Sanctions on Iran Built a Billion-Dollar Compliance Industry Overnight
Every time Treasury adds a name to its Iran blacklist, a constellation of private firms — many staffed by former regulators — collects fees to help banks comply, creating a financial ecosystem...
The single most documented fact in the architecture of U.S. Iran sanctions enforcement is this: BNP Paribas paid $963 million to the Treasury Department's Office of Foreign Assets Control in June 2014 — and then spent an estimated $500 million or more hiring the same class of consultants, monitors, and compliance technology vendors that former OFAC officials now staff and advise. The penalty created the contract. The regulator created the market. And the officials who wrote the rules walked through a revolving door to collect on both sides.
The Office of Foreign Assets Control administers the Iran sanctions regime under authority rooted in the International Emergency Economic Powers Act of 1977 and a layered stack of legislation spanning four decades — from the Iran Sanctions Act of 1996 through the Comprehensive Iran Sanctions, Accountability, and Divestment Act of 2010 to the maximum-pressure executive orders of 2018 through 2020. Each legislative expansion and each executive order creates a new compliance obligation. Each new compliance obligation creates a billable event for an industry that did not exist at scale twenty years ago. The global anti-money laundering and sanctions compliance technology market stood at approximately $1.5 billion in 2017, according to MarketsandMarkets research cited in investor presentations from LSEG and LexisNexis Risk Solutions. By 2021 it had reached an estimated $3.5 billion. Projections place it at $7.5 billion by 2027. The primary regulatory driver identified in those same investor presentations is OFAC enforcement escalation tied directly to the Iran sanctions program.
The companies collecting that revenue are publicly identifiable. LSEG — which absorbed Refinitiv, formerly Thomson Reuters Financial and Risk — operates the World-Check risk intelligence database, used by more than 10,000 institutional clients globally, according to the company's own disclosures. Every addition to the OFAC Specially Designated Nationals list triggers a subscription update cycle that the company's marketing materials describe as a demand driver. RELX Group's LexisNexis Risk Solutions segment reported £3.3 billion in revenue for 2022, per the RELX PLC Annual Report, with sanctions screening products listed as a growth category. Moody's Corporation paid $824 million in July 2019 to acquire Accuity, a sanctions-screening firm, as documented in the company's 8-K filing with the Securities and Exchange Commission. Oracle Financial Services markets its Anti Money Laundering suite explicitly around OFAC compliance requirements, per its annual investor presentations. Private firm ComplyAdvantage raised $100 million in a Series C extension in 2021, with Iran sanctions compliance listed as a primary use case in its funding announcements archived on Crunchbase.
The penalty-to-compliance-contract pipeline is the mechanism that makes this ecosystem self-reinforcing. When OFAC and the Justice Department settled with HSBC in December 2012 for $1.256 billion in combined penalties, the settlement agreement required the appointment of an independent compliance monitor. Michael Cherkasky of Exiger was appointed to that role by the Justice Department; monitor fees were reported in public proceedings as exceeding $100 million over the five-year term. HSBC simultaneously hired Stuart Levey — who had served as Treasury's Under Secretary for Terrorism and Financial Intelligence from 2004 to 2011, the period during which HSBC's violations occurred and the enforcement infrastructure was constructed — as its Chief Legal Officer in 2012. Levey's Senate confirmation testimony and firm biography are public record. The arrangement is legal. It is also the clearest documented illustration of how the officials who design sanctions enforcement subsequently monetize compliance with that enforcement.
The revolving door runs in both directions and across multiple institutions. Adam Szubin, who served as OFAC Director from 2005 to 2015 and then as Under Secretary of Treasury for Terrorism and Financial Intelligence through 2017, is now a partner at Sullivan and Cromwell LLP, where his biography confirms he advises financial clients on OFAC compliance, per the firm's public website. John Smith, OFAC Director from 2015 to 2018, joined Morrison and Foerster LLP to lead its OFAC practice group, per that firm's public biography. David Cohen, Under Secretary for Terrorism and Financial Intelligence from 2011 to 2015 and later CIA Deputy Director, joined WilmerHale LLP and advises financial institutions on sanctions compliance, per WilmerHale's public website. Brian Hook, Special Representative for Iran from 2018 to 2020, joined Cerberus Capital Management as a senior advisor, per Cerberus's public disclosure. None of these arrangements violates existing ethics law. All of them represent the transfer of regulatory knowledge — built at public expense — into private revenue streams that are not required to be publicly disclosed beyond standard lobbying registrations, which cover only direct legislative and executive branch contact, not legal advisory work.
On the legislative side, the bipartisan authorship of the sanctions architecture is documented in Congressional Research Service report IF12452. The Comprehensive Iran Sanctions, Accountability, and Divestment Act of 2010 was sponsored by Democratic Senator Christopher Dodd and Democratic Representative Howard Berman. The Iran Threat Reduction and Syria Human Rights Act of 2012 was co-sponsored by Democratic Senator Robert Menendez and Republican Representative Ileana Ros-Lehtinen. The Central Bank of Iran sanctions embedded in the 2012 National Defense Authorization Act were co-sponsored by Republican Senator Mark Kirk and Democratic Senator Menendez. The pattern of bipartisan co-sponsorship means the financial beneficiaries of sanctions expansion have operated under consistent policy regardless of which party controlled Congress or the White House — a structural feature that reduces political risk for the compliance industry and its investors.
What remains hidden is substantial. No publicly traded compliance firm breaks out Iran-sanctions-specific revenue in its filings — the market size figures are aggregate estimates with proprietary methodologies. The specific financial institutions invited to participate in Treasury's FinCEN Exchange sessions on Iran sanctions evasion — sessions that, per FinCEN's public announcement, provide attendees with intelligence about sanctions evasion networks — are not named in public releases. The client lists of former OFAC officials now in private practice are not subject to disclosure requirements. The compliance consulting revenues of Guidehouse, Kroll, and Ankura — the three firms most frequently cited in OFAC enforcement contexts — are entirely private. The instrument that would begin to close these gaps is a combination of: expanded lobbying disclosure requirements covering legal advisory work on regulatory matters, not merely direct legislative contact; mandatory public disclosure of FinCEN Exchange participation; and SEC rulemaking requiring publicly traded compliance firms to segment revenue by the specific regulatory program driving demand. Until those disclosures exist, the full financial architecture of Iran sanctions enforcement — who profits, in what amounts, with what relationship to the officials who wrote and administer the rules — remains a matter of inference from public filings rather than established record.