Where is Iranian Money Being Rerouted?
Gold, Crypto, China, OH MY!!
Data verification and timeline assistance were supported by AI tools (Claude), but all perspectives, analysis, and conclusions are my own. The interpretations presented reflect independent research, analysis, and first-hand experience.
On March 11, 2026, the Iranian bank of Sepah data infrastructure was damaged and rendered inoperable in strike that Tehran claims was conducted by “the American terrorist army and cruel zionist regime.” Perhaps most symbolically, this strike occurred as the bank was processing payments for the IRGC and Iranian Military, which brings us to it’s importance. https://www.jpost.com/middle-east/iran-news/article-889604
Bank Sepah is not a bank that happened to serve bad actors. It is a financial hub that was built for proxy network liquidity. It pays military salaries, Basij stipends, and funds Quds Force operational activity across the region. It also backstops the downstream PMF payroll that keeps 238,000 fighters on salary across Iraq through correspondent relationships with Iraqi commercial banks (Iraq is Iran’s mask into western markets see my previous article ) . Striking its data center during an active cash liquidity crisis, at the precise moment Iranian civilians are waiting an hour at empty ATMs to withdraw the equivalent of seven dollars, is not collateral damage. It is a direct node attack on the financial spine of Iran's entire regional proxy architecture. https://fortune.com/2026/04/12/iran-economy-crisis-inflation-prices-payroll-unemployment-currency-collapse/
Iran has a long history of avoiding sanctions. Traditionally it has been through Iraq, which we have largely put up with due to the ability to keep the oil market in check through central bank oversight (Iraq’s money flows through a bank account in NY), but lately the treasury department has begun cracking down on banks and other entities that deal with Iranian proxies in Iraq. To compound matters, Basra is down 70% in exports which means the blended Iraqi-Iranian oil profits are down. My question now becomes where is the money being rerouted? have we lost control? and is our intel picture of the finances now dark?
To understand what is happening with the money right now, you have to look at all 4 pressure points together rather than as separate military events.
As stated, Basra’s oil output is down more than 70 percent from pre-war levels. Iraqi port volumes have been cut in half. The Strait of Hormuz is now subject to a unilateral US Navy blockade that extends to any vessel that has paid an Iranian transit toll. And Bank Sepah, the primary payroll and transfer node for the IRGC and its proxy network, had its data center destroyed on March 11 during an existing cash liquidity emergency in which Iranian banks were already running out of physical banknotes daily.
In my March 15 article, I documented how the PMF operates as a state-funded paramilitary with an annual Iraqi government budget of 3.6 billion dollars, encompassing over seventy factions including several US-designated terrorist organizations. That budget flows through Iraqi government appropriations, which depend on Iraqi oil revenue, which depends on Basra export capacity, which is now as I’ve said several times already, is running at less than a third of its pre-war output with no functioning export corridor through the Strait.
There are 3 scenarios for how Baghdad responds to collapsing oil revenue under these conditions. The first is that Baghdad maintains the PMF budget line and cuts other government spending. This is politically plausible given the PMF’s institutional power within the Iraqi state, but it is fiscally unsustainable at scale and it exposes Iraqi political leadership to significant pressure from a population watching public services deteriorate while paramilitary factions continue to be paid. The second scenario is that Baghdad quietly reduces disbursements while Iran supplements the shortfall directly, which requires a functioning cross-border transfer mechanism at exactly the moment the primary transfer mechanism has been destroyed. The third scenario is that individual PMF factions activate their own independent revenue streams and operate without waiting for either Baghdad or Tehran to bridge the gap.
The third scenario is the one that deserves the most analytical attention, because it is the most likely and the least discussed.
The major PMF factions, Kata’ib Hizballah, Asa’ib Ahl al-Haq, and the Badr Organization, have never been purely dependent on the Iraqi state budget. The state budget was supplemental and legitimizing. It was not foundational. These factions have operated independent revenue streams in parallel with state funding for years: border taxation, protection fees, oil field security contracts, and the kind of front company contract capture I documented in the Muhandis General Company analysis in March. When the state revenue becomes unreliable, which it now has, the factions do not wait. They already know how to feed themselves. The question is whether they stay coordinated under Iranian strategic direction when Tehran’s own ability to fund and direct them through formal channels is degraded. This seems unlikely absent a borderless ideology, which they do have making the scenario much more likely. However, there’s also infighting within the Shia ideology which complicates matters.
The Harder Problem is the Quds Force Regional Funding
Local PMF factions have local resilience. The harder problem is the Quds Force regional operation.
Coordinating proxy networks across Lebanon, Yemen, Syria, and Gaza requires hard currency moving across international borders on a sustained basis. Protection rackets in Basra do not fund Hezbollah’s operational budget in Beirut. That is what Bank Sepah was doing that cannot easily be replaced. The cross-border operational funding layer is where the destruction of Sepah’s infrastructure creates a genuine disruption rather than a manageable inconvenience.
When a financial crime network loses its primary transfer method under these conditions, it does not collapse. It reroutes. And the rerouting options are predictable to anyone who understands how sanctioned money moves when it is forced off its primary rails.
