Public reports link the Iranian Revolutionary Guard Corps (IRGC) to a shadow banking network that moved millions in illicit oil profits, violating international sanctions. This network reportedly included the Bank of New Innovation Ltd., formerly Bank of Nevis International. Despite its known involvement and questions about its founder, now a "Strategic Advisor," there's been no visible action from the U.S. Department of Justice against the bank.
For sanctions analysts, this gap is a lesson. You can't assume a counterparty is clean just because there's no enforcement action. This checklist helps you build controls that don't rely on regulators acting first. Each item includes a done/not-done state and a description of what effective practice looks like.
Prerequisites
Before using the checklist, ensure you have:
- A current, documented sanctions risk assessment covering Iran, the IRGC, and oil-related trade flows.
- Access to FinCEN advisories and alerts, including FIN-2026-Alert002 on IRGC sanctions evasion and shadow banking.
- Authority to escalate to your MLRO or sanctions officer without needing management approval.
- A designated owner for correspondent and offshore counterparty risk.
Checklist Items
1. Add open-source adverse media to your counterparty triggers. Enforcement often lags behind reporting. Investigative journalism can identify institutions long before any charges. Done means: credible investigative reporting is a formal trigger for re-review. Good looks like: a named article or alert automatically opens a case with a documented decision and owner.
2. Screen against designated lists, then go beyond them. Screening against Designated Persons and Entities only catches what's been officially listed. Non-designated banks can still act as conduits. Done means: your process explicitly addresses non-designated institutions linked to designated actors. Good looks like: a written procedure for handling "adjacent" entities with a defined risk rating outcome.
3. Map FATF Recommendation 6 and 7 obligations to your controls. FATF Recommendation 6 (terrorism) and Recommendation 7 (proliferation) require freezing assets without delay for designated parties. Done means: each recommendation is mapped to a specific control and test. Good looks like: an auditable control matrix showing who freezes, how fast, and who is notified.
4. Review every offshore bank relationship for ownership and governance. Examine who founded, controls, and advises the institution. Founders and former executives who stay on as "advisors" can retain real influence. Done means: Beneficial Owner Identification extends to senior advisors and controllers, not just shareholders. Good looks like: a documented control map naming every person with material influence and the evidence for it.
5. Apply enhanced Customer Due Diligence to high-risk offshore jurisdictions. Offshore licenses can offer secrecy and thin supervision. Done means: jurisdiction risk drives the depth of review, and exceptions need MLRO approval. Good looks like: enhanced due diligence files that record rationale, not just a checked box.
6. Build Transaction Monitoring Rules for oil-related flows. Shadow banking networks route oil proceeds through intermediaries and trade-like payments. Done means: Transaction Monitoring Rules cover payments with energy-sector indicators, unusual intermediaries, and mismatches between stated purpose and counterparty profile. Good looks like: rules tuned against known typologies, with alert outcomes reviewed on a schedule.
7. Test indirect exposure through nested and pass-through accounts. Your risk often sits one hop away. Done means: you can identify when a respondent bank processes payments on behalf of another institution. Good looks like: nested-account disclosures required at onboarding and verified in Periodic Review.
8. Document an Escalation to MLRO path for regulator-silent risks. When no agency has acted, analysts may feel they lack grounds to escalate. Done means: your policy states that credible public reporting is sufficient grounds. Good looks like: a short escalation form that records the trigger, evidence, and decision within a set timeframe.
9. Decide on Suspicious Activity Report thresholds for sanctions-linked activity. Where activity may relate to sanctions evasion, assess whether a Suspicious Activity Report is warranted, using the FinCEN SAR (Form 111) through the BSA E-Filing System. Done means: sanctions-evasion indicators are built into your SAR decision tree. Good looks like: filings that cite specific FinCEN alert key terms, with Safe Harbor and SAR Confidentiality respected and no Tipping Off.
10. Schedule Ongoing Due Diligence and Periodic Review for flagged institutions. A one-time clearance goes stale. Done means: flagged counterparties sit on a shorter review cycle. Good looks like: review dates tied to risk tier, with a record of what changed each cycle.
11. Record your decisions, especially the ones to keep or exit. If a regulator later takes a different view than you did, your file is your defense. Done means: every retain-or-exit decision is written and dated. Good looks like: a rationale a stranger could follow without calling you.
Common Mistakes
- Waiting for a designation or indictment. Regulatory inaction isn't a clearance. Reporting-based risk is still risk.
- Treating the bank as the only risk. Founders, advisors, and related parties can carry exposure the entity record doesn't show.
- Relying on list matches alone. If your whole sanctions program is a hit-or-no-hit check, shadow banking will pass straight through.
- Letting alerts expire. Alerts closed without a documented reason leave you exposed during review.
- Skipping the jurisdiction. Offshore licensing doesn't change your obligations; it raises the bar for evidence.
Next Steps
Start by pulling a list of your offshore and correspondent relationships and run them against the first four items. Brief your MLRO on any institution with public reporting that links it to Iranian oil or IRGC finance, and decide, in writing, whether to restrict, review, or exit. Then read FIN-2026-Alert002 and confirm your Transaction Monitoring Rules reflect its indicators.
The enforcement gap won't close on your timeline. Your controls should work whether or not it does.
