FIN-2024-A001: Advisory to counter the financing of Iran-backed terrorist organizations (CVC section)
Document text
Research, not advice. Part of the Bitcoin research archive (October 2026). Claims labelled unverified, contested or fringe are reported, not endorsed; statuses of bills and rules are as of the date checked. Government, court and patent records are public domain; the research notes are CC BY 4.0.
FIN-2024-A001 May 08, 2024
FinCEN Advisory to Financial Institutions to Counter the
Financing of Iran-Backed Terrorist Organizations
In light of intensified terrorist activity in the Middle East, FinCEN urges vigilance in
identifying potential suspicious activity related to the financing of Iran-backed
militias and terrorist organizations, including Hamas, the Houthis, Hizballah,
Palestinian Islamic Jihad (PIJ), and Iran-aligned militia groups in Iraq and Syria.
Suspicious Activity Report (SAR) Introduction
Filing Request:
The Financial Crimes Enforcement Network (FinCEN) is
FinCEN requests that financial
issuing this advisory to assist financial institutions in detecting
institutions reference this
potentially illicit transactions related to Islamic Republic of
advisory in SAR field 2 (“Filing
Iran (Iran)-backed terrorist organizations amid intensified
Institution Note to FinCEN”) and
terrorist activity in the Middle East.1 Recent events have
the narrative by including the
key term “IRANTF-2024-A001” underscored Iran’s involvement in and financing of terrorist
and select SAR field 33(a) activity in the region. Iran seeks, among other goals, to project
(Terrorist Financing-Known or power by exporting terrorism throughout the Middle East and
suspected terrorist/terrorist beyond through the financing of a range of regional armed
organization). groups, some of which are U.S.-designated Foreign Terrorist
Organizations (FTOs) or Specially Designated Global Terrorist
organizations (SDGTs). These terrorist organizations include Lebanese Hizballah (Hizballah),3 Hamas,4
2
1. In 2018, FinCEN published an advisory on Iran’s exploitation of the international financial system, which continues
to serve as an additional resource for financial institutions in identifying suspicious activity related to Iran. See
FinCEN, “Advisory on the Iranian Regime’s Illicit and Malign Activities and Attempts to Exploit the Financial
System” (“Oct. 2018 FinCEN Advisory”) (Oct. 11, 2018). While the Oct. 2018 FinCEN Advisory and this advisory
address U.S. sanctions that prohibit U.S. persons and U.S.-owned or -controlled foreign entities from engaging in
transactions involving Iran, including persons “ordinarily resident” in Iran, financial institutions should note that
some transactions involving Iran, Iranian citizens, or persons with connections to Iran, including certain humanitarian
transactions, may be authorized by general or specific license or exempt from sanctions prohibitions. Institutions
should regard an Iranian nexus and the typologies listed in this advisory as factors to consider when assessing
whether any specific transaction or activity has an illicit nexus or is otherwise prohibited.
2. Congressional Research Service (CRS), “Iran: Background and U.S. Policy” (“Jan. 2024 CRS Report”) (Jan. 26, 2024), at pp. 2-4.
3. Lebanese Hizballah was designated as an FTO on October 8, 1997, by the Secretary of State in accordance with section
219 of the Immigration and Nationality Act (INA), as amended, and as an SDGT by the Secretary of the Treasury
pursuant to Executive Order (EO) 13224 on October 31, 2001. For more information about Lebanese Hizballah, see
Directorate of National Intelligence’s (DNI) National Counterterrorism Center (NCTC), “Counter Terrorism Guide:
Lebanese Hizballah” (Sept. 2022).
4. Hamas was designated as an FTO on October 8, 1997, by the Secretary of State in accordance with section 219 of the
INA, as amended, and as an SDGT by Treasury pursuant to EO 13224 on October 31, 2001. For more information
about Hamas, see DNI’s NCTC, “Counter Terrorism Guide: HAMAS” (Sept. 2022).
1
F I N C E N A D V I S O R Y
the Palestinian Islamic Jihad (PIJ),5 the Houthis (Ansarallah),6 and several Iran-aligned militia groups
in Iraq and Syria. As demonstrated by the October 7, 2023, Hamas attack on Israel and recent Houthi
attacks in the Red Sea,7 these organizations are capable of perpetrating horrific violence, causing
destruction, and disrupting critical supply chains. The U.S. Department of the Treasury (Treasury)
has been systematically working to dismantle these organizations by disrupting their illicit finance
networks and eliminating their sources of revenue.8
This advisory highlights the means by which terrorist organizations receive support from Iran
and describes several typologies these terrorist organizations use to illicitly access or circumvent
the international financial system to raise, move, and spend funds. It also provides red flags that
may assist financial institutions in identifying related suspicious activity and is consistent with
FinCEN’s National Anti-Money Laundering and Countering the Financing of Terrorism (AML/
CFT) Priorities, which include terrorist financing.9
The information contained in this advisory is derived from FinCEN’s analysis of Bank Secrecy Act
(BSA) data, open-source reporting, and information provided by law enforcement partners.
How Iran Raises and Moves Funds in Support of Terrorism
Iran supports its numerous terrorist partners and proxies through the Islamic Revolutionary Guard
Corps (IRGC), a parallel organization to Iran’s regular armed forces.10 In particular, the IRGC
division known as the IRGC-Qods Force (IRGC-QF)11 is responsible for conducting covert lethal
activities outside of Iran, such as supporting terrorism globally and serving as a conduit for funds,
training, and weapons to Iran-aligned partners and proxies.12
5. PIJ was designated as an FTO on October 8, 1997, by the Secretary of State in accordance with section 219 of the INA,
as amended. For more information about PIJ, see DNI’s NCTC, “Counter Terrorism Guide: Palestinian Islamic Jihad
(PIJ)” (“Feb. 2023 Counter Terrorism Guide”) (Feb. 2023).
6. The Houthis were designated as an SDGT by the Department of State pursuant to EO 13224 on January 17, 2024,
effective February 16, 2024. See Department of State, “Terrorist Designation of the Houthis” (“Jan. 2024 Houthi
Designation”) (Jan. 17, 2024).
7. See Deputy Secretary of the U.S. Treasury Wally Adeyemo, The National, “Houthi actions are hurting the people of the
region and hopes for Red Sea prosperity” (Mar. 18, 2024).
8. See Treasury, “Treasury Sanctions Hamas-Aligned Terrorist Fundraising Network” (Mar. 27, 2024), and “Treasury
Targets Qods Force, Houthi, and Hizballah Finance and Trade Facilitators” (“Mar. 2024 Treasury Press Release”)
(Mar. 26, 2024). See also Treasury, “Remarks by Deputy Secretary of the Treasury Wally Adeyemo at the Royal United
Services Institute in London, the United Kingdom” (Oct. 27, 2023), and “Under Secretary for Terrorism and Financial
Intelligence Brian Nelson to Travel to the Middle East” (Oct. 22, 2023).
9. FinCEN, “Anti-Money Laundering and Countering the Financing of Terrorism National Priorities” (Jun. 30, 2021). See also
Treasury, “2024 National Terrorism Financing Risk Assessment” (“Feb. 2024 Terrorism Risk Assessment”) (Feb. 2024).
10. The IRGC was designated by Treasury as a SDGT on October 13, 2017, pursuant to EO 13224. It was added to the
U.S. Department of State’s FTO list on April 15, 2019. See Treasury, “Treasury Designates the IRGC under Terrorism
Authority and Targets IRGC and Military Supporters under Counter-Proliferation Authority” (Oct. 13, 2017). See also
Department of State, “Designation of the Islamic Revolutionary Guard Corps” (Apr. 8, 2019).
