The U.S. Treasury Department on Monday issued an alert urging financial institutions to step up their detection of money laundering, sanctions evasion, and digital-asset transfers tied to Iran’s Islamic Revolutionary Guard Corps (IRGC), warning that the organization is leaning on shell companies, exchange houses, and stablecoins to fund its weapons programs and overseas proxies.

The alert by the Financial Crimes Enforcement Network (FinCEN) asks financial institutions to flag potential IRGC transfers using the case identifier “FIN-2026-Alert002” in suspicious activity reports (SARs) and to call a 24-hour toll-free hotline, (866) 556-3974, for transactions tied to potential terrorist activity.

According to the alert, the IRGC and its subordinate units smuggle oil to international buyers and use the proceeds to fund weapons procurement and terrorist activity abroad.

In its October 2025 Financial Trend Analysis on Iranian shadow banking, FinCEN said that oil companies potentially linked to Iran transacted approximately $4 billion in 2024, while shipping companies based mostly in Iraq, the United Arab Emirates, and Hong Kong potentially tied to sanctioned Iranian oil and petrochemicals moved about $707 million through U.S. correspondent accounts in the same period.

The cargo is sometimes blended with oil from third countries or relabeled with forged documents, most commonly as “Malaysian blend,” and is overwhelmingly sold to small independent Chinese refineries known as “teapot refineries,” according to the document.

The IRGC and other Iranian actors rely on multi-jurisdictional “shadow banking” networks of exchange houses, trading companies, and front companies. The alert said likely shell companies matching indicators of Iranian activity moved roughly $5 billion in 2024, primarily from non-resident accounts at banks in China operated by Hong Kong-based companies to the UAE.

Iranian banks have separately established so-called “rahbar” companies to handle their clients’ international transactions, with exchange houses then setting up third-country front companies, often in free trade zones, to obscure Iranian involvement and access the international banking system without repatriating funds to Iran, FinCEN said.

The 11-page alert also devotes substantial attention to digital assets, which the bureau described as serving as “one leg of Iran’s shadow banking network.” Citing industry reporting, the alert said Iranian digital asset activity has reached billions of dollars per year, with Iranian government entities including the IRGC engaged in sanctions evasion as part of that activity. Iran has stated its intent to use digital assets to collect illegal payments from oil tankers seeking to navigate the Strait of Hormuz, the alert noted.

FinCEN said Iranian facilitators are likely to use stablecoins because of their liquidity, ease of settlement, and exchange-rate stability, and that Iran’s use of stablecoins includes minting, moving funds between large-volume issuers, and creating proprietary tokens such as USDZ, the stablecoin associated with OFAC-designated issuer Zedxion. The alert also pointed to Zedcex Exchange Ltd. and Zedxion Exchange Ltd., two U.K.-registered digital asset exchanges blacklisted by OFAC in January 2026, saying multiple digital asset addresses attributed to those exchanges processed funds for wallets linked to the IRGC.

Included in the alert is a case study from a September 2025 OFAC action in which two Iranian nationals, Alireza Derakhshan and Arash Estaki Alivand, were said to have used front companies in multiple foreign jurisdictions between 2023 and 2025 to facilitate the purchase of more than $100 million in digital assets tied to Iranian oil sales benefiting the IRGC-Qods Force and Iran’s Ministry of Defense and Armed Forces Logistics.