War Bucks: How Iran Evades Sanctions and Funds Terror

After decades of economic sanctions and other pressures from the West, Iran and it’s fundamentalist regime still manage to maintain a large and lethal military. This is done in a variety of ways including state funding, Iranian Republican Guard Corps (IRGC) corporate and economic activity, diversion of resources from civilian programs, and funding of its proxy network of regional terror groups, aka the Axis of Resistance.

In all of this, oil smuggling plays a central role, generating funds by selling refined products internally, as well as crude oil abroad. This is done through complex networks of companies and various shipping manipulation tactics, especially leveraging China as a trading partner via Southeast Asian shipping routes.

Oil is the lifeblood of the Iranian economy and, as such, oil revenue is also the primary source of funds for Iran’s military. The military forces are divided between conventional and the IRGC component, which has its own Army, Navy, and Air forces, as well as the external, asymmetric warfare group known as the IRGC Quds Force. Through the Quds Force, Iran’s military trains and funds select regional terror groups, including Hezbollah (which it helped found), Hamas, and the Houthis, among others. 

Top 5 Ways to Sell Sanctioned Oil

Trans-shipment

The simplest and perhaps most obvious way to get oil from Iranian facilities onto tankers and onto some kind of market is to physically move the oil from one ship to another. This is known as trans-shipment and can take place either via a port facility or sometimes at sea via ship to ship transfer methods. The ships and the facilities are all poorly maintained as decades of sanctions affected the ability to replace parts and maintain facilities properly. Therefore, all these transactions carry heightened risk of spills and environmental damage, as well as risk to the workers operating the machinery.

Reflag, rename, recycle

Instead of physically moving crude oil from one vessel to another, smugglers use a variety of methods to mask true vessel ownership and registration. Every ship has a registered name, an International Maritime Organization (IMO) number (like a Vehicle ID Number, VIN, for US cars & trucks) and sails under a specific country’s flag. Reflagging is the process of changing the flag from one country to another; similarly, smugglers may change the vessel’s registered name to mask the true origin of the ship. Every ship also bears an IMO number which uniquely identifies vessel hulls. IMOs can be manipulated, changed, invented, or reused on mismatching vessels. 

Document manipulation

Shipping manifests and bills of lading can be similarly falsified or manipulated along with any piece of documentation related to the vessel. Like something out of a spy movie, illicit oil is sometimes called, “Malaysian Blend” in documentation and payment instructions. When the ships themselves are reflagged and renamed, the goods are made to look like they came from somewhere else. Recycling legitimate seeming IMO numbers from one hull to another masks the vessel via paperwork hiding its true form. All of these facilitate the transportation and sale of sanctioned oil.

Transponder manipulation 

As part of the scheme, ships manipulate their digital location devices, turning them on and off in key locations. This allows for untrackable movement and facilitates conducting activities such as transshipment or re-painting in the interim. This also enables route masking, with a ship appearing and disappearing in disparate areas with unknown stops in-between. Such activity may be used to cover up trans-shipment points and rendezvous locations.

Layered beneficial ownership 

Vessels can be owned similar to corporations and are often owned by several corporations at once. Layering the ultimate financial beneficial ownership of a vessel under multiple corporations owned in turn by other companies makes detection of individual identity challenging. Operations will open companies using gatekeeper professions such as attorneys and accountants to further obscure the trail. Extensive use of companies in free trade zones further allows for masking the true revenue beneficiary of the commodity a vessel may be carrying. In this case, when an oil tanker appears to be owned by various corporate entities not connected to Iran, which are actually in turn owned by people who are connected to Iran, it allows that vessel to operate more freely and evade detection.

Iranian Regional Terrorism Financing 

Neighborly cooperation 

While funding has traditionally flowed outward from the Iranian government via the IRGC QudsForce, modern complexities have necessitated new connections between regional terror groups and financial facilitators in the region. The US Financial Crimes Enforcement Network (FinCEN) has repeatedly warned institutions to watch payments made via exchange houses and money services businesses throughout the Emirates and Turkiye. 

Drugs, guns, and arbitrage

Across the world, opportunities for terrorists to collaborate with narcotics traffickers, and for all to profit from the exchange of illicit commodities, seem to abound. Traditional barriers of industry, allegiance, or geography have become blurred or erased. Hezbollah has been found to profit from selling narcotics. Weapons are more easily acquired in some places, and thereby fetch a higher price in others. Some of these efforts are so profitable that they return funds to IRGC coffers to keep efforts going. 

Crypto, donations, and trade

Many of the proxy forces still rely on donations from like-minded individuals all over the world. These donations, as well as other funding, may flow by traditional means, but also use all means available. This includes early adoption of virtual assets and cryptocurrency (more for their speed and borderless nature than for pseudo-anonymity) as well as full use of ancient means of informal value transfer. Criminals will use digital cash just as much as paper hawala ledgers and exchanges of trade goods via land transport. 

What to look for

Financial institutions of all kinds must be especially wary in a time of global crisis. When opportunities abound for criminals to mask their activity in a rush of global panic, it can make the search for a true red flag seem hopeless. Here are a few definitive steps to protecting your institution from being used for nefarious purposes:

• Train team members to look for multiple indicators to find truly risky activity related to the typologies discussed in this article. Cross-referencing several items helps separate truly unusual activity from the flurry of otherwise legitimate transactions.
• Ensure sanctions and monitoring systems are recently fine-tuned to catch alerts and use specific geographical targeting logic. Now is a good time to test models, update screening protocols, and re-train alert clearing staff.
• Recognize the potential trade routes for oil, including the nexus to Southeast Asia, Hong Kong, and China. Geographic targeting can be especially effective – revisit risk ratings for countries and jurisdictions both in and around the conflict zone. 
• Know Your Customer and Due Diligence: Use all of this information to tighten beneficial ownership documentation controls and create layered, nuanced ways to detect potential violations. Take time to truly understand an entity, its owners, and its business type.