Sanctions and Digital Assets: The 2026 Compliance Shift

Two things happened to digital asset sanctions compliance in the first half of 2026, and together they redraw the map. On the enforcement side, OFAC systematically dismantled the on-chain infrastructure of Iran's shadow banking networks — culminating in the June 2 designation of Iran's four largest cryptocurrency exchanges, with secondary sanctions attached. On the regulatory side, FinCEN and OFAC jointly proposed the first rule in U.S. history to mandate an effective sanctions compliance program for a specific category of institutions: payment stablecoin issuers under the GENIUS Act.

Enforcement and regulation are converging on the same perimeter. For virtual asset service providers (VASPs), banks with digital asset exposure, and prospective stablecoin issuers, the message is the same from both directions: on-chain activity is inside the sanctions system now, not adjacent to it.

General information only — not legal advice. For specific transactions and program decisions, consult counsel.

2026: the year sanctions enforcement went on-chain

The Iran arc tells the story in three acts.

January 30 — the first exchange designations for operating in Iran's financial sector. OFAC designated Zedcex Exchange Ltd. and Zedxion Exchange Ltd., two UK-registered platforms, for operating in Iran's financial sector and processing transactions for the Islamic Revolutionary Guard Corps (IRGC) — the first time OFAC had designated digital asset exchanges on that specific basis. Blockchain analytics linked roughly $1 billion in stablecoin flows to IRGC-controlled accounts and designated terrorist financiers.

April 24 — the sovereign wallet freeze. OFAC designated two wallets tied directly to the Central Bank of Iran, citing connections to the IRGC-Qods Force and Hezbollah. Tether, cooperating with OFAC and U.S. law enforcement, froze approximately $344.2 million in USDT — reported as the largest single on-chain freeze of state-linked crypto holdings to date. The wallets had accumulated roughly $370 million across nearly 1,000 deposits since 2021.

June 2 — the exchanges themselves. OFAC designated Nobitex, Wallex, Bitpin, and Ramzinex — Iran's four largest digital asset exchanges — along with four executives, under counterterrorism (E.O. 13224) and Iran financial-sector (E.O. 13902) authorities. Nobitex alone processed more than half of all Iranian digital asset inflows in 2025. Treasury framed the action as severing the on-ramps and off-ramps connecting Iranian entities to the global financial system, part of a campaign that had already frozen nearly half a billion dollars in regime-linked cryptocurrency.

Why the June 2 designations are different

Three features make this action a compliance inflection point rather than a routine SDN update.

Secondary sanctions attach to all four exchanges. Primary sanctions bind U.S. persons. Secondary sanctions extend the risk to foreign financial institutions — including non-U.S. VASPs, banks, and stablecoin issuers — that continue processing transactions for the designated platforms. A foreign exchange with no U.S. nexus can no longer treat these designations as someone else's problem.

OFAC issued new guidance alongside the designations (FAQ 1257), signaling that the agency expects a global compliance response, not merely U.S.-person de-risking.

The screening unit is the wallet cluster, not the name. These designations came with on-chain addresses. Effective screening against them requires blockchain analytics that can trace exposure through address clusters, successor wallets, and nested services — capabilities a conventional name-screening engine does not have. The unit of compliance has moved on-chain.

The other half: the GENIUS Act stablecoin rule

While enforcement escalated, the regulatory perimeter was being drawn. On April 8, 2026, FinCEN and OFAC jointly issued a proposed rule (Docket FINCEN-2026-0100) implementing the GENIUS Act's illicit-finance provisions. The comment window closed June 9, 2026; the GENIUS Act requires final regulations by July 18, 2026, with the broader regime becoming operational by January 2027.

The proposal does several consequential things:

It creates a new category of financial institution. Permitted payment stablecoin issuers (PPSIs) become a stand-alone category under the Bank Secrecy Act — distinct from money services businesses, banks, and broker-dealers — with full AML/CFT program obligations aligned to FinCEN's parallel program-rule proposal.

It mandates a sanctions compliance program — a federal first. OFAC's proposed rule would require every PPSI to maintain a sanctions compliance program with five mandatory elements: senior management commitment, risk assessment, internal controls, testing and auditing, and training. Those five elements are OFAC's 2019 Framework for OFAC Compliance Commitments — previously guidance, now proposed as binding regulation for this category. No federal rule has ever explicitly required a specific category of U.S. persons to maintain an effective sanctions compliance program before.

It splits AML and sanctions obligations at the secondary market. PPSIs would not be required to monitor secondary-market activity for AML purposes — but sanctions blocking obligations would apply across both primary and secondary markets. If a sanctioned person holds or trades a PPSI's stablecoin anywhere, the issuer is responsible for identifying it and taking appropriate action, on a strict-liability basis, with civil and potentially criminal exposure for failure.

It makes freeze, block, and reject capabilities enforceable infrastructure. The technical ability to freeze tokens, block addresses, and reject transactions stops being a product feature and becomes a compliance obligation an examiner can test.

What this means for VASPs, banks, and issuers

A few practical implications follow. None are specific legal advice.

