Crypto Sanctions Risk: OFSI Threat Assessment Explained

Cryptoasset firms are on the front line of sanctions evasion, because value can move across borders in minutes. In July 2025 the UK's Office of Financial Sanctions Implementation (OFSI) published a threat assessment on cryptoassets, covering the period from January 2022 to May 2025. This guide summarises its findings and what it expects from firms. It supports our Financial Crime Risk in Cryptoassets course overview, and follows our guides to the FATF 2026 cryptoasset update and to sanctions alert resolution.

The key judgements

OFSI's assessment sets out five key judgements. It says UK cryptoasset firms have almost certainly under-reported suspected breaches of financial sanctions to OFSI since August 2022. It judges that most non-compliance is likely to stem from direct and indirect exposure to designated persons and from delayed attribution, which also delays asset freezes. It says UK firms have highly likely been directly or indirectly exposed to the Garantex exchange, causing breaches, and that they are highly likely at risk from hackers and IT workers linked to North Korea. It also judges that UK firms are likely facilitating transfers to Iranian cryptoasset firms with suspected links to designated persons.

What the figures show

According to the assessment, just over 7 percent of all suspected breach reports to OFSI since January 2022 involved cryptoasset firms, and over 90 percent of these were made since April 2024. Russia accounts for over 90 percent of cryptoasset-related reports and Iran for the remaining 10 percent, based on data to April 2025. The document also cites incidents it attributes to North Korea-linked actors, including about $1.5 billion stolen from Bybit in February 2025 and about $19.5 million lost from Lykke in June 2024. On Garantex, it says about $26 million was frozen in the March 2025 disruption, and that a successor, Grinex, recorded over $1.2 billion in USDT transaction volume as of May 2025.

Threat typologies

• Russia: Garantex remains central, with activity shifting toward merchant services and indirect flows. The assessment says Russian peer-to-peer platforms may also facilitate circumvention.
• North Korea: threat actors use cyber heists, phishing and social engineering, and launder through bridges, mixers, exchanges without know-your-customer checks and over-the-counter desks. IT workers pose a risk of data compromise. The assessment calls North Korea-linked actors the most significant and persistent threat to the sector.
• Iran: payments run through the Nobitex exchange, which the assessment says has suspected links to the Islamic Revolutionary Guard Corps.
• Stablecoins and layering: USDT is widely exploited, and mixers, privacy wallets, chain-hopping and bridges add obfuscation.

What OFSI expects from firms

On screening, the assessment expects blockchain analytics across multiple stages, with counterparty exposure assessed, including through geolocation tools, and a scan of at least three to five hops or until an attributed service provider is reached. It also says exposure to a designated person never truly disappears, as more hops do not eliminate exposure fully. Firms should watch for new addresses linked to designated persons, not just the originally listed ones.

On frozen assets, the assessment says firms cannot reject incoming transactions. They should restrict account access to suspect assets, report to OFSI, and freeze assets of designated persons where no licence applies. On reporting, firms should report suspected breaches promptly, even when discovered retrospectively, bundle small transactions with an explanation, and include addresses, transaction hashes and values, together with know-your-customer details, the screening process and actions taken. They should also report to the National Crime Agency through suspicious activity reports and to the FCA where relevant.

OFSI's recommended actions

OFSI recommends risk-based due diligence and a look-back for past unreported suspected breaches. It says clusters of red flags should trigger enhanced due diligence, and gives examples such as large transfers after sanctions announcements, use of VPNs, and multiple small transfers under £10,000. It also points firms to its North Korean IT workers advisory and encourages them to subscribe to OFSI alerts.

Using this in a crypto compliance role: our suggestions

These steps are our suggestions, not requirements in the assessment.

• Check how many hops your analytics tool scans and who decides when to stop.
• Run a look-back on historic flows to the entities the assessment names.
• Write down what staff should do with an incoming transfer from a designated person, since the assessment says it cannot be rejected.
• Check that reports include addresses, transaction hashes and values.

For structured learning, browse our CPD courses.

What we could not confirm

The assessment is dated July 2025 and covers the period to May 2025, so newer developments are not included. The document is inconsistent on when Garantex was designated, giving May 2022 in the threat section and 2023 in one key judgement. We did not read OFSI's separate North Korean IT workers advisory or the underlying breach reports. We took all figures from OFSI's text and did not verify them against other sources. This post is general information, not legal advice.