The Criminal Empire of Iran's Revolutionary Guard. Part 4: Hezbollah and the Houthis.
How Hezbollah and the Houthis became criminal enterprises the war was designed to survive,
The captain was gone before the helicopters arrived. Soheil Jelveh, 52 years old, Iranian, master of the Panamanian-flagged bulk carrier MV Matthew, had radioed a medical emergency the night before. An Irish Coast Guard helicopter had hoisted him off the deck and flown him to a hospital in Cork. By the time the Army Ranger Wing fast-roped onto the Matthew on the morning of 26 September 2023, 160 nautical miles off the Waterford coast, Jelveh was already in custody but no longer aboard.
In the holds were 2.2 tonnes of cocaine, loaded at a Venezuelan port three weeks earlier.
On 4 July 2025, in the Special Criminal Court on Parkgate Street, Dublin, Justice Melanie Greally handed down 129 combined years of prison time to eight of the men involved.
Six had crewed the Matthew. Two had worked the MV Castlemore, a small Irish trawler bought for approximately €300,000 in cash by a Scottish operator who had flown in from Dubai for the purpose. The Castlemore had been sent out to rendezvous with the Matthew at sea and offload the cocaine for distribution into European markets. It had run aground on a sandbank off the Wexford coast instead.
Jelveh got 17 years and six months. His fellow Iranian crewman Saeid Hassani, 40, got 15. Irish police and Interpol assessed both men as affiliated with Hezbollah.
The heaviest individual sentence, 20 years, went to Cumali Ozgen, a 50-year-old Dutch national whom Greally described in her sentencing remarks as having the closest connection to the Dubai-based criminal organisation that had planned and funded the operation. The man who had actually run the operation from the UAE end, known in the court record as “Captain Noah” and identified by investigators as Mehdi Bordbar, was not in the dock. Neither was the Scottish operator who had delivered the Castlemore cash. Both remain at large.
At the post-sentencing briefing in Haulbowline, Assistant Commissioner Angela Willis confirmed that the Kinahan Organised Crime Group, the Dublin-founded, Dubai-based cartel that has been an OFAC-designated entity since 11 April 2022, was part of the investigation. Reporting by The Journal, citing security service sources, laid out the money. Iranian fundraisers for Hezbollah had put up a €5 million advance in a profit-share arrangement with a South American cartel, with Hezbollah’s cut routed back through Kinahan money-laundering channels to give the Iranians, as one source put it, some distance from the trail.
This is not a terrorism case. It is not a cartel. It is not a terrorist group. It is something else, a third form that the Islamic Revolutionary Guard Corps has spent three decades deliberately engineering, and that the 2026 war has now pushed into its most autonomous phase to date.
This is the fourth in a five-part series, The Organized Crimes of Iran’s Revolutionary Guard, examining how the IRGC built, operates, and is adapting one of the world’s most complex and profitable criminal enterprises. Parts One through Three examined the oil machine, the narco corridor, and the financial architecture. The final part will cover the IRGC’s seizure of Iran’s domestic economy.
1. The Franchise
Why is the IRGC’s relationship with Hezbollah and the Houthis better understood as a commercial franchise than as a proxy network?
On 17 April 2018, somewhere inside the Islamic Republic of Iran, a man named Muhammad Qasir sat down and wrote a receipt. The document confirmed that he had received, on Hezbollah’s behalf, a transfer of over $63 million. The recipient of the receipt was a senior official at the Central Bank of Iran.
The transaction surfaced four weeks later, in a Treasury designation that identified Qasir as the principal financial conduit between the IRGC-Quds Force and Hezbollah. Hundreds of Treasury documents have named Qasir since 2018. Only this one reproduces an amount, a date, and the detail that makes the whole operation legible: that a member of Hezbollah’s senior financial leadership was confirming receipt of a wire transfer to a counterpart at Iran’s central bank, in writing, as a matter of routine bookkeeping.
Read it again. A paramilitary organisation designated by the United States as a foreign terrorist organisation was receiving institutional transfers from the central bank of a sovereign state, and its financial officer was filing paper on them. This is not how clandestine operations function. This is how a corporate treasury functions. The $63 million was not salary payments or weapons procurement. It was a transfer into an ecosystem (Hezbollah’s Business Affairs Component, the Al-Qard al-Hassan quasi-bank, the diamond networks, the cocaine routes) that would generate multiples of that amount in revenue the Central Bank of Iran had no claim on.
