Sanctions and Export Controls Update

Monthly Roundup – September 2026

📅 October 6, 2026

Welcome to this month’s Sanctions and Export Controls Update, highlighting IFI’s take on key developments from September 2026.

September was dominated by the continued rollout of Operation Economic Outcast, which produced four additional tranches of bank-focused Iran sanctions designations and confirmed the strategy’s central logic: a weekly cadence of sanctions designations, paired with a public-private information-sharing push, designed to force global institutions to choose between the U.S. dollar system and Iranian business. The month’s headline action was the September 14 designation of Russia’s VTB Bank—likely the “major bank” Bessent had promised at his August G20 press conference—under Iran (rather than Russia) sanctions authority, which closes the escape hatch a future Russia sanctions waiver might otherwise have opened. Operation Economic Outcast also grounded Iran’s aviation sector and sanctioned Türkiye’s Golden Global Bank. On September 18, President Trump signed the Lindsey O. Graham Sanctioning Russia and Iran Act of 2026 into law (Public Law 119-111)—the most significant Russia and Iran sanctions legislation in years. In the UK, the Chancellor announced a doubling of OFSI’s maximum sanctions penalty to 100% of breach value, and OFSI published a record £4.73 million penalty against Citibank’s London branch for Russia sanctions violations.

The month also produced a wave of third-country enforcement responses to Operation Economic Outcast that deserve particular attention: Türkiye revoked Mellat Bank’s Istanbul operating license; the UAE barred Bank Melli’s UAE branches from conducting any financial transactions with Iran; and the UAE, Oman, Iraq, Georgia, and Azerbaijan all suspended Iranian airline flights in response to OFAC’s September 8 aviation sector designations. Together these actions constitute the most visible multilateral cascade of sanctions-driven enforcement action since the operation’s August 24 launch.

Iran

Operation Economic Outcast (OEO) maintained its near-weekly cadence of Iran sanctions actions throughout September, focusing on financial institution enablers and aviation—two of the five sectors covered by the new secondary sanctions determinations issued at the campaign’s August 24 launch. FinCEN also held its first public-private information exchange under the operation, arming global financial institutions with intelligence on Iran-linked revenue streams and procurement networks.

On September 4, OFAC designated Türkiye-based Golden Global Yatirim Bankasi Anonim Şirketi and two subsidiaries, which allegedly facilitated tens of millions of dollars’ worth of transactions for the IRGC-Qods Force, including the transfer of Iranian oil revenues from China through Türkiye-based financial channels. Golden Global—Türkiye’s 35th-largest bank by assets—denied the allegations and announced plans to contest the designation through legal channels. The action built on the August 28 Banque Misr UAE action and followed Bessent’s explicit statement that “Treasury has detailed knowledge of the financial institutions supporting Iran’s networks.”
On September 8, OFAC targeted Iran’s aviation sector, designating aircraft procurement facilitators, cargo service providers, and sales agents that support Mahan Air and other Iranian carriers, including a Türkiye-based company that coordinated shipments on behalf of Mahan Air involving UAV components and industrial equipment destined for Iran. Concurrently, OFAC suspended three long-standing Iran aviation authorizations, including those covering overflights and the operation of U.S.-origin or U.S.-controlled commercial aircraft into Iran.
On September 10, OFAC updated its Iran-related specific licensing policy under OEO to a presumption of denial, designated individuals and entities in Iraq, Lebanon, the UAE, and Türkiye tied to Kataʼib Hizballah and Hizballah for fueling Iran’s destabilizing regional influence, and announced a $1,427,230 settlement with a U.S. person who engaged in 39 apparent violations of Iran sanctions. The apparent violations included management consulting services to an Iranian software company, receipt of Iranian-origin dividends in U.S. bank accounts, and purchase of property in Iran. OFAC found the conduct egregious and not voluntarily self-disclosed, a rare classification that carries significant weight in OFAC’s enforcement calculus.
On September 14, OFAC designated VTB Bank—one of Russia’s largest financial institutions, with over 1,000 branches worldwide including in China—under its Iran sanctions program, making VTB “among the most comprehensively sanctioned financial institutions in the world.” VTB had opened offices in Iran, established correspondent banking relationships with sanctioned Iranian financial institutions, and was moving frozen Iranian assets and building a currency settlement system. By designating VTB under Iran authorities in addition to Russia authorities, the administration ensures that VTB remains sanctioned even if future Russia sanctions relief is granted. VTB’s global presence—particularly its operations in China—was central to the action’s intended message to Chinese financial institutions: any bank touching VTB’s China operations now carries secondary sanctions exposure. Treasury noted that foreign financial institutions dealing with VTB “are exposed to even more sanctions risk than before and should cut off those relationships immediately.”
On September 16, FinCEN led a public-private FinCEN Exchange with global financial institutions to advance OEO, sharing intelligence on Iranian revenue streams and procurement networks and encouraging institutions to monitor FinCEN’s Iran-related alerts and OFAC’s sanctions actions. Bessent framed the session as evidence that financial institutions are “in lockstep with the U.S. government in support of Operation Economic Outcast.”
On September 29, OFAC sanctioned 10 individuals and entities across multiple jurisdictions that procured weapons and weapons components for Iran’s Ministry of Defense and Armed Forces Logistics (MODAFL), the entity responsible for weapons research, production, and acquisition for Iran’s armed forces. The targets include procurement networks based in Iran, the UAE, and the PRC that sourced materials for MODAFL’s ballistic missile and UAV programs.

