On October 1, Treasury announced coordinated actions against a Russia-linked shadow banking network that it alleged helped the Iranian regime evade sanctions, as part of Operation Economic Outcast. FinCEN issued a notice of proposed rulemaking under section 9714(a) of the Combating Russian Money Laundering Act. The notice finds that transactions involving companies outside the U.S. that the network controls, which FinCEN calls “Sub-Agents,” are a class of transactions of primary money laundering concern. The proposed rule would prohibit transmittal of funds tied to transactions involving the Sub-Agents. Comments are due November 4. OFAC also sanctioned the network as a “significant transnational criminal organization.” Treasury said the Central Bank of Iran, the Islamic Revolutionary Guard Corps and Iran-backed terrorist organizations used the Sub-Agents to move funds.

FinCEN also issued an alert with red-flag indicators to help financial institutions detect and report suspicious activity involving the network. According to the alert, the network runs hundreds of companies with accounts at about 435 financial institutions in at least 83 countries. It sets up, buys or teams with companies abroad that act as Sub-Agents, letting it move money through the international financial system without its sanctioned customers appearing in the payment chain. FinCEN grouped the red flags into three categories: “Use of ‘Sub-Agents,’” “Mis-invoicing and Invoice Falsification” and “Digital Asset Abuse.” Examples include a newly formed company that suddenly conducts unusually high volumes of large transactions, transaction documents that appear altered or generated with AI, and digital asset transfers to identified or suspected Sub-Agents. FinCEN asked institutions to use the key term “FIN-2026-A7NETWORK” in related suspicious activity reports.