OFAC Iran Crypto Sanctions 2026: Compliance Obligations After the $100M Oil-Payment Designation

The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) has extended its Iran sanctions program deeper into digital asset infrastructure, designating a United Arab Emirates-based brokerage alleged to have processed more than $100 million in cryptocurrency tied to Iranian oil sales. For US crypto exchanges, custodians, payment processors, and the compliance officers who staff them, this is not an abstract foreign-policy development. The moment a name lands on the Specially Designated Nationals and Blocked Persons List (SDN List), strict-liability blocking obligations attach — no grace period, no knowledge requirement, and no safe harbor for a firm that simply had not refreshed its screening lists yet.

This analysis follows the sequence a compliance team actually works through: whether you have exposure, what you must freeze, what you must file and when, what it costs if you get it wrong, and what recourse exists if a designation catches you unfairly. Along the way it covers three overlays that are easy to miss — the FinCEN suspicious activity reporting obligation that runs alongside the OFAC report, the freeze-and-burn duties the GENIUS Act imposes on permitted stablecoin issuers, and the enforcement record that shows precisely which control failures OFAC has chosen to penalize.

Key Takeaways

• Blocking is immediate and strict-liability. Under the International Emergency Economic Powers Act (IEEPA), 50 U.S.C. §§ 1701–1706, civil liability attaches without regard to intent or knowledge. An exchange that processes a withdrawal for a newly designated party on day one has violated on day one.
• Blocked, rejected, and reportable are three different things. Property in which a designated person holds an interest must be frozen and reported within 10 business days under 31 C.F.R. § 501.603(b)(1)(i); transactions merely declined are reported under 31 C.F.R. § 501.604. Conflating them is itself a violation.
• The OFAC report probably is not your only filing. A sanctions hit at a money services business will frequently also trigger a suspicious activity report under 31 C.F.R. § 1022.320. Two regimes, two deadlines, two filings.
• Wallet addresses are identifiers, not the designation. The prohibition attaches to the person. Unlisted addresses controlled by that person are equally off-limits, so screening a static address list is not adequate diligence.
• The lookback is now ten years. Congress extended the IEEPA statute of limitations from five to ten years in April 2024, and OFAC conformed its recordkeeping rule. Retrospective transaction reviews should be scoped accordingly.

What did OFAC actually do?

According to Treasury’s announcement, OFAC designated a UAE-based broker for moving cryptocurrency representing proceeds of Iranian oil sales, with alleged volume exceeding $100 million. The action fits a pattern that has accelerated since 2023: OFAC now routinely names digital-asset intermediaries as components of the same networks it sanctions for conventional oil smuggling and shadow banking, rather than treating crypto as a separate enforcement track.

The underlying typology is familiar. Iranian crude is sold below market through front companies and ship-to-ship transfers; buyers pay into an offshore lattice of exchange houses and trading companies; and value returns to Iran through trade-based laundering, hawala, and — increasingly — dollar-denominated stablecoin transfers that settle in minutes without touching a correspondent bank. The digital-asset leg is what OFAC targeted here.

Before acting on this article, retrieve the Treasury press release and the corresponding SDN List update directly. Screening requires exact entity names, aliases, and any listed digital currency addresses. A narrative summary is not a screening input.

Which legal authority controls, and why does it matter?

Iran sanctions rest on layered authorities, and the specific one OFAC invoked changes the downstream analysis in ways that are not merely academic.

IEEPA, 50 U.S.C. §§ 1701–1706, is the enabling statute and the source of both civil and criminal penalties. The Iranian Transactions and Sanctions Regulations (ITSR), 31 C.F.R. Part 560, supply the operative prohibitions: § 560.204 bars the exportation or supply of goods, technology, or services to Iran or its government; § 560.206 bars trade-related transactions by US persons; § 560.208 bars facilitation; and § 560.211 governs blocking.

