Washington goes after the lawyers behind Iran's shadow fleet as INTERPOL arrests 1,462 across Africa

On 21 October 2026 OFAC designated Karnakis and Karnakis, a Panama- and Greece-based law firm that Treasury says registered shipping companies owning shadow fleet vessels and acted as corporate agent for many of Seyed Asadoollah Emamjomeh's firms, together with its two founders and co-owners and three employees. The ship manager Roxette Maritime Shipping and Trading S.A., the Singapore port agent Amigoz Singapore Pte. Ltd. and Dubai-based Whales Shipping Line LLC were also designated, all under E.O. 13902, and nine vessels were identified as blocked property: seven Panama-flagged ships managed by Roxette and two UAE-flagged ships owned by Whales Shipping Line. FinCEN said it had issued its first administrative subpoena under 31 U.S.C. 5318(k) of the Bank Secrecy Act, to investigate a Greek bank's potential ties to Iran and its proxies, and multiple requests for information on banks' relationships with designated Iranian financial institutions. General Licenses GG and HH authorise wind-down until 12:01 a.m. EST on 20 November 2026. The same day OFAC removed North Korea-related entries linked to Moxing Cartoon and Shanghai Hongman and the Belarus-related listing of Andrei Alekseevich Rybakov.

On 19 October 2026 the State Department sanctioned five entities it connects to Linwei Ding, a Chinese national convicted by a US federal jury on 29 January 2026 of seven counts of theft of trade secrets, including Google trade secrets on super intelligence technology. The action uses the Protecting American Intellectual Property Act (PAIPA). The four MiraclePlus entities (Qiji Chuangtan Beijing Investment Management Co Ltd and three Beijing Qiji Chuangtan partnerships) and Shanghai Zhisuan Technology Co Ltd were added to OFAC's Non-SDN Menu-Based Sanctions List, not the SDN List, each with blocking of property and four further PAIPA measures. PAIPA General License 2 allows wind-down with the four MiraclePlus entities until 12:01 a.m. EST on 19 January 2027; Shanghai Zhisuan is not covered.

On 16 October 2026 the President issued Executive Order 14436, implementing the Lindsey O. Graham Sanctioning Russia and Iran Act of 2026, which he signed into law on 18 September 2026. The order sets duty increases, including 500 per cent on goods from Russia and 100 per cent for the five largest importers of Russian crude oil and gas and for the top five facilitators of Russian oil sanctions evasion. Section 4 then waives the duties under sections 112 and 113 of the Act and the order, and the sanctions and restrictions in sections 102(a), 102(d), 102(e), 103 to 111 and 117. The waivers remain in effect until the President or the Secretary of State determines that further action is appropriate; the order sets no notice period.

On 20 October 2026 the World Bank added seven parties to its list of ineligible firms and individuals. In Nigeria, Idmon Engineering and Construction Company Limited (Warri) and Bruke Lonia Nigeria Limited (Ibadan) were debarred for fraudulent practices until 19 October 2030 and 19 February 2030, Inclined Tech. & Construction Company Limited (Warri) until 19 April 2029, and Idmon Inclined Joint Venture Ltd. (Ibadan), as a controlled affiliate of a sanctioned entity, until 19 October 2030. In Tanzania, Aqgola Engineering & Management Services Limited and Aquiline Joseph Massawe were debarred for corrupt and fraudulent practices until 19 February 2031, and Godfrey William Mashauri until 19 February 2029. On 16 October the Bank also recognised cross-debarments of China Railway 20th Bureau Group Corporation Ltd (from the African Development Bank, to 23 October 2027) and of three Costa Rican parties (from the Inter-American Development Bank).

On 22 October 2026 INTERPOL announced the results of Operation Serengeti III, run from 29 June to 31 August 2026 with law enforcement from 20 African countries and the United States, including Nigeria, Ghana, Côte d'Ivoire, Senegal, Benin, Cameroon, Kenya and South Africa. It led to 1,462 arrests, disrupted 10,909 malicious networks, identified 65,929 victims and recovered more than USD 105 million; financial investigations linked the activity, from cyber-enabled fraud, ransomware and business email compromise to online scams and digital extortion, to losses above USD 385 million. In Nigeria one suspect was arrested over a phishing and business email compromise operation that had amassed about 2.1 million email addresses, and another over an investment fraud promoted through messaging apps that moved more than USD 2.4 million, much of it laundered through cryptocurrency. Uganda arrested 365 foreign nationals running call-centre investment and pension fraud against victims in Asia.

On 21 October 2026 the Gambling Commission announced that L & L Europe Limited, which runs seven websites including allbritishcasino.com, casinocasino.com and hypercasino.com, will pay £900,000 as part of a regulatory settlement. The Commission found that its controls to identify money laundering and terrorist financing risks were not appropriate, relying mainly on financial thresholds and sampling rather than risk factors and customer risk profiles, and that it did not follow its own customer due diligence procedures, including on risks from newly opened bank accounts and on whether funds came from employment, business income or savings. It also found a term allowing only one withdrawal at a time unfair under the Consumer Rights Act 2015, and safer gambling alerts that were active on some of the websites only.

On 19 October 2026 INTERPOL launched a public awareness campaign, “Wait. Validate. Don't take the bait.”, on crime that uses AI-generated or altered media. It says generative AI tools now need little technical skill or investment and can copy a real person's face or voice from a small amount of online content, and that deepfakes, once seen mainly as a threat to public figures, increasingly target private citizens through investment and romance scams, impersonation such as a video call from a supposed colleague asking for a bank transfer, sextortion and disinformation. For businesses it recommends mandatory training on deepfakes and social engineering and multi-step verification of financial transactions, including face-to-face confirmation for large sums. The campaign is part of Project SynthWave PLUS, supported by the Government of Japan.