Iran -- Sanctions Compliance Regulatory Overview

**Controlling the flow of capital and preventing money laundering/terrorist financing.**

**Utilizing cryptocurrencies (specifically mined ones) for import payments to circumvent sanctions.**

**Prohibiting or heavily restricting the domestic use and trading of cryptocurrencies by individuals and unlicensed entities.**

**No explicit license requirements for third-party digital asset custody services exist.** This is primarily because such services are generally not permitted or recognized within a regulated framework for individual or institutional clients.

The Central Bank of Iran (CBI) has historically taken a prohibitive stance on cryptocurrency activities that could lead to capital flight or undermine the national currency. While mining has been licensed for specific purposes (see "Pending Legislation" below), this doesn't extend to general custody services.

Financial institutions (banks, credit institutions) in Iran are generally prohibited from dealing in cryptocurrencies, which would include offering custody services.

**Non-existent.** As there are no recognized licensed custodians, there are no rules mandating the segregation of client assets from proprietary assets.

**Non-existent.** Without a regulatory framework for custody services, there are no requirements for insurance or bonding.

**No specific regulatory mandates.** While any entity holding significant amounts of cryptocurrency (e.g., licensed miners before selling to the CBI or authorized banks) would likely use best practices like cold storage for security, this is not a regulatory mandate for a "custody service."

**No definition of "qualified custodian"** exists within Iranian law or regulation concerning digital assets.

**Central Bank of Iran (CBI) Stance:** The CBI has generally prohibited banks and financial institutions from dealing in cryptocurrencies.

**Reference (Indirect):** Reports often cite CBI directives. For example, a 2018 directive banned banks and financial institutions from crypto activities, which was later somewhat softened for mining but not for general trading or services.

*Example News Report referencing CBI stance:* "Iran Allows Banks, Exchange Bureaus to Pay for Imports With Crypto," Reuters (August 2022) - While this mentions banks *paying* with crypto, it's specific to imports and doesn't imply general crypto services. https://www.reuters.com/markets/currencies/iran-allows-banks-exchange-bureaus-pay-imports-with-crypto-2022-08-28/

**FATF Grey List:** Iran remains on the FATF's "High-Risk Jurisdictions Subject to a Call for Action" list. This significantly hinders any attempt to integrate with the global financial system and makes it extremely difficult for any entity in Iran to offer internationally compliant crypto financial services, including custody.

**Reference:** Financial Action Task Force (FATF) list of High-Risk Jurisdictions.

**Legalization of Crypto for Imports:** In 2022, Iran officially approved the use of cryptocurrencies for international trade payments, specifically imports. This framework allows miners to sell their crypto directly to the CBI or authorized banks to facilitate import payments. While this involves entities holding and managing crypto, it is a very specific use case for state-approved transactions, not general third-party custody.

**Reference (News):** "Iran approves using cryptocurrency for imports," Mehr News Agency (August 2022).

**Reference (News):** "Iran makes first official import using cryptocurrency," Tasnim News Agency (August 2022).

**Mining Regulations:** Iran has licensed cryptocurrency mining operations, with specific requirements for registration, energy consumption, and often mandates for selling mined crypto to the government or authorized channels. This is the most regulated aspect of the crypto industry in Iran.

**Reference (News):** "Iran's Central Bank, Industry Ministry to Regulate Crypto Mining," Financial Tribune (December 2020).

**National Digital Currency (CBDC):** The CBI has been working on a national digital currency (digital rial). This initiative is about central bank-issued digital currency, not private digital assets or third-party custody.

**Central Bank of Iran (CBI):** The main financial regulator, responsible for monetary and banking policies.

**Money and Credit Council (MCC):** A high-level policy-making body under the CBI, which has issued critical directives regarding virtual assets.

**Cabinet of Ministers:** Has issued resolutions governing the use of cryptocurrencies, especially for trade.

**Anti-Money Laundering and Counter-Terrorist Financing (AML/CFT) Supreme Council:** Relevant for AML compliance, although Iran remains on the FATF's "black list" for failing to address strategic deficiencies in its AML/CFT regime.

**Ministry of Industry, Mine and Trade:** Involved in licensing cryptocurrency mining operations.

**Retail Trading:** Direct retail trading of cryptocurrencies for the general public on independent, regulated exchanges remains ambiguous and highly restricted. While some local platforms operate, their legal status for direct fiat-to-crypto and crypto-to-fiat transactions is precarious and not clearly licensed by a comprehensive framework similar to other jurisdictions.