11. The IRGC-QF was designated by Treasury as a SDGT on October 25, 2007, pursuant to EO 13224. See OFAC, “Global
Terrorism (SDGT) Designations and NPWMD Designations” (Oct. 25, 2007), and “Treasury and the United Kingdom
Target Qods Force Deputy Commander and Houthi-Affiliated Supporters” (Feb. 27, 2024).
12. See Jan. 2024 CRS Report, supra note 2 at p. 4.
2
F I N C E N A D V I S O R Y
Iran’s Sources of Foreign Revenue
Iran uses the revenue from the sale of commodities, particularly oil, to countries such as the
People’s Republic of China (PRC) to fund its terrorist proxies.13 Following the reimposition of U.S.
sanctions against Iran’s petroleum sector in 2018,14 Iran’s ability to finance itself through sales of
crude oil and petroleum products—its most important economic sector—was severely diminished.
In response, Iran established large-scale global oil smuggling and money laundering networks to
enable access to foreign currency and the international financial system through the illicit sale of
crude oil and petroleum products in global markets.15
In 2021, the National Iranian Oil Company sold approximately $40 billion worth of products,16
and its crude oil and condensate exports reached an average of more than 600,000 barrels per day,
with nearly all of it sent to the PRC and Syria.17 Iran’s exports to the PRC have increased over time,
reaching approximately 1.3 million barrels per day in 2023.18 Some of these oil proceeds finance
the activities of the IRGC-QF and other terrorist groups.19 To restrict these sources of revenue,
Treasury has designated numerous Iranian- and third-country operatives, front companies, and
ships involved in Iran’s oil smuggling networks.20
13. See Treasury, “Treasury Sanctions Key Actors in Iran’s Oil Sector for Supporting Islamic Revolutionary Guard Corps-
Qods Force” (Oct. 26, 2020). See also Jan. 2024 CRS Report, supra note 2 at p. 15.
14. As part of the reimposition of U.S. nuclear-related sanctions that had been lifted or waived in connection with the
Joint Comprehensive Plan of Action (JCPOA), Treasury designated over 400 persons and entities connected to the
Iranian energy and shipping sectors. See Treasury, “U.S. Government Fully Re-Imposes Sanctions on the Iranian
Regime as Part of Unprecedented U.S. Economic Pressure Campaign” (Nov. 5, 2018).
15. See, e.g., Treasury, “Treasury Sanctions Companies Involved in the Production, Sale, and Shipment of Iranian
Petrochemicals and Petroleum” (Feb. 9, 2023); “Treasury Targets Network Supporting Iranian Petrochemical
and Petroleum Sales” (Nov. 17, 2022), and “Treasury Targets Companies Supporting Iranian Petrochemical
Conglomerate” (Aug. 1, 2022).
16. U.S. Energy Information Agency (EIA), “Country Analysis Executive Summary: Iran” (“Nov. 2022 EIA Country
Analysis”) (Nov. 17, 2022), at p. 2.
17. Id., at p. 5. See also Jan. 2024 CRS Report, supra note 2 at Summary and p. 13. In 2019, Treasury designated actors
involved in a large shipping network that is directed by the IRGC-QF and Hizballah that moved oil worth hundreds
of millions of dollars for the benefit of the Assad regime in Syria, Hizballah, and other illicit actors. In spring 2019
alone, this IRGC-QF-led network employed more than a dozen vessels to transport nearly 10 million barrels of
crude oil, predominantly to the Syrian regime. See Treasury, “Treasury Designates Vast Iranian Petroleum Shipping
Network that Supports IRGC-QF and Terror Proxies” (Sept. 4, 2019).
18. See CRS, “Iran’s Petroleum Exports to China and U.S. Sanctions” (Feb. 28, 2024), at p. 2.
19. See Treasury, “Treasury Targets Vessels Shipping Iranian Commodities for Houthis and Qods Force” (Mar. 15, 2024).
20. See, e.g., Treasury, “Treasury Sanctions Oil Shipping Network Supporting IRGC-QF and Hizballah” (“Nov. 2022
Treasury Press Release”) (Nov. 3, 2022); “Treasury Sanctions Network Financing Houthi Aggression and Instability in
Yemen” (“June 2021 Treasury Press Release”) (June 10, 2021); “Treasury Targets Oil Smuggling Network Generating
Hundreds of Millions of Dollars for Qods Force and Hizballah” (May 25, 2022); and “Treasury Targets Companies
and Vessels Facilitating Qods Force and Houthi Commodity Shipments” (Mar. 6, 2024).
3
F I N C E N A D V I S O R Y
Proceeds from Iran’s sale of weapons and unmanned aerial vehicles (UAVs), including to buyers in
Russia, also benefit the Iranian military, including the IRGC-QF.21 In response, Treasury has also
designated companies that enable Iran’s UAV production.22
Case Study
In February 2024, the U.S. Department of Justice (DOJ) indicted seven defendants, including a
senior IRGC-QF official and officers of a Turkish energy group, on terrorism, sanctions evasion,
fraud, and money laundering charges in connection with their illicit billion-dollar network that
enabled Iran to sell its oil products to government-affiliated buyers in the PRC, Russia, and
Syria and to gain access to foreign currency. The United States seized $108 million that China
Oil & Petroleum Limited, a Hong Kong-based IRGC front company,23 attempted to launder
through correspondent transaction accounts at U.S. financial institutions in furtherance of
the scheme to fund the IRGC-QF’s malign activities through the illicit sale of Iranian oil. In
furtherance of this scheme, the defendants charged in the U.S. District Court for the Southern
District of New York used a myriad of deceptive techniques including: (1) the use of front
companies and intermediaries in countries outside of Iran to disguise the IRGC’s role in the
oil transactions and the Iranian source of the oil; (2) the use of falsified documentation to
misrepresent the source of the oil and deceive unwitting companies and banks to provide
services in furtherance of the scheme; and (3) the use of ship-to-ship transfers and the
manipulation of location and shipping data for vessels to obscure the loading and unloading of
Iranian oil cargoes and therefore avoid identifying vessels used to facilitate oil smuggling.
Likewise, defendants charged in a related U.S. District Court for the District of Columbia
indictment allegedly negotiated the sale of and sold illicit Iranian oil to buyers in the PRC. They
allegedly obtained the oil from Iran using surreptitious means, and the scheme relied on the use
of the U.S. financial system. According to the indictment, the defendants created fraudulent
documents to mask the oil’s Iranian origin, used electronic communications to arrange for
21. The IRGC-QF maintains a division known as Department 8000 tasked with developing UAVs and providing UAVs
and UAV-related training to proxy forces such as the Houthis in Yemen and Iranian-aligned militia groups in Iraq
and Syria. Iranian-manufactured UAVs have been provided to and utilized by Iran-backed militias across the Middle
East, resulting in attacks against U.S. service members, allied forces, maritime vessels in the Red Sea. See Treasury,
“Treasury Targets Iranian UAV Program, Steel Industry, and Automobile Companies in Response to Unprecedented
Attack on Israel” (Apr. 18, 2024). See also Jan. 2024 CRS Report, supra note 2 at Summary, p. 7.
22. See, e.g., Treasury, “Treasury Targets Vessel Shipping Iranian Commodities Valued at over $100 Million for Iran’s
Ministry of Defense” (Feb. 27, 2024); “Treasury Targets Actors Involved in Production and Transfer of Iranian
Unmanned Aerial Vehicles to Russia for Use in Ukraine” (Nov. 15, 2022); “Treasury Sanctions Iranian Persons
Involved in Production of Unmanned Aerial Vehicles and Weapon Shipment to Russia” (Sept. 8, 2022); and “Treasury
Targets Networks Facilitating Illicit Trade and UAV Transfers on Behalf of Iranian Military” (Apr. 25, 2024).
