In May, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) issued Alert FIN-2026-Alert002, warning financial institutions about the use of front companies, financial facilitators, and digital asset infrastructure by Iran’s Islamic Revolutionary Guard Corps (IRGC) to evade sanctions and launder proceeds. The Alert represents an escalation in U.S. government guidance concerning Iranian illicit finance and underscores the expectation that covered institutions maintain robust controls capable of detecting increasingly sophisticated sanctions evasion typologies.
Background: The IRGC and the Policy of “Maximum Pressure”
The IRGC was created after the Iranian Revolution as a parallel military organization reporting directly to Iran’s Supreme Leader, and includes ground, naval, and air forces, the Basij internal security militia, and the IRGC-Qods Force (IRGC-QF), which conducts covert operations abroad and supports terrorism by supplying funding, training, and weapons to aligned groups. The IRGC is a designated Foreign Terrorist Organization (FTO) and is subject to comprehensive U.S. sanctions, including a prohibition on opening or maintaining correspondent accounts in the United States for Iranian financial institutions pursuant to Section 311 of the USA PATRIOT Act.
The Alert arrives in the context of renewed maximum pressure on Iran. On February 4, 2025, President Trump signed National Security Presidential Memorandum-2 (NSPM-2), imposing a whole-of-government approach to deny Iran all paths to a nuclear weapon and counter its influence. The Financial Action Task Force (FATF) has also reiterated that Iran remains a high-risk jurisdiction, calling on all jurisdictions to apply effective countermeasures—including prohibiting Iranian digital asset service providers from establishing a presence in their countries.
Key Typologies and Financial Activity Flagged by FinCEN
The Alert identifies several categories of illicit financial activity through which the IRGC generates and moves funds, along with corresponding red flag indicators designed to help financial institutions detect, prevent, and report potential suspicious activity connected to Iranian sanctions evasion. No single red flag is determinative; institutions should consider the totality of the circumstances.
- Commodity Sales and Oil Smuggling
The IRGC supplements its budgets by smuggling oil to international buyers, with proceeds funding procurement, weapons development, and terrorist activity abroad. FinCEN’s 2025 Financial Trend Analysis found that oil companies potentially linked to Iran transacted approximately $4 billion in 2024, while shipping companies potentially related to the transport of sanctioned Iranian oil conducted transactions through U.S. correspondent accounts totaling approximately $707 million over the same period. The IRGC uses a “shadow fleet” of aging vessels operating outside standard maritime regulations, often owned or managed by front companies outside Iran, and engages in deceptive shipping practices including blending Iranian oil with oil from third countries or relabeling it with forged documents as “Malaysian blend.”
Red flags in this area include transactions involving petroleum or shipping companies with ties to Iran or “shadow fleet” vessels; irregularities in shipping documentation intended to obscure an Iranian nexus; documentation referencing vessels with recent or multiple name, flag, or ownership changes following OFAC designations; and transactions referencing “Malaysian blend” oil, particularly if the vessel is bound for China via Southeast Asia with automatic Information System (AIS) irregularities.
- Front Companies and Shadow Banking Networks
The IRGC relies on multi-jurisdictional shadow banking networks comprised of exchange houses, trading companies, and front companies to sell oil and other commodities abroad, launder the proceeds, and procure weapons and materiel on the international market. Iranian banks have established “rahbar” companies to manage international transactions, using exchange houses to form front companies in third-country jurisdictions, often in permissive free trade zones, to obscure Iranian involvement. FinCEN found that likely shell companies matching indicators for shell and Iranian activity moved $5 billion in 2024, primarily from non-resident accounts at banks in China operated by Hong Kong-based companies to the UAE.
Red flags in this area include wire transfers with unclear sources of funds involving entities in high-risk jurisdictions; general trading companies with opaque ownership registered in commercial free trade zones in the UAE with counterparties in Singapore, Hong Kong, China, or Oman; likely front companies with little to no web presence transacting in unusually high amounts from non-resident accounts; and unusual use of multiple exchange houses with fees or transaction patterns that do not reflect standard commercial practices.
- Facilitators and Service Providers
IRGC networks are bolstered by facilitators including money services businesses (MSBs), investment companies, and trust and company service providers that assist—wittingly or unwittingly—in orchestrating complex money laundering and sanctions evasion schemes. Purported trust companies based in Hong Kong and Eastern Europe have been identified as facilitating the transmission of value to the IRGC, including through the conversion of fiat currency to digital assets.
- Digital Assets
Iranian digital asset activity has reached billions of dollars per year, with the IRGC conducting sanctions evasion as part of this activity. Digital assets enable Iranian facilitators to circumvent the traditional financial system by transferring value internationally without intermediary financial institutions. Iranian facilitators are likely to use stablecoins due to their relative liquidity, ease of settlement, and exchange rate stability, and Iran’s use of stablecoins includes minting, moving between large-volume stablecoin issuers, and creating proprietary stablecoins. FinCEN also notes that unregistered peer-to-peer exchangers, unregistered foreign-located MSBs, and nested digital asset service providers (DASPs) may offer digital asset-related services in Iran.
Red flags in this area include companies with exposure to Iranian oil smuggling deviating from normal business practices to send or receive payments using digital assets; stablecoin payments with unclear sources of funds in high-risk jurisdictions; unusual stablecoin mint activity requiring multiple rate or limit increases; transactions directly or indirectly with digital asset addresses attributed to Iranian entities; authentication activity from Iranian IP addresses, email services, or phone numbers; and customer accounts that may be operating as unregistered P2P exchangers or nested DASPs providing services in Iran.
Conclusion
The FinCEN IRGC Alert reflects the U.S. government’s intensified focus on disrupting Iranian sanctions evasion networks and its expectation that the private sector serve as a critical partner in this effort. Regulatory compliance teams should evaluate existing frameworks governing exposure to Iranian illicit finance and ensure that processes align with current reporting and blocking obligations under U.S. law.
If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. Please click here to find out about our Anti-Money Laundering Team.








