OFAC Sanctions Hamas Crypto Facilitators and Seven TRON Addresses: What Accounting Firms and CFOs Must Act On Now
On 23 July 2026, the US Treasury's Office of Foreign Assets Control designated three individuals and seven TRON cryptocurrency addresses as Specially Designated Global Terrorists for their roles in a Hamas financial network. The total cryptocurrency received by the seven wallets amounts to approximately $38.6 million. For any accounting firm or CFO that manages digital asset portfolios, audits virtual asset service providers, or processes payments through TRON-based instruments, this action is a direct compliance trigger, not background noise.
Who Was Designated and Why
The three named individuals
OFAC named Zaid Issam Ahmed al-Jebouri, an Iraqi national operating from Istanbul, alongside two associates: Abdulla Issam Ahmad al-Jebouri and Khaldun Khamis Zakaria Alden. All three are now listed on the Specially Designated Nationals and Blocked Persons list as Specially Designated Global Terrorists.
The trio operate El-Kahira for General Trading, a Turkey-registered over-the-counter exchange office that Israel's National Bureau for Counter Terror Financing (NBCTF) had already targeted in a January 2026 seizure order. The OFAC action takes that regional enforcement step further: it names the individual operators and ties specific on-chain identifiers to the network for the first time.
The seven TRON addresses
OFAC added seven TRON wallet addresses as identifiers in the designation. On-chain analysis indicates that these wallets show material interaction with other addresses previously listed in the NBCTF's January 2026 seizure order. The pattern documented in the designation includes funds flowing from El-Kahira-related wallets into al-Jebouri's primary wallet, which in turn cashed out through a Gaza-based money service business named on OFAC's SDN list (Buy Cash Money and Transfer Company) and an unnamed UAE-based OTC desk. The same wallet also sent funds to mainstream exchange deposit addresses that received concurrent inflows from a Palestine-based OTC desk and a separate Hamas-linked wallet.
The network's reliance on TRON is consistent with a broader pattern in sanctions enforcement: TRON's low transaction fees and stablecoin liquidity have made it a recurring feature of illicit finance cases over the past two years. Firms that have not yet extended their on-chain screening coverage to TRON-denominated assets should treat this designation as the prompt to do so.
Why Regional OTC Desks Are the Core Compliance Challenge
Small, informal, and frequently unlicensed
OFAC's own commentary on this case is pointed: the action illustrates the critical importance of regional exchange offices in terror financing. These are not large, regulated exchanges with robust compliance programmes. They are often small, informal operations in jurisdictions where AML supervision is limited or inconsistently applied. El-Kahira fits that profile: a Turkey-registered entity, flagged by Israel's NBCTF in January 2026, now confirmed by OFAC as a Hamas financing node.
For accounting firms and CFOs, that profile creates a specific due diligence problem. Standard counterparty screening that relies on regulated-entity databases will not catch a small OTC desk that operates informally. Effective screening requires wallet-level controls, not just entity-level checks against registered VASPs.
Corridor risk: Turkey, UAE, and Gaza-linked MSBs
The transaction pattern documented in the designation spans at least three jurisdictions: Turkey (El-Kahira's registration base), the UAE (the OTC cash-out desk), and Gaza (Buy Cash Money and Transfer Company). Each corridor represents a distinct risk vector. Firms with clients or counterparties operating in any of these corridors, particularly those using OTC desks for settlement or liquidity, should treat this designation as a prompt to re-examine those relationships.
The UAE corridor is particularly notable for global firms. The UAE has made significant regulatory progress in recent years, but OTC desks operating outside the formal licensing framework remain a known gap. The involvement of a UAE-based desk in a confirmed terror finance network reinforces the case for wallet-level verification, not just entity registration checks, when onboarding or maintaining OTC counterparties in the region.
Accounting and AML Implications for Firms and CFOs
Immediate screening obligations
Under US sanctions law, any US person or entity is prohibited from transacting with a designated party. That prohibition extends to accounts and wallets. The seven newly designated TRON addresses must be added to screening lists immediately. Firms that use crypto accounting software or digital asset accounting software with integrated sanctions screening should verify that their provider has updated its address databases to include the new OFAC additions. If that update is not confirmed, manual addition is the safer interim step.
Firms with non-US clients that have TRON exposure should also consider the extraterritorial reach of the SDGT designation. Secondary sanctions risk and reputational exposure are both live considerations, even for entities not subject to US jurisdiction as a primary matter.
Transaction review and documentation
Any historical transaction that touched the seven designated addresses, or that passed through El-Kahira or the named MSB, requires review and documentation. The relevant period extends at least to January 2026, when Israel's NBCTF seizure order was issued, because that order created a public record that a diligent compliance function should have captured. Firms that cannot demonstrate they screened against that earlier order may face questions about the adequacy of their AML controls.
For month-end and quarter-end reporting purposes, any open positions or balances associated with now-sanctioned addresses must be disclosed and, where required under applicable law, frozen. The accounting treatment of frozen digital assets depends on the jurisdiction and the relevant accounting standard, but the starting point is segregation and disclosure, not continued fair-value carrying as an active asset.
