On May 11, 2026, FinCEN issued an Alert to help financial institutions identify and stop funding streams and procurement networks supporting Iran’s Islamic Revolutionary Guard Corps (IRGC). The Alert outlines how the IRGC facilitates and launders the proceeds of illicit oil sales by using networks of shell companies and financial facilitators.
According to FinCEN, the IRGC has engaged in terrorist activity since its inception with the full support of the Iranian regime. FinCEN’s Alert provides the following red flags related to the IRGC’s oil smuggling, front company abuse, and use of digital assets:
Oil Smuggling-Related Red Flags
Transactions involving petroleum or shipping companies may indicate Iranian ties through counterparties, shadow fleet vessels, or port activity linked to Iran.
Shipping documents with missing, falsified, or incomplete information may be used to conceal an Iranian connection.
Frequent vessel name, flag, or ownership changes may indicate attempts to disguise sanctioned Iranian ownership or control.
References to “Malaysian blend” oil combined with AIS irregularities or suspicious ship-to-ship transfers may suggest Iranian oil smuggling.
Shadow Banking and Front Company Abuse-Related Red Flags
Wire transfers or deposits with unclear or inconsistent sources of funds involving high-risk jurisdictions may indicate Iranian illicit finance activity.
Opaque trading companies registered in free trade zones with multiple foreign bank accounts may be used for IRGC-related financial abuse.
Newly formed or low-profile companies making large, unexplained payments may be acting as front companies for Iranian shadow banking.
Transactions routed through multiple exchange houses with excessive fees or unusual patterns may signal efforts to obscure Iranian-related activity.
Digital Assets-Related Red Flags
Petroleum, shipping, or trading companies using digital assets outside normal business practices may be attempting to facilitate Iranian oil transactions.
Stablecoin payments with unclear funding sources and links to high-risk jurisdictions may indicate Iranian illicit finance activity.
Stablecoin accounts showing rapid minting increases or activity inconsistent with the customer’s business profile may be suspicious.
Blockchain activity involving wallets linked to Iranian entities may indicate prohibited digital asset transactions.
Digital asset account activity showing Iranian IP addresses, devices, or geolocation indicators may suggest attempts to evade sanctions controls.
Customers operating as unregistered P2P exchangers, foreign MSBs, or nested DASPs in high-risk jurisdictions may be facilitating Iranian-related transactions.
Read FinCEN’s press release here.
The full Alert can be found here.