The Iran Conflict: What AML and Sanctions Compliance Teams Need to Know Right Now

BIJI DEALS
Mar 12
6 min read

The world is watching the escalating conflict between the United States, Israel, and Iran with understandable concern. For most observers, this is a geopolitical crisis to follow at a distance. For financial institutions, fintech platforms, and regulated businesses in Malaysia and Singapore, it represents something more immediate: a rapidly evolving sanctions and financial crime risk environment.

This article cuts through the geopolitical noise and focuses on the compliance questions that actually matter: What has changed? What does it mean for your institution? And what should you be doing about it?

Geopolitical crises don't rewrite the compliance rulebook. But they do put every page of it to the test.

The Iran Conflict - What Happened (The Short Version)

Iran and Western governments have been locked in a long-running dispute over Iran’s nuclear programme. In 2015, Iran and the P5+1 countries (i.e., United States, United Kingdom, China, France, Russia, and Germany) reached the Joint Comprehensive Plan of Action (JCPOA) or the ‘Iran nuclear deal’. The agreement lifted many international sanctions in exchange for Iran limiting its nuclear activities.

It was fragile from the start and eventually collapsed. What followed was a gradual, then sudden, escalation. By 2025, Israel and Iran were exchanging direct military strikes. On 28 February 2026, the United States and Israel launched coordinated airstrikes on Iranian military and leadership targets, resulting in the death of Iran’s Supreme Leader and triggering a wider regional conflict. The Middle East has not seen a disruption of this scale in decades.

The knock-on effects reached every part of the global economy. Energy markets became volatile. Sanctions designations accelerated. And shipping through the Strait of Hormuz, the narrow waterway through which roughly 20% of the world’s oil passes daily, was severely disrupted as several major shipping lines suspended transits due to security concerns.

For compliance teams, the pace of regulatory change has been just as striking as the military escalation. Here is the sequence that matters:

Timeline	What Happened
Feb 2020	Financial Action Task Force (FATF) blacklists Iran - the most serious multilateral AML/CFT designation.
Sept 2025	UN Security Council sanctions reimposed on Iran under the JCPOA snapback. OFAC issues one of its largest single sanctions actions targeting Houthi-linked networks across Yemen, China, UAE and the Marshall Islands.
Jan 2026	FATF reaffirms Iran's blacklist status.
Feb 2026	US-Irael airstrikes results in death of Iran's Supreme Leader. Iran retaliates with missile and drone strikes across the Gulf. OFAC designates 30+ new entities linked to Iranian oil and weapons procurement, and designates two crypto exchanges for operating in Iran's financial sector.

What are Sanctions and What has Changed?

Sanctions are legal restrictions that prevent financial institutions and businesses from dealing with specific countries, individuals, or organisations. They are financial pressure tools — used by governments and international bodies to isolate actors they consider a threat, without resorting to military force.

Think of it this way: a sanction means you cannot open an account for that person, process a payment on their behalf, or provide them with financial services. Breach it, even unknowingly - and the consequences range from heavy fines to being cut off from international financial networks entirely.

How This Affects Financial Services in Malaysia and Singapore?

For institutions in our region, the Iran conflict creates risk across several fronts simultaneously. Here is where the exposure is and what it looks like in practice.

Sanctions Screening: Your list has already changed

Sanctions screening is the process of checking customers, counterparties, and transactions against lists of designated individuals and entities. When those lists change - sometimes overnight - every institution that has not yet updated its system is carrying an undetected exposure.

The challenge today is speed.

The February 2026 OFAC action alone added 30+ new entities in a single announcement. Institutions that rely on periodic batch screening risk unknowingly processing transactions involving newly sanctioned parties for days or weeks before the next update cycle runs.

For Practitioners - Review your sanctions list ingestion frequency. Fragmented list management across business units remains one of the most common root causes of sanctions enforcement actions in the region.

Transaction Monitoring: Looking for the Right Things

Transaction monitoring (TM) is how institutions identify unusual or suspicious patterns in financial flows. Most TM systems are tuned to catch money laundering - large cash deposits, structuring, unusual cross-border patterns. That is necessary but not sufficient in the current environment.

The Iran conflict introduces two specific TM challenges that go beyond standard AML typologies:

Sanctions evasion typologies. Sanctioned parties do not announce themselves. They use intermediaries, shell companies and jurisdictional layering to disguise the true origin or destination of funds. In Iran's case, well-documented evasion methods include routing payments through UAE, Turkish or Omani intermediaries, and using companies in third countries with opaque beneficial ownership structured.

