WASHINGTON, D.C. — In a week that stretched from bond markets to battlefields and from cyber back alleys to university tax credits, the U.S. Department of the Treasury moved to assert American financial power on nearly every front, revealing a sweeping Trump-era strategy to pull money toward the United States while cutting off cash pipelines to criminals, cartels, and foreign adversaries.
In a dense series of announcements between November 18 and 20, officials published delayed capital flows data showing massive foreign inflows into U.S. assets, unveiled new economic and capital-markets pacts with Saudi Arabia, tightened sanctions on Russian cybercriminal infrastructure and Iranian oil networks, targeted one of the world’s most violent drug kingpins, and moved to block illegal immigrants from receiving key refundable tax credits starting in 2026.
Taken together, the moves paint a portrait of a department waging what amounts to a global money war — courting foreign investment into U.S. markets while aggressively weaponizing access to the dollar system against those who threaten American security or defy U.S. law.
“This is about enforcing the law, protecting Americans, and making sure the financial system works for the people who play by the rules,” Treasury Secretary Scott Bessent said in one of several statements this week, vowing to uphold President Donald Trump’s America First agenda from the bond desk to the sanctions list.
TREASURY DATA REVEAL MASSIVE FOREIGN INFLOWS INTO U.S. ASSETS
The week began with a look under the hood of the global financial engine. With the federal government only recently reopened after a partial shutdown, Treasury released delayed Treasury International Capital (TIC) data for August and September — offering a rare, back-to-back snapshot of global appetite for U.S. securities.
The figures were striking.
In August, the United States recorded a net TIC inflow of 187.1 billion, followed in September by another 190.1 billion. The TIC measure combines net foreign acquisitions of long-term U.S. securities, short-term instruments such as Treasury bills, and related banking flows.
Foreign private investors were the central drivers of those inflows. In August, net foreign private inflows reached 224.9 billion, while foreign official holders — primarily central banks and sovereign funds — registered net outflows of 37.9 billion. In September, private inflows were 213.9 billion against official outflows of 23.7 billion.
The data show foreign residents piling into long-term U.S. securities at a brisk pace. Net purchases of long-term U.S. securities totaled 181.2 billion in August and 208.5 billion in September. Private foreign investors accounted for nearly all of that demand — 196.4 billion in net purchases in August and 210.7 billion in September. Official institutions, by contrast, were modest net sellers, offloading 15.1 billion in August and 2.2 billion in September.
The details offer a window into how markets are interpreting U.S. policy. While some foreign governments appear to be trimming certain holdings, global private investors are leaning in — buying up long-term U.S. debt and other assets amid relative economic resilience and rising yields.
“The flows suggest that as Washington tightens sanctions abroad and tries to rewire supply chains, private capital is still voting with its feet and heading for U.S. markets,” said one senior Treasury official, speaking generally about capital flows.
American investors, meanwhile, continued to expand their own global footprint. U.S. residents increased holdings of long-term foreign securities by 47.0 billion in August and 28.7 billion in September.
After adjusting for factors like foreign portfolio acquisitions of U.S. stocks via stock swaps, Treasury estimated overall net foreign purchases of U.S. long-term securities at 134.2 billion in August and 179.8 billion in September.
Short-term flows were more volatile. Foreign holdings of U.S. Treasury bills rose by 25.0 billion in August but fell by 22.0 billion in September. Holdings of all dollar-denominated short-term U.S. securities and other custody liabilities increased 12.1 billion in August, then declined 8.3 billion the following month.
Banks also played a role. U.S. banks’ own net dollar-denominated liabilities to foreign residents — a measure of how much they owe foreign counterparties — rose 40.8 billion in August and 18.6 billion in September.
For the administration, the combined picture is politically potent: as Washington ramps up sanctions and enforcement, the dollar remains the central magnet for global savings, even as officials move to shut out bad actors.
DEEPENING TIES WITH SAUDI ARABIA: CAPITAL, MINERALS, AND TAX COOPERATION
If the TIC data showed the world buying into the U.S. financial system, Treasury’s next announcement signaled how the department hopes to shape the terms of that partnership abroad — beginning with one of Washington’s most consequential economic allies.
On November 17, Treasury and the Kingdom of Saudi Arabia signed two new frameworks for enhanced cooperation, described as pillars of President Trump’s Strategic Economic Partnership with the kingdom, unveiled in May.
