designated entity was not in the screening data at the time payments cleared.
Electronic Money Institutions carry the same AML obligations as banks, with the same enforcement exposure.
The funds in this case moved through UK EMIs, not traditional banks. EMIs are regulated financial institutions under the Money Laundering Regulations and carry AML program, CDD, and SAR filing obligations equivalent to those applied to deposit-taking institutions. The ENEX case demonstrates that the NCA applies civil recovery powers and account freezing orders to funds held at EMIs in the same way it does to funds at banks. Furthermore, EMIs operating in the payments and money transfer space are specifically listed in FinCEN and FATF guidance as higher-risk for money laundering typologies involving layering and cryptocurrency conversion. Compliance programs at EMIs that are calibrated to a lower standard than those at banks are exposed to this enforcement risk.
The Structure Behind the Case
The ENEX case exhibits a layering pattern that regulators and compliance professionals encounter repeatedly in Iranian sanctions evasion typologies. A trading company is registered in a low-transparency offshore jurisdiction. It operates through UAE-based intermediaries with stated legitimate trading activity. Payments are received through a network of front companies operating in a third country, in this case China. Those funds are transferred to newly opened accounts in a jurisdiction with developed financial infrastructure, in this case the UK, and then converted into cryptocurrency to obscure the trail further.
Each layer in that structure performs a specific function. The offshore registration creates ownership opacity. The UAE trading history provides a plausible business narrative for source of funds. The Chinese accounts provide geographic distance from the Iranian connection. The UK EMI accounts provide access to Western financial infrastructure. The cryptocurrency conversion provides a further obfuscation step before funds exit the system.
No single layer in that structure is necessarily suspicious in isolation. It is the combination of layers, the speed of fund movement, the newly opened accounts, the offshore registration, the multi-jurisdictional routing, and the absence of a verifiable explanation for the ultimate source, that generates the risk picture. Compliance programs that evaluate these factors individually rather than holistically will miss the pattern.
What Financial Institutions and EMIs Should Take From This Case
Newly opened accounts receiving large inflows shortly after opening require enhanced source of funds verification, not just explanation. ENEX opened UK accounts and received significant funds within the same July to September 2024 window. That velocity, a recently opened account receiving large inflows from multiple sources in a short period, is one of the most documented red flags in AML guidance. Consequently, CDD procedures should escalate source of funds requirements specifically for this pattern, requiring evidence rather than self-certification.
Offshore-registered entities with UAE or multi-jurisdictional trading histories require deeper beneficial ownership due diligence. ENEX was registered in St Kitts and Nevis and referenced UAE-based Burston Trading FZE as part of its source of funds narrative. Both St Kitts and Nevis and the UAE appear in FATF guidance as jurisdictions requiring enhanced scrutiny. Furthermore, an offshore-registered agricultural trading company with UAE connections opening UK accounts for the first time warrants beneficial ownership verification that goes beyond the named individual and traces the full corporate chain.
Cryptocurrency conversion activity at EMIs requires monitoring as a layering indicator, not just as a transaction type. The NCA found that funds were being routed through UK EMIs to be converted into cryptocurrency. That specific pattern, large inflows from a recently opened account followed by cryptocurrency conversion, is a documented typology for layering in both FinCEN guidance and NCA enforcement experience. EMIs that provide crypto on-ramp services should specifically calibrate their monitoring for this combination of behaviors.
Ongoing screening needs to capture post-transaction designations of known counterparties. The companies linked to ENEX's Chinese accounts were not designated at the time of the transactions. They were designated later. Consequently, a monitoring program that only screens at onboarding and transaction time will not detect when a counterparty connected to an existing customer is subsequently designated. Continuous screening against OFAC, HMT, and other sanctions lists, applied to the counterparty networks associated with existing customers, is the control that surfaces this category of risk.
Frequently Asked Questions
What is the ENEX NCA forfeiture case about?
What is an NCA Account Freezing Order?
Do Electronic Money Institutions have the same AML obligations as banks?
What is Iranian sanctions evasion and how does it typically work?
What is civil recovery and how is it different from a criminal conviction?
The Sentinel Perspective
The ENEX case brings together several of the most significant compliance risks in the current sanctions environment: Iranian oil revenue evasion, multi-jurisdictional layering, offshore shell company structures, and cryptocurrency conversion through EMIs. No single element of that structure is new. Together, however, they form a pattern that point-in-time screening at account opening would not have detected, because the most damaging connection, the designation of the counterparty companies, occurred after the transactions cleared.
Sentinel's continuous customer monitoring and sanctions screening platform addresses exactly this temporal gap. Ongoing screening against OFAC, HMT, and other major sanctions lists generates alerts when the designation status of entities connected to existing customers changes. Rather than treating the onboarding screen as the only point of scrutiny, Sentinel maintains a live picture of the risk landscape around your customer base. When counterparties connected to an existing customer are designated, your team is alerted. The workflow opens. The decision is documented.
For financial institutions and EMIs processing cross-border payments, the question the ENEX case raises is direct: when a counterparty connected to one of your existing customers is designated tomorrow, how long will it take your compliance program to surface that connection?
See How Sentinel Supports Continuous Sanctions Screening and Source of Funds Monitoring
Request a demonstration tailored to your institution's sanctions exposure and AML compliance program.
Official References and Sources
- Millions Forfeited by Company Linked to Suspected Money Laundering and Sanctions Evasion — National Crime Agency, 27 August 2026
- UK NCA Secures £3.84M Forfeiture From Caribbean Agri-Trader ENEX — AML Network, 27 August 2026
- UK Weekly Sanctions Update — Mayer Brown, September 2026
- Agricultural Company Forfeits £3.8 Million Following UK Investigation — Global Sanctions, 1 September 2026
Truth Technologies provides AML, KYC, OFAC, and sanctions screening compliance solutions through the Sentinel platform. This post is published for informational purposes only and does not constitute legal advice. No criminal charges have been filed against ENEX Premium Trading Limited or Nadir Valiyev. The civil recovery settlement does not constitute an admission of unlawful conduct by either party. All facts are sourced from the official NCA press release and publicly available reporting linked above.
