OFAC Sanctions Eight Houthi Crypto Addresses: AML Implications for Firms
Eight crypto wallet addresses linked to Ansarallah, the Yemeni armed group more widely known as the Houthis, have been added to the U.S. Treasury's Specially Designated Nationals (SDN) list by the Office of Foreign Assets Control (OFAC). All eight sit on the Tron blockchain, and the dominant asset flowing through them is Tether USDT. Combined inflows across the cluster total just under $900 million. For any firm touching Tron or USDT, this is an immediate screening event, not a story to monitor from a distance. Getting your crypto accounting software and AML workflows aligned with these designations is now a compliance baseline, not an option.
What OFAC Actually Designated
The action, dated 2 April 2025, targets a network of financial facilitators and procurement operatives working under the direction of Sa'id al-Jamal, a senior Houthi financial official backed by Iran's Islamic Revolutionary Guard Corps-Qods Force (IRGC-QF). According to OFAC's press release, the network arranged the purchase of tens of millions of dollars' worth of commodities from Russia, including weapons, and facilitated the theft and onward shipment of Ukrainian grain to Houthi-controlled territory in Yemen.
The addresses and their character
All eight addresses are on Tron, with USDT accounting for the bulk of value transferred. One address in the cluster stands out: blockchain analysis indicates it is best characterised as a service used by Ansarallah rather than a wallet directly controlled by the group, largely because of its scale (inflows of roughly $822 million) and its exposure to other illicit actors that appear unrelated to the Houthis. This distinction matters for compliance purposes. An address does not have to be exclusively Houthi-controlled to generate SDN exposure for a counterparty that touches it.
Key facilitator: Hassan Jafari
The designation also names Hassan Jafari, a Turkey-based money launderer described by OFAC as closely connected to al-Jamal. Jafari's inclusion signals that the Treasury views the network as genuinely transnational, with nodes in Turkey, Yemen, Iran, and Cambodia. Firms with business relationships in any of those jurisdictions should treat this as a prompt to review counterparty exposure.
The Huione Pay Connection
One of the more operationally significant findings in the underlying blockchain intelligence is the two-hop link between Ansarallah-used addresses and Huione Pay. Huione Pay is part of the Huione Guarantee Group, a Cambodia-based conglomerate that has been publicly identified as a facilitator of large-scale online fraud and money laundering.
How the transaction chain worked
The pattern identified in the blockchain data runs as follows. Between November 2023 and late January 2024, Huione Pay transferred approximately $964 million to a virtual asset service provider (VASP). From 30 January 2024 onward, that same VASP began routing funds to the service address that Ansarallah was using, with around $39 million moving through this channel up to July 2024. The two-hop structure is deliberate: it places distance between the sanctioned actor and the originating platform, making automated screening at a single hop insufficient.
This is precisely the scenario that regulators in the Financial Action Task Force (FATF) travel-rule guidance anticipated. A firm screening only direct counterparties would not catch this exposure. Multi-hop or "holistic" tracing is now a practical necessity, not a gold-standard aspiration. For a deeper look at how firms are engineering these controls, see our analysis of the nine engineering decisions that define on-chain AML screening.
Why Tron and USDT Keep Appearing in Sanctions Cases
This is not the first time Tron-based USDT has been at the centre of a major sanctions action, and it is unlikely to be the last. Tron's low transaction fees, high throughput, and Tether's deep liquidity make the combination attractive for high-volume value transfer in markets where dollar-denominated banking is restricted. The Senate has previously flagged the use of USDT within Iran-adjacent financial networks, a pattern directly relevant here given the IRGC-QF's role in funding Ansarallah.
Asset coverage beyond USDT
The Houthis do not rely on USDT alone. The designation picture also covers Tron's native token TRX, and blockchain monitoring has identified Houthi-affiliated Bitcoin addresses that received funds in the past year. The dollar amounts on the Bitcoin side are small compared with the USDT flows, but their existence confirms that any single-asset screening approach leaves gaps. Firms that monitor only USDT on Tron are not screening the full exposure surface.
Geopolitical Context and Why It Shapes Compliance Risk
Ansarallah controls Yemen's northwestern coastline, which gives it direct access to the Bab al-Mandeb Strait, one of the world's most critical commercial shipping chokepoints. The group has conducted repeated attacks on commercial vessels in the Red Sea, driving up insurance premiums and forcing rerouting around the Cape of Good Hope. U.S. airstrikes against Houthi personnel and infrastructure in western Yemen are part of a wider pressure campaign that also encompasses sanctions, and Treasury has signalled it intends to pursue the financial networks that sustain Ansarallah's military capacity.
Iran's role is central. The IRGC-QF provides direct financial and military support to the Houthis, and the U.S. has made clear it will treat Iran's regional proxies as legitimate enforcement targets. That means the enforcement perimeter for any firm assessing geopolitical risk is not just Yemen: it extends to Iran, to Iran-linked actors in Turkey, Russia, and Cambodia, and to any VASP that serves those jurisdictions without robust AML controls.
Practical Obligations for Compliance Teams and CFOs
OFAC's SDN designations carry strict liability in the United States. A U.S. person, or any entity with U.S. nexus, that processes a transaction involving a designated address, even unknowingly, faces potential civil penalties. Non-U.S. VASPs face secondary sanctions risk if they maintain U.S. dollar correspondent relationships. The practical obligations cluster around three areas.