**State-Sanctioned Trading:** The primary regulatory focus for exchanges is related to **facilitating import payments**.

In **August 2022**, Iran announced it had made its first official import order using cryptocurrency. This followed a **2020 Cabinet resolution** that authorized the CBI to develop a mechanism for using cryptocurrencies for import payments.

Under this framework, **licensed miners** (see below) are allowed to sell their mined cryptocurrencies directly to the CBI or other approved entities to finance imports.

Only CBI-approved banks and licensed money exchangers are permitted to use cryptocurrencies for import and export settlements.

**Key Requirement:** Any entity facilitating such transactions would need explicit authorization/licensing from the CBI and likely other government bodies, aligning strictly with national economic policy.

There is no separate, explicit licensing regime for independent cryptocurrency custody providers.

Custody functions, if they exist, would be an integral part of any CBI-approved entity permitted to handle cryptocurrencies for import/export purposes. These entities would be subject to the same stringent controls and would not be offering general custodial services to the public.

Similarly, there is no independent licensing framework for general cryptocurrency payment processors.

The use of cryptocurrencies as a means of payment within Iran for goods and services is generally **prohibited** for the public.

The only authorized use of cryptocurrencies as a "payment" mechanism is for **international trade settlement**, specifically for imports, as facilitated by CBI-approved financial institutions and licensed miners. Any entity involved in this would fall under the existing financial regulations and require specific CBI authorization.

This is the most regulated and encouraged virtual asset activity in Iran due to its energy surpluses and the ability to generate hard currency for import financing.

**Required License:** Mining farms must obtain a license from the **Ministry of Industry, Mine and Trade**. They must also register with the CBI.

Miners must comply with specific electricity tariffs.

They are obliged to sell their mined cryptocurrencies directly to the CBI or other authorized financial institutions to finance imports.

Failure to obtain a license or comply with regulations can result in heavy fines, equipment confiscation, and electricity disconnections.

**Capital Requirements:** Substantial, though often less critical than strategic alignment.

**AML/KYC Requirements:** Extremely stringent under Iranian law, despite international concerns about Iran's overall AML/CFT regime (due to FATF blacklisting). Any licensed entity would be expected to implement robust customer identification, transaction monitoring, and suspicious activity reporting *within the Iranian legal framework*.

**Local Presence:** Absolutely mandatory. Full operational presence in Iran is a prerequisite.

**Alignment with National Interests:** A critical, unwritten requirement. The activity must directly serve the state's economic goals (e.g., import financing, sanctions circumvention).

**Security and Data Localization:** Strict requirements for cybersecurity, data storage, and potentially data localization within Iran.

**Reporting:** Extensive and frequent reporting to the CBI and other relevant authorities.

**Opaque and Centralized:** Involving multiple government ministries and agencies.

**Lengthy and Complex:** Requiring extensive documentation and background checks.

**Politically Sensitive:** Success often hinges on demonstrating how the proposed activity serves Iran's national economic and strategic interests.

**Direct Application:** Likely to the CBI for financial aspects, and the Ministry of Industry, Mine and Trade for mining.

**CBI & Money and Credit Council (MCC) Resolution on Virtual Currencies (2018/2019):** This initial directive banned the use of cryptocurrencies as legal tender and for payments within Iran but allowed mining under specific conditions.

*Reference:* Often cited in news articles, e.g., Reuters, Financial Times. Direct CBI link usually in Farsi.

**CBI Official Website (Farsi):** https://www.cbi.ir/ - Navigating this for specific decrees requires Farsi proficiency.

**Cabinet of Ministers Resolution on Crypto Mining for Import Financing (2020):** This authorized the CBI and Ministry of Industry, Mine and Trade to issue regulations for miners to sell their output to finance imports.

*Reference:* Reported by numerous news outlets.

**Official Iranian Government Portal (Farsi):** https://www.irangov.ir/ - Decrees are published here but are in Farsi.

**Ministry of Industry, Mine and Trade:** Responsible for issuing mining licenses.

**FATF Statement on Iran:** Crucial context for any financial activity involving Iran. Iran is on the FATF's "High-Risk Jurisdictions Subject to a Call for Action" list.

Search for "Iran" in their "High-Risk Jurisdictions" section.

**Sanctioned individuals or entities:** Any person or organization listed on relevant sanctions lists.

**Prohibited jurisdictions:** Transactions directly involving Iran.

**Prohibited activities:** Certain types of trade, financing, or services involving Iran.

**Iranian Transactions and Sanctions Regulations (ITSR), 31 CFR Part 560:** These regulations implement various Executive Orders imposing sanctions on Iran. They generally prohibit U.S. persons from engaging in virtually any transaction with Iran, its government, or persons ordinarily resident in Iran.

