Author: CryptoSlate / Liam 'Akiba' Wright
Compiled by: TechFlow
TechFlow Introduction: A cryptocurrency payment might settle in seconds, but if a wallet is later identified as being linked to Iran's Islamic Revolutionary Guard Corps (IRGC), UK companies and individuals could face up to 14 years in prison. This is not an anti-money laundering fine, but a criminal offense—even if the blockchain transfer was completed before you identified the wallet's affiliation. For the crypto industry, this means wallet attribution and the timeline of awareness become a critical evidence chain of life-and-death importance.
The UK's designation of Iran's Islamic Revolutionary Guard Corps (IRGC) took effect on July 17, creating new criminal risks for UK-connected persons and businesses that receive or retain value linked to the organization.
According to the designation documents, the IRGC is one of the first three entities listed in Schedule 6A of the 2023 National Security Act.
The new Section 17C offense stipulates that a person who obtains, accepts, or retains a qualifying material benefit, and knows—or ought reasonably to know based on other facts known to them—that the benefit is from a designated entity, can face up to 14 years in prison.
The rules still leave some room for judgment. Payments connected to Iran do not automatically constitute a crime, and the Schedule 6A designation itself does not trigger asset freezes and transaction prohibitions under UK sanctions law. The key issues are whether the value can be linked to the IRGC and what the recipient knew at the time. Freezing stablecoins would still require separate action from the issuer or other legal authority.
The law never mentions crypto assets, but its wording is broad enough to cover them. It covers money or anything of value provided directly or indirectly, including through a company, which could bring stablecoins and other on-chain transfers within scope.
For exchanges, custodians, issuers, payment businesses, or UK users, this makes wallet attribution and timing an operational issue. A blockchain network might complete a transfer before the recipient can reject it, and an address might only be linked to a designated entity afterwards.
The core question becomes: what was known about the wallet and counterparty, and when, and what happened to that value afterwards.
Offense Follows Value, Not Payment Path
Section 17C(1) applies not only to payments made directly to a person. It can also apply when a person obtains or accepts a benefit for another, or retains a benefit already received. The key questions are whether the benefit is from a designated entity and whether the recipient knew or ought reasonably to have known of that connection.
The phrases "by or on behalf of" and "directly or indirectly" are important in a market built around intermediaries. The payment need not come from a wallet labeled "IRGC" or from an entity using the organization's name.
The supply chain can run through companies or other intermediaries. However, an Iranian counterparty, an Iran-linked wallet, or a crypto payment itself does not establish that the IRGC provided the benefit. Prosecution would still require a connection to the designated entity and the required subjective element.
The maximum sentence depends on the conduct. Upon conviction on indictment, the Section 17C(1) offense involving obtaining, accepting, or retaining a benefit carries a maximum of 14 years' imprisonment and a potential fine.
The Section 17C(2) offense of agreeing to obtain, accept, or retain a benefit carries a maximum of 10 years' imprisonment and a potential fine. A Home Office announcement broadly describes the regime as carrying up to 14 years, while the legal text provides this distinction.
Sending value in the other direction follows a separate statutory path. Section 17B covers conduct intended to materially assist a designated entity in UK-related activities. It also covers conduct likely to provide such assistance when the person knows, or based on known facts ought reasonably to know, that it may provide that assistance. Receiving and assisting are distinct offenses with different elements; neither creates a comprehensive prohibition on Iranian crypto activity.
The law also retains targeted protections. A financial benefit is excluded when it is a reasonable consideration for goods or services, and providing them is not itself an offense. Other provisions cover having a reasonable excuse for retaining or providing information, qualifying legal obligations and public functions, and humanitarian activities conducted in accordance with internationally recognized applicable principles and standards. Their application still depends on specific facts.
On-Chain Settlement Makes Timing a Challenge
The Office of Financial Sanctions Implementation (OFSI)'s crypto asset threat assessment (concerning sanctions, not the new designated entity offenses) states that crypto firms cannot reject incoming blockchain transactions. It also notes that addresses may be attributed later, and analytical tools can identify historical direct or indirect risks.
These observations describe the same technical sequence that UK-connected recipients must now consider. A deposit may complete before a custodian has reliable identity for the sending wallet. New intelligence may later link that address or a set of related addresses to a designated entity after completion.
An initially unidentified receipt does not automatically constitute a crime. The timeline may instead become crucial evidence.
