On May 11, 2026, the US Department of the Treasury’s Financial Crimes Enforcement Network (“FinCEN”) issued an alert (the “Alert”) to financial institutions outlining funding streams and procurement networks that support Iran’s Islamic Revolutionary Guard Corps (“IRGC”). The Alert supplements an earlier June 6, 2025 FinCEN Advisory on the Iranian Regime’s Illicit Oil Smuggling Activities, Shadow Banking Networks, and Weapons Procurement Efforts, as well as FinCEN’s May 8, 2024 Advisory to to Counter the Financing of Iran-Backed Terrorist Organizations. In addition to reminding financial institutions of their reporting obligations under the Bank Secrecy Act (“BSA”), the Alert describes the IRGC’s primary sanctions-evasion typologies and identifies 14 red flags that financial institutions should consider when assessing potential exposure to IRGC-related illicit finance.
Background
The IRGC is a US-designated Foreign Terrorist Organization (“FTO”) that operates as a parallel military organization reporting directly to Iran’s Supreme Leader. Its sub-unit, the IRGC-Qods Force (“IRGC-QF”), conducts covert operations abroad and supplies funding, training, and weapons to proxy groups, including Ansarallah (the Houthis) and Lebanese Hizballah. The Alert was issued in the context of the Trump Administration’s “Economic Fury” campaign and National Security Presidential Memorandum-2 (“NSPM-2”), signed on February 4, 2025, which imposes a policy of maximum pressure on the Iranian regime.
Key Sanction-Evasion Typologies
As part of the Alert, FinCEN identified four core activities used by the IRGC to supplement their budgets:
- Commodity Sales and Misrepresentation of Commercial Activity. The IRGC and its subordinate units supplement their budgets by smuggling oil to international buyers through the use of old or poorly maintained “shadow fleet” vessels These vessels are often owned or managed by front companies outside of Iran, most commonly from Iraq, the United Arab Emirates, and Hong Kong. In order to further hide the oil’s origins, Iranian oil is also blended with oil from third countries and relabeled with forged documents from said countries, most commonly as “Malaysian blend.” This oil typically is sold to small independent refineries in China, which are referred to as “teapot refineries.” FinCEN’s 2025 Financial Trend Analysis (“FTA”) found that oil companies potentially linked to Iran transacted approximately $4 billion in 2024, while shipping companies conducted approximately $707 million in transactional activity through U.S. correspondent accounts potentially related to the “shadow fleet.”
- Use of Front Companies and Layered Corporate Structures. The IRGC and other Iranian actors utilize “shadow banking” networks to sell oil and other commodities, launder the proceeds, and then use such proceeds to procure weapons and other materials on the international market. These networks typically involve exchange houses, trading companies, and front companies. Iranian banks have established so-called “rahbar” companies to manage international transactions, using exchange houses to incorporate rahbar front companies in permissive jurisdictions to open bank accounts outside of Iran. The Alert noted that common indicators of rahbar companies include entities transacting in large sums, rapid movement of funds in large round dollar payments, and transactions between companies in varying lines of business. In the FTA, FinCEN estimated that about $5 billion dollars were transferred in 2024 relating to this activity, primarily from non-resident accounts in China operated by Hong-Kong-based companies to accounts in the UAE.
- Use of Facilitators and Other Service Providers. The IRGC networks are also bolstered by a web of facilitators, including money services businesses (“MSBs”), investment companies, and trust service providers which assist in orchestrating complex money laundering schemes. For example, Iranian facilitator Mohammad Hossein Shamkhani, who was designated by the Treasury’s Office of Foreign Assets Controls (OFAC) in July 2025, uses a network of vessels, ship management firms, and front companies to launder billions in profits from both Iranian and Russian crude oil. The IRGC also operates in conjunction with terrorist partners such as Ansarallah and Hizballah, which maintain their own global facilitation networks.
