The sectoral determination OFAC issued on August 24, 2026, under Executive Order 13902, marks a significant expansion of secondary sanctions. It's the first time the U.S. has targeted an entire country's digital assets sector, meaning your crypto business can be sanctioned simply for operating in or supporting Iran's crypto economy, without needing to prove a direct link to terrorism or weapons proliferation.
If you're running compliance at a crypto exchange, OTC desk, or payment intermediary, you have 30 days to tighten your Iran exposure controls before examiners start asking questions.
What You Need Before Starting
Team alignment:
- Your MLRO or Chief Compliance Officer must lead this project.
- You'll need engineering support to modify screening logic and transaction monitoring rules.
- Legal should review your Terms of Service for geographic restrictions.
- Customer operations needs talking points for account closures.
Technical inventory:
- Current Name Screening configuration and vendor contract.
- Access to your transaction monitoring platform.
- List of all blockchain addresses your platform has interacted with in the past 12 months.
- Customer onboarding flow documentation.
- IP geolocation and VPN detection tools.
Regulatory baseline:
- A copy of Executive Order 13902.
- OFAC's August 24, 2026 designation list (nearly 60 entities and vessels).
- The three MOIS-linked cryptocurrency addresses flagged for Behzad Mesri, Keyvan Fayyaz Ghareh Blagh, and Arman Kahzadian.
- Ivan Obukhov's designation details.
Data you'll need to pull:
- All customers with Iranian citizenship, residency, or beneficial ownership.
- Counterparties in UAE, Turkey, Russia, China, and other jurisdictions commonly used for Iranian oil trade settlement.
- Any transactions involving addresses later labeled as Iran-nexus by your blockchain analytics provider.
Step-by-Step Implementation
Days 1-3: Audit current Iran exposure
Run a full customer book review filtered by:
- Nationality: Iran
- Residency: Iran
- IP history showing Iranian access patterns
- Beneficial owners with Iranian passports
- Counterparty exposure to previously designated Iranian entities
Pull transaction data for the past 24 months and flag:
- Payments to or from addresses in Iran's crypto economy (if your blockchain analytics vendor tracks this)
- OTC trades settled in USDT or other stablecoins with counterparties in high-risk jurisdictions
- Any interaction with the newly designated MOIS addresses
Document your findings in a risk assessment memo. If you find active Iran-nexus customers or recent transactions, escalate to your MLRO immediately.
Days 4-7: Update screening and monitoring rules
Configure your Name Screening tool to:
- Block onboarding for any applicant with Iranian nationality, residency, or beneficial ownership.
- Screen against OFAC's Specially Designated Nationals (SDN) List, including the August 24 additions.
- Flag customers with counterparty exposure to entities operating in Iran's digital assets sector.
Update your transaction monitoring rules to:
- Alert on deposits or withdrawals involving blockchain addresses labeled Iran-nexus.
- Flag transactions with OTC brokers or exchanges in UAE, Turkey, or other jurisdictions frequently used for Iranian oil payments.
- Monitor for structuring patterns consistent with sanctions evasion, such as payments just below your enhanced due diligence threshold routed through multiple intermediaries.
If you're using Chainalysis, Elliptic, or TRM Labs, confirm they've labeled the MOIS addresses and any Obukhov-linked wallets. If not, add them manually.
Days 8-14: Harden onboarding controls
Revise your Customer Due Diligence questionnaire to ask:
- "Do you or any beneficial owner hold Iranian citizenship or residency?"
- "Will you use this account to facilitate transactions with counterparties in Iran or Iranian-controlled entities?"
- "Do you operate in the oil, petrochemical, shipping, or digital assets sectors in the Middle East?"
Update your Terms of Service to explicitly prohibit:
- Transactions supporting Iran's digital assets sector.
- Use of your platform by persons operating in sectors designated under E.O. 13902.
- Facilitating payments for Iranian oil, shipping, or shadow fleet operations.
Deploy IP geolocation and VPN detection at account creation. If a user's IP resolves to Iran, block registration and log the attempt.
