Iran’s Islamic Revolutionary Guard Corps (IRGC) is using global organised crime networks and complex financial structures to evade sanctions and conceal state-backed activity, according to an anti-money laundering expert.
Phil Cotter (main picture, inset), Chief Executive of identity verification and AML firm SmartSearch, says public intelligence and enforcement records reveal a long-established system in which Iranian-linked activity is routed through criminal intermediaries to obscure state involvement and maintain plausible deniability.
The networks are used to disguise oil sales, procure restricted goods and move funds through shell companies, forged documentation and cryptocurrency channels.
According to Cotter, these methods mirror patterns financial institutions and compliance teams encounter during routine checks across banking, legal and property sectors.
ENFORCEMENT ACTIONS
Evidence from enforcement actions shows Iranian-linked networks using shell companies in jurisdictions such as the UAE and Hong Kong to bypass petrochemical sanctions, while forged identity documents have been used to open financial accounts across Europe.
The warning comes as geopolitical tensions in the Middle East rise, a period when sanctioned regimes have historically increased their reliance on proxy networks rather than direct state involvement.
Cotter says: “I can’t discuss specific SmartSearch customer cases or investigations; however, the public record is extensive. The IRGC has been designated as a terrorist organisation by the US, Canada, Australia, and the entire EU. Western intelligence agencies assess that the IRGC systematically uses organised crime to finance operations and evade sanctions, controlling front companies, shipping networks, ports, and financial intermediaries to disguise oil sales, move weapons, and procure restricted goods.
“There’s documented evidence of IRGC-aligned networks involved in narcotics trafficking from Afghanistan through Iran to Turkey and Europe, overlapping with arms smuggling, human trafficking, and trade-based money laundering.
“Public enforcement actions show shell companies in the UAE and Hong Kong evading petrochemical sanctions, forged identity documents opening accounts across Europe, and cryptocurrency networks facilitating IRGC sanctions evasion.”
CRIMINAL NETWORKS
Cotter says that the IRGC’s approach has been deliberately developed over many years, relying on established criminal groups capable of moving money and goods across borders while distancing the Iranian state from direct involvement.
He adds: “They’ve spent years developing sophisticated evasion infrastructure using criminal proxies for plausible deniability. Historically, when tensions escalate, sanctioned regimes increasingly rely on proxy networks, turning to criminals they’ve cultivated and essentially saying ‘we’ll pay you to do this for us.’”
The structure also extends to cyber operations, where funding and logistics can be routed through criminal channels to obscure attribution.
“Iran maintains state-sponsored cyber capability linked to the IRGC and Ministry of Intelligence. Well-known groups include APT33, APT34, APT35 (Charming Kitten), APT39, and MuddyWater, attributed by the US, EU, UK, and Israel to Iranian state actors conducting espionage, sabotage, and surveillance,” he says.
“I can’t comment on their technical capabilities or likely targets, that’s for cybersecurity experts. What I can address is how these operations are financed and why the proxy network angle matters.
“The IRGC integrates cyber operations with military, intelligence, and criminal tools as asymmetric warfare. Even cyber operations need funding – operatives, infrastructure, tools. Rather than the IRGC directly funding through traceable channels, they use criminal intermediaries who’ve been moving money for them for years.”
PLAUSIBLE DENIABILITY
According to Cotter, this structure often makes Iranian-linked activity appear indistinguishable from conventional organised crime.
“It looks like organised cybercrime rather than state-sponsored activity, even though funding and tasking ultimately come from IRGC elements or Iranian intelligence. This creates plausible deniability and makes attribution harder,” he said.
While most UK citizens will not directly encounter Iranian-linked money laundering, Cotter said the wider implications remain significant, particularly where existing organised crime groups operating in Europe could receive direction or funding from Iranian actors.
“Iranian threats to the UK likely won’t be direct IRGC operations, they’ll come through organised crime networks already operating in the UK and Europe. These networks might now receive tasking and funding from IRGC elements for operations like cyber-attacks, surveillance, targeting dissidents.”
DEEPER SCRUTINY
From a compliance perspective, Cotter says the evolving threat highlights the need for deeper scrutiny across financial, legal and property transactions.
“The IRGC has spent years developing sophisticated evasion infrastructure through organised crime partnerships. They don’t build it themselves, they use established criminal networks with shell companies across jurisdictions, corrupt officials providing false documents, money laundering expertise, front businesses and multi-commodity trafficking routes.
“What SmartSearch does daily is screen millions of checks across financial services, legal, and property sectors. We catch attempts matching these patterns, corporate structures where beneficial ownership doesn’t align with stated directors, forged documents, and sanctions screening matches. Our role is preventing accounts from being opened under false pretences, whether it’s a direct IRGC entity or a criminal proxy working on their behalf.
“But no single technology stops this. The IRGC is a hybrid military-intelligence-criminal-economic organisation. Countering it requires financial institutions, regulators, law enforcement, intelligence services, and international partners working together. The goal is making operations difficult, expensive, and risky enough that they can’t operate with impunity.”