Immediate screening
All eight Tron addresses should be loaded into your screening infrastructure the same day they are identified. Any VASP, custodian, exchange, or OTC desk that has processed Tron USDT transactions should run a retroactive check against the newly published addresses. Document the date and scope of that check. If historic exposure is identified, legal counsel should be engaged immediately to assess whether a voluntary self-disclosure to OFAC is appropriate.
Travel-rule and multi-hop tracing
Because at least one of the designated addresses functions as a service used by Ansarallah rather than a wallet it directly controls, first-hop screening will not catch all exposure. Your transaction monitoring should be configured to trace at least two hops and flag indirect exposure to SDN-listed addresses. The FATF travel rule requires originator and beneficiary information to accompany transfers; where that information is missing or inconsistent, the transaction should be held and investigated rather than passed through.
OTC and correspondent relationships
OFAC's findings highlight the Houthis' heavy reliance on OTC desks, both inside Yemen and in third-country jurisdictions. If your firm provides correspondent services, liquidity, or settlement to OTC operators without full know-your-customer (KYC) documentation on the underlying clients, this designation is a direct prompt to review those relationships. The Turkey nexus identified through Jafari is particularly relevant for firms with Middle East or Central Asia-facing business lines.
For a comparison with how a prior OFAC crypto enforcement action was structured and what it required of firms operationally, the earlier piece on how OFAC's fentanyl-network crypto designations shaped SDN screening obligations sets out a useful parallel framework.
Accounting and Audit Implications
For accounting firms and CFOs, the designation has direct balance-sheet and disclosure consequences that go beyond the compliance team's immediate response.
Asset impairment and write-down risk
Any digital assets held in wallets that have received funds, directly or indirectly, from a designated address are at risk of being frozen or forfeited if the exposure is identified by a regulator or law enforcement. Under both IFRS and US GAAP, a crystallised legal impediment to the recovery of an asset is a trigger for impairment assessment. Firms using digital asset accounting software should ensure that their ledger systems can flag wallet-level SDN exposure and link it to the relevant asset balance on the balance sheet.
AML provision and contingent liability disclosure
Where a retroactive screening exercise identifies historic transactions with SDN-linked addresses, the firm faces a potential civil penalty exposure. Under IAS 37 or ASC 450, this is likely a contingent liability requiring at minimum disclosure, and potentially a provision if the outflow is probable and estimable. The audit committee should be briefed as part of the next reporting cycle, and the external auditor should be notified if the exposure is material.
Enhanced due diligence documentation
For firms that audit or provide accounting services to VASPs, crypto exchanges, or OTC desks, this designation is a prompt to revisit whether the client's own AML controls are adequate. A client that cannot demonstrate it screens Tron USDT transactions against the current SDN list represents an elevated audit risk. That risk should be documented in the working papers and factored into the risk assessment at the planning stage of the next engagement. Robust crypto bookkeeping software integrated with live sanctions feeds is no longer a nice-to-have for clients in this space: it is part of the control environment the auditor needs to rely on.
Frequently Asked Questions
Do these designations apply outside the United States?
Directly, OFAC's SDN list binds U.S. persons and entities with a U.S. nexus. However, secondary sanctions risk means that non-U.S. firms maintaining U.S. dollar correspondent banking relationships can face consequences if they process transactions involving SDN-listed addresses. Many jurisdictions also implement parallel financial sanctions through their own authorities, the UK OFSI, the EU, and the UN Security Council among them, so global VASPs should check their own regulator's equivalent lists as well.
What does "two-hop" exposure mean in practice?
It means that even if your firm never transacted directly with a designated address, you may have sent or received funds from a counterparty that did. Because at least one of the addresses in this cluster is characterised as a service used by Ansarallah rather than a wallet it directly controls, the exposure can be one step removed. Effective screening traces funds through intermediary hops, not just the immediate sender or recipient.
Why are all eight addresses on Tron rather than Ethereum or Bitcoin?
Tron's combination of low fees, fast settlement, and Tether's large USDT liquidity pool on the network makes it operationally attractive for high-volume, low-cost value transfer, particularly in markets where traditional banking access is restricted. This is consistent with a broader pattern in sanctions enforcement cases involving Iran-linked actors and their affiliates.
Does historic exposure to these addresses automatically trigger a penalty?
Not automatically. OFAC operates a strict liability framework for civil penalties, but enforcement decisions factor in whether the firm had adequate controls, whether it self-disclosed, and whether it cooperated with any investigation. A firm that can demonstrate a robust AML programme, promptly ran a retroactive screen on publication of the designation, and self-disclosed any identified exposure is in a materially better position than one that did not.
How should this designation be treated in the audit file?
Auditors should document the designation date, the scope of the retroactive screening their client performed, any identified historic exposure, and the client's legal assessment of penalty risk. Where exposure exists and the penalty risk is probable and estimable, a provision under IAS 37 or ASC 450 should be considered. Disclosure in the notes to the financial statements is likely required even where the amount cannot be reliably estimated.
Source: Elliptic