The guilty plea entered by Estonian national Andrey Shevlyakov is a useful reminder of just how far the Justice Department is willing to reach, geographically and procedurally, to prosecute export control evasion tied to the Russian military. Shevlyakov, who pleaded guilty to conspiracy to commit export violations, has agreed to pay a $1.5 million fine and faces up to 40 years in prison for his role running a procurement network that funneled sensitive U.S. electronics to Russian military and government contractors.

The Case in Brief

According to the Justice Department, Shevlyakov ran a years-long scheme to acquire sensitive American technology and electronics on behalf of Russian defense contractors and government agencies, despite being named on the U.S. Entity List, the Commerce Department’s roster of parties subject to specific export licensing restrictions because of national security or foreign policy concerns. Being named on that list did not stop him. Instead, according to court documents, Shevlyakov built a network of shell companies designed specifically to obscure his identity and evade the very restrictions that were supposed to block him from acquiring controlled technology in the first place.

The mechanics of the deception are worth dwelling on because they are so mundane, and that is exactly the point. In one instance highlighted by DOJ, Shevlyakov placed an order with a U.S. company for sensitive electronic components. The company checked its screening process, identified him as a party on the Entity List, and refused to sell. Shevlyakov canceled the order. Then, days later, he placed the same order again, using a different email address and a false name.

That single sequence, refused, canceled, reordered under a new identity, tells you almost everything you need to know about how sanctioned and listed parties actually operate in practice. They do not stop when a compliance control catches them the first time. They probe, adjust, and try again, often almost immediately, counting on the next vendor, or the same vendor under a slightly different transaction, to miss what the first one caught.

Shevlyakov was arrested by Estonian authorities in 2023 and extradited to the United States in 2025, where he ultimately entered his guilty plea. U.S. Attorney Joseph Nocella framed the case as a statement of reach and intent: the government will pursue those who assist Russian efforts to illegally procure U.S. technology regardless of who they are or where in the world they reside.

Why This Case Matters Beyond the Individual Defendant

It is tempting to read a case like this purely as a story about one determined bad actor and move on. That would miss the real lesson. This case is a live illustration of exactly the pattern export compliance programs are designed to catch, and exactly the pattern that a program without persistence controls will miss.

The initial denial in this case worked. A U.S. company screened its customer, found the Entity List match, and refused the transaction. That is the system functioning as intended. The failure risk sits entirely in what happens next: does the exporter, or the industry more broadly, have any mechanism to flag that the same buyer, operating under a new name and a new email address, is attempting the identical purchase again shortly afterward? A one-time screening check performed at the moment of sale is necessary, but it is not sufficient against a determined procurement network that has already demonstrated it will simply change its identity and try again.

This is precisely why export control compliance cannot be treated as a single-gate screening exercise. Sophisticated procurement networks assume the first attempt may be blocked and build in redundancy: multiple shell entities, multiple points of contact, multiple slightly varied identifying details, all aimed at the same underlying end use. A compliance program built only to catch the first attempt, without any capability to correlate related attempts across time, product type, shipping destination, or payment method, is built to catch exactly the scenario that did not happen here and to miss the one that did.

What This Means for Export Compliance Programs

A few practical points are worth drawing from this case for any company that manufactures or distributes sensitive electronics, dual-use technology, or other export-controlled goods.

Entity List and denied party screening needs to happen at every transaction, not just at initial customer onboarding. A buyer who is screened once and cleared can still be a different, listed party attempting a repeat purchase under new details weeks or months later. Screening has to be a standing transactional control, not a one-time gate.

A denied or canceled transaction should trigger enhanced scrutiny of subsequent orders that share any identifying characteristics with the denied transaction, whether that is a shipping address, a product configuration, a payment method, or simply the timing of a near-identical reorder shortly after a refusal. Companies should have a documented process for flagging and investigating these patterns, not simply logging the denial and moving on.

Front companies and shell entities remain a durable evasion tool precisely because they are cheap and easy to create relative to the value of the controlled technology being pursued. Export compliance teams should treat newly formed counterparties, especially those requesting sensitive electronics with plausible but unverified end-use explanations, with a heightened level of diligence, including independent verification of the business’s history, ownership, and legitimate commercial purpose.

Finally, this case is a reminder that export control enforcement against Russia-related procurement networks is an active, resourced, and international priority for the Justice Department, extending to extradition of foreign nationals years after the underlying conduct. Companies should not assume that geographic distance from the United States, or the involvement of intermediaries based abroad, meaningfully reduces enforcement risk for the U.S. entities whose products end up, however indirectly, in the hands of a sanctioned military or government end user.