US Treasury doubles down on fighting Iranian illicit finance and supply chain networks

The Office of Foreign Assets Control (OFAC) and the Financial Crimes Enforcement Network (FinCEN) of the US Department of the Treasury (Treasury) took two significant steps against Iran on June 6, 2025: OFAC issued several designations targeting an Iranian “shadow banking network,” and FinCEN issued a new advisory on Iranian illicit use of financial networks. The moves demonstrate the current Administration’s continued commitment to use all available tools across the whole of government to counter national security threats posed by the Iranian regime. Banks and other businesses operating in the financial services, shipping, and energy sectors are encouraged to reassess the sanctions, anti-money laundering (AML), and countering the financing of terrorism (CFT) risks they face, along with their current compliance controls, in this increasingly fraught environment.

For the first time since the US government’s campaign of “maximum pressure” against Iran, unveiled in a February 2025 National Security Presidential Memorandum (NSPM-2), OFAC has targeted an Iranian “shadow banking network.” Sanctioning more than 35 individuals and entities on June 6, 2025, OFAC described the related network as leveraging “Iranian exchange houses and foreign front companies” to launder billions of dollars through the international financial system. OFAC’s announcement marks the approximately 30th action by the US Government (in addition to the Treasury, including the Departments of Justice, Commerce, and State) against Iran or associated individuals, entities, or shipping vessels since January 21, 2025.

Also on June 6, 2025, FinCEN issued its “Advisory on the Iranian Regime’s Illicit Oil Smuggling Activities, Shadow Banking Networks, and Weapons Procurement Efforts” (2025 Advisory). The guidance urges US financial institutions to identify and report potential sanctions evasion and other suspicious activity related to Iran’s oil smuggling, shadow banking networks, and weapons procurement. The 2025 Advisory also provides examples of red flags, transaction typologies, and updated compliance guidance, replacing FinCEN’s 2018 advisory on countering Iran’s illegal financial activities (2018 Advisory).

This alert first discusses the implications for banks and other businesses of OFAC’s recent Iran-related sanctions designations. Second, it provides a summary of FinCEN’s 2025 Advisory, highlighting key findings such as typical tactics used by Iran to conceal its illicit financing activities; FinCEN’s updated red flags to assist US financial institutions comply with their obligations under the Bank Secrecy Act (BSA); and guidance on the use of a new suspicious activity report (SAR) code, together with more general BSA reporting requirements. We conclude with key takeaways in light of these new risks for the financial services, maritime, and transportation industries.

OFAC targets Iran’s shadow banking network and front companies

OFAC designated more than 35 individuals and entities tied to Mansour, Nasser, and Fazlolah Zarringhalam – three Iranian brothers responsible for laundering billions of dollars through a shadow banking network spanning China, Hong Kong, and the United Arab Emirates (UAE) [1]. The Iranian government has used this network to evade sanctions, launder money from its oil sales, finance its nuclear weapons and ballistic missile programs, and support terrorist proxies. Several of the front companies designated by OFAC are based in the UAE and Hong Kong.

As a result of the June 6, 2025 action, all property and interests in property owned or controlled by the designated persons are immediately blocked. US persons and financial institutions transacting in US dollars are broadly prohibited from transacting with the designated persons. OFAC’s announcement follows approximately two dozen previous announcements by the current Administration designating Iran-linked individuals, entities, and vessels, highlighting the Administration’s targeting of Iran’s weapons procurement. Although the designations of members of Iran’s shadow banking network represent the first since NSPM-2, OFAC designated in June 2024 nearly 50 individuals and entities associated with Iran’s Ministry of Defense and Armed Forces Logistics (MODAFL) and the Islamic Revolutionary Guard Corps for their shadow banking activities.

The Administration’s focus on sanctioning persons involved in Iran’s oil networks has influenced OFAC’s designations of persons tied to Mexican oil smuggling cartels, which we discussed in a previous alert on May 8, 2025. In that alert, we considered the Administration’s intensified use of sanctions enforcement tools that were made available by designating oil smuggling cartels and logistics providers as terrorists. We cautioned that sanctions exposure to oil smuggling in particular could result in harsher enforcement penalties. The escalating crackdown on Iranian-linked oil smuggling should alert businesses operating along financial and global supply chains of the increased sanctions risk. 

FinCEN’s 2025 advisory details Iran’s financial tactics, updates red flags, and provides new SAR field

The 2025 Advisory underscores Iran’s destabilizing activities across the globe, including strikes against US and allied forces in Iraq and Syria; deepening military and economic ties with Russia and China; and support for terrorist proxies like Hizballah, Hamas, and the Houthis. Oil exports remain a critical revenue source for Iran’s military and proxies, with large quantities of oil sold at a discount to small refineries in China. China has since become a key supplier of ballistic missile and unmanned aerial vehicle (UAV) components to Iran.