The most striking development in September, however, was the cascade of third-country enforcement responses to the OEO’s designations and pressure campaign.

After OFAC’s September 8 action covering 27 additional Iranian airlines and related entities, the UAE suspended all flights by Iranian airlines until further notice, Oman followed suit the same day, and Iraq later suspended flights from all four airports where Iranian airlines had been operating. Georgia and Azerbaijan imposed similar restrictions. Bessent warned on the sidelines of the UN General Assembly that companies dealing with Iranian airlines would be “knocked out of the dollar system.” The suspension of Iranian airline access to the region’s major aviation hubs is described by Reuters as the first concrete, large-scale effect of OEO’s secondary sanctions strategy on third-country behavior.
Türkiye’s banking watchdog (BDDK) revoked the operating license of Mellat Bank’s Istanbul branch on September 19 under Turkiye’s banking law, which permits license revocation where continued operation poses risk to depositors’ rights or financial system stability. The BDDK notice cited no U.S. measures or specific operational failings—the official basis was the banking law trigger—but Reuters noted the timing coincided with intensifying U.S. pressure on countries to increase economic pressure on Tehran. Mellat Bank has operated in Istanbul since 1982 and is subject to both U.S. and EU sanctions for its role in Iran’s nuclear financing.
The UAE Central Bank barred all Bank Melli Iran branches from conducting any financial transactions to or from Iran citing “significant, repeated failures” under the UAE’s AML/CFT and sanctions framework. Bank Melli is Iran’s largest lender, has operated in the UAE since 1969, and maintains seven branches across the country; Dubai-based deposits have long included Iranian funds frozen under U.S. sanctions. The National noted that the UAE Central Bank had simultaneously ordered a special examination of Banque Misr UAE following the August 28 U.S. Treasury/FinCEN action.

Together, the Mellat and Bank Melli UAE actions—alongside the UAE’s August trade and financial cutoff—represent a fundamental restructuring of Iran’s Gulf financial infrastructure that has been in place for decades.

The UK also tightened its Iran sanctions framework in September. On September 8, the UK laid the Iran (Sanctions) (Amendment) Regulations 2026, which introduce new sectoral trade, financial, and transport restrictions, including expanded financial account prohibitions, new restrictions on UK credit and financial institutions’ dealings with Iran-domiciled entities and branches, and enhanced transport sector sanctions. On September 23, OFSI published guidance applying a presumption of denial to license applications made by five designated Iranian banks operating in the UK, effective immediately. Under the policy, OFSI will only grant licenses to these banks in exceptional and urgent circumstances, such as risk to life—a near-blanket denial posture that effectively makes the UK financial system unavailable to these institutions for any routine purpose.

Legislative Developments

The Lindsey O. Graham Sanctioning Russia and Iran Act of 2026 was signed into law by President Trump on September 18, following House passage on September 16. The bill cleared the House over the opposition of Democratic leadership, which objected to the breadth of tariff authority delegated to the executive branch and to the absence of direct Ukraine military finance loans. The law’s key provisions include: mandatory primary and secondary sanctions on Russia and foreign actors supporting its war in Ukraine; authority for the President to impose tariffs of up to 100% on the five largest importers of Russian crude oil and gas (principally China and India); a congressional review mechanism requiring a verified peace agreement before sanctions may be terminated; and an extension of the Iran Sanctions Act of 1996 through 2031, preventing a lapse in the statutory authority that has for three decades underpinned secondary sanctions on foreign companies investing in Iran’s energy and weapons sectors. The law is named for the late Senator Lindsey Graham, who announced a White House deal on the legislation at a press conference in Kyiv on July 10 and died the following day.