Audit trail and client file updates
Accounting firms acting as auditors or advisors to VASP clients, crypto funds, or treasury teams holding TRON-based assets should update client files to reflect the new designation. Audit working papers for the period ending 31 July 2026 and beyond should document the screening run date, the database version used, and the outcome. Where a subsequent event exists between the balance sheet date and the audit sign-off date, the designation warrants consideration as a recognised or non-recognised subsequent event depending on whether it provides evidence of conditions existing at the balance sheet date.
For clients who use crypto bookkeeping software to record digital asset transactions, firms should confirm that the software's address labelling and sanctions flagging is current. A designation issued on 23 July 2026 should appear in any reputable provider's database within a matter of hours. Delays beyond 24 to 48 hours are a gap worth flagging in a client's internal control assessment.
The Broader Enforcement Signal
Coordinated multilateral action is accelerating
This designation did not emerge in isolation. It builds directly on the NBCTF's January 2026 seizure order, meaning the underlying intelligence was shared across allied enforcement bodies months before OFAC acted. That pattern of coordinated, sequenced enforcement is becoming more common: a regional authority moves first, OFAC follows with individual-level designations and on-chain identifiers, and the combined effect is a more complete blocking of the network's liquidity access.
For compliance professionals, the sequenced nature of this action carries a practical implication: monitor allied enforcement actions, not just OFAC additions, as early warning indicators. The NBCTF order in January 2026 was a public signal. Firms that incorporated it into their screening at that point had a six-month head start on the OFAC designation.
Compliance teams as intelligence partners
OFAC's own analysis of this case notes that compliance teams may hold critical insight into regional OTC exchangers, and that partnership between private sector compliance functions, public sector agencies, and blockchain analytics is essential to tracking terror finance flows. That framing has direct implications for how accounting firms position their AML advisory services. Firms that invest in on-chain monitoring capability, and that maintain relationships with OFAC's compliance engagement channels, are better placed to provide substantive value to VASP and treasury clients navigating this environment. For further context on how on-chain monitoring obligations are evolving, see how the Chainalysis addition of Cronos affects AML monitoring obligations for firms.
The risk is not only reputational. Firms that provide audit, accounting, or advisory services to clients with undisclosed exposure to sanctioned addresses face potential liability under sanctions regulations, professional standards, and, in some jurisdictions, AML legislation that imposes obligations on gatekeepers. For a related enforcement pattern involving Treasury sanctions on crypto-linked entities, see what the US Treasury sanctions against Iranian firms accepting Bitcoin mean for accounting workflows.
Practical Next Steps for Accounting Firms and CFOs
Immediate actions
First, confirm that all seven designated TRON addresses are in your firm's active screening database and that your crypto accounting software has been updated to reflect the designation. Second, run a retrospective screen of transaction histories against the new identifiers, covering at least the period from January 2026 to the designation date. Third, flag any matches for SAR filing assessment under your jurisdiction's AML reporting obligations. Fourth, update client files and audit working papers with the screening run date and outcome before the next reporting cycle closes.
Medium-term controls review
This designation is a prompt to review the breadth of your sanctions screening coverage. If your current controls screen only against registered VASP entities and do not extend to wallet-level checks, that gap needs to be closed. OTC desks operating outside formal licensing frameworks will not appear in entity registries. They will, however, appear in on-chain address databases, and that is where effective controls must operate.
Firms should also review their counterparty onboarding procedures for any clients or counterparties with OTC operations in Turkey, the UAE, or Gaza-adjacent corridors. Corridor risk assessments based on the documented transaction pattern in this designation provide a legitimate basis for enhanced due diligence requests.
Frequently Asked Questions
What does the OFAC SDGT designation mean in practical terms for a US accounting firm?
It means that any transaction with the designated individuals, entities, or addresses is prohibited under US law. Firms must freeze any assets connected to the designation, report to OFAC as required, and document their compliance steps. Failure to screen and block can result in civil penalties regardless of intent.
Are non-US firms affected by this designation?
Non-US firms are not directly subject to US primary sanctions jurisdiction, but secondary sanctions risk exists for transactions that have a US nexus, such as dollar-denominated settlements or US counterparties. Beyond legal risk, reputational exposure and correspondent banking relationships make screening against OFAC's SDN list a standard practice for international firms with any digital asset exposure.
Why are TRON addresses specifically relevant to this action?
OFAC included seven TRON wallet addresses as formal identifiers in the designation. Any firm transacting in TRON-based assets, including TRON-native stablecoins, must screen against these addresses. Interaction with a designated address, even through an intermediary, can create sanctions exposure.
How should frozen digital assets be treated in financial statements?
Frozen assets should be segregated from active holdings and disclosed as restricted. They should not be carried at fair value as a liquid asset while the freeze is in place. The specific accounting treatment depends on the applicable standard (IFRS or US GAAP) and the nature of the freeze, but disclosure is required in all cases.
What is the significance of the NBCTF's January 2026 seizure order for retrospective review?
The NBCTF order was a public enforcement action against El-Kahira in January 2026, predating the OFAC designation by six months. A robust compliance function should have captured that order and screened against the associated entities at that time. Firms that cannot evidence a January 2026 screen may face questions about the adequacy of their historical controls during audits or regulatory examinations.
Source: Chainalysis