¿Qué es Wire stripping?

What is wire stripping?

Sanctions screening works by reading the text of a payment message and matching names, addresses, and countries against watchlists. Wire stripping, also called message stripping, attacks that process at its source: someone edits the payment message to take out or disguise the information that would trigger a hit. Strip out the sanctioned party's name or country, and the automated filter downstream has nothing to catch.

It usually happens at a bank or intermediary that is knowingly helping a customer evade sanctions. Before forwarding a wire through a correspondent or clearing bank, staff remove references to a sanctioned country, replace a blocked entity's name with a generic description, or reroute the message so the origin is hidden. The payment then reaches banks that would have blocked it, but they never see the flag.

For a sanctions or AML team, wire stripping is a form of deliberate evasion, not an accidental screening miss. It is one of the most heavily penalized compliance failures, because it defeats the entire control by corrupting the data before it is ever screened.

How a stripped payment gets through

The manipulation happens in the payment message, before it reaches the screening bank:

InstructCustomer sends a risky payment A payment involves a sanctioned party, country, or entity that would normally be blocked.
StripAlter the message Staff delete or disguise the names, countries, or references that screening filters look for.
RouteSend it onward The cleaned message passes through correspondent and clearing banks that screen only what they can see.
SettlePayment clears undetected Funds reach the destination as if the transaction were ordinary and fully compliant.

Who is involved?

Who	Their role
The originating customer	Wants to move funds tied to a sanctioned party, country, or entity.
The stripping bank	The institution or staff that edit the message to remove the flag before sending it on.
The correspondent or clearing bank	Screens the payment but sees only the sanitized message, so nothing triggers.
The sanctioned party	Receives the value that sanctions were meant to deny them.

What it looks like in practice

A customer needs to pay a counterparty in a sanctioned country, and its bank wants to keep the business. Before routing the wire through a major clearing bank, the originating bank's staff remove the sanctioned country from the payment message and replace the counterparty's name with a vague reference to a trading company.

The clearing bank's sanctions filter reads the sanitized message, finds nothing on its lists, and processes the payment. The funds settle normally. The evasion is invisible in the transaction itself, and it surfaces only later, through a whistleblower, a pattern of formatting anomalies, or a regulator comparing the bank's own records against the messages it sent.

Why it matters to operators

Wire stripping is dangerous precisely because it makes a prohibited payment look clean to everyone downstream. The banks that would have blocked it are screening corrupted data, so their controls report success while a sanctions violation sails through. That is why enforcement treats stripping as among the most serious offenses, with some of the largest penalties ever levied for sanctions breaches tied to it.

The defense cannot rely only on screening the message you receive, since that is the thing being manipulated. Teams look for signs of tampering: cover payments that hide the underlying parties, mismatches between a bank's internal records and the messages it transmits, unexplained use of generic descriptions, and formatting that suggests fields were edited. Strong internal controls, staff accountability, and preserving the full original payment data are as important as the filter itself.

What to watch in the data

Record mismatches. Differences between a bank's internal customer records and the party details in the messages it actually sent.
Vague party fields. Generic descriptions like "a trading company" or "our client" standing in where a real name and country belong.
Cover payment misuse. Payment structures that hide the underlying originator and beneficiary from the intermediary bank.
Edited formatting. Truncated, reformatted, or inconsistently populated fields that hint a message was altered in transit.
High-risk corridors going quiet. Expected sanctioned-country exposure that never generates screening hits, suggesting details are being removed.

Quick questions

Is wire stripping the same as a screening false negative?

No. A false negative is an honest miss by a filter. Wire stripping is deliberate: someone edits the message to remove the information that would have triggered a hit, so it is intentional evasion rather than a technical failure.

Who actually does the stripping?

Typically staff at a bank or intermediary that is knowingly helping a customer evade sanctions. They alter the payment message before forwarding it to correspondents or clearing banks that would otherwise block it.

Why can't downstream banks catch it with screening?

Because they screen the message they receive, and that message has already been sanitized. If the sanctioned name or country has been removed, the filter has nothing to match, so the payment looks fully compliant.

How do investigators find it?

By comparing a bank's own records with the messages it sent, spotting vague or edited party fields, examining cover-payment structures, and following whistleblower or audit leads. It usually surfaces through reconstruction, not real-time screening.

Why are the penalties so large?

Because stripping is a knowing scheme to defeat sanctions rather than a control gap, and it can move significant value to prohibited parties. Regulators treat it as among the most serious sanctions offenses, with settlements running into the hundreds of millions.