Detection v. Prevention: Iranian money and the U.S. correspondent accounts

Around nine billion dollars of suspected Iranian flows moved through United States correspondent accounts in a single year. The figure came from the banks themselves. That provenance, rather than the number, is what should concern compliance officers across the region.

I.  A routinely misread figure

In October 2025, the Financial Crimes Enforcement Network published a Financial Trend Analysis identifying approximately USD 9 billion of potential Iranian shadow-banking activity conducted through United States correspondent accounts during 2024. The figure has since done a great deal of rhetorical work. It is cited as evidence that U.S. banks are lacking strictness, that sanctions on Iran are porous, and that the dollar clearing system is the softest point in an otherwise formidable architecture of restriction.

The analysis was assembled from Bank Secrecy Act reporting. Suspicious activity reports filed by United States financial institutions between February 2024 and July 2025 in respect of transactions occurring in 2024. The nine billion is accordingly a measure of what U.S. institutions observed, suspected and disclosed. It is a detection figure, not a failure figure. Whatever volume of Iranian-linked activity passed entirely unnoticed is, by definition, absent from it.

That distinction exposes the structural weakness in the regime. Reporting obligations are informational before they are preventive. A suspicious activity report is a disclosure to the state, not an instruction to the payment system. Absent a blocking obligation attaching to a designated party, or a jurisdictional nexus identifiable at the moment of processing, an institution that harbors suspicion may still clear the payment, and will frequently have no lawful basis on which to refuse it. Suspicion is reported; the funds move; the report is analysed months later. The system describes the problem with real precision after the fact while doing comparatively little to stop it in the moment.

The composition of the figure confirms how ordinary the underlying conduct is. Entities exhibiting the standard indicators of shell activity accounted for roughly five billion dollars, the greater part of it sent from non-resident accounts at banks in mainland China operated by companies registered in Hong Kong. Oil-linked entities, predominantly in the United Arab Emirates and Singapore, accounted for approximately four billion. Shipping and technology procurement account for smaller but analytically significant remainders. None of this is shocking. It is the familiar furniture of trade-based sanctions evasion, catalogued in guidance for more than a decade, moving in plain sight through accounts that were reviewed, questioned, and reported by institutions that nonetheless processed the payments.

II.  Why the correspondent cannot detect it

Iranian financial institutions are officially excluded from direct access to the dollar system. The regime's response has been to interpose layers between itself and the clearing bank: exchange houses operating as informal banking conduits, third-country trading companies with no verifiable commercial substance, and respondent banks in jurisdictions where onboarding standards, supervisory intensity and political appetite for enforcement vary considerably. The foreign bank maintains a correspondent relationship with a U.S. institution for entirely legitimate commercial reasons. Its customer, for example, presents as a Gulf trading company or a Hong Kong electronics supplier. The U.S. bank sees its respondent, the payment message, and whatever originator and beneficiary data the message carries.

International standards allocate responsibility along precisely those lines. The correspondent is expected to understand its respondent's business, ownership, supervisory environment and the adequacy of its financial crime controls. It is not, as a general proposition, expected to conduct due diligence on the respondent's customers. That allocation has always been a compromise between the practical limits of what a clearing bank can know and the volume of transactions it must process. The compromise held for as long as nobody was prepared to test it.

It is now being tested.

III.  An instrument chosen for its indirect effects

On 28 August 2026, as part of the pressure campaign, the United States Treasury has designated Operation Economic Outcast, FinCEN issued a notice of proposed rulemaking under section 311 of the USA PATRIOT Act directed at the United Arab Emirates branches of Banque Misr, Egypt's second largest bank and a state-owned institution of considerable national significance. The proposal would prohibit United States financial institutions from opening or maintaining correspondent accounts for those branches, and would require reasonable steps to prevent indirect access through other foreign banks' accounts. The Treasury stated that the branches processed approximately USD 1.8 billion for 103 companies potentially connected to Iranian shadow banking networks between January 2024 and June 2026, describing them as a critical access node to the dollar. Separately, the Office of Foreign Assets Control designated the manager of Bank Melli's Dubai branch and a Hong Kong front company.

The choice of instrument deserves closer attention than it has received.