- Digital Assets Infrastructure. The IRGC also uses digital asset transactions as part of Iran’s shadow banking network. Iranian actors favor stablecoins for their liquidity, ease of settlement, and exchange rate stability, which have also been used by Iranian proxies such as Hamas and Hizballah. More recently, Iran’s use of stablecoins includes minting activity, movement between large-volume stablecoin issuers, and the creation of proprietary stablecoins (such as USDZ, associated with OFAC-designated stablecoin issuer Zedxion). The Alert notes that U.S. financial institutions with exposure to digital assets should consider reviewing blockchain ledgers for activity potentially attributable to Iran-based digital assets service providers (“DASPs”). Financial institutions should also be mindful of unregistered digital assets exchanges who may rely on liquidity provided by larger DASPs to process transactions. The Alert further notes that more recently, Iranian actors have turned to the creation of DASP front companies to further avoid sanctions, such as Zedcex Exchange, Ltd. and Zedxion Exchange, Ltd., two UK-registered digital asset exchanges that were designated by OFAC in January 2026 and that had multiple digital asset addresses which processed funds to wallets linked to the IRGC.
Red Flags
The Alert identifies fourteen red flags that may be indicative of suspicious activity related to Iranian actors, and which supplement FinCEN’s earlier advisory. While no red flag is determinative, financial institutions should consider heightened due diligence across the identified areas.
Oil Smuggling
- Suspicious Shipping Companies: Transactions involving petroleum or shipping companies with counterparties that have ties to Iran or that use “shadow fleet” vessels linked to Iranian ports.
- Irregular Shipping Documentation: Oil-related transactions involving vessels previously linked to suspicious financial activities, or documentation (e.g., bills of lading) that appears falsified or omits key information to obscure an Iranian nexus.
- Efforts to Disguise Vessel Information: Vessels that have undergone recent or multiple name, flag, or ownership changes, particularly following an OFAC designation of the prior owner or operator.
- Efforts to Disguise Oil Origins: Transactions referencing “Malaysian blend” oil, particularly where the vessel is bound for China via Southeast Asia and displays Automatic Information System (AIS) irregularities or evidence of ship-to-ship transfers in areas of concern.
Shadow Banking and Front Company Abuse
- Unclear Source of Funds: Wire transfers or deposits with incomplete or absent source-of-funds information involving entities in high-risk jurisdictions for Iranian illicit finance.
- Use of Company Types and Jurisdictions at High-Risk for IRGC Abuse: General trading companies with opaque ownership registered in UAE free trade zones (or similar locations), with trading counterparties in Singapore and Hong Kong and bank accounts in China, Hong Kong, Oman, or the UAE.
- Likely Front Companies with Suspect Transaction Patterns: Hong Kong-registered companies banking through Chinese non-resident accounts that are recently incorporated, lack web presence, are co-located with similar companies, or transmit large, round-dollar payments to UAE trading companies with no clear business purpose.
- Unusual Use of Exchange Houses: Transactions moving through multiple exchange houses and/or trading companies with fees, volumes, or patterns inconsistent with standard commercial practices.
Digital Assets
- Unusual Digital Asset Payments by Petroleum Companies: Companies with potential exposure to Iranian oil smuggling that deviate from normal business practices to send or receive payments using digital assets.
- Stablecoin Payments with Unclear Sources of Funds: Stablecoin payments received by customers in high-risk jurisdictions that do not match the customer’s line of business, with insufficient source-of-funds documentation.
- Unusual Stablecoin Activity: Unusual stablecoin minting activity, including rapid rate/limit increases by foreign entities such as overseas purported trust companies.
- Payments to/from Iran-located DASPs: Blockchain analysis indicating direct or indirect transactions with digital asset addresses attributed to Iranian entities.
- Iran-related Cyber Indicator: Cyber indicators suggesting digital asset transactions from Iran, including connections from Iranian IP addresses, use of Iranian email services or telephone numbers, and use of VPNs or Tor exit nodes combined with other evidence of an Iranian location.
- Unregistered P2P Exchangers, Foreign-Located MSBs, and Nested DASPs: Account activity suggesting operation of an unregistered P2P exchanger, foreign-located MSB, or nested DASP providing services in Iran.
FinCEN requests that financial institutions reference the Alert in Suspicious Activity Report (“SAR”) field 2 by including the key term “FIN-2026-Alert002” in that field when reporting suspicious activity relating to the Iran-related activities described in the Alert.