A reliable record may need to show the transaction time, wallet risk data available then, counterparty information, when an attribution alert appeared, the basis and confidence of that alert, whether the value remains accessible, and the escalated response.
Receiving and retaining may also occur at different points. Network-level finality may prevent a recipient from reversing the original transfer, while separate account or token controls may affect what happens next.
A custodian may be able to restrict account access, block subsequent withdrawals, investigate the source, or seek appropriate consent pathways. The necessary response depends on the facts and applicable legal systems.
UK Connection Follows the Funds
Section 17C can apply to conduct wholly outside the UK when the benefit is provided in or from the UK, the person is a UK person, or there is a specific Crown connection. UK persons include UK nationals, individuals resident in the UK, entities incorporated under UK law, and unincorporated associations formed under UK law.
This scope brings more entities beyond regulated trading venues into the potential review population. UK-related exchanges and custodians are the most obvious examples as they receive and hold client assets.
Payment processors, OTC desks, merchants, and other businesses may facilitate or retain on-chain value. Some stablecoin issuers, depending on their token architecture and permissions, can restrict subsequent token use after attribution. Ordinary UK-related users can also receive value, subject to the same designated entity link and knowledge threshold.
The government's impact assessment states the Act does not create new reporting obligations for businesses. Nonetheless, it considers businesses that receive, hold, or move funds on behalf of designated entities and encourages the use of existing suspicious activity and consent processes. Applying the same logic to crypto goes beyond what the law explicitly requires.
Governance may affect risk. Under Section 35 of the 2023 National Security Act, an officer may be liable alongside an entity when a Part 1 offense is committed with their consent or connivance, or is attributable to their neglect. Directors are not automatically liable for every flagged wallet, but escalating ownership and written follow-up now carry higher stakes.
Designation Separate from Sanctions Freezing
Schedule 6A and UK financial sanctions perform different legal functions. A government factsheet states that an organization listed solely under sanctions is not within the scope of the designated entity offenses unless also designated for these offenses.
Adding an entity to Schedule 6A does not itself trigger the asset freeze, transaction prohibitions, and reporting obligations that arise under financial sanctions law. It also does not alter stablecoin smart contracts. Issuer freezing depends on separate sanctions obligations, other legal bases, or actions taken under the issuer's own control.
The case of Tether freezing 134 wallets illustrates the technical dimension. The issuer used its control over its tokens to freeze addresses in a sanctions context. The new UK issue is different: whether a person accepted or retained a benefit linked to a designated entity with the requisite knowledge, including when no issuer has frozen anything.
Thus, workflows limited to sanctions have gaps. Businesses may need to separate Schedule 6A attribution alerts from OFSI asset freeze matches and then determine which legal and operational escalation paths apply.
A wallet could raise issues under both regimes, but the presence or absence of a sanctions freeze does not resolve Section 17C liability.
Controls Need an Evidence Timeline
For UK-connected crypto businesses that receive, hold, transfer, or facilitate value, a practical response may be to review how existing controls preserve the chronological sequence behind decisions.
The Act itself does not impose this crypto-specific checklist, but the offense and official crypto risk materials support reviewing how businesses:
Map designated entities, aliases, and related counterparties separately from financial sanctions lists;
Record the source, confidence, and timing of wallet attributions;
Re-screen earlier deposits when reliable attribution changes;
Link on-chain findings with client, company, and intermediary information;
Escalate uncertain matches without treating proximity to an Iran-linked wallet as proof; and
Document decisions regarding access, retention, withdrawals, and existing reporting or consent pathways.
UK crypto asset exchanges and custodial wallet providers already operate under the FCA's AML framework, which expects proportionate transaction monitoring and internal escalation. Schedule 6A adds separate potential criminal risk to the facts these systems may uncover.
Targeted statutory protections are not equivalent to a general safe harbor for due diligence, unsolicited transfers, or network-level irreversibility. A suspicious activity report or a request through existing consent processes may form part of an escalation, but official materials do not present either as an automatic defense to Section 17C. Analysis still relates to the benefit, its link to the IRGC, facts known to the person, and subsequent conduct.
Recipients typically cannot reject or reverse an incoming blockchain transfer at the network level, though separate account or issuer controls may restrict its subsequent use.
Therefore, the first crypto test of this designation will focus on whether UK-connected recipients and intermediaries can reconstruct a reliable record on attribution and knowledge, as wallet intelligence evolves.
From July 17, this evidence timeline could lead to criminal risk measured in years, even if the transfer itself settled in seconds.