Treasury officials framed the agreements as delivering concrete benefits to American taxpayers, not just diplomatic talking points.
“These new frameworks further deliver on the President’s foreign policy vision that benefits America and its people first,” the department said, emphasizing that the pacts are designed to influence how global economic institutions and capital markets operate — and who they serve.
The first agreement, the Financial and Economic Partnership Arrangement, was signed by Secretary Bessent and Saudi Finance Minister Mohammed Aljadaan. It formalizes cooperation on key issues at the World Bank, the International Monetary Fund and the G20, with an explicit goal: ensuring those institutions “deliver for Americans.”
The arrangement also locks in continued U.S.–Saudi coordination on anti–money laundering and counter–terrorist financing, aiming to make the global financial system “even safer” by tightening scrutiny of illicit flows.
The second agreement, the Arrangement Regarding Capital Markets Collaboration, focuses on day-to-day financing activity between U.S. and Saudi jurisdictions. The framework aims to improve the efficiency of capital markets transactions, standard-setting and cross-border regulation between the two countries. Treasury will lead U.S. engagement in close coordination with domestic regulators.
“Efficiently moving capital for investments between our economies is a key catalyst to realize the full economic potential of the relationship between our countries,” Treasury said, underscoring the goal of leveraging financial assets “to drive growth that benefits the American people.”
Beyond financial plumbing, Treasury also welcomed a separate Strategic Framework for Cooperation on Securing Uranium, Metals, Permanent Magnets, and Critical Minerals Supply Chains — an agreement firmly in the national security wheelhouse. The framework is designed to enable two-way investment in critical minerals and related infrastructure, which U.S. officials describe as “a cornerstone of the strategic partnership” and a major step toward building a more resilient global supply chain.
Finally, Treasury and Saudi Arabia’s Zakat, Tax and Customs Authority reached agreement in principle on a Tax Information Exchange Agreement. The accord is meant to deepen the economic relationship while enhancing both nations’ ability to prevent cross-border tax abuse and fraud.
The raft of agreements underscores a central feature of the administration’s approach: using bilateral partnerships to shape global standards — from development banks to tax transparency — in ways that Treasury argues are aligned with U.S. workers, investors and security interests.
CYBERSPACE CRACKDOWN: RUSSIAN BULLETPROOF HOSTING IN THE CROSSHAIRS
If cooperation with Saudi Arabia showed how Treasury hopes to steer friendly capital, the next set of actions showed how it plans to choke off hostile infrastructure.
On November 19, Treasury’s Office of Foreign Assets Control (OFAC), acting in coordination with Australia and the United Kingdom, announced sanctions on Media Land, a Russia-based bulletproof hosting provider, along with three of its leaders and three related companies.
Bulletproof hosting services sell server space and infrastructure specifically engineered to evade detection and resist law enforcement takedowns. These services provide the digital safe houses used by ransomware gangs, malware distributors and other cybercriminals who target businesses and critical infrastructure.
“These so-called bulletproof hosting service providers like Media Land provide cybercriminals essential services to aid them in attacking businesses in the United States and in allied countries,” said John K. Hurley, Treasury’s under secretary for terrorism and financial intelligence. “Today’s trilateral action with Australia and the United Kingdom, in coordination with law enforcement partners, demonstrates our collective commitment to combatting cybercrime and protecting our citizens.”
Media Land, headquartered in St. Petersburg, has hosted infrastructure used by criminal marketplaces and notorious ransomware groups including Lockbit, BlackSuit and Play, officials said. Its systems were also used in multiple distributed denial-of-service attacks targeting U.S. companies and critical sectors.
Among those designated:
- Media Land LLC itself
- Sister company ML Cloud, often used in tandem with Media Land in ransomware and DDoS operations
- General director Aleksandr Volosovik, known online as “Yalishanda,” who personally provisioned servers and troubleshooting for criminal clients
- Employee Kirill Zatolokin, responsible for collecting payments and coordinating with other cyber actors
- Media Land Technology and Data Center Kirishi, two subsidiaries 100 percent owned by Media Land
OFAC also designated Yulia Pankova, who handled finances and legal issues for Volosovik and knew of his illicit activities, for providing material support.
All were targeted under Executive Order 13694, as amended, which covers foreign cyber-enabled activities that threaten U.S. national security, foreign policy or economic health.
