Sanctions and Export Controls Update

Monthly Roundup – October 2026

📅 November 3, 2026

Welcome to this month’s Sanctions and Export Controls Update, highlighting IFI’s take on key developments from October 2026.

October was defined by the continued rollout of Operation Economic Outcast (OEO), which moved steadily up the chain toward the global banking system. Treasury designated Russia’s A7 shadow banking network and paired the action with a FinCEN proposed rule; warned foreign banks that those dealing with sanctioned Iranian institutions “could be targeted at any time without advance notification”; targeted what it called the “vast majority” of Iran’s remaining shadow fleet; and designated an Iraqi bank that supplied U.S. dollar access to Iran, while the State Department designated Cuba-based BICSA for serving an Iranian bank. Notably, none of the financial institutions designated under OEO to date is a China-based bank, a restraint that coincides with the September 24–25 Trump–Xi summit and an extension of the U.S.–China trade truce to January 10, 2027.

On Russia, Washington and Europe moved in opposite directions. The administration authorized imports of Russian diesel and waived the Russia-related sanctions and tariffs of the newly enacted Graham Act, while the EU adopted its largest-ever package of listings (1,569 individuals and entities in Russia’s military-industrial complex), and the UK added 69 entries across two packages, including two Russian oil producers and several crypto platforms.

In enforcement, Treasury announced a coordinated resolution with Bank of America—a $1.2 billion FinCEN penalty (inclusive of a $750 million OCC penalty) and an $11.66 million OFAC settlement—the third-largest penalty in Treasury’s history. And with BIS yet to formalize its extension of the Affiliates Rule suspension, institutions face a possible snap-back of that rule on November 10.

Iran

OEO, launched August 24, passed the two-month mark in October with Treasury sustaining a roughly weekly cadence of actions, now concentrated on the financial intermediaries—banks, exchange houses, and shadow banking networks—that Iran uses to move money. Treasury said the combination of the U.S. naval blockade and OEO is leaving the regime “running out of options” to stabilize the economy, while diplomatic efforts to end the conflict remain at an impasse.

On October 1, OFAC designated the A7 Network under E.O. 13581, as amended by E.O. 13863, a Russia-linked “shadow banking network” that Treasury says Iran’s IRGC and other Iran-backed actors have used to evade sanctions, as a significant transnational criminal organization. In tandem, FinCEN proposed a rule under the Combating Russian Money Laundering Act that would prohibit transmittals of funds regarding transactions involving A7 Network “Sub-Agents,” and issued an alert (FIN-2026-Alert007) with red flags. Treasury cited an A7 Sub-Agent and its sister company that received nearly $140 million from entities involved in Iranian sanctions evasion. The same day, Treasury separately designated companies and suppliers in Iran’s automotive, rail, manufacturing, and metals sectors.
On October 5, OFAC issued an Alert to foreign financial institutions warning that those continuing to transact with sanctioned Iranian financial institutions, including their subsidiaries and branches in third countries, “could be targeted at any time without advance notification” and should take immediate action to terminate those relationships.
On October 8, OFAC designated 17 shadow fleet vessels and their owners that have carried Iranian crude, petroleum, and petrochemicals to South and East Asia, an action Treasury said “effectively neutralizes the vast majority” of Iran’s remaining shadow fleet network. OFAC also removed two vessels (HAKUNA MATATA and PINOCCHIO) from the SDN List after they left the fleet and were sold to non-sanctioned or U.S.-aligned operators, illustrating a delisting pathway based on changed circumstances.
On October 15, Treasury designated more than two dozen individuals and entities, led by Iraq’s International Development Bank for Investment and Finance (IDB), which Treasury says provides U.S. dollar access for Iran, abused the now-dissolved U.S. dollar wire auction, and received the capital of Bank Melli’s closed Iraq operation. Also designated were two Iranian “offshore” banks operating in free trade zones, an Iranian oil “trustee” based in Dubai, and several exchange houses. OFAC issued General License FF authorizing wind-down of IDB transactions, later replaced by GL FF-1, which extends the deadline to December 1, 2026. In coordination, the State Department designated Cuba-based BICSA for services to Iran’s Karafarin Bank (see Cuba, below).
On October 21, OFAC designated Panama- and Greece-based law firm Karnakis and Karnakis, which it says registered shell companies that own shadow fleet vessels, together with Roxette Maritime Shipping and Trading, shipping agents Amigoz (Singapore) and Whales Shipping Line (Dubai), and five individuals, under E.O. 13902. Designating a law firm signals that corporate-services gatekeepers are within OEO’s scope. The same day, FinCEN announced its first-ever administrative subpoena under 31 U.S.C. § 5318(k) of the Bank Secrecy Act in an investigation of an unnamed Greek bank’s potential ties to Iran and its proxies, and said it had issued multiple RFIs to banks about their relationships with designated Iranian financial institutions.

