Uniting BSA, Sanctions Compliance As Treasury Targets Iran

There was a time when U.S. financial institutions could treat sanctions compliance and Bank Secrecy Act obligations as largely parallel tracks, related but operationally distinct. While the walls between the two compliance regimes have arguably been eroding over the course of successive administrations, the current Trump administration's policy toward Iran has taken a sledgehammer to that wall. When it comes to Iran, the separation is no longer tenable.

Through a rapid succession of FinCEN alerts, advisories, financial trend analyses and the August launch of Operation Economic Outcast, the U.S. Department of the Treasury has made clear that Iran-related sanctions evasion is a BSA problem, one that demands suspicious activity report filings, enhanced due diligence and transaction monitoring capabilities that many institutions have not yet calibrated to the threat.

The Treasury is no longer simply asking banks to block Iran. It is asking them to help expose how Iran moves money. That distinction is critical because the first question is principally a sanctions compliance question; the second is squarely within the BSA.

The Maximum Pressure Architecture

When President Donald Trump signed his national security presidential memorandum on Feb. 4, 2025, he directed a whole-of-government approach to deny Iran "all paths to a nuclear weapon" and to counter its influence. The memorandum explicitly called on the attorney general to investigate and prosecute financial and logistical networks inside the U.S. that are sponsored by "Iran or any of its terror proxies."

The pace has been relentless. Between February and June 2025 alone, the Office of Foreign Assets Control announced more than a dozen rounds of Iran-related sanctions designations, targeting shadow fleet oil tankers, oil brokers, front companies, shadow banking networks, teapot refineries, vessel management companies and other facilitators.

At each stage, the administration has embedded the Financial Crimes Enforcement Network and its BSA authorities into the fabric of the campaign.

Perhaps most significantly, the Treasury used FinCEN's Section 311 authority under the Patriot Act, a tool separate from OFAC's blocking power, as part of Operation Economic Outcast. On Aug. 28, FinCEN proposed a rule to prohibit the United Arab Emirates branches of Egypt's Banque Misr from maintaining correspondent accounts with U.S. financial institutions, citing $1.8 billion in transactions linked to 103 potential Iranian shadow banking front companies.

The message to the banking industry was clear: The Treasury's campaign against Iran is not just an OFAC matter; it is a FinCEN matter, and BSA compliance is a core element of the strategy.

The FinCEN Playbook: Alerts, Advisories and Financial Intelligence

The volume of Iran-related FinCEN guidance since early 2025 is without recent precedent, and each publication raises the compliance bar for financial institutions. Understanding the substance of these materials is essential to meeting current expectations.

FinCEN's June 2025 advisory on Iran's illicit oil smuggling and shadow banking networks provided the foundation. That advisory explained, in granular detail, how Iran relies on a network of exchange houses, trading companies and foreign front companies, primarily in Hong Kong, the UAE and Singapore, to conduct international transactions without repatriating funds to Iran. It detailed evasion tactics, including the use of dark fleet vessels, falsified cargo documents, ship-to-ship transfers and the relabeling of Iranian crude as "Malaysian blend" oil.

Critically, the advisory reminded financial institutions of their BSA reporting obligations and encouraged voluntary information sharing under the safe harbor provisions of the Patriot Act.

Most recently, FinCEN's September alert on Iranian commercial aviation procurement, issued just days before the latest FinCEN Exchange event, extended the agency's focus to Iranian airlines' use of front companies to illicitly procure U.S.- and Western-origin aircraft and parts. This alert, keyed to the SAR term "FIN-2026-IRANAIR," explicitly supports Operation Economic Outcast and expands the universe of suspicious activity typologies that banks must monitor.

Why This Is a BSA Problem

The traditional model at many financial institutions treats OFAC screening and BSA/anti-money laundering monitoring as separate disciplines. OFAC compliance focuses on blocking and rejecting transactions involving sanctioned persons and countries. BSA compliance focuses on detecting and reporting suspicious activity, including money laundering, fraud and terrorist financing. In the Iranian context, however, the government has made clear that these two regimes are converging, and institutions that fail to recognize that convergence face escalating risk.

The reason is structural. Iran's sanctions evasion apparatus does not present itself in ways that standard OFAC screening can reliably detect. The Islamic Revolutionary Guard Corps and other Iranian actors rely on multijurisdictional webs of front companies, shell entities and exchange houses, many of which are not themselves designated, to obscure beneficial ownership and move funds through correspondent banking relationships.

Shell companies matching indicators of Iranian activity moved $5 billion in 2024 alone, primarily from nonresident accounts at Chinese banks operated by Hong Kong-based companies to the UAE. These entities are designed to defeat name-matching algorithms. They use recently incorporated entities with no internet presence, shared addresses and transaction patterns that only become suspicious in context.

This is where BSA obligations become critical. Even when OFAC screening does not generate a hit, a bank may have reason to suspect, based on red flags, transaction patterns or counterparty profiles, that activity passing through its accounts is connected to Iranian sanctions evasion. Under the BSA, that suspicion triggers an obligation to investigate and, where warranted, file a SAR.

