FinCEN Issues Red Flags on IRGC Oil-Sale Networks, Front Companies and Digital Assets

FinCEN has issued a new alert describing how Iran’s Islamic Revolutionary Guard Corps uses oil sales, front companies, financial facilitators and digital assets to evade sanctions and move funds through the international financial system.

The alert is relevant not only to institutions dealing directly with Iran. IRGC-linked transactions may pass through companies, banks, shipping businesses, exchange houses and digital asset providers located in third countries, with no visible reference to Iran in the payment message.

For compliance teams, the central message is clear:

Sanctions screening cannot rely solely on matching customer and beneficiary names against designated-party lists.

Effective detection requires institutions to identify the wider network behind a transaction—including ownership links, shared addresses, vessel activity, trade documentation, payment patterns and connected blockchain addresses.

How the IRGC Moves Oil-Sale Proceeds

The IRGC and associated Iranian actors generate revenue through the sale of oil and petrochemicals to international buyers.

FinCEN says these proceeds may support:

• Weapons procurement;
• Domestic military development;
• Overseas operations;
• Terrorist groups and proxies; and
• Other activities conducted by the Iranian regime.

To reach international markets, Iranian oil may be transported through ageing vessels operating outside normal maritime practices. These ships are often described as part of a “shadow fleet” or “dark fleet”.

The vessels may be owned, managed or leased through companies outside Iran. Operators may attempt to conceal their involvement by:

• Changing vessel names or flags;
• Transferring formal ownership after a sanctions designation;
• Disabling or manipulating Automatic Identification System data;
• Conducting ship-to-ship transfers;
• Omitting ports of call;
• Using incomplete bills of lading; or
• Relabelling the origin of the cargo.

Iranian oil may also be blended with oil from another jurisdiction and described in trade documents as originating elsewhere. FinCEN specifically highlights transactions referring to “Malaysian blend” oil where other shipping indicators suggest a possible Iranian origin.

The transaction may therefore appear to involve a non-Iranian seller, a non-Iranian vessel and a non-Iranian trading company, while the underlying commodity and proceeds remain connected to Iran.

Front Companies Create Distance from Iran

Oil sales alone do not provide access to the international financial system. The proceeds must be received, transferred and converted without exposing the sanctioned beneficiary.

The IRGC and other Iranian actors use multi-jurisdictional shadow-banking networks involving:

• General trading companies;
• Exchange houses;
• Oil brokers;
• Shipping and logistics businesses;
• Investment companies;
• Trust and company service providers; and
• Other financial facilitators.

Front companies may be incorporated in commercial centres or free-trade zones outside Iran. They can then open bank accounts, receive customer payments and transfer funds to other companies in the network.

Common characteristics may include:

• Recent incorporation;
• Limited or no genuine online presence;
• Opaque beneficial ownership;
• Registration at an address shared by many companies;
• Large transaction values inconsistent with the company’s apparent size;
• Round-dollar payments;
• Rapid movement of funds;
• Accounts maintained in several jurisdictions; and
• Transactions with companies in unrelated lines of business.

A company may appear to be an ordinary commodity trader, while its actual function is to receive oil proceeds or make payments on behalf of sanctioned Iranian actors.

The money may never be formally transferred back to Iran. Instead, funds held by the overseas company can be used to purchase equipment, make investments or settle obligations for the benefit of the IRGC.

Financial Facilitators Link the Network Together

The structure often depends on intermediaries that arrange transactions without appearing as the ultimate buyer or beneficiary.

These facilitators may coordinate:

• Commodity sales;
• Foreign currency conversion;
• Creation of front companies;
• Opening of overseas bank accounts;
• Shipping and maritime services;
• Short-term financing;
• Payments to suppliers; and
• Conversion between fiat currency and digital assets.

Some intermediaries may knowingly support sanctions evasion. Others may provide professional, corporate or financial services without fully understanding who controls the transaction.

