← Regulations / Iran / Operating Models / Remote VASP

Remote VASP serving residents in Iran

Foreign-incorporated entity that offers exchange, custody, or transfer services to residents of a jurisdiction without establishing a local entity or office.

Conditional AI-Generated · Unreviewed

Remote VASP is conditionally permitted in Iran with a local entity, subject to AML obligations and high licensing burden.

Verdict Details

Permitted: conditional
Local entity required: Yes
Licensing burden: High
Last updated: 2026-07-13

AML Obligations

Subject to Law on Combating Money Laundering (Qanun Mobaraze ba Pulshui) if integrated into the authorised financial system, including KYC, reporting obligations, and oversight by the Supreme Council for Combating Money Laundering and Financing of Terrorism.
Subject to Law on Combating the Financing of Terrorism (Qanun Mobaraze ba Taman-e Terrorizm), requiring sanctions screening and suspicious transaction reporting.
CBI directives require identification and verification of customers (National Code, contact info, official documents), and for legal persons: registration details, legal form, address, directors, senior management, and beneficial owners (≥25% shareholding).
Transaction monitoring and suspicious transaction reporting obligations under CBI regulatory framework if authorised.
Any cross-border servicing of Iranian residents would trigger international sanctions screening obligations (US primary sanctions, FATF countermeasures).

Key Restrictions

Domestic use of cryptocurrencies for payments is generally prohibited by the CBI.
Public trading of cryptocurrencies is restricted/controlled by the CBI.
Banks and financial institutions were banned (2018) from dealing in cryptocurrencies — remote VASPs likely cannot use local banking channels.
FATF has called for countermeasures against Iran; remote VASPs would face severe correspondent banking and compliance barriers.
US primary sanctions prohibit most financial transactions involving Iranian residents — a remote VASP serving Iranians would expose itself to US enforcement risk.

Key Risks

Extreme enforcement risk: unlicensed cross-border servicing of Iranian residents would violate both Iranian law (CBI restrictions) and international sanctions regimes (US OFAC primary sanctions).
FATF blacklisting means that even a compliant domestic VASP would face de-risking by foreign banks and counterparties.
Regulatory ambiguity: the CBI's evolving stance on crypto (mining allowed, trading restricted, payments banned) creates an unclear path for a remote VASP serving residents.
Operational risk: no legal/regulatory framework exists for licensing a foreign-entity remote VASP to serve Iranian residents — the domestic regime focuses on licensed miners and potential future onshore exchanges.
US sanctions enforcement could involve criminal penalties, asset freezes, and designation of the operator.

Evidence

This verdict synthesizes the following facts. Each fact links to its primary source(s).

aml 60% confidence

FATF Blacklisting: Iran is currently on the FATF's "Public Statement – High-Risk Jurisdictions Subject to a Call for Action," meaning it is subject to a call for countries to apply enhanced due diligence and, in the most serious cases, countermeasures to protect the international financial system from the ongoing money laundering, terrorist financing, and proliferation financing (ML/TF/PF) risks emanating from Iran. This significantly impacts any international VASP's ability or willingness to operate in or with Iran.