OFAC Sanctions Crypto Network Tied to Iranian Oil Smuggling

On 16 September 2025, the US Department of the Treasury's Office of Foreign Assets Control (OFAC) designated four individuals for helping transfer funds derived from Iranian oil sales to the IRGC-Qods Force (QF) and Iran's Ministry of Defense and Armed Forces Logistics (MODAFL). Seven cryptocurrency addresses were added to the Specially Designated Nationals (SDN) list alongside the individuals, making this one of the most significant crypto-focused Iran sanctions actions in recent memory. For compliance teams, accounting firms, and CFOs with any exposure to stablecoin flows, the designation carries immediate screening obligations and longer-term lessons about indirect exposure risk.

What OFAC Actually Did

The action named Alireza Derakhshan and Arash Estaki Alivand as two of the four designated individuals. Both are alleged to have coordinated funds transfers, including proceeds from Iranian oil sales, that ultimately benefited the IRGC-QF and MODAFL. OFAC described their role as laundering money through a network of overseas front companies and cryptocurrency, enabling Iran to convert sanctioned oil revenues into usable financial resources.

Scale of the wallets involved

The dollar figures attached to the sanctioned addresses are substantial. Addresses linked to Alivand had received a total of approximately $300 million, while those connected to Derakhshan had received approximately $442 million. The dominant asset in both cases was USDT, the US dollar-pegged stablecoin. Together, these figures illustrate a pattern that regulators have flagged repeatedly: sanctioned actors increasingly favour stablecoins because they offer dollar-denominated value without requiring access to the traditional banking system.

OFAC also noted that Derakhshan and Alivand are alleged to have facilitated the purchase of more than $100 million in cryptocurrency directly using oil-sale proceeds, channelling those funds through front companies across multiple countries.

The Hizballah and Garantex connections

The designation extended beyond the two principal individuals. OFAC identified a link between Alivand and Tawfiq Muhammad Sa'id al-Law, a money changer associated with Hizballah, who reportedly provided Hizballah with access to digital wallets to receive funds tied to IRGC-QF commodity sales and who conducted cryptocurrency transfers on behalf of the Al-Qatirji Company.

Blockchain tracing also revealed that addresses linked to the designated individuals received approximately $2 million directly from Garantex, the Russian cryptocurrency exchange sanctioned and disrupted by US law enforcement in March 2025. Several hundred thousand dollars more arrived from an Iranian exchange also named in OFAC's records. These connections underscore that the network was not operating in isolation: it drew on infrastructure associated with multiple sanctioned actors across different jurisdictions.

The Broader US Iran Sanctions Campaign

This designation sits within a sustained US government effort to close off Iran's access to oil revenues. Two weeks before the crypto-focused action, on 2 September 2025, OFAC had already designated one individual, seven entities, and nine vessels connected to Iranian oil smuggling and sanctions evasion. On 15 September 2025, Israel's National Bureau for Counter Terror Financing published its own designation linking entities to the IRGC. The coordinated timing across multiple agencies and jurisdictions signals that enforcement pressure on Iranian oil-related networks is intensifying, and that cryptocurrency flows are now a primary target rather than a secondary concern.

Why Indirect Exposure Is the Core Compliance Problem

The most technically demanding aspect of this designation for compliance teams is not the direct exposure question, that is relatively straightforward to screen. The harder problem is indirect exposure, which arises when funds reach a wallet through one or more intermediate transactions before arriving at a counterparty a firm interacts with.

How hop-based exposure works

A wallet that received USDT from a Garantex-linked address, then moved those funds to a second wallet, then to a third, can appear clean in a basic screening that only checks the immediate counterparty. The sanctioned taint is still present, but it is obscured by intervening hops. OFAC's strict liability standard for sanctions violations does not require intent: if a US person or entity processes funds that are connected to a sanctioned party, that can constitute a violation regardless of whether the firm knew about the connection.

Given that the sanctioned addresses in this action had collectively received hundreds of millions of dollars in stablecoins, the pool of potentially tainted downstream transactions is large. Any exchange, payment processor, OTC desk, or corporate treasury that accepts USDT without hop-level tracing carries residual risk it may not have quantified.

What blockchain analytics reveals here

Blockchain's inherent transparency cuts both ways. It enabled investigators to reconstruct the full flow of funds from oil-sale proceeds through front companies to crypto addresses and onward to sanctioned-linked actors. That same transparency, when accessed through properly configured analytics tools, gives compliance teams the ability to assess how many hops separate a counterparty wallet from a sanctioned address, and to set policy thresholds accordingly. The key operational requirement is that screening must cover both direct and indirect exposure, and it must be applied at the point of transaction, not retrospectively.

Accounting and Recordkeeping Implications

For accounting firms serving crypto-active clients and for CFOs managing treasury positions that include stablecoins, this enforcement action raises several practical questions that go beyond the compliance function.