The question of whether Treasury will target a major Chinese bank remains open. The banks designated under OEO to date (Golden Global in Türkiye, VTB in Russia, Banque Misr in the UAE, IDB in Iraq, and BICSA in Cuba) sit outside China’s major banking system. Presidents Trump and Xi extended the Busan trade truce by two months at their Washington summit, with further leader-level meetings planned around APEC in November and the G20 in December. Companies with China-linked Iran exposure should not read that restraint as immunity: the October 5 Alert is explicit that action can come without warning.

Russia

Russia policy pulled in opposite directions in October. The U.S. eased pressure, authorizing Russian diesel imports and waiving the new Graham Act’s Russia provisions, while the EU adopted its largest-ever set of listings and the UK added 69 entries across two packages.

On October 9, OFAC issued General License 135, authorizing transactions otherwise prohibited under the Russia-related sanctions that relate to the sale, delivery, offloading, or importation (including into the United States) of Russian-origin diesel through April 7, 2027. The license does not authorize debits to U.S. accounts of the Central Bank, the National Wealth Fund, or the Ministry of Finance. A week later, on October 16, the President signed an executive order implementing the Lindsey O. Graham Sanctioning Russia and Iran Act that, on national interest grounds under section 115 of the Act, waived its Russia-related tariffs and sanctions provisions before they took effect. Existing sanctions under prior executive orders, such as E.O. 14024, remain in force, and the Act’s Iran provisions are unaffected. Press reports in late October indicate the administration is also weighing a Russian request to delist the Russian Direct Investment Fund; no delisting had been announced as of month-end.
On October 12, EU foreign ministers adopted what the Council called its largest-ever package of listings: 1,569 individuals and entities, comprising 826 Russian companies and 743 of their executives, adopted under Council Decision (CFSP) 2026/2279 and Implementing Regulation (EU) 2026/2281, bringing listings under the Ukraine territorial-integrity regime to nearly 4,600. More than half of the listings relate to the production chain for ballistic missiles. The same day, the Council separately listed 77 individuals, including 74 candidates in the occupied territories and three Central Election Commission members, over the September State Duma “elections” in occupied Ukraine (Implementing Regulation (EU) 2026/2292).
The UK added 69 entries to its Russia sanctions list in two packages. The October 1 package (22 individuals, one entity, and eight ships) targeted vessels the UK says form a new LNG “shadow fleet,” Kremlin disinformation networks, and perpetrators of abuses in occupied Ukraine, including individuals tied to the September “elections.” The October 8 package (26 designations and 12 ship specifications) designated oil producers Zarubezhneft and INK-Capital, crypto platforms including Cryptomus and Heleket, and Kyrgyzstan-based TokenSpot, and suppliers of military-industrial goods. The government said UK sanctions now cover more than 90% of Russia’s oil production capacity.
OFAC extended Lukoil-related authorizations twice. On October 15, it issued GL 128D and GL 130B, extending authorization for Lukoil’s retail stations outside Russia and its Bulgarian entities through April 24, 2027. On October 21, it issued GL 131K, extending authority to negotiate the sale of Lukoil through November 21. Carlyle has reportedly ended its pursuit of the assets, and press reports indicate a consortium led by Todd Boehly is now bidding; any sale still requires separate OFAC authorization.

Other Significant Developments

Outside the Iran and Russia stories, October brought a mix of near-term compliance deadlines, new designations across Africa, North Korea, and Mexico, and a landmark enforcement resolution. In export controls, BIS’s Affiliates Rule, which extends Entity List restrictions to entities owned 50% or more by listed parties, remains scheduled to return on November 10. Treasury Secretary Bessent announced that the U.S. and China had agreed to extend their trade truce to January 10, 2027, but no formal implementing notice had been published as of late October. In the Iran space, the UK’s interim license for designated Iranian banks operating in London reached its October 22 expiry with HM Treasury having said it would not be renewed; FinCEN issued a new alert on Iran’s abuse of religious charity networks; and the State Department’s designation of Cuba-based BICSA linked the administration’s Cuba and Iran campaigns, with foreign institutions facing a November 14 wind-down deadline. In enforcement, the Bank of America resolution—combining a $1.2 billion FinCEN penalty (inclusive of a record $750 million OCC penalty) and an $11.66 million OFAC settlement—stands as the month’s defining compliance case, with lessons on screening alert prioritization, list update timeliness, and blocked bank payment controls. Elsewhere, OFAC sanctioned Rwanda’s Ministry of Defence over support for M23, North Korean IT worker facilitators in Russia, and a Cartel del Noreste horse racing network, and removed 125 outdated list entries; China announced new export licensing for tunnel boring machines.

