Crypto OTC Risk: A Field Guide to Shared Illicit Rails

Scope

This guide helps you assess and monitor exposure to cryptocurrency over-the-counter (OTC) desks, using OFAC's designation of eight Canadian OTC money service businesses as a case study. These OTCs allegedly facilitated transactions for the Iranian regime and drug trafficking networks. It's designed for AML Compliance Officers and security engineers building detection controls.

This guide doesn't replace legal advice on your sanctions obligations. It provides a structure you can adapt to your own AML/CFT Framework.

Key Concepts and Definitions

OTC Desk: A broker that executes large crypto trades off-exchange, often converting bulk cash to digital assets. OTCs frequently operate as money service businesses (MSBs), which have their own registration and compliance obligations.

Shared Illicit Infrastructure: One intermediary serving unrelated criminal clients. In this case, the same OTCs reportedly received funds from IRGC-linked wallets and Iranian exchanges, then sent funds to the Ryan Wedding Criminal Enterprise. The OTC acts as a common node between two illicit economies.

Cash-to-Stablecoin Pipeline: Couriers deliver bulk cash to an exchange business, which converts it to a Stablecoin like USDT and moves it overseas. This is the placement step for cash-heavy predicate offenses, including drug trafficking.

Designated Persons and Entities: Parties named on OFAC's sanctions lists. Exposure to them, direct or indirect, is a sanctions event, not just a typology flag.

Indirect Exposure: Funds that reach you after passing through one or more intermediary wallets. The Wedding Cartel flows reportedly moved through intermediary wallets as well as direct transfers, so direct-only screening misses part of the picture.

Requirements Breakdown

Your obligations come from three layers.

1. Targeted Financial Sanctions: FATF Recommendation 6 requires freezing assets tied to designated terrorism-related persons and entities without delay. FATF Recommendation 7 covers the same for Proliferation Financing. IRGC-linked activity can touch both. United Nations Security Council Resolution 2462 (2019) reinforces counter-terrorist financing expectations for member states. Your national implementation determines your exact duties; for US persons, that means OFAC regulations.

2. Predicate Offense Coverage: The Vienna Convention (1988) criminalizes laundering drug trafficking proceeds, and the Palermo Convention (2000) extends the framework to transnational organized crime. Your risk assessment should treat cash-to-crypto conversion as a recognized laundering method for those offenses.

3. Travel Rule Compliance: When you transmit virtual asset transfers to or from other institutions, you need originator and beneficiary information flowing with the transaction. An OTC counterparty that can't or won't support this is a risk signal in itself.

Implementation Guidance

Build a Counterparty Risk Tier for OTCs: Treat OTC desks as a distinct high-risk category in your Customer Risk Rating model, not as generic exchange customers. Factors worth scoring include:

• Language and marketing targeting of a sanctioned-jurisdiction diaspora
• Licensing status and the quality of the OTC's own AML controls
• Volume profile inconsistent with the stated business
• Blockchain-analytics exposure to sanctioned and terrorist-financing wallets

Screen Wallets, Not Just Names: Name screening against OFAC lists catches the entity. It won't catch a wallet cluster. Add blockchain-analytics screening to onboarding and ongoing monitoring so you see exposure to sanctioned exchanges and attributed wallets. The Canadian OTCs reportedly received funds from Iranian exchanges, so the exposure was visible on-chain well before it was visible in KYC files.

Tune Transaction Monitoring Rules for Convergence: Write transaction monitoring rules that look for both sides of the pattern in a single counterparty: inflows from sanctioned-jurisdiction or sanctioned-entity sources paired with outflows to wallets tied to cartel or organized crime activity. Either leg alone may be explainable. Together they describe a bridge between illicit economies.

Trace Multiple Hops: Set exposure rules to evaluate indirect as well as direct links. Define your hop threshold, document the rationale, and review it. A risk-based cutoff is defensible; an undocumented one isn't.

Escalate and Document: Route hits to your sanctions analysts and then to the MLRO. Where activity is suspicious, file a Suspicious Activity Report (FinCEN SAR, Form 111) through the BSA E-Filing System, use a Continuing Activity SAR for ongoing patterns, and protect SAR confidentiality. Avoid tipping off the customer during review.

Cooperate Across Borders: Designations that reach into Canada show why bilateral thinking matters. If you operate in both jurisdictions, align your sanctions lists, your SAR escalation paths, and your analytics attribution so a designation in one country triggers review in the other. Use information-sharing channels available to you, including Joint SAR mechanisms where permitted and engagement with your financial intelligence unit, a member of the Egmont Group.

Common Pitfalls

• Screening Only the Immediate Counterparty: Indirect flows through intermediary wallets are where the Wedding Cartel connection reportedly appeared.
• Siloed Typology Teams: If your counter-terrorist financing and drug-proceeds teams don't share findings, you'll miss a node that links both.
• Treating a Designation as a One-Time Event: OFAC's action builds on earlier designations of Iranian exchanges. After a designation, re-run lookbacks against newly named OTCs and their associated wallets.
• Relying on Language or Geography as a Proxy: Farsi-language marketing is a risk indicator, not a conclusion, and profiling by ethnicity creates its own legal and ethical problems. Anchor decisions to transaction and attribution evidence.
• Ignoring the Cash Side: Bulk cash conversion happens before the blockchain does. Know whether your OTC customers can explain their cash sources.
• Weak Documentation: Undocumented judgment calls on hop depth, thresholds, or exits won't survive an examination.

Quick Reference Table

Bottom Line

The lesson from these designations is structural. Illicit networks with different goals still share infrastructure. If your controls evaluate each typology in isolation, the OTC that quietly serves several of them will pass through. Build your monitoring around the node, not the narrative.