Stablecoin flows and the books

When a business receives USDT, it typically records it at fair value as a financial asset. If that USDT later turns out to be linked to a sanctioned network, the firm faces a potential obligation to block and report the asset rather than use or dispose of it. Assets subject to OFAC blocking orders cannot simply be written off or written down: they must be frozen and reported to OFAC within ten business days of the firm learning of the connection. That reporting requirement creates a direct intersection between the compliance function and the finance function. The accounting treatment of a blocked asset differs from a normal disposal, and firms that have not thought through this scenario may find their chart of accounts and their treasury policy are both unprepared.

Audit considerations for digital asset holdings

Auditors reviewing clients with material stablecoin balances should now be asking whether the client's AML screening covers indirect exposure, not just direct counterparty checks. If a client cannot demonstrate that its incoming USDT flows have been traced across multiple hops, that is a gap in internal control over financial reporting, specifically over the completeness and accuracy of the assertion that assets are free from legal encumbrance. This is not a theoretical risk: the scale of the wallets involved in this OFAC action means that tainted USDT has had ample opportunity to migrate into the broader market through secondary and tertiary transactions.

Firms that use robust crypto accounting software with integrated sanctions screening will be better positioned to provide auditors with the hop-level tracing evidence they need. Without that capability, audit evidence for stablecoin balances may be insufficient to support an unqualified opinion.

Front company risk and due diligence

OFAC's description of the network's use of front companies across multiple countries highlights a due diligence challenge that goes beyond blockchain analytics. A front company may have a legitimate-looking corporate registration, a bank account, and a trading history, yet still be channelling funds on behalf of a sanctioned network. For accounting firms onboarding new clients that deal in commodities, oil trading, or cross-border payments, enhanced due diligence on the ultimate beneficial owners of counterparties is not optional. The IRGC-linked network allegedly used this structure specifically because it obscures the origin of funds at the entity level.

This pattern also appeared in earlier enforcement actions. The FBI and Brooklyn DA's takedown of a crypto scam network similarly relied on layered corporate structures to distance the principals from the underlying activity, and the investigative method, following the on-chain trail, was comparable.

Practical Steps for Compliance Teams

The immediate priority after any OFAC designation is to screen existing counterparty addresses against the updated SDN list. OFAC updates its list on the same day as a designation, so the seven addresses added in this action should be treated as screened from 16 September 2025 onward. Any transaction processed after that date without a screening check carries elevated enforcement risk.

Beyond the immediate screening update, the action suggests three broader adjustments for firms operating in the stablecoin space. First, screening policies should explicitly cover indirect exposure, with a defined hop threshold and a process for escalating wallets that sit within that threshold of a sanctioned address. Second, treasury policies for stablecoin acceptance should include a blocking and reporting procedure so that, if a tainted asset is identified post-receipt, the finance team knows exactly what steps to take and in what timeframe. Third, onboarding documentation for counterparties that transfer large stablecoin amounts should include beneficial ownership verification that goes beyond the immediate legal entity.

Teams tracking the evolution of AI-assisted compliance tools may also find it useful to review how regulators such as VARA, the FCA, and HKMA are reshaping crypto supervision through technology, since the analytical methods that flagged this network's indirect exposure are increasingly being built into regulatory expectations rather than treated as optional best practice.

Frequently Asked Questions

Does this OFAC action apply to non-US firms?

OFAC's primary jurisdiction covers US persons and entities. However, non-US firms that process US dollar-denominated transactions, including USDT, or that route payments through US correspondent banks can face secondary sanctions exposure. The practical effect is that the designation has global reach for any firm with US dollar touchpoints.

What does "blocking" a sanctioned asset mean in practice?

If a firm identifies that it holds or has received a digital asset connected to a sanctioned party, it must freeze that asset, meaning it cannot transfer, pay, export, or withdraw it. The firm must then file a report with OFAC within ten business days. The blocked asset stays on the books in a segregated position until OFAC issues a licence or other instruction.

How should auditors treat stablecoin balances where hop-level screening has not been performed?

Where a client cannot demonstrate that incoming stablecoin flows have been screened for indirect sanctions exposure, auditors should consider whether this constitutes a material weakness in internal controls. The relevant assertion is that assets are free from undisclosed legal encumbrance. If that assertion cannot be supported by adequate evidence, the auditor may need to qualify their opinion or issue an emphasis-of-matter paragraph, depending on materiality.

What is the significance of USDT being the dominant asset in these wallets?

USDT is the most liquid stablecoin by volume and is widely used in cross-border settlement, particularly in markets with limited banking access. Its dollar peg makes it attractive to sanctioned actors who need to preserve dollar value without using the US banking system. The concentration of USDT in these wallets reinforces existing regulatory concern that dollar-pegged stablecoins require the same level of sanctions screening as dollar wire transfers.

Is "one hop" from a sanctioned address automatically a sanctions violation?

Not automatically. OFAC applies a risk-based analysis that considers the size of the exposure, whether the firm had reason to know, and what controls were in place. However, under OFAC's strict liability standard, lack of knowledge is not a complete defence for US persons. Firms that can demonstrate robust screening, a defined hop-threshold policy, and prompt action upon discovery are in a materially stronger position than those that cannot.

Source: Elliptic / US Treasury OFAC