23. Treasury’s Office of Foreign Assets Control (OFAC) sanctioned China Oil & Petroleum Limited on the same day
the DOJ unsealed the indictment for its role arranging contracts, selling hundreds of millions of dollars’ worth of
Iranian commodities for the benefit of the IRGC-QF, and using falsified documents to mask the origin of the Iranian
commodities. See Treasury, “Treasury Sanctions Transnational Procurement Network Supporting Iran’s Ballistic
Missile and UAV Programs” (“Feb. 2, 2024 Treasury Press Release”) (Feb. 2, 2024); DOJ, “Justice Department
Announces Terrorism and Sanctions-Evasion Charges and Seizures Linked to Illicit, Billion-Dollar Global Oil
Trafficking Network That Finances Iran’s Islamic Revolutionary Guard Corps and Its Malign Activities” (“Feb. 2024
DOJ Press Release”) (February 2, 2024).
4
F I N C E N A D V I S O R Y
Chinese buyers, used shell corporations to launder the proceeds through the U.S. financial
system, provided false information to the U.S. companies about the source of funds generated
by the transactions, and used U.S. companies as a “trust” to hold the profits for the IRGC.24
Moving the Money
Iranian government agencies, such as the Central Bank of Iran (CBI) and the IRGC-QF, as well as
state-sponsored organizations such as Hizballah, play a key role in channeling funds to terrorist
proxies using overseas front companies and financial institutions.25 Financial institutions located
outside Iran can—wittingly or unwittingly—become intermediaries for the IRGC-QF’s illicit
transactions.26 IRGC-QF officials have been known to collect funds in various currencies from
CBI-held accounts at financial institutions in neighboring countries and transfer those funds back
to Iran or to terrorist organizations.27 According to BSA analysis, third-country front companies—
often incorporated as “trading companies” or “general trading companies”—and exchange
houses28 act as a global “shadow banking” network that processes illicit commercial transactions
and channels money to terrorist organizations on Iran’s behalf.29 Exchange houses and front
companies rely on banks with correspondent accounts with U.S. financial institutions, especially
to process dollar-denominated transactions. In such cases, Iranian banking customers may omit
24. See Feb. 2024 DOJ Press Release, supra note 23.
25. A front company is a legal entity used to obscure the identity of the owner or the true nature of their business
activities. See Treasury, “Treasury Targets Iran’s Central Bank Governor and an Iraqi Bank Moving Millions for
IRGC-Qods Force” (May 15, 2018); “Treasury Sanctions Iran’s Central Bank and National Development Fund” (“Sept.
2019 Treasury Press Release”) (Sept. 20, 2019); “United States and United Arab Emirates Disrupt Large Scale Currency
Exchange Network Transferring Millions of Dollars to the IRGC-QF” (May 10, 2018); “Terrorist Financing Targeting
Center Jointly Designates Network of Corporations, Banks, and Individuals Supporting IRGC and Hizballah” (“Oct.
2019 Treasury Press Release”) (Oct. 30, 2019); and June 2021 Treasury Press Release, supra note 20. See also Oct. 2018
FinCEN Advisory, supra note 1 at pp. 2-4.
26. On January 29, 2024, FinCEN issued a finding and notice of proposed rulemaking (NPRM) that identified Al-Huda
Bank, an Iraqi bank that serves as a conduit for terrorist financing, as a foreign financial institution of primary
money laundering concern. Along with its finding, FinCEN proposed imposing a special measure that would sever
the bank from the U.S. financial system by prohibiting domestic financial institutions and agencies from opening
or maintaining a correspondent account for or on behalf of Al-Huda Bank. Since its establishment, Al-Huda Bank
has been controlled and operated by the IRGC and the IRGC-QF and has laundered money and afforded access to
the U.S. financial system for the IRGC-QF and Kata’ib Hizballah (KH) and Asa’ib Ahl al-Haq (AAH). See FinCEN,
“FinCEN Finds Iraq-based Al-Huda Bank to be of Primary Money Laundering concern and Proposes a Rule to
Combat Terrorist Financing” (“Jan. 2024 FinCEN Press Release”) (Jan. 29, 2024). OFAC also designated Hamad al-
Moussawi, the owner and president of the board of directors of Iraq’s Al-Huda Bank, for his support to the IRGC-QF,
including through support for its proxy militia groups in Iraq. See Treasury, “U.S. Treasury Takes Action to Protect
Iraqi Financial System from Abuse” (Jan. 29, 2024).
27. See Sep. 2019 Treasury Press Release, supra note 25.
28. An exchange house is an entity specializing in the purchase and sale of foreign currency which derives its profits
from differences in exchange rates and currency sales. For more information about Iran’s use of exchange houses, see
OFAC, “Advisory on the Use of Exchange Houses and Trading Companies to Evade U.S. Economic Sanctions Against
Iran” (Jan. 10, 2013).
29. A shadow bank is a non-bank financial service provider that performs functions like a bank outside of regulatory
oversight. On March 9, 2023, OFAC sanctioned 39 entities constituting a significant “shadow banking” network, one
of several multi-jurisdictional illicit finance systems which grant sanctioned Iranian entities access to the international
financial system and obfuscate their trade with foreign customers. See Treasury, “Treasury Targets Sanctions Evasion
Network Moving Billions for Iranian Regime” (Mar. 9, 2023). See also Treasury, “Treasury Designates Vast Network
of IRGC-QF Officials and Front Companies in Iraq, Iran” (“Mar. 2020 Treasury Press Release”) (Mar. 26, 2020).
5
F I N C E N A D V I S O R Y
or falsify identifying details connecting themselves or the transfers to Iran or attempt to pass the
transactions off as remittances.30
In addition, Iran uses cultural and religious foundations as front organizations for funneling
money to terrorist organizations under the guise of cultural or religious support. In 2020, Treasury
sanctioned the Reconstruction Organization for the Holy Shrines in Iraq (ROHSI).31 Ostensibly a
religious institution devoted to restoring and preserving Shiite shrines in Iraq, ROHSI is in reality
an IRGC-QF front organization that channels funds to terrorist organizations.32
Typologies Associated with Iran-Backed Terrorist Organizations
In addition to receiving support from Iran, terrorist organizations and Iran-aligned militia groups
in Iraq and Syria employ a range of other mechanisms to raise revenue, including sham or
fraudulent charities, engaging in illicit trade activities like arms and drug trafficking, taxing and
extorting local populations, and crowdfunding.
Hamas33
Hamas is a Sunni terrorist organization based predominantly in the Gaza Strip whose goal is the
destruction of Israel and its replacement with an Islamic Palestinian state.34 Hamas has exercised
de facto control over Gaza since 2007, which enabled the group to derive revenue from taxes and
fees it imposed on the local population. Until October 2023, Hamas levied taxes on commodities,
imports, and businesses operating in Gaza, and charged fees for licenses, birth certificates, customs
duties, and vehicles.35 This source of revenue has effectively disappeared since the October 7, 2023,
attacks on Israel and ongoing armed conflict in Gaza, leaving Hamas largely dependent on support
from Iran, crowdfunding contributions, and whatever revenue the group can generate from its
investment portfolio.36
Hamas and its armed element, the Al-Qassam Brigades, have received support from Iran since the
1990s37 through networks of corporations, banks, and individuals located in multiple countries,
including the People’s Democratic Republic of Algeria (Algeria), the Republic of Lebanon
(Lebanon), the Kingdom of Saudi Arabia (Saudi Arabia), the Republic of Sudan (Sudan), the
Republic of Türkiye (Türkiye), and the United Arab Emirates (UAE), that help transfer money
30. See Oct. 2018 FinCEN Advisory, supra note 1 at p. 4.
31. See Mar. 2020 Treasury Press Release, supra note 29.
32. Id.
33. FinCEN published an alert in October 2023 to help financial institutions identify and report suspicious activity
connected to Hamas. See FinCEN, “FinCEN Alert to Financial Institutions to Counter Financing to Hamas and its
Terrorist Activities” (“Oct. 2023 FinCEN Alert”) (Oct. 20, 2023).
