In April 2026, the US Treasury sanctioned more than two dozen people, companies and vessels tied to one Iranian oil-shipping network. It had designated the same network nine months earlier – the largest single Iran action of the renewed pressure campaign. The network remained operational. Three months later, Treasury designated more of it: a Danish national in Singapore, an Indian national, and front companies with genuine incorporation papers in multiple jurisdictions.
None of this required forged documents or breached controls. Each company was real. Each transaction, viewed alone, passed the checks applied to it. This is the pattern regulators keep rediscovering: BNP Paribas paid billions for processing exactly such transactions – its employees stripping Iranian references from payment messages so the next bank’s screening would, correctly, find nothing.
The question this raises is not “which control failed?” Instead, the question is what compliance can even see.
Photo by Ardalan Hamedani on Unsplash
Sequencing Sanctions
In 2014, BNP Paribas, a global financial institution, pleaded guilty and agreed to pay the US Department of Justice $8.9 billion in a sanctions settlement. Despite the sanctions, Iranian entities were able to access the international financial system. This was not due to a single breach but rather a series of violations.
BNP was not an outlier. Standard Chartered paid $2 billion in 2019 – its second settlement for the same conduct, after promising reform in 2012.
Investigators found the same techniques: payment messages altered so Iranian connections would not surface at the clearing bank: two institutions, two regulatory cycles, one playbook. When the same method survives a decade of enforcement attention, the problem is not the institutions – it is what the controls are built to see.
Modern compliance systems are designed to answer a specific question: does this entity, transaction, or relationship meet the criteria defined by the control?
Iran’s sanctions-evasion architecture operated against a rather different question – when multiple, individually acceptable decisions are combined, what system emerges?
Such questions are exploiting the assumptions embedded within governance frameworks.
The Compliance Assumption
Part of the challenge in imposing and upholding sanctions is dependence on trust between institutions that underpins the global financial system.
A bank cannot independently reconstruct every transaction it processes, so it relies on customer information, correspondent relationships, regulatory standards and the assurance provided by other regulated entities. All of which requires a practical assumption: in the system, a transaction that passes the relevant controls can be treated as legitimate. Without this assumption, global finance would not function.
This assumption is not an oversight – it is written into how due diligence is scoped. Correspondent-banking requirements, in every major jurisdiction, direct a bank’s attention to its counterparty: who they are, what markets they service, how they manage risk—one hop. Nothing asks what sits two hops beyond, because no single institution could answer. The controls are not badly drafted; they are drafted for entities, and the risk lives in the chain.
Compliance controls typically validate components, not the systems created by connecting those components. So even with every fact correct, the purpose of the overall structure may remain hidden. Sanctions-evasion techniques, such as those used by Iran, exploit this gap by only needing enough components to appear legitimate. Instead of defeating a control, they can operate outside the control’s intended scope.
The Entity Problem
Sanctions regimes remain entity-based for practical reasons. Entities such as the United Nations Security Council Consolidated List, the EU Sanctions Map, the Office of Foreign Assets Control, and the Australian Sanctions Office designate individuals, companies, vessels, financial institutions, and other identifiable actors.
Legal systems require objects that can be named, regulated, and enforced against. Adversaries, however, do not necessarily organise around the same objects. A sanctioned company is easily replaced, a bank account is closed, and brokers disappear. A removed leader is only a temporary position to fill; the function survives because the operation is not dependent on a single entity. Look to Iran’s Islamic Revolutionary Guard Corps (IRGC) and its persistence in the face of Western pressure, a combination driven by ideology and history that manifests in strategically solving for sanctions time and again.
The function survives because the operation isn’t dependent on a single entity; rather, it’s dependent on the relationships among entities. In other words, the distinction between a node and a system. A node is visible; a system is operational. This goes a long way toward explaining why sanctions enforcement is often futile.
