Crypto AML and Sanctions Compliance 2026: OFAC, FATF, Screening

At 2 a.m. in Singapore, a transaction monitoring analyst at a regional exchange watches an alert queue refill. The US Treasury has just designated four Iranian exchanges, and the blockchain analytics feed has re-scored thousands of addresses overnight. One customer's deposit of 25,000 USDT now traces back, three hops away, to a wallet tied to a newly sanctioned platform. Does she freeze it, ask questions, or let it through? That decision, multiplied across every regulated crypto business, is what anti-money laundering and sanctions compliance looks like in 2026.

Crypto compliance used to be a story about bitcoin and darknet markets. In 2026 it is a story about stablecoins, state actors and the businesses that sit between them. This piece pulls together the official data, the year's sanctions actions and what compliance teams actually check.

The threat picture in official numbers

The FATF's annual reviews give the clearest regulator's-eye view. Its June 2025 update recorded the theft of USD 1.46 billion from the exchange Bybit by North Korean actors, the largest single virtual asset theft on record, with only 3.8% recovered at the time. It cited one industry estimate of about USD 51 billion in illicit on-chain activity tied to fraud and scams in 2024, and concluded that most on-chain illicit activity now involves stablecoins.

The July 2026 update went further on how the money moves. Competent authorities found that one Cambodia-based conglomerate laundered at least USD 4 billion between August 2021 and January 2025, including at least USD 37 million from North Korean cyber-heists. A stablecoin issuer froze more than USD 29 million in a wallet linked to the same group, which had reportedly marketed its own stablecoin as immune to freezing. In Spain, Operation Borrelli uncovered about EUR 460 million laundered from more than 5,000 victims. The FATF also found that terrorist groups increasingly prefer stablecoins over bitcoin, using rotating wallets and multi-hop transfers.

The common thread is speed. Stablecoins settle across borders in seconds and can be fragmented through decentralised exchanges, bridges and multiple platforms faster than any investigator can follow. That is why compliance has shifted from reviewing transactions after the fact to screening them before they settle. For the consumer side of this, see our guides to money transfer scams and AI fraud in payments.

2026's defining sanctions campaign: Iran's crypto exchanges

The US Treasury's "Economic Fury" campaign against Iran has produced the most intensive run of crypto sanctions to date. On 2 June 2026, OFAC designated Nobitex, Iran's largest exchange, alongside Wallex, Bitpin and Ramzinex, under counterterrorism and Iran financial-sector executive orders. The Treasury press release said Nobitex handled over half of all Iranian digital asset inflows in 2025, Wallex 12% and Bitpin 10%, and that Ramzinex processed more than USD 2.45 billion in transactions. It also said Nobitex helped Iran's central bank access hundreds of millions of dollars in stablecoins. Nobitex claims more than 11 million users, according to Elliptic, whose analysts had earlier traced its wallet links to addresses tied to sanctioned and hacking groups.

More followed. In July, Treasury designated Iran-linked wallets holding more than USD 130 million, which an on-chain analyst identified as four Tron addresses holding about USD 131 million in USDT. August brought designations of two more exchanges, Shelbit and Aban Tether, and on 17 September Treasury sanctioned BitBank, alleging it moved hundreds of millions of dollars in bitcoin to the IRGC, as The Block reported. On 9 October, Treasury Secretary Scott Bessent said the US would probably seize about USD 1 billion more in Iran-linked crypto, while earlier totals remained unclear, per The Block.

Stablecoin issuers as the new chokepoint

Unlike bitcoin, centrally issued stablecoins can be frozen by the issuer at the token level. That has turned issuers into a front line of sanctions enforcement. Tether says it froze more than USD 344 million in USDT across two Tron addresses on 23 April 2026 in coordination with OFAC and US law enforcement. In a September 2026 statement, it put Iran-linked freezes over the past year at about USD 550 million, cumulative freezes at more than USD 5 billion, and said it works with over 340 agencies in 70 countries. It has also aligned its wallet-freezing policy with OFAC's SDN list, including secondary-market wallets. These are the company's own figures.