Oil smuggling and the “shadow fleet”

Because US and international sanctions have choked Iran’s oil production capacity, Iran has developed, in the words of the 2025 Advisory, “large-scale global oil smuggling and money laundering networks to surreptitiously access international markets and financial systems to sell crude oil and petroleum products and to use the proceeds to finance weapons development and terrorist activity.”

Through smuggling and other illegal activities, Iran allocates billions of dollars’ worth of oil annually to the National Iranian Oil Company (NIOC), and military entities such as MODAFL and the Islamic Revolutionary Guard Corps-Qods Force (IRGC-QF). Much of this oil is sold at below-market prices to small, independent refineries in China. To circumvent sanctions, Iranian oil is frequently relabeled as a product from, or originating in, a different jurisdiction (eg, “Malaysian blend”). Sometimes, Iranian oil is blended with oil from other countries to further obscure its origin.

Iran also employs a “shadow fleet” (also referred to as the “ghost fleet” or “dark fleet”) of aging, poorly maintained vessels – often owned or managed by front companies in the UAE or Southeast Asia. These front companies use deceptive shipping practices, including: (1) frequent name and flag changes; (2) bogus documentation; (3) ship-to-ship transfers, which are at-sea hand-offs done outside a port to obfuscate the cargo or its origin or destination; and (4) disabling of automatic identification systems (AIS), which are tracking systems that allow international customs’ officials to locate a vessel. Iran’s shadow fleet vessels are frequently uninsured or underinsured, sometimes relying on sanctioned or untested insurance providers, and also pose safety and environmental risks. Consequently, port authorities risk shouldering costs associated with an oil spill or other accident involving Iran’s shadow fleet.

Shadow banking networks and money laundering

According to the 2025 Advisory, Iran relies on complex, multi-jurisdictional shadow banking networks – including exchange houses, trading companies, and front companies often registered in Hong Kong and the UAE – to launder oil proceeds and finance weapons procurement. These networks use forged documentation and opaque ownership structures to exploit correspondent banking relationships and move funds. Recent OFAC actions have targeted individuals and entities suspected of laundering billions of dollars for the Iranian regime through such networks. For example, in February 2025, OFAC targeted six Chinese or Hong Kong entities for serving as front companies to procure UAV components for previously sanctioned Iranian firms.

Weapons procurement and proliferation financing

Proceeds from oil sales are used to procure weapons components, dual-use goods, and chemicals for Iran’s ballistic missile and UAV programs. Iran’s procurement networks operate through front companies and intermediaries in China, Turkey, and Southeast Asia using tactics like transaction layering (ie, the laundering of proceeds through numerous other financial transactions to thwart tracing their origin) and transshipping products through third countries to evade sanctions and export controls. In April 2024, OFAC designated Iranian front company Sahara Thunder for facilitating the sale and production of Iranian UAVs to Russia for use in Ukraine.

Red flags to assist financial institutions

The 2025 Advisory updates the 2018 Advisory’s red flags with more specific guidance, reflecting new Iranian evasion tactics, and incorporating recent case studies. The 2025 Advisory used BSA data, open-source reporting, and information provided by unnamed law enforcement partners. The red flags are grouped into three main categories: (1) oil smuggling and sales, (2) shadow banking networks, and (3) weapons procurement.

Red flags for each category identified in the 2025 Advisory include the following:

1. Oil smuggling and sales

• Inconsistent shipping documentation: Discrepancies between customer-provided shipping documents and information available in maritime databases, such as evidence that a vessel stopped at an Iranian port not disclosed in the customer’s documentation.


• Vessel identity manipulation: References to vessels that have recently or repeatedly changed names, flags, or ownership, especially following OFAC designations, or vessels using International Maritime Organization numbers that do not match the actual vessel or are linked to scrapped ships.


• Deceptive oil labeling and routing: Transactions involving oil labeled as “Malaysian blend,” particularly when destined for China via Southeast Asia, and where vessel tracking data shows irregularities such as disabled or manipulated AIS or ship-to-ship transfers in Southeast Asian waters.


• Suspicious counterparty and vessel ties: Petroleum or shipping companies transacting with entities or using vessels with known links to Iran, or those that have stopped at Iranian ports.


• Falsified or missing documentation: Oil-related transactions or wire transfers involving vessels previously linked to suspicious activity, or documentation (eg, bills of lading and shipping invoices) that: appears falsified; omits key information; or lacks consignees, suggesting attempts to conceal Iranian involvement.

2. Shadow banking networks

• Complex transaction chains: Transactions routed through multiple exchange houses or trading companies, with added fees and costs that do not align with standard commercial practices, indicating possible layering to obscure the origin or destination of funds.


• Use of forged or falsified documents: Exchange houses or trading companies in jurisdictions near Iran using forged documents to conceal the true parties to a transaction, especially when leveraging regional banks’ correspondent relationships with US financial institutions to access US dollars.


