Proliferation financing and sanctions compliance: How Trump’s terror designations have upended compliance

On February 20, 2025, the US Department of State designated eight Transnational Criminal Organisations (TCOs) as Foreign Terrorist Organisations (FTOs) and Specially Designated Global Terrorists (SDGTs). These organisations include:

  • Tren de Aragua
  • Mara Salvatrucha (MS-13)
  • Cártel de Sinaloa
  • Cártel de Jalisco Nueva Generación (CJNG)
  • Cártel del Noreste (formerly Los Zetas)
  • La Nueva Familia Michoacana
  • Cártel del Golfo (Gulf Cartel)
  • Cárteles Unidos

 

These designations aim to expose and isolate these entities, denying them access to the US financial system and resources necessary for their operations. Similarly, the Canadian government has listed seven of these cartels as terrorist entities, reflecting a coordinated North American effort to combat the influence of these organisations.

 

Implications for businesses and due diligence

The designation of these cartels as terrorist organisations has significant implications for all companies, multinationals, and international merchants. Businesses may unknowingly engage with entities linked to these cartels, especially given their diversification of criminal entities into sectors such as agriculture, banking, tourism, transportation, and mining. Such associations can expose companies to severe penalties, including sanctions, asset seizures, suspension of travel visas, fines, and criminal prosecution.

To mitigate these risks, businesses should conduct thorough due diligence to identify and sever ties with any entities connected to these cartels. Failing to undertake extensive sanctions checks and full due diligence could inadvertently lead to a compliance failure and possible complications with terrorist financing.

 

US sanctions on Iran’s oil supply chain

In a parallel effort to curb proliferation financing, OFAC has imposed sanctions on over 30 individuals, entities, and vessels involved in Iran’s oil supply chain. These sanctions target oil brokers in the United Arab Emirates and Hong Kong, tanker operators in China and India, and senior officials of Iran’s National Iranian Oil Company. The objective is to disrupt Iran’s ability to fund destabilising activities through petroleum sales.

Businesses with any links to the global oil market must exercise heightened caution to avoid interactions with sanctioned Iranian entities. Iran uses a “shadow fleet” of vessels employing deceptive practices to transport Iranian oil further complicates compliance efforts. Companies should implement robust monitoring systems to track the origins of oil shipments and ensure they are not inadvertently supporting sanctioned activities.

 

Sanctions, proliferation financing and terrorism: growing compliance risks

The designation of cartels as terrorist organisations and the expansion of US sanctions on Iran’s oil network highlight a broader pattern of financial and security risks that businesses must navigate. Drug trafficking, organised crime and state-sponsored sanctions evasion are each a significant risk for proliferation financing. Both transnational criminal organisations and sanctioned states rely on complex networks of illicit finance, trade-based money laundering, and front companies to move funds and evade law enforcement. As a result, businesses operating across borders, particularly in high-risk regions, must be vigilant against inadvertently facilitating these activities.

The link between cartels and proliferation financing becomes even clearer when considering the overlap in their financial methodologies. Criminal organisations engage in bulk cash smuggling, shell company schemes, and cryptocurrency laundering—tactics that also feature prominently in sanctions evasion efforts by states like Iran. In some cases, there is direct cooperation: reports have highlighted instances where TCOs, including those in Latin America, have laundered money on behalf of sanctioned Iranian entities. Similarly, Hezbollah, a terrorist organisation with deep financial ties to Iran, has long been involved in drug trafficking, using illicit proceeds to fund its operations. 

For businesses, these developments reinforce the need for a holistic approach to compliance. Many firms conduct due diligence based on either anti-money laundering (AML) laws or sanctions compliance but fail to see the overlap between these risks. The designation of cartels as terrorist organisations means that companies should apply the same rigorous screening processes used for counterterrorism financing. Likewise, those monitoring sanctions risks related to Iran must be aware that the same criminal networks used to move illicit oil revenues may also be involved in broader financial crimes linked to cartel activity. A failure to recognise these connections could expose businesses to regulatory penalties, reputational damage, and potential criminal liability.

 

Join our free webinar to understanding and mitigating proliferation financing and sanctions risks on 5 March 2025 at midday UK time.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.