FinCEN issued a notice of proposed rulemaking finding that Banque Misr’s operations in the United Arab Emirates are a financial institution of primary money laundering concern, and proposing to cut the institution off from U.S. correspondent banking under Section 311 of the USA PATRIOT Act. Treasury’s supporting statement, issued under Operation Economic Outcast, points to roughly $1.8 billion processed between January 2024 and June 2026 for more than one hundred companies assessed to be part of Iranian shadow banking networks — including apparent front companies tied to Iran’s Ministry of Defense and the IRGC.
Most compliance teams outside the large correspondent banks will read that headline, note that they hold no relationship with Banque Misr UAE, and move on. That is the wrong conclusion. Section 311 is not a sanctions listing that your screening vendor will quietly absorb overnight. It is a due diligence obligation — and the second half of the proposed rule reaches institutions that have never heard of the target.
What the proposed rule actually requires
The headline prohibition is straightforward: U.S. financial institutions may not open or maintain a correspondent account for, or on behalf of, Banque Misr UAE. The operative burden sits in the two obligations that follow.
Indirect access. U.S. institutions must take reasonable steps not to process a transaction for the U.S. correspondent account of any foreign bank where the transaction involves Banque Misr UAE. This is an indirect-access prohibition, and it captures payment chains you do not originate.
Special due diligence. Institutions must apply special due diligence to their foreign correspondent accounts, reasonably designed to guard against those accounts being used to route transactions involving the named institution. In practice that means notifying foreign correspondents, obtaining assurances, and monitoring for evasion — not simply adding a name to a filter.
Scope discipline. The finding applies only to Banque Misr UAE as defined in the NPRM — not to Banque Misr operations in any other jurisdiction. Over-blocking the parent group is its own compliance failure, and one that generates avoidable customer harm and de-risking complaints.
Why this reaches FinTechs, MSBs and payment firms
If your business model runs on an FBO account at a sponsor bank, a BaaS arrangement, an offshore acquiring relationship, or a network of foreign payout partners, you sit inside somebody else’s correspondent chain. Your sponsor bank’s special due diligence obligation flows downstream to you in the form of new attestations, tighter payment-purpose data requirements, and questions about your own intermediary partners that you will be expected to answer within days, not quarters.
The exposure is rarely a direct account. It looks like a licensed money transmitter in a third country that maintains a nested relationship with the named bank; a trade-finance corridor where the ultimate beneficiary bank is masked behind a cover payment; a crypto off-ramp settling fiat through a regional partner whose own correspondent tree has never been mapped. Iranian shadow banking has, for years, been characterised by exactly this structure — dispersed trading companies, commodity flows, and layered bank relationships that are individually unremarkable and collectively decisive.
The typology worth internalising
The $1.8 billion figure is less interesting than its shape: 103 companies over roughly thirty months. That is an average of well under $20 million per entity — volumes that clear most transaction monitoring thresholds without complaint. Detection here does not come from amount-based rules. It comes from counterparty network analysis, goods-versus-payment consistency in trade documentation, beneficial ownership resolution on corporate customers registered in free zones, and attention to entities whose stated business and observed payment behaviour do not reconcile.
This is also a reminder that jurisdiction risk is granular. The UAE is a major, well-regulated financial centre that exited the FATF grey list in 2024. The action here targets one institution’s operations in that market. Country-level risk ratings, applied bluntly, would have missed this entirely.
What to do in the next thirty days
Run a lookback. Search customer, counterparty, beneficiary and payment-message data for the named institution and its identifiers across at least a 24-month lookback — not just the live customer file.
Map the second tier. Document, for every foreign intermediary you use, who their correspondents are. If you cannot answer that question for a partner, that is the finding, and it will be an examiner’s finding too.
Update policy language. Confirm that your program addresses indirect exposure through nested and pass-through relationships, and that your escalation path handles a Section 311 finding distinctly from an OFAC designation — the two require different responses.
Comment, if affected. The comment period is an opportunity. Institutions with legitimate corridor exposure should say so on the record rather than absorb the operational consequences silently.
Consider SAR obligations. Section 311 findings frequently surface conduct that also warrants a SAR. Look backwards at what you processed, and file where the facts support it.
FinCheck’s perspective and the way forward
Section 311 spent several years as a rarely used authority. It is now, plainly, back in rotation — Huione Group and its successor entities in 2025 and 2026, and now a UAE branch of a major Egyptian state bank. Treasury has demonstrated that it will use the special measure not only against opaque offshore shells but against institutions embedded in mainstream regional banking, and it will do so on the basis of aggregated transaction patterns rather than a single scandal.
The strategic implication for our clients is that correspondent and intermediary risk can no longer be treated as a large-bank concern. Any firm that moves value across borders — an MSB, a payments platform, a crypto exchange with fiat rails, a gaming operator settling international payouts — inherits the compliance posture of every institution in its payment chain. The firms that will handle the next action well are those that have already documented that chain, not those that begin the exercise when the Federal Register notice lands.
Our view is that the practical response is structural, not reactive: a correspondent and intermediary inventory refreshed at least annually, monitoring scenarios built around counterparty networks rather than dollar thresholds, and a risk assessment that separates jurisdiction risk from institution risk. That work is unglamorous. It is also the difference between a two-day lookback and a six-month remediation.
Let’s talk
FinCheck LLC supports FinTechs, MSBs, crypto and digital asset platforms, gaming and sweepstakes operators, payroll processors and e-commerce businesses with independent AML audits, BSA/AML risk assessments, policy and procedure development, fractional compliance officer coverage, money transmission licensing and FBO/BaaS setup. If this action touches your payment chain — or you are not yet certain whether it does — we can help you find out quickly.
Connect with FinCheck LLC on LinkedIn to discuss a correspondent and intermediary risk review.