Other Significant Developments

September’s other significant developments were led by major UK enforcement actions—a record £4.73 million OFSI penalty against Citibank’s London branch, the Chancellor’s announcement doubling OFSI’s maximum penalty ceiling, and a new NCA/OFSI flash alert on the A7 sanctions evasion network—alongside a landmark OFAC structural reform creating unified Sanctions Penalties Regulations for the first time. OFAC also closed out the month with two significant FTO cartel actions: a nearly 50-target designation against the Sinaloa Cartel’s Los Mayos faction targeting corruption networks in Baja California, and a designation of TdA’s ATM jackpotting financial network and illicit gold mining operations. Cuba sanctions continued to escalate, OTSI published its first annual review, and the EU’s 22nd Russia sanctions package remained under negotiation with adoption expected in October.

UK Financial Sanctions Enforcement

OFSI Imposes Record £4.73 Million Penalty on Citibank London Branch for Russia Sanctions Violations

On August 11 (published September 2), OFSI imposed a £4,732,830.58 monetary penalty on Citibank N.A., London Branch, the largest OFSI financial sanctions penalty since Standard Chartered’s £20.47 million penalty in February 2020, and far above every other 2026 action. The violations comprised (a) 970 transactions totaling approximately £19.7 million that made funds available to entities subject to UK Russia sanctions and Global Anti-Corruption Sanctions and (b) a failure to freeze 24 commercial bank accounts belonging to 11 companies controlled by a single designated individual. OFSI found no intention to breach sanctions but cited material and significant failings across multiple systems and business areas: delays in reviewing and escalating sanctions alerts, screening gaps, human error, and an unreasonable ownership determination. The baseline penalty was £7.89 million; Citibank received a 20% voluntary disclosure discount and a 20% settlement discount, resulting in the final £4.73 million figure.

UK Chancellor Announces Doubling of OFSI Maximum Penalty to 100% of Breach Value

Chancellor John Healey announced that OFSI’s maximum monetary penalty will double from the greater of £1 million or 50% of the breach value to the greater of £1 million or 100% of the breach value, pending legislation expected in the forthcoming Autumn Budget. The change aligns OFSI more closely with the severity of Russia sanctions breaches detected in recent years, where the breach value often substantially exceeds the current £1 million floor. The Sabre Global and Citibank cases would both have been eligible for larger penalties under the new framework. The reform follows the February 2026 overhaul of OFSI’s civil enforcement framework and reflects a broader shift in UK sanctions policy from designation-making to enforcement effectiveness.

NCA, OFSI, and FCDO Issue Flash Alert on A7 Russia Sanctions Evasion Network

On August 31, the National Crime Agency, its National Economic Crime Centre, OFSI, and the Foreign, Commonwealth and Development Office jointly issued a flash alert on the A7 sanctions evasion mechanism—a complex web of financial structures hosted between Kyrgyzstan and Russia, backed by state-level support, that enables Russian entities to access the international financial system despite comprehensive sanctions. The alert identifies A7’s key nodes, the typologies it uses to obscure funds flows, and red flags for financial institutions.

Cuba

OFAC Publishes New Cuba Sanctions Regulations; Issues New Guidance and GLs Under EO 14404

On September 29, OFAC published regulatory amendments implementing the Cuba sanctions framework established by Executive Order 14404, including a new stand-alone Cuba Sanctions Regulations chapter (31 CFR Part 516), five new Cuba-related FAQs (1271–1275) and 29 amended FAQs, amendments to the existing Cuban Assets Control Regulations (31 CFR Part 515) restricting professional meetings and educational travel authorizations, and an OFAC Alert titled “Expanded Sanctions Against Cuba.” The publication of binding regulations formalizes and consolidates OFAC’s Cuba secondary sanctions program, previously implemented through executive order and guidance alone, making the EO 14404 framework legally robust and replacing reliance on FAQ guidance with codified text. Non-U.S. institutions with Cuba-linked business should review the new regulations and the amended CACR provisions carefully.

EU Russia Sanctions

EU 22nd Sanctions Package Remains Under Negotiation; Commission President Flags Russia Election Sanctions

The EU’s 22nd Russia sanctions package—which EU High Representative Kallas announced in August would include approximately 1,600 new individual and entity designations—remained under member state negotiation throughout September, with adoption targeted for October. On September 16, European Commission President Ursula von der Leyen, in her State of the Union address, flagged that individuals involved in organizing or standing as candidates in Russia’s so-called elections in occupied Ukrainian territories would also be sanctioned.

