Crypto sanctions screening: OFAC targets Iran exchanges

OFAC just designated Iran’s four largest crypto exchanges. If your crypto sanctions screening hasn’t been updated to cover Nobitex wallet clusters, now is the time to act.

On June 2, 2026, the US Treasury’s Office of Foreign Assets Control (OFAC) designated Nobitex, Wallex, Bitpin and Ramzinex under Executive Orders 13224 and 13902 on counterterrorism and Iran financial sector authorities. This is the largest crypto-specific OFAC action ever taken against Iranian exchange infrastructure. Nobitex alone processed more than 50% of all Iranian digital asset inflows in 2025. Four company leaders were also personally designated.

For VASPs, this requires immediate action. Any transaction linked to these entities or their wallet clusters now carries sanctions risk – and OFAC enforces on a strict liability basis.

This post covers exactly what was designated, which wallet clusters and chains you need to prioritize, and what compliant crypto sanctions screening looks like right now.

Key takeaways:

– OFAC designated four Iranian digital asset exchanges on June 2: Nobitex, Wallex, Bitpin, and Ramzinex

– Nobitex processed more than 50% of Iranian digital asset inflows in 2025 and has confirmed IRGC-linked wallet activity

– Four Nobitex leaders were personally designated, including the chairman, two co-founders, and the current CEO

– VASPs with stablecoin flows, Tron-based transactions, or peer-to-peer exposure to these entities face immediate sanctions risk

– Strict liability applies: review your screening practices now to avoid unintentional exposure.

The four Iranian exchanges OFAC designated on June 2

OFAC added four Iranian digital asset exchanges to the Specially Designated Nationals (SDN) list, along with four individuals tied to Nobitex’s leadership.

• Nobitex is Iran’s largest digital asset exchange. It processed more than 50% of all Iranian digital asset inflows in 2025 and approximately 70% of Iran’s entire digital asset activity at its peak and served an estimated 11 million users. OFAC designated Nobitexunder EO 13224 for materially supporting the Islamic Revolutionary Guard Corps (IRGC) and under EO 13902 for operating in Iran’s financial sector.

• Wallex received 12% of all Iranian digital asset inflows in 2025 and has processed transactions linked to the IRGC.

• Bitpin received 10% of Iranian digital asset inflows in 2025, and its investors have been linked to US sanctions evasion efforts.

• Ramzinex, founded in Tehran in 2018, processed over $2.45B in transactions, including transfers to IRGC-linked wallets and a government-backed financial institution.

The four designated individuals are Amir Hossein Rad (chairman, co-founder, and former CEO), Seyed Ali Khoee (current CEO),and the brothers, Seyed Mohammad Ali Aghamir Mohammad Ali and Seyed Mohammad Aghamir Mohammad Ali.

The latter two, brothers and also co-founders, are members of the Kharrazi family – part of Supreme Leader Khamenei’s inner circle. This is not a rogue exchange that was misused. It is a state-embedded financial infrastructure. The designation is the compliance trigger. The family connection is the intelligence signal. For VASPs, that distinction matters: state-embedded networks relocate. Screening for Nobitex today is necessary, but reviewing all Iran-adjacent exposure is the more important step.

How Iranian stakeholders responded to the OFAC sanctions designations

The sanctioned platforms responded with official statements that highlighted their alleged proactive preparations for this scenario well in advance. Additionally, they pushed back on the implication that sanctions equate to a shutdown, emphasizing that user assets remain fully secure and that services will continue operating without interruption:

• Nobitex noted it had anticipated external sanctions and put technical and operational measures in place accordingly.

• Wallex stressed that all user funds are held in secure, isolated wallets and that sanctions create no gap in personal asset ownership.

• Bitpin similarly stated that its asset protection standards and methods had been implemented months before the designations, with deposits and trading markets remaining fully available to users as normal.

• Ramzinex assured users it had been preparing for the possibility of sanctions since last year, setting up backup systems and alternative operational channels to keep the exchange running.

The Iran Fintech Association also weighed in, condemning the sanction announcement in a June 4 statement (seen below), claiming that the designations are a “continuation of restricting Iranian citizens’ access to modern financial services.”