• Opaque source of funds: Wire transfers, or deposits lacking clear or complete information about the source of funds, or instances where the source does not match the customer’s business profile, particularly when involving high-risk jurisdictions connected to Iranian illicit finance.


• General trading companies in free trade zones: UAE-based general trading companies with opaque ownership, banking at multiple UAE institutions, and trading primarily with companies in Singapore and Hong Kong, often with no clear business rationale.


• Hong Kong-based front companies: Companies in Hong Kong, especially those banking with Chinese non-resident accounts, that have little or no web presence; are co-located with similar entities; or are recently incorporated but engage in large, unexplained transactions with UAE trading companies.

3. Weapons procurement

• Transactions with suspected front companies: Payments involving entities that are general trading companies, suspected front companies, or have a nexus to Iran, especially those with opaque ownership, obscure directors, or residential/co-located business addresses.


• Inconsistent business declarations: Customers whose stated business activities do not align with their transaction history or other available information, particularly if they have a history of facilitating shipments to and from Iran or transact predominantly with technology or chemical suppliers.


• Unusual transaction patterns: Customers receiving funds primarily from commodities trading companies but sending funds mainly to electronics suppliers, or companies operating in unrelated business sectors without a clear connection to their stated business purpose.


• Networked front companies: Multiple companies incorporated around the same time, sharing counterparties, addresses, owners, or similar names, with similar transaction profiles, little web presence, and large, recurring transactions.


• Middle Eastern companies with Iranian links: Middle Eastern companies with ties to Iran, especially those that receive payments from petroleum companies and make payments to electronics companies in Hong Kong and China, suggesting possible procurement of dual-use or weapons components.

SAR and other BSA reporting requirements

The 2025 Advisory also reminded financial institutions of their reporting and recordkeeping obligations under the BSA, including to file SARs when they know, suspect, or have reason to suspect involvement in illicit Iranian activity. Other BSA obligations include the filing of a:

Currency Transaction Report (CTR), Report of Cash Payments Over $10,000 Received in a Trade or Business (Form 8300), Report of Foreign Bank and Financial Accounts (FBAR), Report of International Transportation of Currency or Monetary Instruments (CMIR), Registration of Money Services Business (RMSB), and Designation of Exempt Person (DOEP).

Further, FinCEN requested in the 2025 Advisory that “financial institutions reference this Advisory in SAR field 2 (‘Filing Institution Note to FinCEN’) and the narrative by including the key term ‘IRAN-2025-A002.’” FinCEN also encouraged financial institutions to share information with each other under Section 314(b) of the USA PATRIOT Act – a voluntary program – to assist other financial institutions in identifying and preventing terrorist financing and money laundering.

Key takeaways

• US financial institutions are encouraged to review and update their sanctions and AML/CFT programs to ensure that they reflect the intensifying and evolving threats to the financial services, shipping, and energy sectors from Iranian sanctions evasion, oil smuggling, and shadow banking.


• Both shipping and seemingly unrelated businesses may be affected. Shipping companies, especially those operating in the Asia-Pacific region, should ensure that their sanctions, AML/CFT, export control, and anti-bribery policies and procedures account for the evolving threat in the region from shadow financial networks. In particular, the pervasiveness of sanctioned and shadow fleet vessels heightens the risk to legitimate businesses, particularly those in the commodities, technology, and financial sectors that cater to the oil trade. For example, the Department of Justice has – in addition to criminal charges – used seizure and civil forfeiture authorities against property, such as vessels, suspected of involvement in transporting Iranian-sourced oil. These actions can economically and legally impact charterers, operating companies, and other entities up and down the supply chain.


• Where warranted or required by a company’s risk-based sanctions and AML/CFT compliance programs, enhanced due diligence and focused or specialized transaction monitoring are critical for customers and counterparties with potential links to Iran, especially those operating in high-risk jurisdictions or sectors. Traditional know-your-customer approaches to compliance may need to give way to a know-your-customer’s-customer approach.


• Financial institutions should remain vigilant for the red flags identified in the 2025 Advisory and ensure timely and accurate SAR reporting, including through the use of the IRAN-2025-A002 designated key term, together with well-functioning escalation and investigation policies and procedures.


• Shipping companies and financial institutions that support the shipping industry may see more frequent law enforcement outreach and investigative requests and legal process. These same institutions and companies are encouraged to implement policies and procedures to guide responses to these inquiries and contact with law enforcement generally, which may include engaging outside counsel.

For further information regarding the 2025 Advisory or its guidance for financial, maritime, and energy businesses, please contact your DLA Piper relationship partners or any of the authors of this client alert.

 

[1] The designations were made pursuant to Exec. Order No. 13,902, Imposing Sanctions with Respect to Additional Sectors of Iran, 85 Fed. Reg. 2,003 (January 10, 2020), and Exec. Order No. 13,846, Reimposing Certain Sanctions With Respect to Iran, 83 Fed. Reg. 38,939 (August 6, 2018).