EU Extends Russia Designation Regime to 2029 and Sanctions RT France Executive for Information Manipulation

The EU Council extended its restrictive measures targeting those responsible for undermining Ukraine’s territorial integrity for a further 36 months—through September 22, 2029—covering more than 3,000 individuals and entities subject to asset freezes and travel bans. The EU also separately sanctioned Xenia Fedorova—a Russian media figure and former senior executive of RT France—for foreign information manipulation and interference, citing her continued dissemination of pro-Russian narratives through French media outlets following RT’s EU broadcasting suspension.

OFAC Sanctions Penalties Regulations

OFAC Publishes First-Ever Unified Sanctions Penalties Regulations

On September 25, OFAC published a final rule creating new 31 CFR Part 505, Sanctions Penalties Regulations—the first-ever single, unified codification of OFAC’s civil and criminal penalty rules applicable across all sanctions programs. The rule consolidates previously scattered guidance into a single binding regulatory chapter, and introduces new transparency requirements: after any civil penalty proceeding resulting in a penalty or settlement against an entity, OFAC must publicly disclose the entity’s name, sanctions program(s) involved, violation description, and penalty amount on a monthly basis. For individuals, OFAC will release aggregate statistics rather than individual names. The rule also codifies the rights of U.S. persons under investigation, 30-day response timelines for pre-penalty notices, and settlement procedures. The transparency provisions are particularly significant: they will substantially increase the volume of OFAC enforcement information available to the public, compliance practitioners, and counterparties, and are expected to heighten the reputational stakes of OFAC enforcement proceedings for corporate respondents.

Cyber Scams

OFAC Sanctions Xinbi Guarantee, Chinese-Language Scam Marketplace That Has Processed $24 Billion Since 2022

On September 9, OFAC designated Xinbi Guarantee and two enabling entities—SafeW Technology and Anwen Technology—for operating a Chinese-language online marketplace that supports cyber scams targeting Americans. Officials said Xinbi has processed more than $24 billion since 2022 and has absorbed operations from Huione Pay, previously named by FinCEN as a financial institution of primary money laundering concern. SafeW and Anwen developed messaging and cryptocurrency payment applications that supported Xinbi’s network. The DOJ’s Scam Center Strike Force simultaneously seized Xinbi’s infrastructure and digital wallets.

OFAC Designates Iranian Digital Assets Venture BitBank as part of Operation Economic Outcast

On September 17, OFAC designated BitBank—an Iranian digital asset exchange controlled by sanctioned financier Babak Zanjani, alongside its software developer, Pishtaz Simorgh Electronic Trade, and three Zanjani associates, for funneling hundreds of millions of dollars in Bitcoin to the IRGC. Treasury stated that Zanjani has used BitBank since June 2026 to launder funds through a network of digital asset platforms.

Drug Cartels / Organized Crime

OFAC Sanctions Nearly 50 Sinaloa Cartel Targets Tied to Los Mayos Leadership and Baja California Corruption Networks

On September 29, OFAC designated nearly 50 individuals and entities linked to the Sinaloa Cartel’s Los Mayos faction, led by Ismael Zambada Sicairos (a.k.a. “Mayito Flaco”), son of the late El Mayo Zambada, who was sentenced to life in prison in July. The designations target Mayito Flaco’s innermost circle, Tijuana-based cell leaders, money launderers, and corrupt Mexican politicians who enable the cartel to operate with impunity across border plazas in Baja California. The action follows El Mayo’s sentencing and the administration’s broader campaign to disrupt the Sinaloa Cartel’s leadership succession and revenue infrastructure.

OFAC Sanctions Tren de Aragua Financial Network for ATM Jackpotting Scheme and Illicit Gold Mining

On September 30, OFAC designated 10 targets involved in a Tren de Aragua (TdA) ATM jackpotting fraud scheme—a technique in which TdA operatives hack ATMs to cause them to dispense cash on demand, enabling the theft of millions of dollars from U.S. banks. The designated targets include TdA members who coordinated the scheme and money laundering entities in Latin America used to move the proceeds. OFAC also designated a TdA leader involved in illicit gold mining operations. The action brings the total number of OFAC actions against TdA and related networks to over 30, targeting more than 300 individuals and entities since 2025, and reinforces TdA’s status as a Foreign Terrorist Organization under continuous maximum pressure from the administration.