34. See Feb. 2024 Terrorism Risk Assessment, supra note 9 at p. 14.
35. U.S. Senate Committee on Banking, Housing, and Urban Affairs, Testimony by Dr. Matthew Levitt, “Combating the
Networks of Illicit Finance and Terrorism” (“Oct. 2023 Levitt Testimony”) (Oct. 26, 2023), at p.3.
36. Prior to the imposition of U.S. sanctions in May 2022, this portfolio was worth an estimated $500 million and included
companies operating in Algeria, Saudi Arabia, Sudan, Türkiye, and the UAE. See Treasury, “Treasury Targets Covert
Hamas Investment Network and Finance Official” (“May 2022 Treasury Press Release”) (May 24, 2022).
37. CRS Report, “Israel and Hamas October 2023 Conflict: Frequently Asked Questions (FAQs)” (Oct. 20, 2023), at pp. 12-13.
6
F I N C E N A D V I S O R Y
directly to Hamas.38 Iran has provided as much as $100 million per year to Hamas since 2018.39
To disrupt these sources of support, Treasury has sanctioned numerous financial intermediaries
between Iran and Hamas, including money transfer companies, financiers and financial facilitators
who manage Hamas’s assets and facilitate money transfers for the organization, and political
liaisons to the Government of Iran.40
Hamas also has a history of using “sham” charities: usually foreign non-profit organizations
(NPOs) that claim to provide humanitarian assistance but instead primarily or exclusively funnel
money to terrorist organizations, exploiting the trust and credibility associated with charitable
giving.41 In addition, Hamas and other terrorist groups have exploited crowdfunding and social
media platforms to raise funds under the guise of humanitarian or charitable causes worldwide.42
According to analysis of BSA data, these donations are often placed in bank accounts in third
countries, including Lebanon, the State of Qatar (Qatar), and Türkiye, which are then accessed by
individuals operating in the Gaza Strip.
Additionally, Hamas has used convertible virtual currency (CVC) for fundraising, leveraging
money exchangers that have incorporated CVC into their operations to facilitate cross-border
transfers, probably seeking to benefit from the perceived anonymity afforded by certain CVC
transactions and the lax regulatory oversight of virtual asset service providers (VASPs) in some
high-risk jurisdictions.43 Hamas has sought CVC contributions in donation drives since at least
38. See May 2022 Treasury Press Release, supra note 36.
39. See Feb. 2024 Terrorism Risk Assessment, supra note 9 at p. 14. See also Treasury, “Treasury Targets Network Moving
Millions to HAMAS in Gaza”(Aug. 29, 2019). Despite this consistent support, Office of the Director of National
Intelligence (ODNI) assessed that Iran did not have foreknowledge of Hamas’s October 7, 2023, attacks on Israel. See
ODNI, “Annual Threat Assessment of the U.S. Intelligence Community” (Feb. 5, 2024), at p. 24.
40. See Treasury, “Following Terrorist Attack on Israel, Treasury Sanctions Hamas Operatives and Financial Facilitators”
(Oct. 18, 2023). To date, Treasury has targeted nearly 1,000 individuals and entities connected to terrorism and terrorist
financing by the Government of Iran and its proxies, including Hamas, Hizballah, and other Iran-aligned terrorist
groups in the region. See Department of State, Press Statement by Antony Blinken, U.S. Secretary of State, “Designating
Hamas Operatives and Financial Facilitators - United States Department of State” (Oct. 18, 2023). See also Treasury,
“Treasury Targets Additional Sources of Support and Financing to Hamas” (“Oct. 2023 Treasury Press Release”)
(Oct. 27, 2023).
41. See Feb. 2024 Terrorism Risk Assessment, supra note 9 at p. 24. Treasury remains committed to denying Hamas
access to funds following its heinous terrorist attacks against the people of Israel, while also ensuring legitimate
humanitarian aid can continue to flow to the Palestinian people in Gaza. To that end, and consistent with
longstanding policy to issue general licenses to authorize transactions in support of humanitarian relief efforts, OFAC
authorizes limited transactions with blocked persons to the extent such dealings are ordinarily incident and necessary
to certain humanitarian activity. See OFAC, “Guidance for the Provision of Humanitarian Assistance to the People of
Gaza” (“Nov. 2023 OFAC Compliance Communique”) (Nov. 14, 2023).
42. For example, shortly after the October 7, 2023, attacks, the pro-Hamas news outlet Gaza Now began disseminating
fundraising information on social media. Cloaked in the language of humanitarian aid, these fundraisers mislead
donors as to the end use of their contributions, which were ultimately funneled to Hamas. These campaigns solicited
donations in dollars, euros, and cryptocurrency and touched the U.S. and European banking systems. Other recent
crowdfunding campaigns intended to support Hamas include those set up by the U.K.-based Al-Qureshi Executives,
the U.K.- and Türkiye-based Al Khair Foundation, and Kudus Vakfi, an NGO based in Türkiye and run by senior
leadership of the U.S.-sanctioned Al Aqsa Foundation. See Oct. 2023 Levitt Testimony, supra note 35 at p. 8.
43. According to FinCEN analysis of BSA information, between January 2020 and October 2023, financial institutions
reported approximately $165 million in suspicious activity filings related to Hamas and CVC involving over 200
unique CVC addresses. Given that filing institutions frequently attribute the full value of a customer’s transactions—
including both fiat and CVC activity—to Hamas, even when only a portion of the reported activity may be related,
the reported value is likely an overestimate.
7
F I N C E N A D V I S O R Y
2019,44 and has historically leveraged VASPs in an attempt to safeguard the anonymity of their
donors.45 There is evidence, however, that Hamas has reacted to law enforcement action targeting
its use of CVC. For instance, in April 2023, the al-Qassam Brigades announced that they would no
longer accept Bitcoin donations, warning that donors could be targeted.46
Houthis
The Houthis, or Ansarallah, are an Iran-backed Zaidi Islamist47 movement that arose in Northern
Yemen in 2004. In 2014, the Houthis launched a military campaign to overthrow the internationally
recognized Yemeni government, initiating a bloody civil war. Today, the Houthis control a large
portion of northern Yemen, including the former capital, Sana’a.48
Following the Hamas attacks on Israel on October 7, 2023, the Houthis began attacking commercial
and naval vessels transiting the Red Sea and Gulf of Aden. Since October 17, 2023, the Houthis have
carried out more than 50 attacks on commercial vessels, forcing companies to divert their shipments
to the much costlier route around Africa’s Cape of Good Hope.49 In response, the U.S. Department of
State redesignated the Houthis as a Specially Designated Global Terrorist (SDGT), effective February
16, 2024.50 The United States has also responded by launching Operation Prosperity Guardian, a
naval coalition of more than 20 countries to protect commercial vessels;51 by leading a coalition that
has conducted a series of strikes against Houthi targets in Yemen;52 and by imposing sanctions against
the exchange houses and smuggling network through which Iran funds the Houthis.53
44. In August 2020, the DOJ, Federal Bureau of Investigation (FBI), Treasury, and Internal Revenue Service-Criminal
Investigations (IRS-CI) collaborated to dismantle three Bitcoin funding campaigns benefiting terrorist organizations,
including one initiated by Hamas’ al-Qassam Brigades. The fundraiser was advertised using social media and the al-
Qassam website and falsely claimed that Bitcoin contributions were untraceable. U.S. authorities seized the website
infrastructure and all 150 Bitcoin wallets that had helped launder the funds and charged two foreign nationals with
money laundering in connection with the campaign. See CRS, “Terrorist Financing: Hamas and Cryptocurrency
Fundraising” (“Nov. 2023 CRS In Focus”) (Nov. 27, 2023), at p. 1; see also, DOJ, “Global Disruption of Three Terror
Finance Cyber-Enabled Campaigns” (Aug. 13, 2020).