Layered above those are the relevant Executive Orders. E.O. 13846 (Aug. 6, 2018) reimposed post-JCPOA petroleum-sector and menu-based secondary sanctions. E.O. 13599 (Feb. 5, 2012) blocks Government of Iran and Iranian financial institution property. E.O. 13902 (Jan. 10, 2020) reaches additional economic sectors. E.O. 13224, as amended, applies where Islamic Revolutionary Guard Corps–Qods Force or affiliated networks are implicated.

Why the distinction matters: a designation under E.O. 13224 carries material-support and derivative-liability implications — and a different criminal exposure profile — than a petroleum-sector designation under E.O. 13846. Counsel advising on downstream counterparty risk should identify the operative authority before opining, not after.

What does “blocked” require when the property is on-chain?

The prohibitions bind all US persons — citizens and lawful permanent residents wherever located, entities organized under US law including their foreign branches, and anyone physically present in the United States (31 C.F.R. § 560.314). For a crypto business that sweep is wide: US-person employees of a foreign platform are individually covered regardless of their employer’s domicile, and certain foreign entities owned or controlled by US persons carry their own ITSR obligations.

Blocking means the property is frozen in place. It may not be transferred, withdrawn, paid out, or otherwise dealt in absent an OFAC license. In practice, for a virtual asset service provider:

• Freeze the account and custodial balances — do not close the account and return funds. Returning funds is itself an unlicensed transfer of blocked property.
• Halt pending activity — withdrawals, open orders, staking unbonding, bridge transactions.
• Preserve, do not liquidate. Converting a volatile token to stablecoin “for safekeeping” is dealing in blocked property, however well-intentioned.
• File within 10 business days under 31 C.F.R. § 501.603(b)(1)(i).

One timing point that is widely misunderstood: the Annual Report of Blocked Property, due each September 30, covers property held as of June 30 of that same year. Property blocked in late August 2026 therefore does not appear in the September 2026 filing — it appears in the September 2027 filing. The initial 10-business-day report is the deadline that actually runs now.

OFAC’s Sanctions Compliance Guidance for the Virtual Currency Industry (October 2021) and A Framework for OFAC Compliance Commitments (May 2019) remain the agency’s clearest statements of expectation: management commitment, risk assessment, internal controls, testing and auditing, and training.

Do you also owe a suspicious activity report?

Frequently, yes — and this is the overlay most often missed. OFAC administers sanctions; FinCEN administers the Bank Secrecy Act. They are distinct regimes with distinct filings. A money services business, including most US-facing exchanges, has independent SAR obligations under 31 C.F.R. § 1022.320 for transactions it knows, suspects, or has reason to suspect involve funds derived from illegal activity or are designed to evade BSA requirements.

A sanctions match will very often satisfy that standard. The practical consequence is that a firm which freezes correctly, files its blocked property report on time, and does nothing further may still have an unfiled SAR and a tolling confidentiality obligation. Build the SAR decision into the sanctions escalation workflow rather than treating it as a separate queue.

How does the 50 Percent Rule apply to wallet addresses?

OFAC’s 50 Percent Rule provides that an entity owned 50 percent or more in the aggregate by one or more blocked persons is itself blocked by operation of law, whether or not it appears on the SDN List. Applied to corporate ownership, this is workable. Applied to blockchain addresses it is conceptually awkward, because an address is not an entity with a capitalization table.

The correct translation: the designation attaches to the person, and OFAC publishes digital currency addresses as identifying information for that person — not as a freestanding blacklist of strings. A firm cannot discharge its obligations by screening only published addresses. If a designated broker rotates to a fresh address, dealings with that address remain prohibited dealings with a blocked person. Conversely, an unsolicited inbound transfer from a listed address — sanctions “dusting” — does not automatically convert the recipient’s wallet into blocked property, though it warrants documentation and, depending on facts, a report.

