Sanctions exposure and screening · Lesson 2 of 5
Sanctions risks specific to crypto
7 min read
Crypto changes how sanctions exposure arises. A designated party can open a wallet in seconds, move value across borders without a bank, and hide behind services that pool many users' funds. At the same time, every transfer leaves a permanent public record that a well-equipped compliance team can trace. This lesson maps the sanctions risks that are specific to crypto, so that the screening controls in the next lessons are aimed at the right targets.
Designated addresses and their limits
Since 2018 some autonomous regimes have included virtual asset addresses in designation entries, listed as identifiers of a designated person or entity, in the same way a passport number is listed. A transfer to or from such an address is direct dealing with the designated party.
Address listings are useful but narrow:
- Coverage. The UN Consolidated List has no dedicated field for virtual asset addresses, so UN designations usually reach crypto through names and entities, not addresses. Autonomous lists publish addresses only for some designations.
- Abundance. A designated party can generate new addresses at no cost. A listed address shows where the party was, not every place it is.
- Format. Lists may publish addresses with a chain or token label that is missing, ambiguous or wrong, and the same string can be valid on several EVM-compatible chains.
- Seeds, not boundaries. Listed addresses are best treated as seeds. Blockchain analytics expands them into clusters of addresses likely to be controlled by the same party (see the IDFE-BA lessons on clustering), and screening then covers the cluster.
The practical rule is that a firm screening only against published addresses will miss most sanctions exposure. Addresses are one input; names, entities, geography and behavior are the others.
Sanctioned services
Autonomous regimes have designated not only individuals but crypto services: exchanges accused of processing ransomware and darknet proceeds, mixers used to launder state-linked thefts, and in one case a set of smart contracts: in 2022 the United States designated the Tornado Cash mixer by listing its contract addresses (see the lesson Wallet and transaction screening). When a service is designated, every deposit address and hot wallet attributed to it becomes a sanctions exposure for counterparties.
Two patterns recur. First, a designated exchange often keeps operating, sometimes under a new name or through a successor entity that takes over its customers and liquidity. Second, customers of a designated service may move to other platforms, carrying funds with direct or indirect exposure. Both mean that list updates must be followed by analytics updates, and that counterparty VASP due diligence (see the lesson Identifying and vetting the counterparty) must ask about sanctions links, not only about Travel Rule readiness.
State-linked theft: the DPRK case
The most important state-level sanctions risk in crypto is theft by actors linked to the Democratic People's Republic of Korea, commonly reported under the name Lazarus Group. The DPRK is subject to UN Security Council sanctions under resolution 1718 (2006) and later resolutions, which aim to cut off funding for its weapons programs.
The Panel of Experts that supported the 1718 Committee documented this activity for years. Its report released in March 2024 said it was investigating 58 suspected cyberattacks on crypto-related companies between 2017 and 2023, worth about USD 3 billion, and reported that cyber theft generated as much as half of the DPRK's foreign currency income. The Panel's mandate ended on 30 April 2024 after a draft renewal resolution was vetoed in March 2024. A group of 11 states then set up a monitoring team outside the UN framework, which continues to report on DPRK cyber theft. The theft of about USD 1.46 billion from the exchange Bybit in February 2025 was attributed to DPRK actors.
The laundering pattern described in public reporting is consistent: rapid swaps of stolen tokens on decentralized exchanges, use of mixers and cross-chain bridges, conversion to bitcoin or stablecoins, and cash-out through OTC brokers and accounts at exchanges in permissive jurisdictions. The Panel and later public reports also described DPRK IT workers abroad using false or borrowed identities to obtain remote jobs and freelance contracts, often paid in stablecoins. For a VASP this creates a second exposure: onboarding a customer who is in fact acting for a designated state.
Ransomware and designated cybercriminals
Some autonomous regimes designate ransomware operators, the individuals behind them and the services that launder their proceeds. This matters to VASPs in two ways. A victim who buys crypto through an exchange to pay a ransom may send it to an address controlled by a designated party, which can make the payment, and any firm that facilitates it, a sanctions breach. And ransom proceeds later arrive at exchanges as deposits with direct or indirect exposure. Firms that serve incident-response companies or victims need a procedure for ransom-related transfers: screening the destination, escalating to the sanctions officer, and engaging the competent authority before anything is sent.
Evasion typologies
| Typology | How it works | Signals a VASP can see | Typical control |
|---|---|---|---|
| Nested services | An unlicensed exchange or OTC desk runs its business through an account at a larger VASP | Very high volumes, many unrelated counterparties, deposits from sanctioned-service clusters | Counterparty and customer due diligence; ban undisclosed nesting |
| OTC brokers | Brokers convert large amounts for cash or bank transfers outside regulated venues | Round-number trades, fast in-and-out, links to theft or mixer clusters | Enhanced due diligence on brokers; exposure screening |
| Chain-hopping | Funds move across chains through bridges and swap services to break the trail | Deposits arriving from bridge contracts shortly after a known theft | Cross-chain analytics; holds on fresh high-risk inflows |
| VPNs and proxies | Users in sanctioned territories hide their location | IP addresses from hosting providers, time zone or language mismatches | Geolocation controls with VPN detection |
| Front companies and nominees | A clean name fronts for a designated owner | Thin corporate history, ownership that changes after designation | Ownership and control analysis; rescreening |
| Identity fraud | Borrowed or false identities, as with DPRK IT workers | Shared devices or payout addresses across accounts, inconsistent profiles | Liveness checks, device analytics, behavior monitoring |
These typologies combine. A single case may involve a mixer, a bridge, an OTC broker and a nested account, each step reducing the chance that a simple list check will catch it. The lessons Red flags and typologies and Blockchain analytics for compliance cover the monitoring side.
Geography: IP and location controls
Some sanctions are territorial: they prohibit dealing with persons located in, or ordinarily resident in, a country or region. For an online business with no branches, the only way to apply them is to infer where a customer is. Useful signals include:
- the country of the identity document and declared residential address;
- the IP address at onboarding, login and withdrawal, with flags for VPNs, Tor exit nodes and hosting providers;
- the phone number country code and the country of linked bank accounts or cards;
- device settings such as time zone and language, used as supporting evidence rather than proof.
A good control combines them. Blocking IP addresses from sanctioned territories at the front door is the minimum; checking IP data on existing accounts and acting on mismatches is what separates an effective program from a cosmetic one. A customer who passed onboarding with a document from a permitted country but logs in month after month from a sanctioned territory is a sanctions alert, not a curiosity.
Signals will sometimes conflict, and the procedure should say what happens then. A single login from a sanctioned territory by a long-standing customer with a consistent history may justify a request for explanation, such as evidence of travel. Repeated logins, a VPN pattern that starts right after onboarding, or a change of phone number to that country's code justify restricting the account until the customer's location is resolved, and exiting if it cannot be. Each decision, including the evidence the customer supplied, belongs in the case record. The lesson Running a sanctions compliance program shows how public enforcement actions have punished firms that collected this data and ignored it.
Exam focus: why listed addresses are seeds, not boundaries, and why screening only addresses misses most exposure; that the UN Consolidated List has no dedicated field for virtual asset addresses and UN designations reach crypto through names and entities; designated services and successor entities; the DPRK theft and laundering pattern and the Panel of Experts' role (figures are dated context); DPRK IT workers as an onboarding risk; ransom payments as a sanctions risk; the main evasion typologies and their signals; combining IP, document, phone and device signals for territorial sanctions and acting on IP data for existing customers.