Iran’s IRGC exploits global financial networks to evade sanctions, warns anti-money laundering expert
04 March 2026
Iranian-linked illicit activity is routinely routed through organised crime networks to evade sanctions and obscure state involvement, according to an anti-money laundering expert.
Phil Cotter, CEO of SmartSearch says that said public intelligence and enforcement records show a long-established system in which Iran’s Islamic Revolutionary Guard Corps (IRGC) relies on criminal intermediaries to disguise illicit activity, finance operations and maintain plausible deniability.
While SmartSearch does not comment on specific customer cases, Cotter explained that the patterns seen across global enforcement actions closely mirror the activity financial institutions are attempting to prevent every day.
“I can't discuss specific SmartSearch customer cases or investigations; he said, “however, the public record is extensive. The IRGC has been designated as a terrorist organisation by the US, Canada, Australia, and the entire EU. Western intelligence agencies assess that the IRGC systematically uses organised crime to finance operations and evade sanctions, controlling front companies, shipping networks, ports, and financial intermediaries to disguise oil sales, move weapons, and procure restricted goods.
“There's documented evidence of IRGC-aligned networks involved in narcotics trafficking from Afghanistan through Iran to Turkey and Europe, overlapping with arms smuggling, human trafficking, and trade-based money laundering.
“Public enforcement actions show shell companies in the UAE and Hong Kong evading petrochemical sanctions, forged identity documents opening accounts across Europe, and cryptocurrency networks facilitating IRGC sanctions evasion.”
Rising tensions increase reliance on proxy networks
Cotter said regional instability historically pushes sanctioned regimes to rely even more heavily on criminal proxies, rather than direct state action, and while he can't speculate on future Iranian regime behaviour, he said that the IRGC's model is designed for this.
“They've spent years developing sophisticated evasion infrastructure using criminal proxies for plausible deniability,” said Cotter, “Historically, when tensions escalate, sanctioned regimes increasingly rely on proxy networks, turning to criminals they've cultivated and essentially saying 'we'll pay you to do this for us.'”
This approach also extends to cyber activity, where funding and logistics are deliberately routed through criminal networks to obscure attribution, as Cotter explained:
“Iran maintains state-sponsored cyber capability linked to the IRGC and Ministry of Intelligence. Well-known groups include APT33, APT34, APT35 (Charming Kitten), APT39, and MuddyWater, attributed by the US, EU, UK, and Israel to Iranian state actors conducting espionage, sabotage, and surveillance.
“I can't comment on their technical capabilities or likely targets, that's for cybersecurity experts. What I can address is how these operations are financed and why the proxy network angle matters.
“The IRGC integrates cyber operations with military, intelligence, and criminal tools as asymmetric warfare. Even cyber operations need funding—operatives, infrastructure, tools. Rather than the IRGC directly funding through traceable channels, they use criminal intermediaries who've been moving money for them for years.”
According to Cotter, this makes Iranian-linked activity difficult to distinguish from conventional organised crime.
“It looks like organised cybercrime rather than state-sponsored activity, even though funding and tasking ultimately come from IRGC elements or Iranian intelligence. This creates plausible deniability and makes attribution harder,” he said.
What this means for the UK
Cotter said most UK citizens will not directly encounter Iranian money laundering, but the broader implications are significant.
“Iranian threats to the UK likely won't be direct IRGC operations, they'll come through organised crime networks already operating in the UK and Europe. These networks might now receive tasking and funding from IRGC elements for operations like cyber-attacks, surveillance, targeting dissidents.”
From an AML perspective, Cotter said this reinforces the need for deeper scrutiny beyond obvious sanctions matches.
“The IRGC has spent years developing sophisticated evasion infrastructure through organised crime partnerships. They don't build it themselves, they use established criminal networks with shell companies across jurisdictions, corrupt officials providing false documents, money laundering expertise, front businesses and multi-commodity trafficking routes.
“What SmartSearch does daily is screen millions of checks across financial services, legal, and property sectors. We catch attempts matching these patterns, corporate structures where beneficial ownership doesn't align with stated directors, forged documents, and sanctions screening matches. Our role is preventing accounts from being opened under false pretences, whether it's a direct IRGC entity or a criminal proxy working on their behalf.
“But no single technology stops this. The IRGC is a hybrid military-intelligence-criminal-economic organisation. Countering it requires financial institutions, regulators, law enforcement, intelligence services, and international partners working together. The goal is making operations difficult, expensive, and risky enough that they can't operate with impunity.”