The conventional frame reads this as patron-client finance. Iran pays; Hezbollah receives; the operation continues because the money keeps flowing; cut the flow, starve the client. It is the frame that governs most Western counter-terrorism thinking, and it is what produced the sanctions regime of the last twenty years. The frame is wrong. Iran was not funding Hezbollah’s operations in the sense a government funds a contractor. It was capitalising Hezbollah’s operations in the sense a franchisor capitalises a franchisee. Initial investment, continued support, brand protection, strategic direction. All of it in exchange for a cut of the revenue the franchisee would generate in territory the franchisee controlled.
Afshon Ostovar, writing in Security Studies in 2019 under the title The Grand Strategy of Militant Clients, noted the pattern without naming it: Hezbollah, he observed, does not solely depend upon resources from Iran, and Tehran does not control the group’s finances. Matthew Levitt of the Washington Institute, in Senate testimony on 21 October 2025, put it on a ledger. Hezbollah’s annual operating budget runs to approximately $1 billion. Iran supplies roughly seventy per cent, around $700 million. The remainder comes from illicit activity. Hanin Ghaddar, testifying before a House Foreign Affairs subcommittee the same month, identified the ecosystem that makes the remainder possible: Lebanon’s formal banking system has collapsed, and an $18 billion cash economy has grown up in its place, providing the medium through which the franchise monetises its revenue streams without generating records any regulator can read.
None of them named the architecture. It is a franchise system, and the Houthis in Yemen, coming later, have been onboarded to it. The franchisor provides capital, weapons, training, brand, and ideological cover. The franchisee is granted a territorial monopoly: southern Lebanon and the Shia diaspora in Hezbollah’s case, northwest Yemen and the Red Sea in the Houthis’. The franchisee uses the franchisor’s playbook to generate independent revenue. A portion flows back to Tehran. Most does not. The franchisee’s loyalty is secured not by financial dependence but by the fact that the brand and the weapons pipeline and the diplomatic cover are franchisor property, and can be withdrawn.
The framework is visible in the 6 November 2025 Treasury designation that documented the IRGC-QF having transferred over $1 billion to Hezbollah since January 2025 alone, through the worst year of Hezbollah’s existence, following the October 2024 strikes that killed Hassan Nasrallah, Hashem Safieddine, and most of the organisation’s senior military command. The conventional reading is that the money keeps flowing because Hezbollah depends on it. The franchise reading is the opposite. The money flows harder because Hezbollah’s own revenue streams have been stressed by war, and the franchisor is making up the shortfall to keep the enterprise functional while the franchisee rebuilds. In a patron-client relationship, wartime reveals the patron’s indispensability. In a franchise relationship, wartime reveals the franchisor’s investment in keeping the brand alive.
2. The BAC
What does the succession from Mughniyah to the Qasir cousins reveal about the institutional structure of Hezbollah’s criminal holding company?
On the evening of 12 February 2008, Imad Mughniyah walked out of a building in the Kafr Sousa district of Damascus and got into his Mitsubishi Pajero. A bomb concealed in the spare tyre detonated. The man who had run Hezbollah’s military wing since the 1980s, who had directed the 1983 Beirut barracks bombing that killed 241 American servicemen and a generation of subsequent operations against US, Israeli, and Western targets, was killed instantly. Israeli and American intelligence services never formally claimed the operation. Everyone understood who had done it.
What most people did not understand, and what would not become publicly documented for another eight years, was that Mughniyah had spent part of his career running something other than a terrorist organisation. He had also founded a drug-trafficking company. The DEA named it for the first time in a press release dated 1 February 2016: the Business Affairs Component, sitting inside Hezbollah’s External Security Organisation, responsible for the movement of large quantities of cocaine, coordinating with the IRGC-Quds Force through Unit 108/4400. By the time the DEA wrote that press release, Mughniyah had been dead for eight years. The company he had founded had continued operating without him. It had grown.
That the military wing and the commercial wing had been built by the same man in the same decade tells you how Hezbollah conceptualised the relationship between guns and money from the outset. They were not separate functions. They were the same function, expressed through different instruments. What the DEA’s 2016 release did not say, but what every subsequent Treasury designation has made visible, is that the BAC is the most important single institution in the entire IRGC proxy architecture. It is larger, more diverse, and more globally dispersed than anything the Houthis have built, than anything the Iraqi PMF militias operate, and than any comparable enterprise run by any state-sponsored non-state actor on earth. Hundreds of subsidiaries. Six continents. Run, structurally, as a business.