45. In November 2023, FinCEN and OFAC entered a $3.4 billion settlement with VASP Binance, in part due to its failure
to identify and report suspicious transactions involving terrorist organizations including PIJ and Hamas’ al-Qassam
Brigades. See Treasury, “U.S. Treasury Announces Largest Settlements in History with World’s Largest Virtual
Currency Exchange Binance for Violations of U.S. Anti-Money Laundering and Sanctions Laws” (Nov. 21, 2023).
46. See Nov. 2023 CRS In Focus, supra note 44 at p. 1.
47. Zaydism is a distinct form of Shi’a Islam practiced by 35% of the Yemeni population. Its similarity to Shi’a Islam is a
large reason for Iran’s support of the Ansarallah movement, despite its distinction from the Islam dominant in Iran.
See Department of State, “2020 Report on International Religious Freedom: Yemen” (May 12, 2021).
48. CRS, “Houthi Attacks in the Red Sea: Issues for Congress” (“Jan. 2024 CRS Insight”) (Jan. 31, 2024), at p.2.
49. Id.
50. See Jan. 2024 Houthi Designation, supra note 6. In conjunction with this designation, Treasury issued six general
licenses to ensure humanitarian assistance to the Yemeni people. See OFAC, “Guidance for the Provision of
Humanitarian-Related Assistance and Critical Commodities to the Yemeni People” (Feb. 16, 2024). The Houthis
were briefly designated by the U. S. Department of State as an SDGT in 2021, however the designation was revoked
in recognition of the dire humanitarian situation in Yemen. See Department of State, “Terrorist Designation of
Ansarallah in Yemen” (Jan. 10, 2021). See also Department of State, “Revocation of the Terrorist Designations of
Ansarallah” (Feb. 12, 2021).
51. See Jan. 2024 CRS Insight, supra note 48 at p. 3.
52. Department of Defense, “U.S., U.K. Launch Strikes Against Houthi Targets in Yemen to Protect Red Sea Shipping”
(Feb. 4, 2024).
53. Treasury, “Treasury Targets Network Financing Houthi Attacks on International Shipping” (Dec. 28, 2023).
8
F I N C E N A D V I S O R Y
Much of the Houthis’ funding is raised and transferred by means of an elaborate smuggling
network connected to Iran-based IRGC-QF-backed Houthi financial facilitator Said Al-Jamal.
The network generates tens of millions of dollars in revenue annually through the sale of
Iranian commodities like petroleum to customers in Asia, the Middle East, and Africa. Those
funds are then funneled to the Houthis in Yemen through a complex network of exchanges and
intermediaries spread across multiple countries. Al-Jamal also maintains connections to Hizballah
and has worked with the group to send millions of dollars to benefit the Houthis.54 The Houthis
also raise funds by collecting customs revenue from the Hudaydah and Salif ports in Yemen,
appropriating public funds using fraudulent contracts, and unlawfully appropriating assets
belonging to political opponents or those who have fled the country.55
Hizballah
Formed in the wake of Israel’s invasion of Lebanon in 1982, Hizballah is a strategic partner through
which Iran projects power throughout the Middle East. While primarily based in Lebanon,
Hizballah’s activities extend to Syria, Iraq, and Yemen.56 Iran has provided hundreds of millions
of dollars in support to Hizballah and has trained thousands of its fighters at camps in Iran.
Hizballah in turn has trained and equipped other Iran-aligned militias in the region and acts as a
conduit for funds from Iran’s IRGC-QF to other Iran-aligned groups.57
Estimates indicate that Iran has historically provided Hizballah with approximately $700 million
of Hizballah’s estimated $1 billion annual budget.58 While Iran has supported Hizballah and
others through a vast network of front companies, banks, and individuals,59 Hizballah also finances
itself through a broad range of illicit activities, including oil smuggling,60 money laundering, drug
trafficking,61 counterfeiting, and illegal weapons procurement.62 These activities are global in scale,
54. See June 2021 Treasury, supra note 20.
55. United Nations Security Council, “Final report of the Panel of Experts on Yemen” (Jan. 27, 2020), at pp. 28-32.
56. CRS, “Lebanese Hezbollah” (“Jan. 2023 CRS Report”) (Jan. 11, 2023), at pp. 1-2.
57. Id., at p. 2.
58. Treasury, “Treasury and State Announce New Humanitarian Mechanism to Increase Transparency of Permissible
Trade Supporting the Iranian People” (Oct. 25, 2019).
59. See Oct. 2019 Treasury, supra note 25. See also Treasury, “Treasury Labels Bank Providing Financial Services to
Hizballah as Specially Designated Global Terrorist” (Aug. 29, 2019).
60. In 2022, Treasury sanctioned a Hizballah and IRGC-QF oil smuggling network that blended Iranian oil with Indian
oil and used modified or counterfeit certificates to obfuscate its origins. See Nov. 2022 Treasury Press Release, supra
note 20. Furthermore, in 2019, OFAC issued an advisory alerting to sanctions risk of vessels carrying petroleum
from Iran have been known to intentionally disable their AIS transponders or modify transponder data to mask their
movements and have engaged in ship-to-ship transfers to conceal the origin or destination of their cargo. See OFAC,
“OFAC Advisory to the Maritime Petroleum Shipping Community” (Sept. 4, 2019).
61. Hizballah’s External Security Organization Business Affairs Component (BAC) has established partnerships with
South American drug trafficking organizations and is responsible for the movement of large quantities of cocaine
into U.S. and European markets. A Drug Enforcement Administration (DEA) investigation in 2015 uncovered a
large network of Hizballah-affiliated money curriers that transported drug proceeds from Europe to the Middle East
that were then disbursed to Colombian drug traffickers through the hawala system. Much of this money transited
through Lebanon and a significant portion benefited Hizballah. See DEA, “DEA And European Authorities Uncover
Massive Hizballah Drug And Money Laundering Scheme” (Feb. 1, 2016).
62. Treasury, “2022 National Terrorist Financing Risk Assessment” (“Feb. 2022 Terrorism Risk Assessment”) (Feb. 2022),
at p. 10.
9
F I N C E N A D V I S O R Y
encompassing the western hemisphere, Europe, Africa, and the Middle East, and often have a
nexus to transnational organized criminal groups, drug trafficking organizations, and professional
money laundering organizations.63
Hizballah also utilizes networks of front companies and legitimate businesses,64 as well as
cryptocurrencies,65 to raise, launder, and transfer funds.66 Hizballah financiers make use of free
trade zones and countries with weak regulatory frameworks to establish import-export companies
that facilitate trade-based money laundering schemes. These companies are often held in the
name of a relative of the financier, for example a spouse. Hizballah operatives have been known to
operate in the Tri-border area of Argentina, Brazil, and Paraguay, and in free trade zones in Chile
and Panama, with members and supporters identified in Colombia and Peru as well.67 Hizballah’s
illicit activities also extend to Africa. In 2019, Treasury designated Nazem Said Ahmad, who had
used his Africa-based diamond business to launder money on behalf of Hizballah,68 along with
Saleh Assi, who used his Congo-based businesses to launder and raise funds for Hizballah.69
Palestinian Islamic Jihad
PIJ is a Sunni Islamist terrorist organization operating in Gaza and the West Bank. It is the second-
largest armed group in Gaza and receives support from Iran, Syria, and Hizballah. PIJ and Hamas share
many similarities: both are violent offshoots of the Muslim Brotherhood; both seek to create an Islamic
Palestinian state through the destruction of Israel; and both receive significant funding and support
from Iran.70 Like Hamas and Hizballah, PIJ’s operatives have been trained by Iran to use Iranian-made
missiles for long-range rocket attacks against Israeli cities and to carry out suicide bombings.71
63. See Feb. 2024 Terrorism Risk Assessment, supra note 9 at pp. 12-13.
64. Id.
65. In March 2024, Treasury sanctioned Lebanon-based Syrian money exchanger Tawfiq Muhammad Sa’id al-Law
for providing Hizballah with digital wallets to receive funds from IRGC-QF commodity sales and for conducting
cryptocurrency transfers on behalf of the sanctioned Syrian Qatirji Company, sanctioned Hizballah officials, and Sa’id
al-Jamal and his network. See Mar. 2024 Treasury Press Release, supra note 8.