This remains genuinely underdeveloped law. OFAC has not issued binding rulemaking translating the 50 Percent Rule to on-chain attribution, so firms operate on FAQ guidance, analytics-vendor clustering, and reasonable-diligence arguments. Document the methodology and its limits contemporaneously; that record is what you will rely on in any enforcement dialogue.

What do stablecoin issuers owe under the GENIUS Act?

The stablecoin layer has become the practical chokepoint in Iran-related crypto enforcement, and since 2025 that is a statutory posture rather than a voluntary one. The GENIUS Act, enacted July 18, 2025, requires permitted payment stablecoin issuers to maintain the technological capability to seize, freeze, or burn payment stablecoins when lawfully required, and to comply with lawful orders to do so.

For issuers, that converts contract-level freeze functionality from a product decision into a compliance obligation. For everyone downstream — exchanges, custodians, DeFi front ends — it means designations now tend to produce near-immediate on-chain immobilization rather than merely paper prohibitions, and that reserve-backed tokens carry a censorship characteristic that must be disclosed in customer terms and factored into liquidity risk models.

What has OFAC actually penalized crypto firms for?

The enforcement record is unusually instructive here, because the failure mode has been remarkably consistent. In its published settlements with US digital asset businesses — including Payward (Kraken) in November 2022, Bittrex in October 2022, BitPay in February 2021, and BitGo in December 2020 — OFAC’s recurring finding was not sophisticated evasion by customers. It was that the companies collected IP address and other location data sufficient to identify a sanctioned-jurisdiction nexus and did not screen against it. Several settlements involved firms that had transaction-level geolocation data sitting in their own logs the entire time.

The Binance resolution announced in November 2023 — the largest OFAC settlement on record — reflected a different and more severe theory involving deliberate accommodation of US users on a platform positioned as offshore. But for most compliant-intending firms, the operative lesson is the smaller cases: OFAC will hold you to the data you already have. Reconcile what your KYC file asserts against what your server logs show, because that gap is precisely where the agency has looked.

What are the penalties, and what mitigates them?

Civil penalties under 50 U.S.C. § 1705(b) run to the greater of an inflation-adjusted statutory maximum or twice the value of the underlying transaction — per violation. Because each transfer typically counts separately, aggregate exposure for a payments-volume business scales into eight and nine figures quickly. The per-violation multiplier, not the headline cap, is what drives real exposure. Willful violations are criminal under § 1705(c), carrying up to 20 years’ imprisonment.

Two mitigating levers matter under the Economic Sanctions Enforcement Guidelines, 31 C.F.R. Part 501, App. A. Voluntary self-disclosure is a substantial mitigating factor, conventionally cutting the base penalty roughly in half. And the existence and quality of a risk-based sanctions compliance program is an express General Factor. Firms that discover a violation are almost always better served by early, complete disclosure than by quiet remediation and hope — particularly now that blockchain analytics make retrospective attribution straightforward for the government.

Do non-US exchanges face secondary sanctions exposure?

Yes, and this is the under-appreciated angle for offshore platforms. Petroleum-sector authorities including E.O. 13846 provide for menu-based secondary sanctions against foreign persons who knowingly engage in significant transactions with designated parties — including correspondent and payable-through account restrictions on foreign financial institutions under the Iranian Financial Sanctions Regulations, 31 C.F.R. Part 561, and in severe cases full blocking of the foreign person.

Whether a transaction is “significant” turns on a multi-factor analysis including size, number, frequency, nature, level of awareness of management, and the pattern of conduct. A non-US exchange with no US nexus is not bound by the ITSR, but it can be designated for its own conduct — and the practical consequence is loss of dollar banking, stablecoin issuer freezes, and delisting by US-facing counterparties. That is often more commercially fatal than a fine.

How does this fit the post-Tornado Cash landscape?

The outer boundary of OFAC’s authority over crypto infrastructure has been litigated. In Van Loon v. Department of the Treasury, the Fifth Circuit held in November 2024 that immutable smart contracts were not “property” within the meaning of IEEPA and therefore could not be designated; Treasury subsequently delisted the Tornado Cash addresses in 2025.