North Korea

MSMT Report Details North Korea’s Sanctions-Evading Overseas Labor Program

The Multilateral Sanctions Monitoring Team (MSMT)—formed in October 2024 to monitor UN sanctions compliance after the Security Council’s Panel of Experts disbanded—released a report detailing North Korea’s ongoing evasion of UN sanctions through overseas deployment of laborers. The report, supported by 11 participating countries including the U.S., Japan, and South Korea, estimates North Korea deploys between 35,600 and 101,280 laborers abroad—nearly all in China and Russia—generating $450 million to $800 million annually for Pyongyang’s nuclear and missile programs, with 80–90% of wages confiscated by the regime. The participating states are urging the Security Council to reestablish the disbanded Panel of Experts.

Sudan

UN Security Council Adopts One-Month Extension of Sudan Sanctions; Switzerland Bans Sudanese Gold

The UN Security Council unanimously adopted a resolution extending Sudan’s sanctions regime for one month (Resolution 2828) to allow more time for negotiations on expanding the measures. The U.S., which sponsored the text, has pushed to broaden Sudan’s arms embargo across the country and expand listing criteria to include sexual violence and attacks on aid workers. Separately, Switzerland banned the purchase and import of gold originating in Sudan, as well as the sale to Sudan of certain goods used in gold mining and extraction, in alignment with EU sanctions targeting the conflict-minerals trade.

Enforcement Actions

September’s enforcement developments included the OFAC settlement described in the Iran section, the OFSI Citibank penalty described above, and a significant criminal sentencing in a long-running Russia export control case, as well as the UK enforcement actions described below.

Agricultural Company Forfeits £3.8 Million Following NCA Investigation into Russia Sanctions Evasion

Following a National Crime Agency financial investigation, an unnamed UK-registered agricultural company forfeited £3.8 million linked to Russia sanctions evasion. The NCA identified funds generated through transactions that breached UK Russia financial sanctions; the forfeiture was secured through a civil recovery order without a criminal prosecution, under the Proceeds of Crime Act 2002. The case illustrates the NCA’s expanded use of civil forfeiture powers as a sanctions enforcement tool alongside OFSI’s civil monetary penalty regime, providing a complementary mechanism where criminal prosecution thresholds are not met but illicit funds can nonetheless be recovered.

UK Research and Biotechnology Company Pays £7.4 Million Compound Settlement for Supplying Sanctioned Goods to Russia

HMRC and OTSI announced a £7.4 million compound settlement with an unnamed UK research and biotechnology company for supplying sanctioned goods to Russia and other prohibited destinations using overseas companies within its corporate group (i.e., using intra-group legal entities in non-sanctioning jurisdictions to route prohibited shipments). The settlement is the largest UK trade sanctions compound settlement on record and illustrates the enforcement risk of relying on corporate group structuring to route controlled goods through less-restricted subsidiaries or affiliates.

This report is prepared by the Institute for Financial Integrity (IFI) for informational purposes only and does not constitute legal advice. Links to underlying sources are provided for reference. For questions or to subscribe to future reports, please contact IFI.

Recommended Blogs

Real Estate, Real Risks

September 17, 2026

The FATF has identified the global real estate sector as an area requiring heightened attention due to its vulnerabilities to money laundering, terrorism financing, sanctions evasion and other illicit activity. This article explores why property transactions attract financial crime.

Iran and the Sanctions Landscape

September 10, 2026

Iran has spent nearly five decades under some form of U.S. economic sanctions, and the network built to evade those sanctions is correspondingly mature. Since February 2025, that architecture has come under the most intensive and sustained pressure it has faced since the 2015 nuclear deal.

August Monthly Sanctions and Export Controls Report

September 2, 2026

Explore this month’s Sanctions and Export Controls Update, highlighting IFI’s take on key developments from August 2026.

The Judgment Gap in Market Abuse Compliance

August 25, 2026

While banks may know the set of rules outlined in the EU’s Market Abuse Regulation, exposure sits in the judgment calls related to delayed disclosure, information barriers, and market soundings. Dive into where the risk lies in each area.

The Illicit Oil Pipeline: How Criminal Networks Turn Crude into Clean Cash

August 19, 2026

Money laundering in the oil sector is a highly lucrative global pipeline where illicit networks exploit the massive volume, complex supply chains, and liquid nature of the market. Explore the lifecycle of oil laundering schemes as well as key red flags.