Cryptoassets: OFSI’s Sanctions Threat Assessment

The Threat Assessment covers UK businesses registered with the Financial Conduct Authority (“FCA”) and highlights the types of business activities conducted by cryptoasset firms, including the exchange of cryptoassets for fiat currency (government-issued currencies) or other cryptoassets, the operation of crypto ATMs, and the provision of custodial services for safeguarding and administering cryptoassets or private cryptographic keys (wallet providers).

Under the Financial Services and Markets Act 2000 (as amended by the Financial Services and Markets Act 2023), cryptoassets are defined as “any cryptographically secured digital representation of value or contractual rights that— (a) can be transferred, stored or traded electronically, and (b) that uses technology supporting the recording or storage of data (which may include distributed ledger technology).”

OFSI’s key findings

OFSI’s identified several critical issues within the cryptoasset sector:

OFSI suggests UK cryptoasset firms have almost certainly failed to fully report suspected breaches of financial sanctions since mandatory reporting obligations begun in August 2022. It states that much of this non-compliance is likely inadvertent, stemming from the rapid growth of these services, which creates challenges such as heightened risks of direct and indirect exposure to Designated Persons (i.e. those subject to UK asset freeze measures) and delays in identifying and attributing suspected breaches. Over 90% of suspected breach reports involving cryptoassets are linked to the UK’s Russia sanctions regime. However, while Russia remains a key focus, OFSI urges cryptoasset firms to maintain strong compliance across all UK sanctions regimes.

Russia

OFSI also highlights that UK cryptoasset firms have likely been exposed to the designated Russian exchange Garantex since its designation in 2023, leading to violations of UK financial sanctions.

Iran

Since 2019, Iran has developed a complex cryptoasset ecosystem, advanced by the introduction of the digital Rial in 2024. OFSI has identified an increase in the use of cryptoassets  in foreign trade as means of evading sanctions. Iranian cryptoasset firms are suspected of facilitating payments to designated persons via UK infrastructure. OFSI notes that some Iranian-linked platforms have publicly issued guidance promoting the evasion of banking restrictions and offering AI-generated IDs to bypass KYC controls.

North Korea

OFSI says that cryptoasset firms face significant risks from North Korean (DPRK)-linked hackers and IT workers, who target the wider sector through thefts and money laundering operations. It noted that in February 2025, DPRK-linked hackers carried out the largest cryptoasset theft to date, stealing approximately $1.5 billion from the exchange Bybit.

Red flags

To help firms identify and mitigate risks, OFSI has outlined several typologies and red flags.   These include:

• Large or unusual transactions, e.g., transactions immediately following new sanction announcements, dormant wallets suddenly becoming active or newly created wallets receiving large transfers;
• Centralised exchanges with links to DPs;
• Services lacking KYC requirements or transactions involving services that do not require user identification;
• Large cumulative volumes of microtransactions (<£10,000);
• Rapid movement of assets through multiple addresses;
• Use of anonymity enhanced cryptocurrencies (privacy coins); and
• Transfers originating from or directed to sanctioned jurisdictions

OFSI also warns of sector-wide threats such as the use of non-standard tokens, meme coins, and Non-Fungible Tokens (NFTs), which can be exploited for sanctions evasion due to their reduced traceability and regulatory gaps.

While these red flags may not necessarily indicate illicit activity, the presence of two or more should prompt firms to conduct enhanced due diligence. OFSI encourages for staff of cryptoasset firms to be trained to recognise and report sanctions using the provided red flags.

Complying with reporting obligations

OFSI states that since January 2022, just over 7% of all suspected breaches reported to OFSI have involved cryptoasset firms, with the vast majority of these reports made since April 2024.

To ensure firms do not breach UK sanctions by failing to comply with UK reporting obligations, cryptoasset firms should review their guidance on self-reporting and to implement robust compliance frameworks to ensure timely and accurate reporting.

For further guidance or support in navigating financial sanctions compliance, please do not hesitate to reach out to Hogan Lovells’ sanctions team.

Our global sanctions team

Companies operating internationally face a growing number of economic sanctions regimes imposed by the United States, the European Union, the UK and other jurisdictions, as well as global organizations such as the United Nations. Failure to comply with sanctions regimes can put companies at risk of civil monetary penalties or criminal penalties.

Our economic sanctions lawyers provide counsel to numerous clients seeking to comply with U.S. and non-U.S. economic sanctions and OFAC laws and regulations, and applicable blocking statutes while pursuing their legitimate commercial activities. Working together with colleagues in our offices in the United States, Europe and China/Hong Kong, our lawyers can address problems as they arise and help design reporting and compliance structures that anticipate and reduce the risks associated with such circumstances.

We help clients understand which of their global affiliates, officers, and employees are required to comply with sanctions and how corporate and governance structures affect the degree to which they are affected by sanctions. We assist clients in reducing their sanctions risk by assessing their compliance programs and making recommendations on how to institute operational changes. We have also assisted clients in getting licenses, permitting transactions otherwise prohibited by sanctions. Our team advises clients in all aspects of dealing with potential violations, including voluntary disclosures and penalty assessments. 

Authored by Aline Doussin, Daniel Shapland, and Orpheas Nikopoulos.