66. See Feb. 2024 Terrorism Risk Assessment, supra note 9 at p. 12.
67. Department of State, “Country Reports on Terrorism 2021” (“2021 State Country Reports”) (2021), at p. 191. See also
Treasury, “Treasury Designates Hizballah Operatives and Financial Facilitators in South America and Lebanon”
(Sept. 12, 2023).
68. A nine-count indictment was unsealed on April 18, 2023, in the United States District Court for the Eastern District
of New York charging Ahmad and eight co-defendants with conspiring to defraud the United States and foreign
governments, evade U.S. sanctions and customs laws, and conduct money laundering transactions by securing goods
and services for the benefit of Ahmad. Despite being sanctioned since December 2019, Ahmad and his coconspirators
relied on a complex web of business entities to obtain valuable artwork from U.S. artists and art galleries and to
secure U.S.-based diamond-grading services all while hiding Ahmad’s involvement in and benefit from these
activities. Approximately $160 million worth of artwork and diamond-grading services were transacted through the
U.S. financial system. See DOJ, “OFAC-Designated Hizballah Financier and Eight Associates Charged with Multiple
Crimes Arising Out of Scheme to Evade Terrorism-Related Sanctions” (Apr. 18, 2023).
69. See Feb. 2022 Terrorism Risk Assessment, supra note 62 at p. 11.
70. Treasury designated three PIJ members, two of whom serve as liaisons to Iran, along with a foundation used to
provide financial support to the families of PIJ fighters and prisoners in November 2023. See Treasury, “United States
and United Kingdom Take Coordinated Action Against Hamas Leaders and Financiers” (“Nov. 2023 Treasury Press
Release”) (Nov. 14, 2023). See also Feb. 2023 Counter Terrorism Guide, supra note 5.
71. See 2021 State Country Reports, supra note 67 at pp. 139, 302-303.
10
F I N C E N A D V I S O R Y
PIJ relies on many of the same funding channels as Hamas. It receives much of its support from the
IRGC and IRGC-QF, which distribute those funds through PIJ intermediaries or through Islamic
National Bank of Gaza, which was designated by Treasury in 2010 for being controlled by Hamas.72
Also like Hamas, PIJ makes use of sham charities to move and launder funds. In 2023, Treasury
sanctioned the Al-Ansar Charity Foundation and the Muhjat al-Quds Foundation, through which
Iran provided financial support to PIJ fighters and their families.73
Iran-aligned Militia Groups in Iraq and Syria
Some of the most prominent Iran-aligned militia groups in Iraq are Kata’ib Hizballah (KH),74
Kata’ib Sayyid al Shuhada (KSS),75 Asa’ib Ahl al-Haq (AAH),76 and Harakat al-Nujaba (HaN).77
These groups have received support, training, weapons, and intelligence from the IRGC-QF and
Hizballah. These groups have also abused the Iraqi financial system to generate revenue and
launder money, including through the use of front companies, fraudulent documentation, identity
theft, currency arbitrage, and counterfeit currency.78 Although some members of Iran-aligned
militia groups operate within Iraq’s official Popular Mobilization Forces (PMF), these groups
frequently operate outside government control and conduct destabilizing attacks in Iraq and
neighboring Syria79 as well as attacks against coalition forces seeking to defeat the Islamic State of
Iraq and Syria (ISIS).80
72. See Oct. 2023 Treasury Press Release, supra note 40. See also Treasury, “Treasury Designated Gaza-Based Business,
Television Station for Hamas Ties” (Mar. 18, 2010).
73. See Oct. 2023 Treasury Press Release, supra note 40. See also Nov. 2023 Treasury Press Release, supra note 70.
74. While unconfirmed, the U.S. Department of Defense has speculated that the UAV attack in Jordan on January 28,
2024, that killed three U.S. servicemen and injured 40 more was the work of Kita’ib Hizballah. See Department of
Defense, “3 U.S. Service Members Killed, Others Injured in Jordan Following Drone Attack” (Jan. 29, 2024). KH was
designated as an FTO on July 2, 2009, by the Secretary of State in accordance with section 219 of the INA, as amended,
and as a SDGT pursuant to EO 13224 on July 2, 2009. For more information about KH, see DNI NCTC, “Counter
Terrorism Guide: Kita’ib Hizballah (KH)” (Sept. 2022).
75. KSS was designated by Treasury as a SDGT pursuant to EO 13224 on November 17, 2023. See Treasury, “Treasury
Sanctions Iran-Aligned Militias in Iraq” (Nov. 17, 2023).
76. Asa’ib al-Haq (AAH) was designated as an FTO on January 10, 2020 by the Secretary of State in accordance with
section 219 of the INA, as amended, and as a SDGT pursuant EO 13224 on January 3, 2020. For more information
about AAH, see DNI NCTC, “Counter Terrorism Guide: Asa’ib alh-Haqq (AAH)” (Sept. 2022).
77. HaN was designated as a SDGT pursuant to EO 13224 on March 5, 2019. See Treasury, “Counter Terrorism
Designation and Designation Update” (Mar. 5, 2019).
78. See Jan. 2024 FinCEN Press Release, supra note 26. See also Treasury, “Treasury Targets Kata’ib Hizballah Leaders and
Airline Enabling IRGC-QF and Militant Proxy Groups” (Jan. 22, 2024).
79. Department of State, “Country Reports on Terrorism 2022: Iraq” (2022).
80. ISIS’s predecessor, Al-Qaeda in Iraq (AQI), was designated as an FTO in December 2004 in accordance with section
219 of the INA, as amended, and this designation remains in effect for ISIS. For more information about ISIS, see DNI
NCTC, “Counter Terrorism Guide: Islamic State of Iraq and Ash-Sham (ISIS)” (Sept. 2022). As of late January 2024,
Iran-backed groups have reportedly attacked U.S. forces in Iraq and Syria 140 times since October 17, 2023 (52 times in
Iraq, 75 in Syria); media sources affiliated with the “Islamic Resistance in Iraq,” a catch-all descriptor for Iran-backed
Iraqi militia groups operating in Iraq and Syria, have claimed many of these actual or attempted assaults. These
attacks have mostly used one-way attack drones and rockets, but also include at least one short-range ballistic missile
attack. Those attacks have left “nearly 70” U.S. personnel injured, with most returning to duty “in short order,” per
the Pentagon. See Jan. 2024 CRS Report, supra note 2 at p. 6.
11
F I N C E N A D V I S O R Y
Red Flag Indicators Related to the Fundraising and Money
Laundering Activities of Iran-Backed Terrorist Organizations
FinCEN has identified the red flags listed below to assist financial institutions in detecting,
preventing, and reporting suspicious activity connected to the financing of Iran-backed
terrorist organizations. These red flags are in addition to the red flags identified in FinCEN’s
2018 Iran advisory81 and 2023 Hamas alert,82 all of which remain relevant. As no single red
flag is determinative of illicit or suspicious activity, financial institutions should consider the
surrounding facts and circumstances, such as a customer’s historical financial activity, whether
the transactions are in line with prevailing business practices, and whether the customer exhibits
multiple red flags, before determining if a behavior or transaction is indicative of terrorist finance
or is otherwise suspicious.
