ICBC
Chinese state-owned commercial bank based in Beijing, with 57 trillion yuan in assets.
ICBC halted new lending to Hengli Petrochemical and four other US-sanctioned refiners in May 2026 on its regulator's orders, then faced clearing dollar trades alone after Washington's General Licence V lapsed on 24 May without guidance.
Last refreshed: 12 October 2026 · Appears in 1 active topic
How did a ransomware attack on ICBC reach the US Treasury market?
Timeline for ICBC
Mentioned in: Citrix replaces its own NetScaler fix
Cybersecurity: Threats and DefencesOFAC silent as sanctions licence lapses
Iran Conflict 2026Instructed by NFRA to halt new lending to Hengli and four other sanctioned refiners
Iran Conflict 2026: China halts big-four loans to refinersMentioned in: Hormuz tolls paid in yuan, $2m a ship
Iran Conflict 2026Halted new yuan loans to Hengli under NFRA instruction while defying MOFCOM Announcement No. 21 in practice
Iran Conflict 2026: China splits on Hengli before Trump-XiBackground
Industrial and Commercial Bank of China reported total assets of 57.07 trillion yuan at 30 June 2026, up from 53.48 trillion at the end of 2025, and first-half net profit of 176.5bn yuan, 4.5% higher than a year earlier. Liao Lin chairs the bank and Liu Jun serves as vice chairman and president.
Beijing controls ICBC through Central Huijin Investment, with 34.79% of the shares, and the Ministry of Finance, with 31.14%. That ownership puts the bank between two governments whenever Chinese industrial policy runs into US sanctions, as the 2026 Iran-linked refinery cases showed.
ICBC also carries a lasting cyber lesson. On 8 November 2023 ransomware hit ICBC Financial Services, its US broker-dealer, and briefly severed its connection to the DTCC clearing system; the bank said it still settled that day's US Treasury trades. Security researcher Kevin Beaumont tied the intrusion to an unpatched Citrix NetScaler Gateway, and the 2026 wave of NetScaler zero-days revived that case as the price of an exposed edge device.
ICBC stops new credit to sanctioned refiners
Bloomberg reported on 7 May 2026 that the National Financial Regulatory Administration had privately told ICBC and the other big four state banks to stop new yuan loans to Hengli Petrochemical, while China's commerce ministry publicly told the same refiners to defy US sanctions. The order was confirmed on 25 May; ICBC's existing credit lines to the five refiners stayed open, which kept it short of the full cut-off Washington wanted.
Dollar clearing poses ICBC the harder problem. Dalian Changxing took over 95% of Hengli's Singapore oil trading before the licence expired, and OFAC posted nothing on it. ICBC must decide for itself whether clearing that firm's dollar payments exposes it to US secondary sanctions.