Days 15-21: Customer remediation
For existing customers flagged in your Day 1-3 audit:
High-risk (immediate offboarding):
- Iranian nationals or residents with active accounts.
- Customers with direct transaction history to MOIS addresses or Obukhov-linked wallets.
- OTC brokers with documented ties to Iranian oil trade.
Send a termination notice citing sanctions compliance obligations. Freeze accounts, allow withdrawal of funds to a non-Iranian address after enhanced screening, and file a Suspicious Activity Report if you identify evasion patterns.
Medium-risk (enhanced due diligence):
- Customers in UAE, Turkey, or China with large stablecoin volumes and counterparty exposure to Iran-adjacent entities.
- Accounts with historical (but not recent) Iran-nexus transactions.
Request updated beneficial ownership documentation, source of funds declarations, and business purpose statements. If they can't satisfy your due diligence, offboard them.
Days 22-28: Validate and document
Run a post-implementation audit:
- Test your screening logic with known Iranian identities (use OFAC's SDN test cases).
- Simulate a transaction to a sanctioned address and confirm your monitoring system alerts.
- Verify that your onboarding flow blocks Iranian applicants at the KYC stage.
Document your entire process in a sanctions compliance procedures manual. Include:
- Screening configurations and rule logic.
- Customer remediation decisions and rationale.
- Training materials for customer operations staff.
- Escalation procedures for potential violations.
Days 29-30: Train and communicate
Brief your customer operations team on:
- How to handle inquiries from offboarded customers.
- Red flags for Iran sanctions evasion, such as customers asking to obscure beneficial ownership or requests to process payments for "shipping" or "commodities trading" in the Gulf.
- When to escalate to compliance.
Send an internal memo to leadership summarizing your Iran exposure, remediation actions, and ongoing monitoring plan.
Validation: How to Verify It Works
Screening test: Create a test account using a known Iranian identity from OFAC's SDN List. Your system should block it at onboarding. If it doesn't, your screening configuration is broken.
Transaction monitoring test: Simulate a withdrawal to one of the MOIS-designated addresses (Mesri, Blagh, or Kahzadian). Your transaction monitoring platform should generate an alert within minutes. If it doesn't, your address labeling is incomplete.
Counterparty review: Pull a sample of 50 recent OTC transactions. Manually review the counterparty's jurisdiction, business type, and transaction purpose. If more than 10% involve UAE or Turkey-based brokers with vague business descriptions, your customer due diligence process needs tightening.
Audit trail: Your compliance management system should contain:
- A complete list of offboarded customers with termination reasons.
- Screening logs showing blocked Iranian applicants.
- Transaction monitoring alerts for Iran-nexus addresses, with dispositioning notes.
If you can't produce this documentation in under 10 minutes, your recordkeeping isn't exam-ready.
Maintenance: Ongoing Tasks
Weekly:
- Review transaction monitoring alerts for Iran-nexus addresses.
- Check for new OFAC designations and update your screening lists (subscribe to OFAC's email updates).
- Monitor your blockchain analytics vendor for newly labeled Iranian addresses.
Monthly:
- Run a customer book review filtered by high-risk jurisdictions (UAE, Turkey, China, Russia).
- Audit a sample of customer due diligence files for completeness.
- Review your false positive rate on Iran-related alerts and tune your rules if needed.
Quarterly:
- Update your sanctions risk assessment to reflect changes in Iranian sanctions policy.
- Re-train customer operations staff on Iran red flags.
- Test your screening and monitoring controls with new OFAC test cases.
Annually:
- Conduct a full sanctions compliance audit, including Iran-specific controls.
- Review and update your Terms of Service for regulatory changes.
- Benchmark your program against peer institutions and adjust as needed.
The sectoral determination isn't a one-time compliance lift. OFAC has signaled it'll designate additional Iran-nexus crypto actors as part of Operation Economic Outcast, and enforcement will accelerate. Your job is to stay ahead of the designations, not react to them after your platform has already processed the transactions.
