Out of the Shadows

The Mechanics of Iran’s Shadow Banking System

📅 July 23, 2025

The U.S. Treasury Department has released successive sanctions tranches aimed at reducing Iran’s illicit oil exports and weakening the financial networks that support the Iranian Revolutionary Guards Corps (IRGC), Ministry of Defense and Armed Forces Logistics (MODAFL), and affiliated militia groups. As detailed in FinCEN’s June 2025 Advisory, these efforts include targeting individuals and entities across Iran, Hong Kong, the UAE, Türkiye, and other jurisdictions involved in operating and facilitating Iran’s ‘shadow banking’ system used to evade sanctions.

How Does the Shadow Banking System Enable Illicit Oil Sales?

At its core, the shadow banking system operates as a parallel financial infrastructure that relies on opaque money exchange houses. Iran’s overall revenue generating scheme involves an array of front companies and legitimate businesses, spanning across jurisdictions and sectors, and yields billions of dollars for the state and its proxies.

While there is no single blueprint for how Iran raises funds through illicit oil sales, the process generally follows a similar pattern:

Step 1
Allocation of Oil to the IRGC and MODAFL
At the root of the oil smuggling scheme is the National Iranian Oil Company (NIOC), Iran’s state-owned oil production giant. The NIOC grants the IRGC and MODAFL a significant portion of crude oil stock, which they proceed to sell abroad independently to supplement their budgets.
Step 2
Concealment of Iranian Origin Through Blending and Document Alteration
Secondary sanctions risks dissuade most refineries from purchasing crude oil originating from the NIOC. To get around the restrictions, Iranian oil – now in the possession of the IRGC or MODAFL – is either fraudulently represented as being of foreign origin, or physically blended with foreign petroleum to disguise its chemical composition. The oil is often rebranded as a “Malaysian blend,” and Iraqi networks have emerged as an important vector in facilitating blending operations.
Step 3
Sale to Foreign Refineries
Once blended, front companies of the IRGC or MODAFL (often incorporated in Hong Kong, the UAE, Türkiye, or elsewhere) market the oil as being of purely Malaysian, Iraqi, Omani, or other origin, and sell it at a discounted rate to suitable buyers. Around 90% of customers are independent Chinese refineries, commonly referred to as teapot refineries.
Step 4
Export of Oil Using Shadow Vessels
The front companies that market the oil often handle shipping to the teapot refineries as well. Iran maintains a fleet of “older, poorly maintained vessels operating outside of standard maritime regulations,” which are used for oil shipments. Ship-to-ship transfers, automated identification system (AIS) obfuscation, the use of fraudulent documentation, and other tactics are used to evade international restrictions and reach the port of delivery.
Step 5
Money Exchanges Facilitate Payments and Launder Proceeds
After the refineries receive the shipment, the front companies are not paid directly. Rather, they inform their designated Iranian exchange of the sum of the payment and the originator of the transaction. These exchanges, which operate as wings of the financial departments of the NIOC, function as banks and control their own network of front companies known as “trusts” that hold accounts in foreign banks, often in China or the UAE. The exchange determines which trust needs to be credited and then instructs the shipping company to notify the refinery that it will receive an invoice (denominated in US dollars, euros, or Emirati dirham) from the trust. The payments are then deposited into the account of the trust and are cleaned for weapons procurement or other activities.

🚩 Red Flags Associated with Iranian Oil Shipments

🚩 Ship-to-Ship Transfers: Ship-to-ship (STS) transfers are the practice of transferring cargo from one vessel to another at sea rather than in port. While most STS transfers are legal, tankers transporting Iranian oil have conducted them to move petroleum to non-sanctioned vessels. Iran usually uses multiple STS transfers – often three to five – in a single shipment, which is a strong indicator of sanctions evasion.

🚩 AIS Manipulation or Disabling: AIS is a maritime navigation system designed to identify and locate vessels to avoid collisions that is now often used for tracking. Vessels or tankers carrying Iranian oil intentionally disable or alter AIS, Maritime Mobile Service Identity (MMSI), and other data to conceal their movement.

🚩 Fraudulent Documentation: Networks facilitating Iranian oil sales may manually falsify vessel and cargo documents, including bills of lading, certificates of origin, invoices, packing lists, proof of adequate insurance, lists of last ports of call, and others. The networks may also obtain new documentation in third jurisdictions with weak oversight to conceal an Iranian nexus.

For a full list of deceptive practices associated with Iranian oil shipping, see OFAC’s April 2025 Guidance.

At times, Iran will outsource the process entirely to third-party firms. For example, the IRGC has partnered with the Turkish-based and Gibraltar-incorporated ASB Group, controlled by the designated Turkish businessman Sitki Ayan, to establish relationships with foreign customers, coordinate shipping, and assisting in laundering the proceeds of oil smuggling.