That holding is narrow and offers nothing here. Van Loon concerned autonomous, ownerless code with no controlling party. Designating a UAE brokerage — an identifiable legal person holding controllable property — sits squarely within uncontested IEEPA authority. Practitioners should be prepared to rebut the argument, which clients do advance, that Van Loon introduced general judicial skepticism toward crypto sanctions. It addressed one narrow and unusual category of target.

What if a designation catches you wrongly?

Two procedural paths exist and both are underused. A person who believes they have been designated in error may petition OFAC for administrative reconsideration and delisting under 31 C.F.R. § 501.807, submitting evidence and argument directly to the Office of Global Targeting. Separately, a US person holding blocked property with a legitimate need to deal in it — returning customer funds after a delisting, or effecting a court-ordered disposition — may apply for a specific license under 31 C.F.R. § 501.801.

Neither is fast, and neither excuses non-compliance in the interim. The blocking obligation continues while a petition is pending. But firms sometimes freeze property and then treat the matter as closed indefinitely, when a licensing application would resolve a customer’s legitimate claim.

Practical Implications

For US exchanges and custodians: The immediate exposure is retrospective. If the designated broker held accounts, used your OTC desk, or transacted through counterparties you serve, you likely hold blocked property and a 10-business-day clock is running. Scope historical review to the full ten-year window now available to OFAC, not the legacy five years.

For DeFi protocols and front-end operators: Absence of custody does not eliminate exposure. US-person developers and interface operators face facilitation risk under 31 C.F.R. § 560.208, and front-end address screening has become a de facto expectation for US-touching protocols.

For stablecoin issuers: Confirm that freeze-and-burn capability, governance approvals, and response-time commitments are documented well enough to survive examination, not merely technically present.

For compliance officers: The enforcement record says your greatest risk is data you already hold and do not screen. Reconcile KYC assertions against IP, device, and behavioral signals.

For counsel: Sanctions advice is not a one-time memo. A screening program adequate in 2024 may be inadequate against 2026 attribution standards and a ten-year lookback.

What to Do Now

1. Pull the primary sources. Retrieve the Treasury press release and the SDN List delta for the designation date; extract entity names, aliases, and any digital currency addresses.
2. Push to production screening within 24 hours. Confirm your vendor’s SDN refresh cadence in writing — daily is the minimum defensible standard.
3. Run a retrospective scan against new identifiers and associated clusters across the full ten-year retention period.
4. Block, do not return. Freeze in place and escalate to counsel before any disposition.
5. Calendar both regimes. Blocked property report within 10 business days (§ 501.603); rejected transaction report within 10 business days (§ 501.604); SAR determination under 31 C.F.R. § 1022.320; and note that the September 30 Annual Report covers property held as of June 30.
6. Evaluate voluntary self-disclosure with outside counsel if the scan surfaces prior dealings — before the government surfaces them independently.
7. Document the negative result. If the scan is clean, memorialize methodology, date, and scope. An undocumented review is, for enforcement purposes, no review at all.

Conclusion

OFAC Iran crypto sanctions have moved from the periphery of the sanctions program to its operational core. Treasury has demonstrated repeatedly that it will follow oil-payment value chains onto stablecoin rails and designate the intermediaries it finds there. The compliance obligation is not novel in kind — blocking, reporting, and recordkeeping duties are decades old — but it is unforgiving in application, because strict liability leaves no room for a program that is merely well-intentioned. The firms that fare best in enforcement dialogues are those that can produce a dated, documented, reasoned record of what they screened, when, and why. Build that record before you need it.

---

This article is for informational and educational purposes only and does not constitute legal advice. Reading this content does not create an attorney-client relationship. Laws and regulations in the cryptocurrency space change rapidly — consult a qualified attorney for advice specific to your situation and jurisdiction. Seth Goettelman is licensed to practice law in Wisconsin and Florida.