FinCEN has been explicit about this. The June 2025 advisory reiterates the obligations that U.S. financial institutions have to file a suspicious activity report where a financial institution knows, suspects or has reason to suspect that a transaction it is handling involves illegal activities. Each subsequent alert has reinforced this expectation and added new red flag indicators that, once published, banks are expected to incorporate into their compliance programs.

The convergence extends to customer due diligence and enhanced due diligence. FinCEN's alerts repeatedly recommend that financial institutions conduct heightened due diligence on recently formed companies transacting in unusually high amounts, on customers in high-risk jurisdictions and on entities exhibiting transaction patterns typical of Iranian shadow banking. The May alert on the IRGC specifically encourages

U.S. financial institutions to exercise heightened vigilance with respect to certain correspondent relationships and to carefully consider whether it may be appropriate to require certain respondents to apply strengthened controls, such as targeted monitoring, heightened due diligence, or additional training.

Banks that continue to treat these as separate silos are operating with a compliance model that is no longer fit for purpose.

Practical Steps for Financial Institutions

The volume of new guidance creates an actionable road map.

Update transaction monitoring scenarios.

FinCEN's alerts provide detailed red flag indicators that should be mapped to automated monitoring rules. These include:

· Transactions involving recently incorporated entities with no web presence making large, round-dollar payments;
· Wire transfers between companies in disparate lines of business in jurisdictions such as Hong Kong, the UAE and Singapore;
· References to "Malaysian blend" oil in trade finance documentation; and
· Digital asset activity involving entities in high-risk jurisdictions for Iranian illicit finance.

The September aviation procurement alert adds indicators such as large purchases of aircraft parts by opaque companies, frequent reregistrations or layered ownership transfers of aircraft, and logistics patterns involving transshipment through Turkey or the UAE. Each of these should be translated into monitoring scenarios.

Review correspondent banking relationships.

FinCEN's October 2025 financial trend analysis finding that $9 billion in Iran-linked shadow banking activity flowed through U.S. correspondent accounts should prompt a hard look at respondent bank relationships, particularly those with exposure to Dubai, Hong Kong and Singapore.

Banks should assess whether their respondent banks maintain adequate controls to detect Iranian front company activity and whether additional requirements, such as targeted monitoring, enhanced due diligence questionnaires or training, should be imposed.

Train BSA/AML and sanctions teams on the latest alerts.

FinCEN's guidance is only useful if the analysts reviewing alerts and drafting SARs know what to look for. Institutions should ensure that both sanctions screening teams and BSA/AML investigators are trained on the full suite of current Iran-related alerts and advisories.

Training should cover the specific red flags, SAR filing conventions and the requirement to select the terrorist financing checkbox when activity may be connected to the IRGC.

Assess SAR filing obligations rigorously.

When Iran-nexus activity is detected, even if it does not result in an OFAC hit, the institution must evaluate whether a SAR is required. FinCEN has established specific filing conventions for Iran-related SARs and has encouraged institutions to call its toll-free hotline to expedite reports of suspicious transactions that may relate to terrorist activity.

Institutions should also submit notifications to OFAC through its disclosure portal when they identify potential sanctions violations.

Break down internal silos.

The operational implication of the sanctions-BSA convergence is that sanctions, BSA/AML and legal teams must communicate more effectively.

An OFAC screening hit that is ultimately cleared may still generate red flags warranting a SAR. A BSA alert on unusual transaction patterns may reveal exposure to sanctioned counterparties buried in a network of front companies. Institutions that fail to connect these dots risk both regulatory liability and reputational harm.

Looking Ahead

The enforcement landscape is tightening, and there is no indication it will ease anytime soon. In a press release at Operation Economic Outcast's launch, the Treasury explicitly described the initiative as "a sustained and systematic campaign," not a one-time action.

The Treasury has expanded its sectoral sanctions reach to cover five additional areas of the Iranian economy. It has demonstrated a willingness to use FinCEN's Section 311 authority to cut off foreign banks from U.S. correspondent access when Iranian shadow banking networks exploit their accounts. And through the Iran Maximum Pressure and Counter Terrorism and FinCEN Exchange programs, it has built a public-private information-sharing infrastructure that it expects banks to use.

The risks of noncompliance are compounding. OFAC's enforcement track record includes billion-dollar settlements. BNP Paribas SA's 2014 $8.9 billion penalty for processing transactions on behalf of Iran, Sudan and Cuba remains the largest bank sanctions fine in history. FinCEN, for its part, has its own civil money penalty authority for BSA violations. And beyond formal enforcement, the reputational consequences of being identified as a conduit for Iranian illicit finance, particularly in a geopolitical environment defined by active military conflict and nuclear proliferation concerns, are severe.

The institutions best positioned to manage this risk are those that recognize what the Treasury has been signaling for the past 18 months: Iran sanctions compliance and BSA compliance are no longer separate problems. They are one problem, and they require an integrated response.

Banks that reorganize their compliance architectures accordingly, by updating their monitoring, strengthening their due diligence, training their teams and breaking down internal walls, will be better prepared not only for the current threat environment, but for the broader regulatory trend toward convergence that Iran sanctions are helping to define.

Republished with permission. This article, "Uniting BSA, Sanctions Compliance As Treasury Targets Iran," was originally published in Law360 on October 26, 2026. (login required)