Sanctions and international regulatory frameworks

Different tools, different objectives

Sanctions are restrictions imposed under a jurisdiction's legal authority on particular persons, entities, activities, or territories. They may prohibit dealings, require blocking or freezing, and create reporting responsibilities. Prudential regulation addresses an institution's safety and resilience; conduct regulation concerns market behavior and customer treatment; AML/CFT regulation addresses financial-crime controls. These areas overlap but should not be collapsed into one generic 'crypto license.' A provider could face multiple obligations because it holds client assets, transfers value, serves customers abroad, and deals with a legally restricted party.

The rule to apply depends on jurisdiction, asset classification, regulated activity, customer location, and timing. Public-sector and legal professionals should record the date of their regulatory analysis. A company's marketing statement that it is 'compliant' is not proof of permission to provide a particular service in every country. Equally, authorization in one jurisdiction does not automatically create authorization elsewhere.

FATF: the common international baseline

FATF Recommendations 1, 10, 15, 16, 20, and 35 inform domestic frameworks for risk assessment, customer due diligence, virtual assets, payment transparency, reporting, and sanctions for noncompliance. FATF uses mutual evaluations and follow-up processes to assess how jurisdictions implement and enforce standards. A low-risk assessment does not authorize ignoring binding sanctions or mandatory due diligence. Domestic authorities retain their own legal roles and enforcement powers.

Other international standard setters

FATF is not the only global reference. The Financial Stability Board (FSB) published high-level recommendations for crypto-asset activities and for global stablecoin arrangements in 2023, built on the principle of “same activity, same risk, same regulation.” The International Organization of Securities Commissions (IOSCO) issued Policy Recommendations for Crypto and Digital Asset Markets in November 2023, covering conflicts of interest, market abuse, custody of client assets and cross-border cooperation. The Basel Committee on Banking Supervision sets the prudential treatment of banks' cryptoasset exposures. These bodies do not license anyone; national authorities turn their standards into binding rules.

How national and regional regimes differ

Domestic frameworks implement these standards in different ways. Most require authorization or registration for activities such as exchange, transfer, custody and brokerage, but they define those activities, the exemptions and the capital and conduct requirements in their own terms. Some create a dedicated crypto-asset law with a single licence that can be used across several countries; for example, the EU's Markets in Crypto-Assets regulation (MiCA) lets an authorized provider offer services across the EU. Others apply existing securities, payments and money-transmission laws activity by activity, with several regulators involved; the United States is an example, where a separate federal law now covers payment stablecoins. Thresholds, transitional periods and effective dates also differ, so the date of any legal analysis matters.

A company's statement that it is “regulated” therefore needs three checks: which authority, which activity, and which jurisdiction. Authorization in one country is not permission to serve customers everywhere.

Sanctions: a separate layer

Sanctions programs come from two main sources. United Nations Security Council sanctions are adopted internationally and implemented by each member state through domestic law. In addition, individual states and regional bodies maintain their own programs and lists, which can reach further than the UN lists. Many programs impose strict liability: a prohibited dealing can be a violation even if the firm did not know the counterparty was designated. Some authorities have designated specific blockchain addresses, which makes address screening part of a sanctions program. Because several programs can apply to one firm at the same time (through its location, its currency, its customers or its staff), the applicable programs must be identified before deciding what a match requires.

Applying sanctions in a real workflow

An effective sanctions program assesses exposure, uses current lists and updates, validates potential matches, examines the legal basis of restrictions, and escalates decisions to authorized staff. An on-chain address may be named in a public designation, but not all addresses associated by analytics are necessarily legally designated. Attribution often has confidence limits; a professional should not turn a heuristic relationship into a statement that a person is sanctioned. Blocking, rejecting, freezing, notifying authorities, and releasing funds are legally different actions. The correct choice is controlled by law and program-specific guidance, not analyst preference.

A public agency purchasing data services may need to screen providers, contractual counterparties, and relevant payment paths, while respecting procurement law, due process, and data protection. A cross-border incident can present simultaneous questions of sanctions jurisdiction, local licensing, personal-data disclosure, and competent-authority cooperation. The defensible output is a dated legal-and-operational decision record identifying sources, assumptions, unresolved issues, and responsible approvers. A regulatory matrix is a starting point, not legal advice for a transaction.

Exam focus: Identify the roles of FATF and the other international standard setters (FSB, IOSCO, Basel Committee); explain why sanctions, authorization, AML/CFT and conduct rules are separate tests; recognize that national regimes implement the standards differently, that a licence in one jurisdiction does not travel automatically, and that effective dates and verified legal status must be checked.