Above: The Iran Fintech Association’s response to the OFAC designation, claiming the sanctions adversely impacted ordinary Iranians.

Crystal’s on-chain investigations tested the veracity of these claims and revealed a complex story that VASPS should be aware of.

Iran has a layeredhistory with cryptocurrencies: It has long sought to engineer resilience into its crypto markets – capping stablecoin ownership to limit capital flight and shifting exchange holdings toward Bitcoin to reduce the risk of seizure. Crystal’s data suggests this is deliberate policy, not a coincidence:

• During the January 2026 internet blackout, Nobitex processed 77% of all Iranian exchange outflows. $21M in USDT then moved through Canada-based Farsi-speaking cash desks. The pattern is consistent with urgent capital movement during political instability – exactly the behavior expected from individuals with regime connections hedging against domestic uncertainty.

• On February 28, the day of the US-Israeli strikes, Bitcoin accounted for 94% of Iranian exchange volume, while freezable stablecoins accounted to only 4.5%. Regime-connected individuals rotate into uncensored assets as pressure mounts.

• In the early stages of the current conflict, a notable inflow of Bitcoin was observed to Nobitex, which Crystal assessed to be a preparation against possible action by stablecoin issuers.Bitcoin is the asset that cannot be frozen, seized, or censored. The rotation reversed immediately when pressure eased, confirming deliberate crisis-driven behavior.

VASPs exposed to Iranian address clusters, Farsi-speaking OTC desks, or unusual Bitcoin inflow spikes tied to geopolitical events should treat these patterns as live red flags rather than edge cases. The $21M post-blackout flow through Canadian cash desks also shows how Iranian sanctions evasion reaches into Western jurisdictions. Any VASP in a FATF member state carries exposure here, including those with no obvious Iran-linked clients.

OFAC confirms Crystal’s on-chain analysis: Regime wealth doesn’t stay in Iran

In the OFAC announcement, US Treasury Secretary Scott Bessent skewered the hypocrisy of the regime, stating it has “chosen to co-opt digital asset technologies for its own corrupt agenda, including evading sanctions and transferring wealth out of the country.”

Crystal can confirm this on chain:Nobitex’s footprint is not confined to Iran. Our on-chain analysis has identified money service businesses (MSBs) in both Canada and the United Kingdom with direct blockchain exposure to Nobitex wallets.

These MSBs serving Iranian diaspora communities handle legitimate remittances and regime-connected capital flows through identical channels, making them extremely difficult to monitor. Crystal has separately identified Nobitex-linked individuals acquiring high-value Canadian property for cash, representing the end state of the pipeline: Iranian assets converted into Western real estate.

VASPs with Canadian or UK MSB clients may carry direct, demonstrable Nobitex exposure. This makes Iran sanctions a live compliance obligation rather than a distant geopolitical concern.

Why VASPs face immediate screening exposure

OFAC’s strict liability standard means your compliance team cannot rely on intent. If your platform processed a transaction involving a designated wallet even before June 2, you may face enforcement exposure depending on your screening practices at the time.

The forward-looking risk is more urgent. Any transaction your platform processes from June 2 that touches a Nobitex-linked wallet cluster, a Wallex counterparty, or a Ramzinex-linked address creates asanctions exposure you must remediate.

The scale of Nobitex’s activity makes incidental exposure likely for VASPs with Iranian user bases or broad stablecoin flows. Nobitex facilitated hundreds of millions of dollars in stablecoins for Iran’s Central Bank, much of it routed through Tron and BNB Chain. If you operate stablecoin on- or off-ramps without real-time screening on these networks, you should review your screening coverage on these networks now.

OFAC has also put foreign financial institutions on notice. The Treasury Department stated it is prepared to impose secondary sanctions on foreign firms that facilitate Iran’s activities, signaling directly to non-US VASPs that enforcement can reach beyond US borders.

Chains and wallet clusters to prioritize now

Nobitex operated primarily on Tron and BNB Chain. These are the two networks to prioritize immediately.

