Sanctions, Shadow Banking, and Surveillance: Lessons from the Latest U.S. Action Against Iran

Economic sanctions are one of the most powerful tools governments use to restrict the activities of states and actors that threaten global stability. But sanctions are never static. As governments tighten restrictions, sanctioned regimes often respond with ever more sophisticated evasion tactics — from shadow banks to alternative financial messaging systems.

The latest U.S. Treasury designations against 18 Iranian entities and individuals shed light on how far these efforts can go. According to the U.S. Office of Foreign Assets Control (OFAC), the network developed parallel banking channels to bypass sanctions and advanced surveillance technologies that have been deployed domestically to repress dissent.

This case is a reminder not only of the challenges facing regulators but also of the compliance risks for financial institutions worldwide, including in Asia-Pacific, where cross-border trade and payments continue to expand.

Building a Parallel Banking System

At the center of the sanctions action is Iran’s Cross-Border Interbank Messaging System (CIMS). After repeated disconnections from the SWIFT network, most recently in 2018, Iran accelerated its efforts to build an alternative payment infrastructure.

The Central Bank of Iran authorized CIMS for external use in 2023, allowing Iranian institutions to transact with foreign partners outside of traditional rails. According to OFAC, this included connections with China’s Bank of Kunlun, itself under U.S. sanctions.

This tactic mirrors similar strategies seen elsewhere:

• Russia has promoted its SPFS messaging system as an alternative to SWIFT.

• China continues to expand its Cross-Border Interbank Payment System (CIPS), which, while not sanctioned, plays a central role in de-dollarization strategies.

• North Korea relies on front companies and intermediaries across Asia to obscure payment trails.

• 
  

For compliance teams in Asia-Pacific banks, the lesson is clear: domestic payment systems can be co-opted for sanction evasion, and reliance on local rails does not eliminate global exposure.

Offshore Banks and Hidden Ownership

Treasury also sanctioned Cyrus Offshore Bank, founded in 2021. The bank was allegedly “secretly owned and staffed” by personnel from Parsian Bank, a sanctioned Iranian institution. By layering ownership and disguising beneficial controllers, Cyrus Offshore was used as a vehicle for overseas purchases and financial flows.

This mirrors tactics observed in other regions:

• Shell banks in Southeast Asia have previously been linked to money-laundering schemes for North Korea.

• Offshore corporate structures in Hong Kong and Labuan have been exploited by sanctioned actors to access global capital.

For regulators and financial institutions in Asia-Pacific, this underlines the importance of robust beneficial ownership transparency and continuous monitoring of offshore structures — especially in free-trade hubs that attract cross-border capital.

Surveillance Technology and Human Rights Concerns

The sanctions did not stop at banking. OFAC also targeted Iranian tech firms accused of developing and deploying surveillance capabilities used against citizens.

Among the most notable:

• Behnama facial recognition software, allegedly used by Iranian police and morality enforcement units to identify women violating hijab laws.

• Messaging applications designed to suppress access to platforms like Telegram, widely used by protest movements.

This convergence of financial services and surveillance technology illustrates a broader trend where sanctioned states diversify activities across finance, telecoms, and digital infrastructure.

In Asia-Pacific, the overlap between fintech, regtech, and surveillance technologies is growing. Countries expanding biometric identity programs or digital payment ecosystems must ensure strong governance and export controls, so these technologies are not misused or resold into sanctioned jurisdictions.

Compliance Risks for Global Financial Institutions

The Treasury’s warning was unambiguous: any foreign financial institution that transacts with CIMS or related Iranian entities faces secondary sanctions.

For banks and payment providers across Asia-Pacific, where trade flows with the Middle East and China are significant, this creates material compliance risks. Even indirect exposure through correspondent banking or third-party fintech partners could trigger scrutiny.

Practical steps for institutions include:

• Enhanced due diligence (EDD): on counterparties in trade finance and cross-border settlements.

• Screening for payment rails: monitoring not just names but also messaging networks used in transactions.

• Sectoral awareness: understanding that high-risk entities may be embedded in fintech, telecoms, or IT firms.

Asia-Pacific Dimensions

The case carries particular weight for the Asia-Pacific region:

• China: The link between CIMS and the Bank of Kunlun underscores Beijing’s financial ties to Tehran. This places additional compliance pressure on Chinese institutions and their foreign partners.

• India: As one of the region’s largest oil importers, India has long had to balance trade with Iran against U.S. secondary sanctions. Local banks must continue walking a fine line.

• Southeast Asia: With fast-growing payment networks and digital trade corridors, ASEAN markets must guard against becoming indirect conduits for sanctioned flows.

• Australia & Singapore: As financial hubs with strong regulatory reputations, both face pressure to ensure their correspondent networks are not exploited for sanctions evasion.

Broader Lessons

This case highlights three key realities for compliance leaders globally:

1. Sanctions are never static. Targeted regimes will innovate, from shadow banks to alternative messaging systems.

2. Financial crime is multi-sector. The overlap between banking, telecoms, and surveillance requires cross-disciplinary oversight.

3. Asia-Pacific is not immune. Regional payment systems, offshore centers, and digital trade channels create exposure points that can be exploited.

Conclusion

The U.S. sanctions against Iran’s banking and technology network demonstrate the complexity of modern sanctions evasion — blending offshore finance, domestic payment alternatives, and state-backed surveillance tools.

For financial institutions in Asia-Pacific and beyond, the message is clear: vigilance cannot stop at sanctions lists. Effective compliance today requires a deeper understanding of networks, technologies, and hidden ownership structures, along with constant coordination between regulators, banks, and technology providers.

In an interconnected financial system, evasion schemes in one part of the world can ripple across markets. The challenge for compliance professionals is to stay one step ahead — not just blocking prohibited transactions, but anticipating where the next evasion channel might emerge.