A customer or a customer’s counterparty conducts transactions with Office of Foreign Assets
Control (OFAC)-designated entities and individuals, or transactions that contain a nexus to
identifiers listed for OFAC-designated entities and individuals, to include email addresses,
physical addresses, phone numbers, passport numbers, or CVC addresses.
Information included in a transaction between customers or in a note accompanying a
peer-to-peer transfer include key terms known to be associated with terrorism or terrorist
organizations.
A customer conducts transactions with a money services business (MSB) or other financial
institution, including a VASP, that operates in jurisdictions known for, or at high risk for,
terrorist activity and is reasonably believed to have lax customer identification and verification
processes, opaque ownership, or otherwise fails to comply with AML/CFT best practices.83
A customer conducts transactions that originate with, are directed to, or otherwise involve
entities that are front companies, general “trading companies” with unclear business
purposes, or other companies whose beneficial ownership information indicates that they may
have a nexus with Iran or other Iran-supported terrorist groups. Indicators of possible front
companies include opaque ownership structures, individuals and/or entities with obscure
names that direct the company, or business addresses that are residential or co-located with
other companies.
81. See Oct. 2018 FinCEN Advisory, supra note 1.
82. See Oct. 2023 FinCEN Alert, supra note 33.
83. As of February 2024, the Financial Action Task Force (FATF) has placed 21 jurisdictions on its Jurisdictions under
Increased Monitoring or “Grey List” due to deficiencies in their anti-money laundering, terrorist financing, and
proliferation financing regimes. See FATF, “Jurisdictions under Increased Monitoring—23 February 2024”
(Feb. 23, 2024). In addition, the FATF defines Iran, the Democratic Republic of Korea, and Myanmar as “high-
risk jurisdictions” due to significant strategic deficiencies in their anti-money laundering, terrorist financing, and
proliferation financing regimes. See FATF, “High-Risk Jurisdictions subject to a Call to Action—February 2023”
(Feb. 23, 2024).
12
F I N C E N A D V I S O R Y
A customer that is or purports to be a charitable organization or NPO84 solicits donations
but does not appear to provide any charitable services or openly supports terrorist activity
or operations. In some cases, these organizations may post on social media platforms or
encrypted messaging apps to solicit donations, including in CVC.
A customer receives numerous small CVC payments from many wallets, then transfers the
funds to another wallet, particularly if the customer logs in using an Internet Protocol (IP)
based in a jurisdiction known for, or at high risk for, terrorist activity. In such cases, financial
institutions may also be able to provide associated technical details such as IP addresses with
time stamps and device identifiers that can provide helpful information to authorities.
A customer makes money transfers to a jurisdiction known for, or at high risk for, terrorist
activity that are inconsistent with their stated occupation or business purpose with vague
stated purposes such as “travel expenses,” “charity,” “aid,” or “gifts.
A customer account receives large payouts from social media fundraisers or crowdfunding
platforms and is then accessed from an IP address in a jurisdiction known for, or at high
risk for, terrorist activity, particularly if the social media accounts that contribute to the
fundraisers contain content supportive of terrorist campaigns.
A customer company is incorporated in the United States or a third-country jurisdiction, but
its activities occur solely in jurisdictions known for, or at high risk for, terrorist activity and
show no relationship to the company’s stated business purpose.
84. FinCEN continues to emphasize that legitimate charities should have access to financial services and can transmit
funds through legitimate and transparent channels. As set out in the Joint Fact Sheet on BSA Due Diligence
Requirements for Charities and Non-Profit Organizations, banks are reminded to apply a risk-based approach to
CDD requirements when developing the risk profiles of charities and other non-profit customers. The application of
a risk-based approach is consistent with existing CDD and other Bank Secrecy Act/ AML compliance requirements.
FinCEN, Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, National Credit
Union Administration, and Office of the Comptroller of the Currency, “Joint Fact Sheet on Bank Secrecy Act Due
Diligence Requirements for Charities and Non-Profit Organizations” (Nov. 19, 2020).
13
F I N C E N A D V I S O R Y
Reminder of Relevant BSA Obligations and Tools
for U.S. Financial Institutions
Suspicious Activity Reporting
Other Relevant BSA Reporting
USA PATRIOT ACT Section 314(b) Information Sharing Authority
Suspicious Activity Reporting
A financial institution is required to file a suspicious activity report (SAR) if it knows, suspects,
or has reason to suspect a transaction conducted or attempted by, at, or through the financial
institution involves funds derived from illegal activity; is intended or conducted to disguise funds
derived from illegal activity; is designed to evade regulations promulgated under the BSA; lacks
a business or apparent lawful purpose; or involves the use of the financial institution to facilitate
criminal activity.85 All statutorily defined financial institutions may voluntarily report suspicious
transactions under the existing suspicious activity reporting safe harbor.86
Financial institutions are required to file complete and accurate reports that incorporate all relevant
information available. In situations involving violations requiring immediate attention, such
as ongoing money laundering schemes, financial institution must also immediately notify, by
telephone, an appropriate law enforcement authority and its regulator, in addition to filing a timely
SAR.87 Valuable cyber indicators for terrorist finance-related law enforcement investigations can
include relevant email addresses, IP addresses with their respective timestamps, login information
with location and timestamps, virtual currency addresses, mobile device information (such as
device International Mobile Equipment Identity (IMEI) numbers), and descriptions and timing of
suspicious electronic communications.
When a financial institution files a SAR, it is required to maintain a copy of the SAR and the original
or business record equivalent of any supporting documentation for a period of five years from
the date of filing the SAR.88 Financial institutions must provide any requested documentation
supporting the filing of a SAR upon request by FinCEN or an appropriate law enforcement or
supervisory agency.89 When requested to provide supporting documentation, financial institutions
should take special care to verify that a requestor of information is, in fact, a representative of
FinCEN or an appropriate law enforcement or supervisory agency. A financial institution should
incorporate procedures for such verification into its BSA compliance or AML program. These
procedures may include, for example, independent employment verification with the requestor’s
field office or face-to-face review of the requestor’s credentials.
85. See 31 CFR §§ 1020.320, 1021.320, 1022.320, 1023.320, 1024.320, 1025.320, 1026.320, 1029.320, 1030.320.
86. See 31 U.S.C. § 5318(g)(3).
87. See, e.g., 31 CFR § 1020.320(b)(3) (Bank SAR rule). The other FinCEN SAR rules contain comparable provisions. See id.
88. See 31 CFR §§ 1020.320(d), 1021.320(d), 1022.320(c), 1023.320(d), 1024.320(c), 1025.320(d), 1026.320(d), 1029.320(c),
1030.320(c).
89. Id; see also FinCEN, “Suspicious Activity Report Supporting Documentation” (June 13, 2007).
14
F I N C E N A D V I S O R Y
SAR Filing Instructions
FinCEN requests that financial institutions indicate any connection between the suspicious activity
being reported and the activities highlighted in this advisory by including the key term “IRANTF-
2024-A001” in SAR field 2 (“Filing Institution Note to FinCEN”), as well as in the narrative.
Financial institutions should select SAR Field 33(a) (Terrorist Financing-Known or suspected
terrorist/terrorist organization) as the associated suspicious activity type. Financial institutions may
highlight additional advisory or alert keywords in the narrative, if applicable.
