On May 11, FinCEN issued an alert to assist financial institutions in identifying and reporting suspicious activity connected to Iran’s Islamic Revolutionary Guard Corps (IRGC), which the alert describes as using front companies, financial facilitators, and digital asset infrastructure to evade sanctions and launder proceeds from illicit oil sales. FinCEN reported that the IRGC employs multi-jurisdictional “shadow banking” networks — comprising exchange houses, trading companies, and front companies — to sell oil abroad, launder proceeds, and procure weapons, while using layered corporate structures to access the international financial system without repatriating funds to Iran. The alert states that digital asset transactions serve as one leg of this shadow banking network, with “Iranian facilitators” likely using stablecoins because of their “relative liquidity, ease of settlement, and exchange rate stability.” The alert further explains that Iran’s use of stablecoins includes minting, moving funds between large-volume stablecoin issuers, and creating proprietary stablecoins. The alert enumerates red flag indicators primarily across three categories: (i) oil smuggling; (ii) shadow banking and front company abuse; and (iii) digital assets.

With respect to oil smuggling, FinCEN identified red flags including shipping companies with Iranian counterparties, efforts to disguise vessel information and ownership, and references to “Malaysian blend” oil, among others. As to shadow banking and front company abuse, red flags include unclear sources of funds, use of company types and jurisdictions at “high risk for IRGC abuse” — such as general trading companies in UAE free trade zones with counterparties in Hong Kong and Singapore — and transaction patterns typical of IRGC shadow banking networks. Finally, digital asset-related red flags include, among others, unusual stablecoin payments by petroleum or trading companies, stablecoin account activity inconsistent with a customer’s reported business profile, payments to or from Iran-located digital asset service providers, and Iran-related cyber indicators such as connections from Iranian IP addresses.