OFAC has also linked Nobitex to wallets associated with IRGC-affiliated ransomware entities. These are not static wallet clusters: they evolve. Screening has to go beyond the specific wallets named at designation to cover the broader clusters associated with these entities.

The 50% rule also applies. Any entity owned 50% or more, directly or indirectly, by a designated person is itself blocked, even if not named on the SDN list. This means wallet clusters linked to Nobitex’s co-founders and leadership are also in scope.

What compliant crypto sanctions screening requires

Batch screening alone may not be sufficient. Designations take effect the moment OFAC publishes them. If your screening process runs daily or weekly, you had a gap on June 2.

Compliant screening for this action requires:

• Real-time SDN screening at the point of transaction, rather than after the fact.

• Address-level screening across Tron, BNB Chain, and any other networks where these exchanges operated.

• Cluster analysis- screening individual wallet addresses alone can miss the broader attribution networks linked to designated entities.

• Entity due diligence- counterparty screening to identify businesses and individuals with indirect exposure to the four exchanges.

• Audit-ready documentation- a clear record of screening processes, matches, and decisions is valuable if OFAC enquires.

Steps to take if your screening flags a match

If screening flags a transaction tied to a designated entity, do not process it. Freeze the associated funds and report the blocked property to OFAC as required under US sanctions regulations.

Document the wallet address, transaction attempt, timestamp, and screening result. That record is what OFAC looks at when assessing penalties, and a documented good-faith compliance program with real-time screening is your strongest defense.

For historical transactions that may have touched these wallets before the designation, consult legal counsel. Voluntary self-disclosure to OFAC typically results in significantly lower penalties than an enforcement action OFAC initiates on its own.

Frequently asked questions

Which exchanges did OFAC designate on June 2, 2026?

OFAC designated four Iranian digital asset exchanges: Nobitex, Wallex, Bitpin, and Ramzinex. All four are now on the SDN list and subject to full blocking sanctions. Four Nobitex leaders were also personally designated.

Does the 50% rule apply to Nobitex-linked entities?

Yes. Any entity owned 50% or more by a designated person, including the designated Nobitex co-founders and officers, is itself blocked under US sanctions law, even if not named on the SDN list. This means wallet clusters and corporate structures linked to designated individuals are also blocked.

Are non-US VASPs exposed to these sanctions?

Yes. OFAC has explicitly warned foreign financial institutions of potential secondary sanctions for facilitating Iran’s activities. Non-US VASPs that process transactions involving designated entities risk exposure, and the Treasury has signaled willingness to act against foreign firms.

Which blockchain networks should I prioritize for screening?

Prioritize Tron and BNB Chain, the primary networks used by Nobitex. These are the highest-risk networks for stablecoin flows connected to these designations.Beaware, however, thatrecent changes in strategy due to the risk of seizure of stablecoin holdings may mean funds will not adhere to this pattern.

What should I do if I find a match in my transaction history?

The transaction should not be processed. Associated funds should be frozen, the screening result documented, and blocked property reported to OFAC. For historical transactions that predate the designation, consult legal counsel and consider voluntary self-disclosure to OFAC.

How quickly do I need to act after an OFAC designation?

Immediately. Designations take legal effect the moment OFAC publishes them. Any transaction processed after June 2 that touches a designated wallet cluster is a potential violation. Real-time screening, not batch or daily screening, is the only compliant approach.

Review your screening coverage today

The June 2 designations are the largest crypto-specific OFAC action targeting Iranian exchange infrastructure. For VASPs, the time to review and update screening is now – not next week. They also come amid a wave of global sanctions, as the UK’s Foreign, Commonwealth and Development Office sanctioned 18 entities, including HTX, on May 26.

Reviewing screening coverage on Tron and BNB Chain, confirming the SDN list is current as of June 2, and ensuring cluster-level attribution – not just address-level matching – across these four exchanges and their leadership are all worthwhile steps.

DISCLAIMER:Crystal Intelligence provides this analysis for informational purposes only. It does not constitute legal advice. VASPs should seek independent legal counsel regarding their obligations under applicable sanctions regulations.