Financial institutions should include all available information relating to the account(s) and
location(s) involved in the reported activity, identifying information and descriptions of any legal
entities or arrangements involved and associated beneficial owners, and any information about
related persons or entities involved in the activity. Financial institutions also should provide all
available information regarding other domestic and foreign financial institutions involved in the
activity; where appropriate, financial institutions should consider filing a SAR jointly on shared
suspicious activity.90
Financial institutions wanting to expedite their report of suspicious transactions that may relate
to the activity noted in this alert should call the Financial Institutions Toll-Free Hotline at
(866) 556-3974 (7 days a week, 24 hours a day).91
Other Relevant BSA Reporting Requirements
Financial institutions and other entities or persons also may have other relevant BSA reporting
obligations to provide information in connection with the subject of this advisory. These include
obligations related to the CTR,92 Report of Cash Payments Over $10,000 Received in a Trade
or Business (Form 8300),93 Report of Foreign Bank and Financial Accounts (FBAR),94 Report of
International Transportation of Currency or Monetary Instruments (CMIR),95 Registration of Money
Services Business (RMSB),96 and Designation of Exempt Person (DOEP).97 These standard reporting
90. See 31 CFR §§ 1020.320(e)(1)(ii)(A)(2)(i), 1021.320(e)(1)(ii)(A)(2), 1022.320(d)(1)(ii)(A)(2), 1023.320(e)(1)(ii)(A)(2)(i),
1024.320(d)(1)(ii)(A)(2), 1025.320(e)(1)(ii)(A)(2), 1026.320(e)(1)(ii)(A)(2)(i), 1029.320(d)(1)(ii)(A)(2), 1030.320(d)(1)(ii)(A)(2).
91. The purpose of the hotline is to expedite the delivery of this information to law enforcement. Financial institutions
should immediately report any imminent threat to local-area law enforcement officials.
92. A report of each deposit, withdrawal, exchange of currency, or other payment or transfer, by, through, or to a
financial institution that involves a transaction in currency of more than $10,000. Multiple transactions may be
aggregated when determining whether the reporting threshold has been met. See 31 CFR §§ 1010.310-313, 1020.310-
313, 1021.310-313, 1022.310-313, 1023.310-313, 1024.310-313, 1026.310-313.
93. A report filed by a non-financial trade or business that receives currency in excess of $10,000 in one transaction or two
or more related transactions. The transactions are required to be reported on a joint FinCEN/Internal Revenue Service
form when not otherwise required to be reported on a CTR. See 31 CFR §§ 1010.330, 1010.331. A Form 8300 also may
be filed voluntarily for any suspicious transaction, even if the total amount does not exceed $10,000.
94. A report filed by a U.S. person that has a financial interest in, or signature or other authority over, foreign financial
accounts with an aggregate value exceeding $10,000 at any time during the calendar year. See 31 CFR § 1010.350;
FinCEN Form 114.
95. A form filed to report the transportation of more than $10,000 in currency or other monetary instruments into or out
of the United States. See 31 CFR § 1010.340.
96. A form filed to register an MSB with FinCEN, or to renew such a registration. See 31 CFR § 1022.380.
97. A report filed by banks to exempt certain customers from currency transaction reporting requirements. See 31 CFR §
1020.315.
15
F I N C E N A D V I S O R Y
requirements may not have an obvious connection to illicit finance, but may ultimately prove highly
useful to law enforcement.
Form 8300 Filing Instructions
When filing a Form 8300 involving a suspicious transaction relevant to this advisory, FinCEN
requests that the filer select Box 1b (“suspicious transaction”) and include the key term
“IRANTF-2024-A001”in the “Comments” section of the report.
Due Diligence
Banks, brokers or dealers in securities, mutual funds, and futures commission merchants and
introducing brokers in commodities (FCM/IBs) are required to have appropriate risk-based
procedures for conducting ongoing customer due diligence that include, but are not limited
to: (i) understanding the nature and purpose of customer relationships for the purpose
of developing a customer risk profile; and (ii) conducting ongoing monitoring to identify
and report suspicious transactions and, on a risk basis, to maintain and update customer
information.98 Covered financial institutions are required to identify and verify the identity
of beneficial owners of legal entity customers, subject to certain exclusions and exemptions.99
Among other things, this facilitates the identification of legal entities that may be owned or
controlled by foreign politically exposed persons (PEPs).
Senior foreign political figures and due diligence obligations for private
banking accounts
In addition to these due diligence obligations, under section 312 of the USA PATRIOT
Act (31 U.S.C. § 5318(i)) and its implementing regulations, covered financial institutions
must implement due diligence programs for private banking accounts held for non-U.S.
persons that are designed to detect and report any known or suspected money laundering
or suspicious activity conducted through or involving such accounts.100 Covered financial
institutions must establish risk-based controls and procedures for ascertaining the identities
of nominal and beneficial owners of such accounts and ascertaining whether any of these
owners are senior foreign political figures, and for conducting enhanced scrutiny on accounts
held by senior foreign political figures that is reasonably designed to detect and report
transactions that may involve the proceeds of foreign corruption.101
98. See 31 CFR §§ 1020.210(a)(2)(v), 1023.210(b)(5), 1024.210(b)(6), 1026.210(b)(5).
99. See 31 CFR §§ 1010.230, 1010.605(e)(1) (defining “covered financial institution”).
100. See 31 CFR § 1010.620. The definition of “covered financial institution” is found in 31 CFR § 1010.605(e)(1). The
definition of “private banking account” is found in 31 CFR § 1010.605(m). The definition of “non-U.S. person” is
found in 31 CFR § 1010.605(h).
101. See 31 CFR § 1010.620(c).
16
F I N C E N A D V I S O R Y
AML/CFT program and correspondent account due diligence requirements
Financial institutions are reminded of AML/CFT program requirements,102 and covered
financial institutions are reminded of correspondent account due diligence requirements
under Section 312 of the USA PATRIOT Act (31 U.S.C. § 5318(i)) and implementing
regulations.103 As described in FinCEN Interpretive Release 2004-1, the AML/CFT program of
an MSB must include risk-based policies, procedures, and controls designed to identify and
minimize risks associated with foreign agents and counterparties.104
Information Sharing
Information sharing among financial institutions is critical to identifying, reporting, and
preventing terrorist financing. Financial institutions and associations of financial institutions
sharing information under the safe harbor authorized by section 314(b) of the USA PATRIOT
Act are reminded that they may share information with one another regarding individuals,
entities, organizations, and countries suspected of possible terrorist financing or money
laundering.105 In accordance with the requirements of section 314(b) and its implementing
regulations, FinCEN strongly encourages such voluntary information sharing as it relates
to money laundering or possible terrorist financing in connection with Foreign Terrorist
Organizations (FTOs)106 and Specially Designated Global Terrorists (SDGTs).107
For Further Information
Additional questions or comments regarding the contents of this advisory should be addressed to
the FinCEN Regulatory Support Section at [email protected].
The mission of the Financial Crimes Enforcement Network is to safeguard
the financial system from illicit use, combat money laundering and its
related crimes including terrorism, and promote national security through
the strategic use of financial authorities and the collection, analysis, and
dissemination of financial intelligence.
102. See 31 CFR §§ 1010.210, 1020.210, 1021.210, 1022.210, 1023.210, 1024.210, 1025.210, 1026.210, 1027.210, 1028.210,
1029.210, 1030.210.
103. See 31 CFR § 1010.610.
104. See FinCEN, Anti-Money Laundering Program Requirements for Money Services Businesses with Respect to Foreign
Agents or Foreign Counterparties, Interpretive Release 2004-1, 69 Fed. Reg. 74,439 (Dec. 14, 2004). See also FinCEN,
“Guidance on Existing AML Program Rule Compliance Obligations for MSB Principals with Respect to Agent
Monitoring” (Mar. 11, 2016).
105. See 31 CFR § 1010.540; see also, FinCEN, “Section 314(b) Fact Sheet” (Dec. 2020).
106. See Department of State, “Foreign Terrorist Organizations.”
107. Executive Office of the President, “Executive Order 13224” (Sep. 23, 2001).
17