The succession chain the BAC has run through since Mughniyah’s death reveals the institutional logic. Hashem Safieddine inherited operational leadership of the Hezbollah commercial apparatus inside Lebanon, including the BAC’s flagship domestic revenue operations, until he was killed alongside most of Hezbollah’s senior leadership in the Israeli strike campaign of October 2024. His cousin Abdallah Safieddine was positioned at the other end of the franchise: resident in Tehran, Hezbollah’s dedicated representative to the IRGC-QF and to the Central Bank of Iran, designated by OFAC in May 2018 for working with the central bank to expand banking access between Iran and Lebanon. Two Safieddines. One in Beirut running operations, one in Tehran managing the franchise relationship. When Hashem died, Abdallah kept operating.
The operational boss on the ground was Adham Tabaja, designated 10 June 2015, and his career illustrates how the BAC monetises territorial control better than any other single file. Treasury’s 2015 language is the cleanest public summary available: in 2006, Tabaja used his ties to Hezbollah leadership to create a construction monopoly for Al-Inmaa Engineering and Contracting in the Hezbollah-controlled Dahieh suburb of Beirut. Hezbollah needed buildings. Tabaja built them. Nobody else bid. Al-Inmaa Group for Tourism Works LLC, registered in Lebanon’s commercial registry as entity 8-0788, branched outward from its Dahieh base into oil-services bids in post-2003 Iraq, subsidiaries in Baghdad and Basra, investment vehicles that served simultaneously as construction contractor, commercial enterprise, and Hezbollah treasury. Tabaja was not running a criminal sideline to Hezbollah’s political-military operation. He was building the commercial infrastructure that made the political-military operation financially autonomous.
Which brings us back to Qasir. Muhammad Qasir was the financial artery between the IRGC and Hezbollah for approximately fifteen years. His designation described him in clinical terms as a critical conduit for financial disbursements from the IRGC-QF to Hezbollah. A $10 million Rewards for Justice bounty was issued for his capture in October 2020. He survived both the designation and the bounty. He was killed in Beirut on 1 October 2024, in the same Israeli strike campaign that eliminated Nasrallah and Hashem Safieddine. At his funeral, Iran sent Khamenei’s personal representative, the signal that Tehran regarded Qasir not as a Hezbollah operative but as a member of the IRGC’s own franchise leadership.
What happened after his death is the most important single piece of evidence for the franchise model’s institutional resilience. His role was not inherited by a single successor. It was split. Ja’far Muhammad Qasir, his son, was assigned the revenue portfolio: the money flows, the Lebanese exchange network, the transfers from Iran into Hezbollah’s operational accounts. Ali Qasir, his nephew, was assigned the commercial-logistics brief: oil and gas sales out of Iran, coordination with Syrian businessman Yasar Husayn Ibrahim, and the attempted recovery in mid-2025 of the Iranian tanker Arman 114 (formerly the Adrian Darya 1) that had been seized by Indonesia in 2023. Both men were designated together in the November 2025 Treasury action that documented the $1 billion in transfers since January. The franchise had lost its senior financial officer. The architecture had split his portfolio across two family members and continued to function. This is not what a proxy network looks like. This is what a family business looks like, managed under institutional pressure, with succession planning that long predated the crisis that triggered it.
3. The Global Footprint
How does a Lebanese paramilitary end up moving cocaine through twelve Latin American countries, diamonds across West Africa, and cash into Dublin through a Dubai-based Irish cartel?
The Beqaa Valley, in eastern Lebanon, is the size of a large English county. It has grown hashish and opium since Ottoman times. Since the 1980s it has been, in every meaningful sense, Hezbollah territory. The Lebanese state’s writ does not extend there in any form that matters. And it was from a small operations base in the Beqaa that Ayman Joumaa, a Colombian-Lebanese dual national fluent in Spanish and Arabic, virtually unknown outside counter-narcotics circles, ran what was, at its peak, one of the largest cocaine-laundering operations the DEA has ever mapped.
The scale is the first thing. Joumaa’s network was moving cocaine from Colombia through Central America to Los Zetas in Mexico at a cumulative volume of approximately 85,000 kilograms. It was laundering proceeds at up to $200 million per month, not per year, per month, through the Lebanese Canadian Bank, which FinCEN designated a primary money laundering concern under Section 311 of the USA PATRIOT Act on 10 February 2011. Joumaa himself was designated by the US Treasury as a narcotics kingpin weeks earlier and indicted by the US Attorney for the Eastern District of Virginia in December of the same year. The laundering mechanism was elegantly mundane. LCB processed approximately $329 million in transactions to American used-car dealerships between January 2007 and early 2011. The cars shipped to West Africa, sold for cash, and the proceeds flowed back to Hezbollah as part of a circular trade that Treasury described in the court filings in the plain language of commercial finance. Judge Paul Crotty of the Southern District of New York approved a $102 million forfeiture settlement on 25-26 June 2013. Joumaa has never been apprehended. As of April 2026 he remains at liberty, somewhere in Lebanon, periodically photographed at weddings.