The action builds on sanctions earlier this year against Aeza Group, another bulletproof hosting provider. Treasury found that Aeza’s leadership had attempted to rebrand and move infrastructure through a UK front company, Hypercore Ltd., in an effort to evade restrictions. Hypercore, Aeza’s new director Maksim Makarov, associate Ilya Zakirov, and two companies used by Aeza — Smart Digital Ideas DOO in Serbia and Datavice MCHJ in Uzbekistan — were also sanctioned.
The message from OFAC: designation is not a one-off event, and attempts to route around sanctions with new shells and brands will be answered with further actions.
Behind the legal language lies a broader policy: treat cyber infrastructure that enables ransomware and large-scale attacks as a national security target, and put pressure not just on hackers but on the companies, executives and financial intermediaries that keep their operations online.
A FUGITIVE KINGPIN AND HIS GLOBAL LAUNDERING EMPIRE
Treasury’s focus on illicit networks was not limited to cyberspace. In a separate move, OFAC sanctioned Ryan James Wedding — a former Olympic snowboarder for Team Canada turned alleged multi-ton cocaine trafficker and global murder-for-hire organizer — along with nine associates and nine entities linked to his operations.
Wedding, who competed at the 2002 Winter Olympics, is now on the FBI’s Ten Most Wanted Fugitives list. U.S. authorities say he is responsible for trafficking huge volumes of cocaine through Colombia and Mexico into the United States and Canada, using cryptocurrency to move and launder proceeds and ordering dozens of murders across the Western Hemisphere, including killings of U.S. citizens.
“Today we’re exposing the network of associates and enablers behind Ryan Wedding — one of the most notorious criminals and narcotraffickers still evading justice,” Hurley said. “Our goal is simple: make it difficult for criminals like this to profit from poisoning our communities.”
The sanctions were rolled out in close coordination with the FBI and the Justice Department, which is issuing indictments against Wedding and his network. Treasury also worked with Mexico’s financial intelligence unit, and the State Department raised its reward offer for information leading to Wedding’s arrest or conviction from 10 million to up to 15 million.
Officials described a sprawling criminal architecture.
In Mexico, one key associate, Edgar Aaron Vazquez Alvarado — “the General” — allegedly provides protection for Wedding, using contacts in law enforcement to locate targets. He owns fuel-related companies VRG Energeticos, Grupo RVG Combustibles, and Grupo Ares Imperial, all sanctioned as part of the network.
Wedding’s wife, Miryam Andrea Castillo Moreno, is accused of laundering drug money and helping orchestrate violent acts. Colombian national Carmen Yelinet Valoyes Florez allegedly runs a high-end prostitution ring in Mexico, helped arrange the murder of a federal witness in January 2025, and introduced Wedding to his Colombian girlfriend, Daniela Alejandra Acuna Macias, who officials say knowingly benefited from his drug-funded lifestyle and assisted in intelligence gathering on his rivals.
Canadian attorney Deepak Balwant Paradkar, once a legitimate criminal defense lawyer, is accused of crossing the line into active participation — introducing Wedding to traffickers, facilitating bribery and murder, and allowing Wedding to eavesdrop on privileged conversations with other clients.
Wedding himself was designated under Executive Order 14059, which targets actors involved in the international proliferation of illicit drugs. His close associates — including Vazquez, Castillo, Valoyes, Paradkar, Acuna and several related companies — were designated for providing material support or benefiting from his operations.
Treasury also exposed an elaborate transatlantic laundering machine. Canadian jeweler Rolan Sokolovski allegedly managed books and laundered funds through his Toronto storefront, 2351885 Ontario Inc, doing business as Diamond Tsar, while moving millions through cryptocurrency. Former Italian special forces member Gianluca Tiepolo, officials say, managed Wedding’s luxury car and motorcycle assets via companies in Italy and the United Kingdom, and operated tactical training camps for hired killers through his firm Windrose Tactical.
Additional associates in Italy and the UK — including businessman Cristian Diana and British national John Anthony Fallon — helped manage and conceal assets through firms like Stile Italiano, TMR Ltd, LMJ Trading and Made In Italy Motorcycles.
All were swept into OFAC’s dragnet, cutting them off from the U.S. financial system and warning banks worldwide that doing business with them could lead to enforcement action.
The twin sanctions packages — against Russian bulletproof hosting providers and a hemisphere-spanning drug cartel — signal Treasury’s intent to use financial tools at scale against both digital and physical criminal empires, with a particular focus on infrastructure, intermediaries and enablers.