Export Controls

BIS Affiliates Rule Suspension Set to Expire November 10 Despite Announced U.S.–China Truce Extension

The Affiliates Rule—BIS’s September 29, 2025 interim final rule extending Entity List and Military End-User List restrictions to non-listed foreign entities owned 50% or more, individually or in the aggregate, by listed parties—is suspended only through November 9, 2026 under BIS’s November 2025 suspension rule (90 Fed. Reg. 50857), after which the rule returns to the EAR. On September 23, Treasury Secretary Bessent announced that the U.S. and China had agreed to extend the Busan Agreement by two months, through January 10, 2027, and a U.S. official indicated the Affiliates Rule suspension would be extended correspondingly. As of late October, however, BIS had not published a Federal Register notice implementing the extension, so absent such a notice the rule’s license requirements return on November 10. Companies with exposure to subsidiaries and affiliates of Entity List parties should confirm the rule’s status in the Federal Register before November 10 and keep ownership screening contingency plans ready; even once published, an extension could prove temporary, since BIS can shorten or end the suspension through further rulemaking.

UK Iran Sanctions

UK Interim License for Designated Iranian Banks Reaches October 22 Expiry; HM Treasury Applies Presumption of Denial

HM Treasury’s Interim Necessities General Licence INT/2025/7628424, first issued in October 2025 and renewed in April 2026, covered Bank Melli, Bank Saderat, Bank Tejarat, Persia International Bank Plc, and Iran Insurance Company, and allowed them to meet basic operating costs in the UK. In guidance published September 23, HM Treasury stated that the license would not be renewed when it expired on October 22, 2026, and that after expiry transactions previously authorized would no longer be permitted unless covered by another general license or a specific license, with applications from designated Iranian banks subject to a presumption of denial. The change aligns UK treatment of Iran-linked banks in London with the pressure U.S. Treasury is applying through OEO, and UK counterparties of these institutions should confirm that wind-down and account-closure steps are complete.

Cuba

State Department Designates Cuba-Based BICSA for Services to Iran’s Karafarin Bank; Wind-Down Deadline November 14

In coordination with Treasury’s October 15 OEO action, the State Department designated Banco Internacional de Comercio S.A. (BICSA) under E.O. 14404 for operating in the financial services sector of the Cuban economy; Treasury noted that BICSA has provided services to the designated Iran-based Karafarin Bank since at least 2022. The designation links the administration’s Cuba and Iran pressure campaigns and, because E.O. 14404 authorizes secondary sanctions on foreign financial institutions, matters for non-U.S. banks with correspondent or other dealings with BICSA. OFAC FAQ 1276 encourages foreign persons unable to divest from or wind down transactions involving BICSA (or entities in which it owns 50% or more) before November 14, 2026 to contact OFAC’s Compliance Hotline, and notes relevant humanitarian and diplomatic-related authorizations.

Africa

Treasury Sanctions Rwandan Ministry of Defence and Zigama Credit and Savings Society for Supporting M23

On October 28, OFAC designated Rwanda’s Ministry of Defence and the Zigama Credit and Savings Society under E.O. 13413 for supporting the M23 armed group and its political wing, the Congo River Alliance, in eastern Democratic Republic of the Congo. Treasury said the Ministry directs the Rwanda Defence Force, which has deployed thousands of troops in North and South Kivu to supply M23 with weapons, logistics, and training, and that Zigama paid entities in China and elsewhere for military equipment, helped move gold from M23-controlled territory to Kigali, and processed tens of millions of dollars in transactions for M23 and the Alliance. Designating a state ministry and a financial institution is a notable escalation; counterparties to Rwandan banks and gold traders should review their exposure.