Proliferation financing. Iran has used the financial system to procure components and materials for its weapon programme - often through front companies that appear to be legitimate trading businesses. This risk is not theoretical for our region.

Correspondent Banking and Trade Finance: The Indirect Exposure

Most institutions in Malaysia and Singapore do not have direct relationships with Iranian banks. But indirect exposure through correspondent banking - where your bank processes transactions on behalf of another bank - is a well-documented risk channel.

Iran has historically used complex shipping arrangements to circumvent energy-related sanctions. These methods may include ship-to-ship cargo transfers, frequent vessel renaming, and changes in flag state or ownership.

Such activity can complicate the due diligence process for financial institutions financing commodity transactions or facilitating letters of credit. For trade finance teams, vessel behaviour, such as recent name changes or unusual routing patterns, can be a critical risk indicator rather than a minor administrative detail, or where the beneficiary's beneficial ownership cannot be clearly established.

The shadow fleet - explained simply: Iran has long used a network of ageing tankers - frequently renamed, re-flagged, and re-owned - to move sanctioned oil undetected. These vessels disable GPS tracking, conduct cargo transfers at sea, and arrive in port claiming non-Iranian origin. Malaysian and Singaporean waters are known transfer points. In February 2025, a Malaysian company was sanctioned under US Executive Order 13846 for alleged involvement in these transfers. For trade finance desks: a vessel with a recent name, flag, or ownership change is a red flag - not a footnote.

Crypto: The New Evasion Channel

Crytocurrency has become an increasingly significant tool in sanctions evasion, and the current conflict has intensified this. When a regime face military pressure and financial isolation simultaneously, the incentive to move assets quickly through non-traditional channels become intense.

Cryptocurrency transactions can move quickly across borders and may involve pseudonymous wallet addresses rather than identifiable account holders.

Regulators have responded by expanding sanctions enforcement into the digital asset ecosystem, including actions against crypto platforms facilitating transactions linked to sanctioned jurisdictions and/or individuals. For virtual asset service providers (VASPs) and fintech firms, this means that sanctions compliance must extend beyond traditional financial institutions.

OFAC took a landmark step - it designated two UK-registered crypto exchanges for operating in Iran's financial sector. This was the first time OFAC had ever designated a digital asset exchange on this basis.

The message to the industry was clear: crypto platforms are now considered part of the sanctions evasion infrastructure, and regulators are acting accordingly.

What to Look Out For: Key Read Flags in Current Environment

Compliance teams should pay particular attention to several indicators that may signal heightened sanctions risks.

Area	What to Watch For
Sanctions Screening	Newly designated entities not yet ingested into your screening system. Review your list update frequency.
Customers & Counterparties	Iranian nationals or entities using complex intermediary structures; newly incorporated companies with Gulf or Southeast Asian addresses but unclear beneficial ownership; customers showing sudden changes in transaction volumes following the February 2026 escalation.
Wire Transfers	Incomplete originator or beneficiary information on transfers with Middle Eastern nexus.
Trade Finance and Shipping	Vessels that have recently changed name, flag or ownership structure; letters of credit involving Gulf intermediaries without verified beneficial ownership.
Crypto and Digital Assets	Multiple small transfers aggregating into significant amounts from Iran-nexus wallets; new onboarding attempts using newly created corporate vehicles.
Correspondent Banking	Correspondent relationships that have not been reviewed since the JCPOA snapback; counterparty banks in jurisdictions with weaker sanctions controls acting as pass-through intermediaries.
DNFBPs	Requests to form companies, set up trusts or facilitate property transactions - particularly where the ownership structure is unnecessarily complex or the urgency is unusual.

The Bottom Line

Here is the honest truth - Iran was already the most sanctioned jurisdiction in the world before the first airstrike. What the 2025 - 2026 escalation has done is accelerated the pace of the change - changes that might have unfolded over months are now happening in weeks.

For institutions in Malaysia and Singapore, the question is not whether this matter. It is whether your existing sanctions screening, transaction monitoring, and customer due diligence frameworks are robust enough to keep up.

Your framework should be the last thing that fails.

The institutions that navigate this well will not be the ones that reacted fastest, but they will be the ones that already had the right foundations in place.

At Biji Deals, we help reporting institutions in Malaysia and Singapore review, assess and strengthen their AML/CFT and sanctions frameworks - with a practical, risk-based approach grounded in real regulatory experience.