Physical gold movement through IRGC courier logistics is almost certainly the immediate bridge. Iran holds significant gold reserves and the IRGC has mature physical logistics infrastructure that does not depend on any digital system. It is slow and limited in scale, but it is available right now without rebuilding anything. For targeted operational funding rather than mass payroll, it works.
Hawala networks in the Iraq-Iran-Gulf corridor are the second layer and they were already running parallel to the formal banking system before Sepah went down. This is the part that the military targeting planners appear not to have fully reckoned with. You cannot destroy a hawala network with a airstrike. There is no data center. The infrastructure is a set of trust relationships between brokers distributed across multiple jurisdictions. Treasury can designate individual brokers and degrade the network at the margins, but eliminating it kinetically is not possible. The hawala layer is more resilient than the banking layer by design, because it was built for exactly this kind of pressure environment.
Chinese yuan clearing through PRC-affiliated financial institutions is the medium-term rerouting play. Bank Kunlun has historically processed Iranian transactions. There are other PRC-adjacent institutions that have operated in the grey zone of Iranian sanctions for years. Here is where the blockade order creates an unintended consequence worth examining: Trump’s directive threatening any nation that pays Iranian transit tolls with loss of safe passage is a direct pressure play against China and India. But geopolitical pressure and financial accommodation do not always move in opposite directions. A China that is being threatened with naval interdiction of its own commercial shipping has significant political incentive to provide financial cover to Iran as a countermeasure. The blockade may be accelerating the very yuan-denominated financial accommodation it was designed to prevent. In addition, it can accelerate the digital yuan replacement for the petrodollar agenda that I have theorized is the reason we launched this war to begin with. You can find that outline in my “What comes after the dollar” article… IRGC is accepting payment in yaun for safe passage through the straight.
Cryptocurrency is the fourth layer and the wildcard. The IRGC has been building crypto capability since at least 2020. The scale question is real, because moving proxy payroll across four countries in cryptocurrency requires operational sophistication at the on-ramp and off-ramp points that creates exposure. But for targeted operational transfers rather than mass payroll disbursement, crypto is entirely viable and the blockchain evidence, as I noted in my March 18 piece, exists and is findable with the right tradecraft. Currently, IRGC is also accepting payment for safe passage through the straight, via Tron. Tron is a literal nightmare from an investigator’s standpoint. They chose it for a reason that I may get into in another article.
The Visibility Paradox
This is where the fraud examiner’s lens produces an insight that the military targeting framework entirely misses.
Every rerouting option the network moves toward under this simultaneous node pressure has a lower visibility profile than the system being destroyed.
Dollar-denominated correspondent banking, the layer where FinCEN identified approximately nine billion dollars of Iranian shadow banking activity moving through US correspondent accounts in 2024 alone, is the most visible layer in the entire architecture. It touches US financial infrastructure. It generates records and is subject to subpoena. It is where the paper trail lives.
Hawala generates no records by design. Physical gold courier generates no electronic trail. Yuan clearing through Chinese institutions is outside US correspondent banking and therefore outside US visibility. Cryptocurrency, for all its blockchain transparency, requires analytical tradecraft that most compliance departments do not yet have and it requires cooperation from off-ramps in jurisdictions that aren’t always inclined to cooperate with US court orders..
The strikes on Bank Sepah and the blockade of the Strait are not making the money more visible. They are making it less visible while it continues to move. The financial crime network is not being eliminated. It is being driven into darker channels, and those darker channels will resurface in new transaction patterns, new beneficial ownership structures, new commodity flows, and new correspondent relationships that the current sanctions monitoring architecture was not built to see.
For sanctions practitioners and litigators, the degraded-state architecture is where the next wave of enforcement actions will originate. When rerouted IRGC flows resurface in the financial system, they will look different than they did before. They will appear in jurisdictions and through instruments that did not previously carry Iranian sanctions exposure. Due diligence frameworks built on the pre-war architecture will miss them.
The firms that understand the rerouting playbook now, before the new patterns become consensus, are the ones positioned to identify the exposure, bring the cases, and advise clients through the next enforcement cycle.
For private equity and litigation finance clients with any exposure to Middle East operations, Asian logistics, or emerging market financial institutions, the stress test the network is currently undergoing is also a disclosure event in slow motion. The institutions and intermediaries that are absorbing rerouted Iranian liquidity right now will be the enforcement targets of the next two to five years. Knowing the rerouting architecture is knowing where to look.
Follow the Money When It Goes Dark
In my last articles on the topic, I argued that following the oil explains everything the official narrative never could. The Iraq War. The Iran War. The sanctions architecture. The petrodollar defense.
The rerouting question adds a second principle to that framework.
When you destroy the node, follow the money into the dark. Because it does not stop moving. It adapts, reroutes, and resurfaces.
The stress test is also a visibility event for those who know what to look for.
Lux in Tenebris.
Amanda is the founder of Immaculate International, a boutique private intelligence firm. She served in Iraq in 2008-2009 . She is a licensed private investigator and holds the Certified Fraud Examiner credential.