North Korea

OFAC Targets DPRK IT Worker Facilitators in Russia; 12 Governments Issue Joint Statement

On October 28, OFAC designated 10 individuals and one entity under E.O. 13687 and E.O. 13722 for supporting North Korean IT worker schemes, including Russian nationals Vitold Obertas and Ilya Boykov, who converted millions of dollars in cryptocurrency for DPRK officials and IT worker companies, and the Russia-based First Financial and Technical Development Center and six of its workers. The same day, 11 governments and the EU issued a joint statement noting that the EU, Australia, and the United States imposed sanctions in October targeting DPRK overseas workers, malicious cyber activity, and DPRK–Russia cooperation, building on the Multilateral Sanctions Monitoring Team’s September report on overseas labor.

Drug Cartels

Treasury Sanctions Cartel del Noreste Horse Racing and Business Network

On October 13, OFAC designated four individuals and 11 entities tied to Cartel del Noreste (CDN), a designated Foreign Terrorist Organization, under E.O. 14059 and E.O. 13224, including the Club La Molienda racetrack, a Quarter Horse racing barn, construction, materials, and fuel companies, a trucking firm linked to cocaine shipments, and Nuevo Laredo plaza boss Pablo Cesar Guajardo Alvarez. Treasury called it its largest action yet against CDN’s financial infrastructure, taken in coordination with Mexico’s financial intelligence unit, and said businessman Gamaliel Garza Garcia’s companies funneled money to political campaigns and obtained government contracts.

Sanctions List Modernization

OFAC Removes 125 Entries in Third Round of Sanctions Modernization

On October 5, OFAC removed 125 individuals and entities from its sanctions lists and updated 22 other entries in the third round of its sanctions modernization initiative. The removals include deceased individuals, defunct companies, and entries with too little identifying information for reliable screening. Screening teams should refresh their lists and review any alerts tied to removed entries.

China Export Controls

China to Require Export Licenses for Tunnel Boring Machines

On October 19, China’s Commerce Ministry announced that exports of tunnel boring machines will require licenses under its dual-use export control regime effective November 18, and that it will adjust controls on drone-related items and dredgers. Reporting indicates India, which relies heavily on imported tunnel boring machines for metro and highway projects, is among the most exposed markets.

Iran-Related Financial Intelligence

FinCEN Issues Alert on Iranian Abuse of Religious Charity Networks

On October 15, FinCEN issued Alert FIN-2026-Alert008 asking financial institutions to report potential Iranian regime abuse of religious charity networks, including diversion of religious tithes (khums), as part of OEO. The Alert lists red flags such as charities soliciting donations without apparent charitable activity and organizations receiving large donations from unknown sources over a short period before transferring significant sums onward. FinCEN stressed that no single indicator establishes illicit activity, that legitimate charities should have access to financial services, and that institutions should apply a risk-based approach rather than treating the sector as inherently suspicious.

Enforcement Actions

October’s enforcement activity was dominated by a large coordinated resolution with a major U.S. bank, alongside a Russia-related OFAC and DOJ resolution with a technology company, a BIS settlement over software updates to Huawei, and a major AI chip smuggling prosecution.

Treasury Announces $1.2 Billion Penalty and $11.66 Million OFAC Settlement with Bank of America

On October 13, Treasury announced coordinated actions against Bank of America, N.A. that amount to the third-largest penalty in Treasury’s history, behind only the 2023 Binance and 2024 TD Bank resolutions. FinCEN assessed a $1.2 billion penalty for the bank’s failure to mitigate and report priority national security risks, including Chinese money laundering networks and illicit finance along the southwest border. The total includes a $750 million penalty assessed by the OCC, the largest in that agency’s history.

Separately, OFAC announced an $11,662,930 settlement resolving 475 apparent violations of sanctions programs targeting Russia, Belarus, Iran, Burma, Somalia, narcotics, and global terrorism between September 2021 and April 2025, with a total value of approximately $14.8 million. According to OFAC’s enforcement release, the apparent violations resulted from four failures: processing payments involving blocked banks; failing to appropriately prioritize screening alerts for customers who were exact name and date-of-birth matches to blocked persons; failing to promptly update screening tools following OFAC designations; and mishandling two business accounts associated with blocked persons due to human error. OFAC found the violations non-egregious but largely not voluntarily self-disclosed, and applied no reduction to the base penalty, including no mitigation for remedial measures or cooperation.