CUTTING OFF TAX CREDITS FOR ILLEGAL IMMIGRANTS
While the sanctions and capital flow announcements dominated the national security and markets narrative, Treasury also unveiled a domestic policy change with direct implications for millions of households and the contentious politics of immigration and tax fairness.
On November 20, the department announced that it would issue regulations clarifying that the refunded portions of several widely used individual income tax credits will be treated as “federal public benefits” under the 1996 Personal Responsibility and Work Opportunity Reconciliation Act (PRWORA).
The move would mean that illegal immigrants and other non-qualified aliens would no longer be able to receive the refundable portion of these credits, which include:
- The Earned Income Tax Credit (EITC)
- The Additional Child Tax Credit (ACTC)
- The American Opportunity Tax Credit (AOTC) for higher education
- The forthcoming Saver’s Match Credit, designed to encourage retirement savings
“Under President Trump’s leadership we are enforcing the law and preventing illegal aliens from claiming tax benefits intended for American citizens,” Bessent said. “We will continue to ensure that taxpayer resources are directed only to those who are entitled under the law.”
The department’s decision rests in part on a recent opinion from the Justice Department’s Office of Legal Counsel adopting this interpretation of PRWORA. Treasury will publish a notice of proposed rulemaking that incorporates that legal analysis, with final regulations expected to apply beginning in tax year 2026.
Supporters say the move aligns tax policy with immigration law and prevents misuse of credits that can produce thousands of dollars in refunds for qualifying low- and moderate-income families. Critics are likely to argue that the change could affect mixed-status households and children in immigrant families.
The administration cast the move as a win for the President’s pledge to “preserve taxpayer-funded benefits exclusively for those who are legally entitled to receive them,” and as part of a wider effort to align tax enforcement with immigration rules.
WIDENING THE NET ON IRAN’S OIL, SHIPPING, AND AIRLINES
In another major step, OFAC announced a sweeping array of new sanctions aimed at Iran’s armed forces, their oil export networks and the “shadow fleet” of tankers the regime uses to bypass restrictions.
After its defeat in the 12-Day War with Israel, Treasury said, Iran’s military has leaned more heavily on crude oil sales to fund its rebuilding and operations. The U.S. response: target the brokers, front companies, ships and logistics providers that move that oil from Iranian ports to refineries and buyers across Asia.
“Today’s action continues Treasury’s campaign to cut off funding for the Iranian regime’s development of nuclear weapons and support of terrorist proxies,” Bessent said. “Disrupting the Iranian regime’s revenue is critical to helping curb its nuclear ambitions.”
The latest package focuses heavily on Sepehr Energy Jahan Nama Pars Company, the designated oil sales arm of Iran’s Armed Forces General Staff. Treasury detailed a network of United Arab Emirates and Panama-based fronts, ship management firms and shadow-fleet vessels that, collectively, move billions of dollars’ worth of Iranian crude and liquefied petroleum gas annually.
Among the entities designated:
- UAE-based Luan Bird Shipping Service, which chartered tankers for Sepehr Energy Jahan and handled commissions on sanctioned vessels like BOREAS, SIRI, OXIS, BALU and ROC
- UAE-based Mars Investment, a front company that financed chartering deals with a previously sanctioned shipping firm, Oceanlink Maritime
- Panama-based Loire Shipping, registered owner of the sanctioned vessel HEBE (now DAKSHA), which continued to sail on Sepehr’s behalf
- Greece-based Altomare S.A., owner and operator of the Panama-flagged KALLISTA, which transported nearly four million barrels of Iranian crude in early 2025
OFAC also targeted Moon Line Plastics and Raw Materials Trading in the UAE for acting as shipper of Iranian military oil and disguising Iranian crude as Malaysian heavy oil, as well as Alsafeenah Althahabya Ship and Boats Spare Parts and Components Trading, a ship-to-ship services provider in the Gulf that facilitated cargo transfers from sanctioned Iranian tankers to shadow vessels.
India-based RN Ship Management and two of its executives were designated for operating multiple vessels used in Sepehr shipments, including the sanctioned SOBAR. European traders BPT Berlin Petroleum Trading and UAE-based Shandong Independent Energy Trading were sanctioned for purchasing millions of barrels of Iranian crude from Sepehr fronts at steep discounts.