**Legal Reference:** 31 CFR Part 560 (Available via ECFR: https://www.ecfr.gov/current/title-31/subtitle-B/chapter-V/part-560)

**Executive Orders (EOs):** Numerous EOs underpin the Iran sanctions program, including:

**EO 13599 (2012):** Blocking Property of the Government of Iran and Iranian Financial Institutions.

**EO 13876 (2019):** Imposing Sanctions with Respect to Iran.

**OFAC Sanctions Program - Iran:** Provides an overview of current EOs and regulations.

**Legal Reference:** OFAC Iran Sanctions Program: https://home.treasury.gov/policy-issues/financial-sanctions/sanctions-programs-and-country-information/iran-sanctions

OFAC has explicitly clarified that its sanctions programs apply to transactions involving virtual currency just as they do to traditional fiat currency.

**Legal Reference:** OFAC's "A Framework for OFAC Compliance Commitments" (2019), Appendix A (FAQs on Virtual Currency): https://home.treasury.gov/system/files/126/sanc_compliance_framework_factsheet.pdf (See Virtual Currency-Related Sanctions Risks)

**Legal Reference:** OFAC Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments (2020), which reiterates that virtual currency companies must comply with OFAC regulations: https://home.treasury.gov/system/files/126/ofac_ransomware_advisory_10012020_1.pdf

**SDN List:** VASPs must screen all their customers, counterparties, and relevant transaction parties against OFAC's Specially Designated Nationals and Blocked Persons (SDN) List. This includes individuals, entities, and sometimes their associated virtual currency addresses.

**Legal Reference:** OFAC SDN List: https://home.treasury.gov/policy-issues/financial-sanctions/sanctions-list-search

**50 Percent Rule:** VASPs must also block property and interests in property of entities that are owned 50 percent or more, directly or indirectly, by one or more blocked persons, even if those entities are not explicitly listed on the SDN List.

**Legal Reference:** OFAC 50 Percent Rule: https://home.treasury.gov/policy-issues/financial-sanctions/consolidated-sanctions-list/the-50-percent-rule

All transactions involving Iran are generally prohibited for U.S. persons. For non-U.S. VASPs, secondary sanctions can apply if they engage in significant transactions with the Government of Iran or designated entities (e.g., related to the IRGC, oil, or financial institutions).

**Council Regulations:** The core legal instruments for EU sanctions are Council Regulations, which are directly applicable in all EU Member States. Key regulations include:

**Council Regulation (EU) No 267/2012:** Concerning restrictive measures against Iran and repealing Regulation (EU) No 961/2010 (Nuclear proliferation).

**Council Decision (CFSP) 2011/235/CFSP:** Concerning restrictive measures directed against certain persons and entities in view of the situation in Iran (Human rights).

**Council Regulation (EU) 2023/1529:** Concerning restrictive measures against Iran (Terrorism financing and support).

**Legal Reference:** EEAS - Iran Sanctions Map: https://www.sanctionsmap.eu/#/main (Filter for Iran)

**Legal Reference:** EUR-Lex (official journal for EU legislation): https://eur-lex.europa.eu/ (Search for relevant Council Regulations and Decisions)

While explicit regulations on "crypto sanctions" against Iran are rare, the EU's asset freeze and financial transfer restrictions extend to virtual assets under the general definition of "funds" or "economic resources."

The EU's recent MiCA (Markets in Crypto-Assets) regulation includes provisions for AML/CFT and compliance with sanctions, making it clear VASPs must adhere to existing sanctions regimes.

**EU Consolidated Financial Sanctions List:** VASPs operating in the EU must screen against the EU's consolidated list of persons, groups, and entities subject to financial sanctions.

**Legal Reference:** EU Financial Sanctions Database: https://sanctions.plana.info/ (This is a public database by the EU Commission)

**National Lists:** Member States may also maintain their own lists in addition to the EU list.

EU persons (citizens, entities incorporated in an EU Member State, or persons operating in the EU) are prohibited from making funds or economic resources available, directly or indirectly, to designated Iranian individuals or entities.

**UNSCR 2231 (2015):** Endorsed the JCPOA and lifted many previous nuclear-related sanctions, but maintained some restrictions related to ballistic missiles and conventional arms transfers (some of which have since expired or been subject to US snapback claims).

**Legal Reference:** UNSCR 2231 (2015): https://undocs.org/S/RES/2231(2015))

**Terrorism Sanctions:** Iran is also subject to UN sanctions if any of its entities or individuals are designated under the UN's global terrorism sanctions regimes (e.g., related to ISIL (Da'esh) and Al-Qaida, or others). These designations are separate from Iran-specific nuclear sanctions.

