OFAC Sanctions Russian Disinformation Actors: Crypto AML Duties for Firms

The US Treasury's Office of Foreign Assets Control has designated two Russian individuals and two entities for their roles in a state-directed disinformation campaign, and it has done something that directly affects every firm handling digital assets: it has named specific cryptocurrency addresses on the TRON network as part of the designation. For accounting firms, auditors, and CFOs, this is not just a geopolitical headline. It is an active sanctions compliance obligation that requires immediate action on counterparty screening, ledger review, and AML documentation.

Who Was Designated and Why

OFAC designated Ilya Andreevich Gambashidze, a Russian national, along with his company the Social Design Agency (SDA). It also designated Nikolai Aleksandrovich Tupikin, described as the CEO and current owner of the Russia-based Company Group Structura LLC, referred to here as Structura.

The Disinformation Infrastructure

According to Treasury, Gambashidze, the SDA, and Structura were central to implementing a campaign that impersonated legitimate news websites across Europe, created fabricated videos, and operated fake social media accounts to spread pro-Russian messaging. The campaign, reportedly conducted in October 2022, involved more than 60 websites cloning the appearance of real media outlets. This activity is part of what Treasury, the US State Department, and European partners have described as a coordinated Kremlin-backed effort to undermine support for Ukraine and erode confidence in Western institutions, with a particular focus on Latin American audiences.

Prior Designations by Allied Regulators

This OFAC action is not the first time these actors have been designated. The European Union sanctioned Gambashidze and the SDA in July 2023 for supporting disinformation campaigns targeting Ukraine and several European countries. The US State Department separately called out their role in disinformation efforts focused on Latin America in November 2023. The SDA and Structura have been linked in official sources to a scheme known as the "Doppelganger Operation," named for the entities' systematic imitation of legitimate news organisations. The March 2024 OFAC designation represents the US Treasury formally adding its own legal prohibitions on top of those already in place.

The Cryptocurrency Dimension: What OFAC Actually Named

This is where the action becomes directly relevant to firms using any crypto accounting software or digital asset accounting software to manage client portfolios or treasury positions. OFAC's designation included two TRON (TRX) addresses linked to Gambashidze.

Address Activity and Fund Flows

The first address was active between April 2022 and March 2024. According to blockchain tracing conducted by TRM Labs and referenced in Treasury's designation, the vast majority of funds received by that address originated from a sanctioned Russian exchange. Tracing revealed that payments moved through a cross-chain swap service, with at least one payment reaching a Bitcoin wallet that then paid a US-based payment processor, suggesting the funds were used to purchase internet infrastructure to support the disinformation operation.

The second address was active only during February and March 2024. The majority of outbound funds appear to have been sent from a hot wallet likely associated with an exchange that had also made significant transfers to other Russian cryptocurrency traders, exchanges, and services.

Why TRON Addresses Matter for Screening

TRON-based stablecoin transfers, particularly in USDT, have become a common settlement rail in cross-border crypto transactions. Any firm whose clients transact on TRON, or whose treasury holds TRX-denominated assets, now has a direct obligation to confirm that neither of these named addresses appears in its transaction history, pending orders, or counterparty wallets. The named addresses are on the OFAC Specially Designated Nationals (SDN) list, meaning US persons and entities are prohibited from transacting with them, and any property in which the designated parties have an interest is effectively frozen.

AML and Compliance Obligations for Accounting Firms and CFOs

Screening Against the Updated SDN List

OFAC updates the SDN list on a rolling basis, and the expectation under US sanctions regulations is that firms screen against the current list, not a cached version from weeks or months ago. Accounting firms advising crypto-active clients, and CFOs managing treasury positions that include digital assets, should treat this designation as a prompt to run an immediate screening pass. This applies not only to the two named TRON addresses but to any address that has directly transacted with them, given the risk of secondary exposure.

Counterparty Due Diligence Documentation

For firms providing audit, advisory, or bookkeeping services to clients operating in the digital asset space, the appearance of a sanctioned address in a client's transaction history creates a documentation obligation. The relevant questions are: when did the transaction occur, was the address on the SDN list at the time, and has a voluntary self-disclosure to OFAC been assessed? These are not hypothetical scenarios. The cross-chain routing described in the TRM Labs analysis, where funds moved from a sanctioned exchange through a swap service to a Bitcoin wallet and then to a US payment processor, illustrates exactly the kind of layered transaction that standard crypto bookkeeping software needs to be capable of unwinding for compliance review.

Ledger and Financial Statement Implications

If any digital assets held by a client are subsequently identified as traceable to a designated address, those assets may need to be treated as blocked property under OFAC regulations. This has direct accounting implications: blocked assets should not be recognised as freely available funds, and disclosure may be required in financial statements depending on materiality. Firms should ensure their digital asset accounting software can flag wallet-level provenance, not just aggregate balances, so that asset-level compliance holds up under audit scrutiny.

The Broader Enforcement Context

This designation sits within a sustained US government effort to disrupt Russian state-linked financial flows through the crypto ecosystem. Treasury has repeatedly demonstrated that it will name specific on-chain addresses, not just legal entities, when it has sufficient blockchain intelligence to do so. That approach raises the stakes for any firm that treats crypto AML as a periodic exercise rather than a continuous monitoring obligation.

The use of cross-chain swap services to move funds, as documented in this case, is a specific typology that compliance teams should have on their radar. Swaps that convert assets across blockchains, such as from TRON to Bitcoin, can obscure the origin of funds if not properly traced. Firms advising clients who use such services should confirm that those services themselves are not on the SDN list and that transaction-level records are preserved.

For additional context on how Treasury has used crypto-specific sanctions designations in enforcement actions, see our earlier coverage of the US Treasury sanctions on Iranian firms accepting Bitcoin for Hormuz passage, and for the wider white-collar enforcement picture, the BDO Worldwatch 2026 analysis of white-collar crime trends is essential reading for accounting professionals.

Practical Steps for Firms to Take Now

Immediate Actions

First, pull the current OFAC SDN list and confirm that the two named TRON addresses are loaded into your screening tools. Second, run a retroactive check across any client portfolios or treasury accounts that include TRON-based transactions. Third, document the results of that screening, including the date it was performed and the version of the SDN list used. Fourth, if any match or proximity exposure is identified, escalate to legal counsel before taking any further action, as OFAC's general prohibition means even unwinding a flagged position without authorisation could itself be a violation.

Ongoing Monitoring

Firms should also review whether their current crypto accounting software and AML tooling is capable of wallet-level provenance tracing across multiple chains. The fact that funds in this case moved from TRON through a cross-chain swap to Bitcoin before reaching a US payment processor means that single-chain screening is insufficient. Robust digital asset accounting software should be able to ingest transaction data from multiple chains and flag addresses that appear on sanctions lists, regardless of the originating blockchain.

Source: TRM Labs