Wallet screening is now table stakes, and it is not name screening. Institutions with digital asset exposure generally need blockchain analytics capable of screening addresses and tracing cluster exposure — including indirect exposure through nested services and successor platforms, a known evasion pattern after exchange designations.

Secondary-sanctions exposure needs its own analysis. Foreign institutions and VASPs that previously scoped sanctions risk to U.S.-nexus transactions should reassess: the June 2 designations attach consequences to continued dealings regardless of nexus.

The ownership analysis still applies on-chain. The OFAC 50 Percent Rule does not stop at the exchange level — entities owned 50 percent or more by designated persons are blocked whether or not they are listed, and layered corporate structures around exchanges and OTC desks are exactly where that analysis bites. On-chain data helps; it does not replace the diligence.

Prospective PPSIs should build to the proposed rule now. With final regulations statutorily due July 18, 2026 and the regime operational by January 2027, the runway is short. The five program elements, the risk assessment, and the freeze/block/reject stack take longer to build and document than the timeline allows for late starters.

Banks with crypto clients inherit the exposure. Correspondent relationships, custody arrangements, and fiat on/off-ramp services for VASPs all carry look-through risk to on-chain activity. The Iranian shadow-banking typology — layered exchanges, trusted intermediaries, stablecoin settlement — is precisely the pattern transaction monitoring and KYC refresh cycles should be tuned to catch.

Frequently asked questions

What did OFAC do to Iranian crypto exchanges in 2026? In January, OFAC designated two UK-registered exchanges serving Iran's financial sector; in April it designated Central Bank of Iran wallets, prompting a ~$344 million Tether freeze; and on June 2 it designated Iran's four largest exchanges — Nobitex, Wallex, Bitpin, and Ramzinex — with secondary sanctions attached.

What is the GENIUS Act stablecoin sanctions rule? A joint FinCEN/OFAC proposed rule (April 8, 2026) implementing the GENIUS Act. It would treat permitted payment stablecoin issuers as BSA financial institutions and — for the first time in federal law — require them to maintain an effective sanctions compliance program built on OFAC's five framework elements.

Do sanctions obligations reach the secondary market for stablecoins? Under the proposed rule, yes. AML monitoring obligations stop at the primary market, but sanctions blocking obligations follow the token — issuers must identify and act on sanctioned holders wherever the stablecoin trades, on a strict-liability basis.

Do the June 2026 designations affect non-U.S. institutions? Yes. OFAC attached secondary sanctions to all four exchange designations, extending risk to foreign financial institutions and VASPs that continue processing transactions for them, regardless of U.S. nexus.

Key takeaways

• OFAC spent the first half of 2026 dismantling Iran's on-chain financial infrastructure, culminating in the June 2 designation of its four largest crypto exchanges with secondary sanctions attached.
• Screening obligations have moved from names to wallet clusters — blockchain analytics is now core sanctions infrastructure, not an add-on.
• The GENIUS Act proposed rule is a federal first: a mandated sanctions compliance program for stablecoin issuers, built on OFAC's five framework elements.
• Sanctions blocking obligations would follow stablecoins into the secondary market on a strict-liability basis, even where AML monitoring does not.
• Final GENIUS Act regulations are statutorily due July 18, 2026, with the regime operational by January 2027 — the build window for issuers is now.

The bottom line

For a decade, digital assets sat at the edge of the sanctions system — reachable by enforcement but outside the regulatory architecture. In 2026 both moved at once: OFAC took down the largest on-chain evasion network it has ever targeted, and Treasury proposed writing sanctions compliance programs into federal regulation for the first time. The perimeter now runs through wallet clusters, secondary markets, and freeze-capable smart contracts. Institutions that still screen names against lists are screening the previous decade. This guide is written for compliance officers, MLROs, VASP and stablecoin operators, and in-house counsel; specific decisions should be reviewed with counsel.

Primary sources

1. U.S. Department of the Treasury, press release, Economic Fury Targets Iran's Largest Digital Asset Exchange for Terror Finance and Sanctions Evasion (June 2, 2026): home.treasury.gov/news/press-releases/sb0519
2. FinCEN & OFAC, Permitted Payment Stablecoin Issuer AML/CFT Program and Sanctions Compliance Program Requirements, Notice of Proposed Rulemaking, Federal Register (April 10, 2026), Docket FINCEN-2026-0100: federalregister.gov/documents/2026/04/10/2026-06963
3. FinCEN, PPSI AML/CFT NPRM (PDF): fincen.gov/system/files/2026-04/PPSI-AMLCFT-NPRM.pdf
4. OFAC, FAQ 1257 (June 2, 2026): ofac.treasury.gov/faqs
5. OFAC, A Framework for OFAC Compliance Commitments (May 2019): ofac.treasury.gov/media/16331/download?inline
6. OFAC recent actions: designation of Zedcex Exchange Ltd. and Zedxion Exchange Ltd. (January 30, 2026); designation of Central Bank of Iran-linked digital asset wallets (April 24, 2026).

---

Sanctionfy helps compliance teams extend defensible, documented sanctions processes to digital asset exposure — from wallet-screening governance to the risk assessments and program documentation the GENIUS Act rule would require. Get in touch for a walkthrough.