Source: Treasury Sanctions Iranian Network Laundering Billions for Regime Through Shadow Banking Scheme

Case Study: Sahara Thunder

In April 2024, OFAC sanctioned Sahara Thunder, the primary front company involved in facilitating the sale of unmanned aerial vehicles (UAVs) and overseeing all commercial activities for MODAFL. The firm managed illicit oil sales to raise funds for MODAFL and coordinated with Sadaf Exchange, based in Iran and operated by an Iranian-Turkish moneychanger, in a multi-step process to launder the proceeds and procure advanced weapons components on the international market.

After delivering oil to a refinery, Sahara Thunder would inform MODAFL that funds were ready to be transferred and request a dummy invoice from Sadaf Exchange. The exchange, which controlled the bank account of a trust at a Hong Kong financial institution, provided a dummy invoice from the trust to MODAFL, which then sent it to Sahara Thunder. Sahara Thunder passed the dummy invoice to the refinery, which subsequently transferred the funds to the trust’s account in Hong Kong.

Source: Treasury Targets Shadow Banking Network Moving Billions for Iran’s Military

Red Flags for Financial Institutions

While most Iranian oil smuggling and shadow banking typologies should already be incorporated into the internal controls of financial institutions, the evolving sophistication and multi-jurisdictional nature of Iran’s operations may make it more difficult to detect its obfuscation techniques. According to FinCEN’s Advisory published on June 6, 2025, a few red flags may be unique to Iran’s activities:

🚩 Transactions relate to oil, especially those originating from Southeast Asia and bound for China, referencing “Malaysian blend” oil.

🚩 Maritime databases indicate AIS irregularities or evidence of ship-to-ship transfers in Southeast Asia.

🚩 Petroleum or shipping companies conduct business with counterparties with ties to Iran, or transport goods using vessels with ties to Iran.

🚩 Transactions involve multiple exchange houses or general trading companies, adding additional fees and costs that do not reflect conventional commercial practices.

🚩 Exchange houses or trading companies in jurisdictions near Iran use forged documents to disguise the identities of parties involved in transactions.

🚩 General trading companies registered in free trade zones in the UAE hold bank accounts in multiple Emirati financial institutions and conduct business with companies located in Singapore and Hong Kong.

🚩 Middle Eastern companies with links to Iran or showing indications of being a front company receive payments primarily from petroleum companies, then make payments primarily to electronics companies based in Hong Kong and China.

Financial institutions should continue to review and integrate alerts and advisories from FinCEN and other authorities regarding Iranian activities into their financial crime compliance program. Proactive monitoring of red flags is essential to mitigate exposure to illicit financial activity.

Recommended Blogs

Dirty Barrels

September 24, 2026

While oil and gas is one of the world's most valuable and strategically important industries, it is vulnerable to corruption. Explore how corruption risks can arise throughout the lifecycle of an oil and gas transaction.

Synthetic Identities

January 8, 2026

Fraud generates billions in proceeds every year, and the use of AI significantly increases the speed, scale, and likelihood of success. Synthetic identities are already leveraged to open accounts used to commit fraud and launder money. Explore red flags and actions financial institutions must take to detect and respond to AI-enabled synthetic identities.

Deepfake Deep Dive

August 27, 2025

Artificial intelligence (AI) can increase the volume, value, and effectiveness of fraud attacks such as CEO fraud. Financial institutions should take action to protect themselves – and their customers.

The Network, Not the Node

June 5, 2025

Data analytics and advanced technologies are critical tools to take effective action against increasingly complex criminal networks. In this article we consider the best practices a financial institution could apply when implementing data analytics strategies and solutions, and what the future holds.

AI vs. Human Judgment

April 9, 2025

AI is helping financial institutions stay on top of their game while making processes faster and more efficient. But with recent advancements, one question keeps coming up: Will AI replace compliance professionals? In this article, we explore where AI excels versus human judgment.

The Heat is On

February 24, 2025

Explore the key insights and implications from Transparency International’s 2024 Corruption Perceptions Index.

The Green Gold Rush

January 13, 2025

Explore the corruption risks in the green transition mining and minerals sector, a rapidly growing industry fraught with challenges that expose businesses to bribery, fraud, and reputational damage. Discover strategies to protect your operations and ensure compliance in the race for sustainable energy solutions.

Toward a Financial Integrity Risk Management Program

December 19, 2024

This article explores the commonalities between AML, sanctions compliance, ABC, fraud risk management, and export control compliance programs and recommends that organizations consider using a holistic financial integrity risk management and compliance framework.

Safeguarding Trust – How to Balance Innovation and Security in Gen AI-Powered Compliance

December 12, 2024

This article explores how privacy-first architecture, robust guardrails, and source transparency can build trust while ensuring responsible AI deployment in compliance solutions.

Previous Next

Out of the Shadows

The Mechanics of Iran’s Shadow Banking System

How Does the Shadow Banking System Enable Illicit Oil Sales?

Step 1

Step 2

Step 3

Step 4

Step 5

Case Study: Sahara Thunder

Red Flags for Financial Institutions

Recommended Blogs