This is not a blocking designation. No property is frozen. The branches are not listed as specially designated nationals, no derivative ownership analysis follows, and no third-country person incurs secondary sanctions exposure by continuing to deal with them. The measure binds United States financial institutions and, formally, reaches only branches rather than the legal person. Egypt's central bank said within a day that the measure was confined to the dollar correspondent business of the Emirati branches and touched neither the domestic bank nor its other foreign operations. That statement is “legally” accurate.

However, it is commercially beside the point. The Central Bank of the United Arab Emirates ordered a forensic lookback across the branches covering the period identified by the Treasury. Correspondent banks elsewhere will not have waited for a final rule before convening their own reviews. Both reactions confirm that the instrument is working exactly as designed: the operative sanction is the response of everybody else. A rulemaking carrying a comment period is a supervisory ultimatum delivered in administrative form, and it deliberately leaves a window in which the host supervisor, the parent institution and the market may act before the rule is finalised. The Treasury has kept a more destructive tool in reserve and achieved much of its effect without deploying it.

The branch-level framing is coherent in law and porous in practice. Counterparty risk in correspondent banking is assessed at group level, because that is how the standard due diligence questionnaires are constructed, how ratings are assigned and how risk committees think. Containment is announced by regulators and decided by counterparties.

IV.  A standard that has moved without being amended

No recommendation has been revised, and no rule has been rewritten, yet the operative expectation has shifted one layer deeper into the payment chain.

The red-flag indicators Treasury has published (opaque ownership structures in the Emirates, Hong Kong-registered companies banking in mainland China with no meaningful commercial footprint, newly incorporated entities generating volumes disproportionate to any plausible business, payment chains routed through multiple intermediaries for no discernible commercial reason) are addressed in substance to the correspondent, not to the respondent that onboarded the customer. They describe patterns visible only from the clearing position, in aggregate, across counterparties. An institution that cannot detect them will be told after the event that it ought to have done so, and the absence of a formal obligation to know its customer’s customer will provide thinner comfort than it once did.

Read in that light, the Banque Misr proposal functions as a specification of what an inadequate programme now looks like: a branch operating in a high-exposure jurisdiction, a customer base including entities a competent lookback would have identified, and a parent that learned of the difficulty when Treasury announced it.

V.  The limit that will not be crossed

Escalation has a ceiling, and the ceiling is the dollar itself. The currency's utility as an instrument of coercion depends on its indispensability, and every coercive use of it strengthens the argument for building alternatives. That constraint is visible in the pattern of enforcement. China takes the overwhelming majority of Iranian oil exports, and no major Chinese financial institution has been touched. The institutions absorbing the pressure are those whose exclusion threatens nothing systemically: mid-sized banks and branches in Egypt, the Gulf, Turkey and South and East Asia, frequently in jurisdictions formally allied to the United States.

The corollary for this region is not a comfortable one. Exposure is penalised where the capacity to retaliate is lowest. An institution's protection lies neither in the diplomatic standing of its home state nor in the systemic consequence of its failure, but solely in the quality of the evidence it can produce about its own conduct.

There is a second cost, less often acknowledged. Nine billion dollars of observed flow is an intelligence asset. Restricting access does not extinguish the underlying trade; it displaces it towards yuan settlement, barter and digital assets, where no reporting line exists, and no trend analysis will ever be written. Trading visibility for denial.

VI.  What follows for institutions in the region

Lebanese and regional institutions operate with correspondent access that has already been thinned by a decade of de-risking, and with Iran-linked exposure embedded in the risk profile of the market rather than in the conduct of any particular bank. For them, the practical implications are narrow and immediate.

Nested and downstream relationships should be inventoried and understood as an extension of the institution's own risk perimeter into counterparties it does not select. Non-resident account structures and trading customers with disproportionate dollar volumes warrant review against the published indicators before a correspondent raises them. The ability to reconstruct several years of activity for a defined customer population, in weeks rather than quarters (lookback capability) has become a condition of retaining relationships, because that is the request that arrives when a correspondent's own committee becomes nervous. Where an institution is itself the subject of a proposed measure, the comment period is a legal opportunity to be used rather than an interval to be endured.

None of this is a compliance exercise in the administrative sense. The determinative judgement on an institution's access to the dollar is now taken by other banks' risk committees, on evidence the institution supplies about itself, long before any rule is finalised. That judgement is made once and is rarely revisited.

Sections of this article were generated with the assistance of AI for purposes of linguistic expression and idea formulation.