**Legal Reference:** UN Security Council Sanctions Committees (e.g., Al-Qaida Sanctions Committee): https://www.un.org/securitycouncil/sanctions/information

Any financial transaction with an entity or individual designated on a UN sanctions list (e.g., for terrorism) involving virtual assets would be a violation of UN sanctions, which are binding on all UN Member States.

**UN Consolidated Sanctions List:** VASPs must screen against the UN Security Council Consolidated List, which includes individuals and entities subject to various UN sanctions regimes.

**Legal Reference:** UN Security Council Consolidated Sanctions List: https://www.un.org/securitycouncil/content/un-sc-consolidated-list

**Know Your Customer (KYC) and Customer Due Diligence (CDD):**

Identify and verify the identity of customers and beneficial owners.

Assess the risk profile of customers, including their geographic location and any links to sanctioned jurisdictions like Iran.

**Automated Screening:** Implement systems to screen all new and existing customers, as well as transaction counterparties, against all relevant national, EU, UN, and OFAC sanctions lists (SDN, EU CFSP, UN Consolidated List).

**Continuous Monitoring:** Regularly re-screen customers and monitor transactions for potential sanctions breaches.

Implement technical controls (e.g., IP address blocking) to prevent access to services from Iran or from entities known to operate within Iran.

Be aware of VPN usage and other methods used to circumvent geo-restrictions.

Monitor transaction patterns for unusual activity, large transfers to/from high-risk jurisdictions, or attempts to obfuscate beneficial ownership.

Look for direct or indirect connections to Iranian IP addresses or known Iranian entities.

**Blocking:** Immediately freeze/block any virtual assets or accounts belonging to sanctioned individuals or entities. Do not process transactions.

**Reporting:** Report blocked property and suspicious transactions (SARs/STRs) to the relevant authorities (e.g., OFAC for U.S. persons, national FIUs for EU VASPs).

**FATF Recommendations:** The Financial Action Task Force (FATF) recommends that VASPs implement measures to prevent the misuse of virtual assets for proliferation financing (PF) and terrorism financing (TF), which includes adherence to targeted financial sanctions.

**Legal Reference:** FATF Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers (2021): https://www.fatf-gafi.org/content/dam/fatf-gafi/guidance/Virtual-Assets-RBA-2021.pdf (See Recommendation 6 on targeted financial sanctions related to proliferation and terrorism).

**FATF Recommendation 15 (New Technologies):** Requires countries and VASPs to identify and assess risks, and apply AML/CFT measures to virtual assets.

**Civil Penalties:** Can range from thousands to millions of dollars per violation, depending on the severity and number of transactions. OFAC often calculates penalties based on the value of the transaction.

**Example:** OFAC has imposed significant fines on crypto companies for violations, including Bittrex ($24 million), BitGo ($99,828), and Kraken ($362,158) for allowing customers in sanctioned jurisdictions (including Iran) to transact.

**Legal Reference:** OFAC Recent Enforcement Actions: https://home.treasury.gov/policy-issues/financial-sanctions/recent-actions

**Criminal Penalties:** For willful violations, individuals can face substantial fines and imprisonment (up to 20 years), and corporations can face fines in the millions.

Penalties for sanctions violations are determined by individual EU Member States. They typically include significant fines, asset freezes, and imprisonment for individuals found guilty of violating sanctions laws.

Beyond financial and criminal penalties, non-compliance can lead to severe reputational damage, loss of trust, and potential blacklisting from traditional financial services.

**OFAC SDN List:** Includes numerous individuals and entities based in Iran or acting on behalf of the Iranian government, IRGC, or other designated organizations. These designations apply to all forms of assets, including virtual currencies.

**Specific Crypto Designations (General):** While not Iran-specific, OFAC *has* designated virtual currency addresses and entities involved in sanctions evasion (e.g., for North Korea) or other illicit activities. If Iranian actors were found to be using these designated addresses, transactions with them would also be prohibited.

**Legal Reference:** OFAC's List of Digital Currency Addresses: https://home.treasury.gov/policy-issues/financial-sanctions/special-designated-nationals-and-blocked-persons-list-sdn-human-readable-list#add (Scroll down to "List of Digital Currency Addresses")

**EU Consolidated Financial Sanctions List:** Lists Iranian individuals and entities subject to asset freezes and financial restrictions.

**UN Consolidated Sanctions List:** Lists entities and individuals sanctioned by the UN, which would include any Iranian entities designated under terrorism or other applicable regimes.