Treasury went further up the chain, sanctioning individuals like Hamidreza Heidari, Mohammad Moloudi, Kaveh Rostami Zahabi and others who handled technical operations, finance, cryptocurrency, documentation, and banking access, including European investments arranged by Bulgarian businesswoman Penka Ivanova Madzharska.
In parallel, OFAC moved to uphold “maximum pressure” on Iran’s broader shadow fleet, designating Liberia-registered Pioneer Tankers Marine and four Panama-based maritime trading companies that own or operate tankers moving Iranian LPG and other petroleum products to South Asia.
Several vessels — including PIONEER SAM, TUSITALA, NEXO, KAISA I and GAS ATHENA — were identified as blocked property. Many are linked to Iranian LPG magnate Seyed Asadoollah Emamjomeh, previously sanctioned for operating in Iran’s petroleum sector.
Treasury also turned its attention to the skies. Iran-based Yazd International Airways, a subsidiary of Mahan Air, was sanctioned for assisting the airline in supporting Iranian proxies and destabilizing activities. Officials said Yazd-registered aircraft had been used by the Islamic Revolutionary Guard Corps–Qods Force to shuttle officers to Lebanon, deliver weapons to Syria and support Lebanese Hizballah operations.
The managing director and vice chairman of Yazd Airways, Reza Heidari and Reza Namakshenas, were designated, along with Mahan flight operations manager Mohammad Mahdi Maghfoori and pilot Mohammad Reza Moaref Jahromi, who allegedly helped procure Western aircraft and use civilian cover to smuggle weapons.
Gambia-based Macka Invest Company was sanctioned for helping Mahan acquire Airbus A340 jets from Lithuania. Several Western aircraft now operating under Mahan’s fleet — including EP-MJA, EP-MJE, EP-MJG, EP-MMU, EP-MEB, EP-MEH and EP-MJF — were identified as blocked property.
All of the Iranian-related measures were taken under a mix of counterterrorism and Iran-specific Executive Orders, including E.O. 13224 and E.O. 13902, which targets Iran’s petroleum and petrochemical sectors. Officials framed the actions as part of a coherent strategy to drive up costs, complicate exports and shrink Iran’s revenue per barrel of oil, while targeting logistics and procurement networks that underpin Iran’s regional interventions.
THE POWER — AND LIMITS — OF SANCTIONS
Each of this week’s sanctions announcements came with a familiar set of legal consequences. All property and interests in property of designated persons that fall under U.S. jurisdiction must be blocked and reported to OFAC. Any entity owned 50 percent or more by one or more blocked persons is automatically treated as blocked as well.
Unless authorized by OFAC license or exempt, U.S. persons are generally prohibited from engaging in transactions involving designated entities or their property. That includes financial institutions processing payments, companies providing services, and individuals doing business with blocked actors.
Treasury underscored that foreign institutions and persons also face risk. Those who knowingly provide significant support or services to designated targets may themselves become subject to sanctions or enforcement actions.
The department also reiterated a key principle: sanctions are intended to change behavior, not impose permanent punishment. OFAC repeatedly stresses its willingness to remove persons from the Specially Designated Nationals and Blocked Persons List when they demonstrate a shift in conduct consistent with U.S. law and policy.
A SINGLE WEEK, A BROAD AGENDA
Viewed in isolation, each of this week’s announcements would be significant. Together, they reflect a Treasury Department operating on multiple fronts at once:
- Attracting global capital into U.S. securities even after a government shutdown
- Locking in economic partnerships and critical minerals deals with key allies like Saudi Arabia
- Targeting digital infrastructure that enables ransomware and cybercrime
- Exposing and isolating a violent transnational narcotrafficking empire
- Rewriting tax rules to exclude illegal immigrants from refundable credits
- Tightening the noose on Iran’s oil exports, shipping networks and airline logistics
Behind the numbers and legal citations is a coherent message: access to the U.S. financial system and the dollar-based global economy is both a privilege and a tool of policy, one that the administration intends to use aggressively in service of its America First agenda.
For markets, the TIC data show that, so far, investors are still willing to bet on U.S. assets amid global uncertainty. For allies and adversaries alike, the week’s moves serve as a reminder that Treasury is more than a domestic finance ministry. It is, increasingly, one of Washington’s most powerful instruments of economic statecraft — capable of welcoming capital with one hand and cutting off lifelines with the other.
For the latest news on everything happening in Chester County and the surrounding area, be sure to follow MyChesCo on Google News and MSN.