Extreme Networks Resolves OFAC and DOJ Matters Over Sales to Russian Defense Manufacturer

In late October, OFAC announced a $1,529,685 settlement with North Carolina-based Extreme Networks, Inc. for nine apparent violations of Russia sanctions between September 2018 and March 2022, during which it exported networking equipment, software, and services to JSC Moskovskiy Mashinostroitelniy Zavod Avangard (MMZA), a Russian defense manufacturer blocked by operation of law as a majority-owned subsidiary of designated Concern Almaz Antey. Purchase orders named a different end user, but OFAC found MMZA was the actual recipient and that the company did not adequately investigate warning signs, including MMZA email addresses and its Moscow address on several purchase orders. Meanwhile, DOJ entered a non-prosecution agreement with Extreme Networks requiring roughly $975,000 in criminal penalties The case shows that entities blocked by operation of the 50% rule can still be hidden behind a different end-user name, and that screening should extend to email domains and addresses on purchase orders and that screening should extend to email domains and addresses on purchase orders.

BIS Settles with Lambda Research over Software Updates to Huawei and SiCarrier

In early October, BIS announced a conditional settlement with Massachusetts-based Lambda Research Corp. over 66 alleged violations of the Export Administration Regulations, most involving automatic software updates sent to Entity List parties, including 47 to Huawei Technologies Japan K.K. and seven to Shenzhen SiCarrier Technologies, without required licenses. The $2 million civil penalty would be suspended for one year and then waived if the company complies and commits no further violations. The case illustrates that each automated update can be treated as a separate export, which matters for software and SaaS providers with Entity List customers.

California Man Arrested for Allegedly Smuggling $300 Million in AI Servers to China

DOJ announced the arrest of Greg Lui on October 1, 2026, owner of Earthmade Computer, on a three-count indictment alleging that from 2023 to 2024 he smuggled more than $300 million in export-controlled servers containing U.S.-made GPUs to China through Malaysia and Singapore, using falsified documents to misrepresent end users. Earthmade allegedly received more than $176 million from Malaysia-based shippers between January and October 2024. Lui faces charges of conspiracy to violate export laws, outbound smuggling, and money laundering conspiracy.

This report is prepared by the Institute for Financial Integrity (IFI) for informational purposes only and does not constitute legal advice. Links to underlying sources are provided for reference. For questions or to subscribe to future reports, please contact IFI.

Recommended Blogs

Across Borders, Beyond Sight

October 21, 2026

Cross-border payments power the global economy, but they also create opportunities for financial crime. Explore key areas of exposure and how leading institutions are gaining greater visibility into the payment chain.

September 2026 Monthly Sanctions and Export Controls Report

October 6, 2026

Explore this month’s Sanctions and Export Controls Update, highlighting IFI’s take on key developments from September 2026.

Real Estate, Real Risks

September 17, 2026

The FATF has identified the global real estate sector as an area requiring heightened attention due to its vulnerabilities to money laundering, terrorism financing, sanctions evasion and other illicit activity. This article explores why property transactions attract financial crime.

Iran and the Sanctions Landscape

September 10, 2026

Iran has spent nearly five decades under some form of U.S. economic sanctions, and the network built to evade those sanctions is correspondingly mature. Since February 2025, that architecture has come under the most intensive and sustained pressure it has faced since the 2015 nuclear deal.

August Monthly Sanctions and Export Controls Report

September 2, 2026

Explore this month’s Sanctions and Export Controls Update, highlighting IFI’s take on key developments from August 2026.

The Judgment Gap in Market Abuse Compliance

August 25, 2026

While banks may know the set of rules outlined in the EU’s Market Abuse Regulation, exposure sits in the judgment calls related to delayed disclosure, information barriers, and market soundings. Dive into where the risk lies in each area.

The Illicit Oil Pipeline: How Criminal Networks Turn Crude into Clean Cash

August 19, 2026

Money laundering in the oil sector is a highly lucrative global pipeline where illicit networks exploit the massive volume, complex supply chains, and liquid nature of the market. Explore the lifecycle of oil laundering schemes as well as key red flags.

July Monthly Sanctions and Export Controls Report

August 4, 2026

Explore this month’s Sanctions and Export Controls Update, highlighting IFI’s take on key developments from July 2026.

A Financial Institution’s Guide to Updated EU Market Abuse Regulation

July 29, 2026

MAR sounds straightforward until a real case tests it. This guide breaks down what the regulation covers, who it applies to, and the disclosure rules, court rulings, and regulatory guidance that shifted the ground under compliance teams in 2026.

Previous Next