Institutions should therefore examine whether the use of several intermediaries has a credible commercial purpose.

A payment routed through multiple exchange houses or trading companies may be higher risk where the structure increases cost and complexity without providing a clear business benefit.

Digital Assets Form Part of the Shadow-Banking Network

FinCEN also highlights the growing use of digital assets, particularly stablecoins, within Iranian sanctions-evasion networks.

Digital assets can be transferred internationally without relying on the same correspondent-banking chain used for conventional cross-border payments. Stablecoins may be attractive because they combine relatively stable value with rapid settlement and broad liquidity.

The alert describes potential use of digital assets to:

• Receive proceeds from Iranian oil sales;
• Transfer funds between front companies;
• Convert fiat proceeds into stablecoins;
• Make payments to procurement networks;
• Support affiliated or proxy organisations;
• Move value through offshore digital asset providers; and
• Avoid controls within the traditional banking system.

A case study cited by FinCEN involved more than $100 million in digital assets purchased between 2023 and 2025 using a network of companies across several jurisdictions. The transactions were linked to oil sales benefiting Iranian government entities.

Digital asset activity should therefore not be treated as a separate risk from trade finance or sanctions evasion. A single network may use shipping companies, bank transfers and stablecoin wallets at different stages of the same transaction.

Digital Asset Providers May Also Be Front Companies

FinCEN warns that Iranian actors may establish digital asset businesses outside Iran to obtain access to the global market.

A company may be incorporated in the United Kingdom, the UAE or another jurisdiction while maintaining hidden connections with Iranian facilitators.

Risk indicators may include:

• Wallets linked directly or indirectly to Iran-based digital asset providers;
• Customer information containing references to Iran;
• Access from Iranian IP addresses;
• Use of Iranian telephone numbers or email services;
• Shared devices or IP addresses with known Iran-linked accounts;
• VPN or proxy use combined with other Iranian geographic indicators;
• Stablecoin activity inconsistent with the customer’s stated business;
• Rapid requests to increase minting or transaction limits; and
• Activity suggesting the customer operates a nested exchange or unregistered peer-to-peer service.

A regulated exchange may also provide liquidity to a smaller customer that is effectively operating as an unregistered exchanger for Iranian users.

The regulated institution may see only its direct customer, while the customer uses the account to serve an undisclosed network of third parties.

Why List-Based Screening Is Not Enough

Sanctions lists remain an essential control, but designated actors often restructure their activities after being identified.

They may replace a company, change shareholders, appoint new directors, move to another address or transfer business to a related entity.

A screening system limited to exact legal names may fail where:

• The company uses a trading name or alias;
• Ownership is held through nominees;
• A new entity takes over the previous company’s business;
• Directors or managers move between related companies;
• Several entities share an address or contact information;
• Payments are made by an intermediary rather than the designated party;
• A vessel changes its name, flag or registered owner; or
• Digital assets are moved to newly created wallets.

Institutions need to understand the relationships between names, companies, people, vessels and wallets.

A non-listed entity may still require further investigation where it shares several material characteristics with a designated network.

Corporate and Transaction Data Should Be Connected

A stronger sanctions and AML review should combine information from several sources.

Corporate information

Compliance teams should examine:

• Beneficial owners;
• Directors and authorised signatories;
• Incorporation dates;
• Registered and operating addresses;
• Related companies;
• Shared telephone numbers and email addresses; and
• Whether the business has a credible operating presence.

A shared address alone is not necessarily suspicious, particularly where a registered agent is used. It becomes more relevant when combined with common owners, payment counterparties or transaction patterns.

Shipping information

For oil and petrochemical transactions, institutions may need to review:

• Vessel names and IMO numbers;
• Flag and ownership changes;
• Port history;
• AIS interruptions or irregularities;
• Ship-to-ship transfers;
• Vessel operators and managers; and
• Connections with sanctioned owners or previous operators.

The IMO number is particularly useful because it generally remains with the vessel even when its name or flag changes.