The Tajideens were a different kind of operation. Not cocaine logistics but commercial empire, a Lebanese trading family with operations across Sierra Leone, Guinea, the Democratic Republic of the Congo, Angola, Belgium, and Lebanon, designated as a Hezbollah-controlled network since 9 December 2010. The family’s public face was Kassim Tajideen, who was arrested at Casablanca airport in March 2017, extradited to the United States, and pleaded guilty before Judge Reggie Walton of the DC district court on 6 December 2018 to conspiracy to launder financial instruments in violation of IEEPA. Five years, $50 million forfeiture. The scale of the operation exposed in the DOJ filings was what made the case instructive. In the period following his original 2009 designation, Tajideen had cleared approximately $1 billion through the US financial system. Roughly $30 million of it had been wired to American vendors who had no idea they were supplying a Hezbollah financier: producers of poultry, producers of grains, and, in a detail that captures the absurdity of sanctions enforcement at scale, a California manufacturer of home safes. Tajideen was released on COVID compassionate grounds on 28 May 2020, reportedly tied to a prisoner swap for US citizen Amer Fakhoury, and returned to Beirut to a hero’s welcome. Most of the companies, including Tajco, Kairaba Supermarket in Banjul, Congo Futur in the DRC, and Grupo Arosfran in Angola, continue operating.
And then there is Nazem Said Ahmad, who is the single most creative money launderer in the BAC’s recent history. Ahmad is a Lebanese-Belgian diamond dealer, designated in a $440 million action on 18 April 2023, who figured out something the art market did not want anyone to figure out. The art market has no correspondent banking. It has no suspicious-activity reporting regime. It has no equivalent of Know Your Customer in any form the financial sector would recognise. So Ahmad, operating through a Beirut gallery and his son Firas’s South African company Mega Gems PTY LTD, simply converted Hezbollah money into canvases. More than $54 million in fine art since 2012. Picassos. Warhols. A concurrent Eastern District of New York criminal indictment named 52 individuals and entities across nine countries. The $10 million Rewards for Justice bounty for Ahmad’s capture remains open. A Warhol purchased in Beirut in 2017 for $4 million and sold at a New York auction house in 2022 for $6 million is a laundering transaction that has no counterparty any regulator can identify.
In Europe, the BAC’s most consequential recent operation is the one that opened this investigation. The MV Matthew joint venture with the Kinahan Organised Crime Group was not an improvisation. It was the mature product of a working relationship. The Kinahans, including Christy Kinahan Sr., Daniel Kinahan, and Christopher Kinahan Jr., together with the Dubai-based front companies Ducashew General Trading and Hoopoe Sports, were designated by the US Treasury on 11 April 2022, with a combined $15 million Rewards for Justice bounty. Dublin origin. Dubai base since approximately 2010. Cocaine from Iberia to the Middle East, arms brokerage, Gulf property laundering. What the MV Matthew case revealed, and what Ed Caesar documented in the New Yorker on 27 October 2025, is that the Kinahans have been acting as one of Hezbollah’s European laundering outlets for years. Iranian Hezbollah fundraisers co-financed a cocaine shipment with a Venezuelan cartel. The Kinahans provided the logistics and the back-channel that allowed Hezbollah’s cut to be repatriated to Lebanon without leaving a fingerprint on any Iranian account. Franchise to franchise. Two OFAC-designated transnational criminal structures pooling capital on a single operation.
The generalisation came later, and from an unexpected direction. Rawa Majid is a Swedish-Kurdish narcotrafficker operating between Stockholm, Istanbul, and Tehran. His Foxtrot Network is primarily a drug-importation operation serving the Scandinavian retail market. He is not a Hezbollah asset. He is not even Shia. And yet his organisation was recruited directly by the IRGC and the Iranian Ministry of Intelligence for a series of attacks on Israeli diplomatic facilities in Europe: grenades thrown at the Stockholm embassy on 31 January 2024, two Swedish teenagers sent to attack the Copenhagen embassy in October 2024, 12-year terrorism sentences handed down in February 2025. Treasury designated the network on 12 March 2025. The Foxtrot case established, for the first time publicly and at the level of US financial sanctions, that the franchise model is not limited to Shia militias with decades-old ideological alignment. It is a generalised operational architecture that the IRGC will extend to any criminal organisation capable of delivering violence or logistics on demand. MI5 Director-General Ken McCallum, speaking in October 2024, stated the conclusion plainly: “Iranian state actors make extensive use of criminals as proxies.” The proxies are the criminals. The criminals are the proxies. The category distinction that most Western counter-terrorism policy depends upon has dissolved.