Congress is not convinced that is enough. A Senate Permanent Subcommittee on Investigations report released on 28 September 2026 analysed 846 sanctioned or blocked Iran-linked wallets and found that 87% of 757 wallets implicated in Iranian terrorism financing had transacted mainly in USDT, and argued the issuer had failed to act on some wallets with strong illicit-finance indicators, The Block reported. Tether rejected the claim. The episode shows where the policy fight is heading: issuers will be judged not only on whether they freeze when asked, but on whether they spot problems first. Our comparison of USDT and USDC covers the two largest issuers' approaches.

A freeze button is only a control if someone presses it before the money moves on.

What compliance teams actually screen

A regulated crypto business runs several overlapping checks on every customer and transfer. The table below maps each to its legal hook and a 2026 example.

Two technical points trip up even experienced teams. First, OFAC's 50% rule concerns ownership: any entity 50% or more owned by blocked persons is itself blocked, even if it is not named. It does not mean funds become sanctioned once half of them pass through a listed address. Second, sanctions liability is strict. Treasury's release reminds firms that OFAC can impose civil penalties without proving intent, and that non-US firms can be exposed if they cause US persons to violate sanctions. Our guide to the FATF Travel Rule explains the data layer that makes counterparty screening possible.

Worked example: one deposit, three decisions

Return to the Singapore analyst and her 25,000 USDT deposit. Suppose the analytics tool breaks it down like this.

1. Direct exposure: zero. The sending address itself is not on any sanctions list. No mandatory block yet.
2. Indirect exposure: 7,500 USDT, or 30%. That portion arrived three hops back from a wallet attributed to an exchange designated by OFAC in June. The other 17,500 USDT came from two regulated exchanges.
3. Customer profile. The account holder is a freelancer who says she was paid by a client through a P2P trader. P2P is exactly the channel 58 of 66 assessing jurisdictions told the FATF they rate as high risk.

A typical risk-based response: hold the deposit, request evidence of the underlying work and payment, and escalate to the money laundering reporting officer. If the explanation does not hold, file a suspicious transaction report with the local financial intelligence unit and consider ending the relationship. If the exchange has US nexus or uses a US-regulated stablecoin, legal will also check whether any portion constitutes blocked property. None of this is automatic. Analytics tools produce a risk score; people still make the call, and regulators examine whether the call was reasonable.

The numbers matter. A tool tuned to flag any indirect exposure above 5% will catch this deposit and thousands of innocent ones. Tuned to 50%, it would have missed it. Every compliance team is choosing a threshold, and the right one depends on its customers, products and regulators.

Where the system is still weak

The FATF's own 2026 data shows the gaps. Only 23% of jurisdictions (31 of 133) collect P2P market data. Just 26 of 142 have assessed DeFi risks, and only one reported enforcement against a DeFi arrangement. Of 91 jurisdictions with Travel Rule laws, 55 had taken no supervisory or enforcement action on them. Criminals route through whichever link is weakest: an unlicensed OTC desk, a lightly supervised offshore platform, a bridge. Our explainer on OTC crypto desks covers one of those channels.

Our view: sanctions enforcement has become far more effective at the stablecoin layer, because issuers and large exchanges can be compelled to act. The weakness is everything that does not touch a regulated chokepoint. Expect regulators to keep pushing obligations outward, to issuers, to analytics on unhosted wallets and to the licensing of offshore platforms, rather than inventing new rules for the core.

What to watch next

• October 2026: whether Treasury follows through on the roughly USD 1 billion Iran-linked seizure Secretary Bessent flagged on 9 October, and how much is held in stablecoins.
• Late 2026: the response of Justice and Treasury to Senator Blumenthal's request for investigations following the Senate subcommittee's 28 September report.
• Mid-2027: the FATF's next targeted update on virtual assets, which will show whether supervisors have started enforcing Travel Rule and licensing obligations.
• 25 October 2027: the UK's FSMA crypto regime takes effect, bringing conduct supervision to firms that today are registered only for AML; see our guide to crypto licences.
• End of 2030: the deadline for the FATF's revised Recommendation 16, which will apply similar originator and beneficiary data rules to all cross-border payments.

This article explains AML and sanctions frameworks for general information and is not legal advice. Firms should take advice from qualified sanctions and AML counsel on specific obligations.

About this researchMuffinPay InsightsIndependent analysis of stablecoins, CBDCs, cross-border payments and digital public infrastructure. Every figure is linked to its source. Read our editorial standards →