Trade documentation

Bills of lading, invoices and certificates of origin should be assessed for consistency.

Warning signs may include:

• Missing consignee information;
• Conflicting descriptions of the commodity;
• Unexplained changes in origin;
• Documents that appear altered or incomplete;
• Shipping routes inconsistent with the transaction;
• A buyer or seller lacking an identifiable role in the trade; and
• Payment values inconsistent with the cargo.

Collecting documents without comparing them against shipping and payment information provides limited protection.

Wallet and account relationships

Digital asset monitoring should consider:

• Direct and indirect exposure to identified Iranian wallets;
• Transfers involving Iran-based digital asset providers;
• Movement between newly created wallets;
• Common deposit or withdrawal infrastructure;
• Wallets connected with front companies;
• Stablecoin minting and redemption behaviour; and
• Links between blockchain activity and bank-account funding.

A risk score from a blockchain analytics provider should support investigation, not replace it. Institutions should consider the reliability of the attribution, the distance from the identified wallet and the customer’s explanation.

Key Red Flags for Financial Institutions

FinCEN’s alert identifies several categories of potentially suspicious activity:

• Petroleum or shipping companies dealing with Iran-linked counterparties or shadow-fleet vessels;
• Missing, falsified or inconsistent shipping documents;
• Recent changes to vessel names, flags, ownership or operators;
• Oil described as originating elsewhere despite shipping indicators suggesting an Iranian connection;
• Recently formed trading companies processing large round-dollar payments;
• Companies with little commercial presence sharing addresses or counterparties;
• Payments routed through multiple exchange houses without a clear commercial reason;
• Significant digital asset payments by petroleum, shipping or trust companies where such payment methods are unusual;
• Stablecoin payments with an unclear source of funds;
• Digital asset activity inconsistent with the customer’s business profile;
• Connections with Iran-based digital asset providers; and
• Account-access or device information indicating an undeclared Iranian nexus.

No single indicator proves sanctions evasion or terrorist financing.

Institutions should assess the customer’s history, expected business activity, transaction purpose and the presence of multiple connected indicators.

What Compliance Teams Should Review

Financial institutions exposed to international trade, correspondent banking, shipping or digital assets should consider whether their controls can:

1. Link aliases, related companies, directors and beneficial owners;
2. Identify customers sharing addresses or counterparties with sanctioned entities;
3. Screen vessels by IMO number rather than name alone;
4. detect ownership and flag changes after sanctions designations;
5. Compare trade documents with maritime and payment data;
6. Identify recently incorporated companies moving unusually large sums;
7. Review unexplained payments through exchange houses and trading intermediaries;
8. Connect fiat transactions with related digital asset activity;
9. Detect direct and indirect wallet exposure to Iranian entities; and
10. Use cyber information such as IP addresses and device identifiers in appropriate investigations.

For relevant suspicious activity reports, FinCEN asks institutions to include the reference “FIN-2026-Alert002” and select the applicable terrorist-financing reporting category.

The Compliance Takeaway

The IRGC’s financial networks are designed to separate the real beneficiary from the visible transaction.

An oil payment may involve a front company outside Iran. The cargo may travel on a vessel with a changed name and flag. The proceeds may pass through exchange houses before being converted into stablecoins and transferred through newly created wallets.

Each stage can appear disconnected when reviewed separately.

Effective sanctions compliance therefore requires more than checking whether a customer’s name appears on a list. Institutions need to identify continuity and relationships across corporate ownership, trade, shipping, payments and blockchain activity.

The objective is not only to screen the party named in the transaction, but to understand the network that ultimately controls and benefits from it.

Main Source

FinCEN — Alert on the Use of Front Companies, Financial Facilitators, and Digital Asset Infrastructure by Iran’s Islamic Revolutionary Guard Corps to Evade Sanctions and Launder Proceeds

https://www.fincen.gov/system/files/2026-05/FinCEN-Alert-IRGC.pdf