A System Within a System
Hawala provides a useful illustration. Hawala is a legitimate remittance system used globally; like Chinese Flying Money (Feiqian), it forms part of an underground banking system based on trusted intermediaries – not unlike the above-ground banking system in that regard – and when co-opted, it provides a powerful tool to bypass legal barriers.
‘Customers give a sum of money to a hawala broker (known as a hawaladar) in one city, to be transferred to a recipient in another, usually foreign, city.
Karim Sadjadpour, ‘The Battle of Dubai: The United Arab Emirates and the U.S.–Iran Cold War’
The hawaladar in the sender’s city then calls another hawaladar in the recipient’s city in order to provide the cash (minus the standard 2 percent commission) to the intended recipient.
There is often no physical or even electronic transfer of money. The hawaladar who made the payment is reimbursed when the funds flow in the reverse direction, sometimes within minutes.’
The scale is not marginal: estimates of informal remittance flows run to billions of dollars annually, most of it invisible to the formal reporting system.
The formal banking system may record only part of the underlying activity, which doesn’t make hawala inherently illicit but does generate a governance challenge: how to ensure the relevant information is distributed.
The Protocol Behind the Entity
The term ‘sanctions evasion network’ can imply a traditional organisation: a hierarchy, a command structure, or identifiable members. However, the model is often incomplete, as modern evasion systems are better understood as protocols. Protocols define how participants interact; the entities are replaceable, but the process remains resilient.
Iran’s financial networks do not require every intermediary to understand the full objective, including the use of the Axis of Resistance network. Instead, they require participants to perform narrowly defined functions within a broader structure.
It’s a familiar property evident in technology systems; consider a distributed team consisting of an owner, a back-end developer, a front-end developer, and UX and UI specialists. The nodes do not need to be permanent, but they do need to connect to exchange information and perform functions. The same principle applies here, where operational capability carries more weight than an individual participant.
Why State Actors Matter to GRC
State actors are relevant to GRC as their behaviour reveals weaknesses in governance architecture. Most governance frameworks are built on identifiable ownership. A control, process, system, supplier, or regulated entity has an owner. The model works best when risk exists inside organisational boundaries and is weakened when risk emerges across those boundaries.
State actors exploit relationships between systems; North Korea’s remote IT worker program demonstrated this in another domain. The operation entered through legitimate recruitment, identity verification, and payroll processes. Each function assessed the information relevant to its responsibility, but the vulnerability lay in the connection between functions.
Iran’s sanctions-evasion architecture used the same principle. Relevant controls existed: Know Your Customer (KYC), transaction monitoring, and correspondent banking. The vulnerability was in the space between. Different adversary, different domain, but the same governance problem – and it’s illustrative of where governance can grow.
The Missing Control Category
Current governance frameworks are most robust at assigning responsibility for individual decisions but are flawed when assigning responsibility for patterns. Who owns a risk that only becomes visible after multiple valid events are combined? Who owns a relationship that spans multiple institutions? Who owns a pattern that does not belong to a single business function? This isn’t a simple control failure and cannot be resolved by adding another screening rule, because analytical boundaries have created the problem.
Instead, does governance have a mechanism to observe activity at the same level of abstraction as the adversary? The hardest problem is identifying when separate, individually acceptable observations form a coordinated system. It requires correlation and ownership, and ultimately a different model of risk.
The NIST Cybersecurity Framework 2.0, for example, recognises that resilience depends not only on the security of individual components, but also on the governance of the dependencies and relationships that connect them.
The Broader Lesson
This is an example of emergent risk: risk that does not reside in any individual component, but arises from the interaction between otherwise legitimate components.
Supply chains, third parties, cloud environments, identity and access management systems, financial networks – the components may all appear acceptable, but the system created by connecting them may not be.
State actors are useful case studies because they bring the resources, ingenuity, and patience to identify these structural weaknesses first. Beyond broken controls, they also reveal assumptions and highlight what a framework considers visible, what is owned, and what is outside scope.
Leave a Reply