Author: CryptoSlate / Liam 'Akiba' Wright

Translation: Deep Tide TechFlow

Deep Tide Introduction: A crypto payment may be credited in seconds, but if it is later found that the wallet is associated with the Islamic Revolutionary Guard Corps of Iran, related companies and individuals in the UK could face up to 14 years in prison. This is not an anti-money laundering fine, but a criminal offense—even if the blockchain transaction was completed before identifying the wallet's owner. For the crypto industry, this means that wallet ownership and timestamp records have become a vital chain of evidence.

The UK's designation of the Islamic Revolutionary Guard Corps (IRGC) came into effect on July 17, creating new criminal risks for UK individuals and businesses that receive or retain value associated with this organization.

According to the designation document, the IRGC became one of the first three entities listed in Schedule 6A of the 2023 National Security Act.

The new offense under Section 17C stipulates that if a person obtains, accepts, or retains a qualifying significant benefit, and knows—or ought to know based on other known matters—that the benefit comes from a designated entity, they could face a maximum sentence of 14 years in prison.

These rules still leave room for judgment. Payments related to Iran do not automatically constitute a crime, and the designation in Schedule 6A alone does not trigger asset freezes and trading restrictions under UK sanctions law. The key question is whether the value can be linked to the IRGC and what the recipient knew at the time. Freezing stablecoins still requires separate action from the issuer or other legal institutions.

The law never mentions crypto assets, but its wording is broad enough to cover them. It encompasses money or anything of value provided directly or indirectly, including through companies, which may bring stablecoins and other on-chain transactions into scope.

For exchanges, custodians, issuers, payment companies, or UK users, this makes wallet ownership and timing operational issues. Blockchain networks may complete transfers before the receiving party can refuse, and an address may only be linked to the designated entity afterward.

The core issue becomes: what the wallet and counterparty knew, when they knew it, and what happened to the value thereafter.

Crimes follow value, not payment rails

Section 17C(1) applies not only to payments made directly to someone. It may also apply when a person obtains or accepts benefits for others or retains benefits already received. The key question is whether the benefit comes from a designated entity and whether the recipient knows or ought to know this link.

"By or on behalf of" and "directly or indirectly" are important phrases in a market built around intermediaries. Payments do not need to come from a wallet labeled "IRGC" or from entities using that organization's name.

The supply chain can operate through companies or other intermediaries. However, Iranian counterparties, Iran-related wallets, or crypto payments themselves do not establish that the IRGC provided the benefit. Prosecution still requires a connection to the designated entity and the necessary subjective elements.

The maximum sentence depends on the conduct. Following formal prosecution and conviction, the crime under Section 17C(1) relating to obtaining, accepting, or retaining benefits can result in a maximum of 14 years in prison and possible fines.

Crimes specified under Section 17C(2) regarding the consent to obtain, accept, or retain benefits can lead to a maximum of 10 years in prison and possible fines. The Home Office announcement vaguely describes the system as carrying a maximum penalty of 14 years, while the legal text provides this distinction.

Sending value in the other direction follows a separate statutory path. Section 17B encompasses acts intended to materially assist a designated entity in conducting UK-related activities. It also covers acts that may provide such assistance when the actor knows or ought to know based on what they know. Receiving and assisting are distinct crimes with different requirements, and neither creates a blanket prohibition on Iranian crypto activity.

The law also preserves targeted protections. When an economic benefit is a reasonable consideration for goods or services, and providing them does not itself constitute a crime, that benefit is excluded. Other provisions cover reasonable justifications for retaining or providing information, qualifying legal obligations, and public functions, as well as humanitarian activities conducted according to internationally recognized applicable principles and standards. Their application still depends on specific facts.

On-chain settlement makes timing a challenge

The Office of Financial Sanctions Implementation (OFSI) crypto asset threat assessment (involving sanctions rather than the new designated entity offenses) states that crypto companies cannot refuse incoming blockchain transactions. It also notes that an address may be subsequently attributed, and analytical tools can identify historical direct or indirect risks.

These observations describe the same technical sequence that UK relevant recipients now need to consider. A deposit may be completed before a reliable identity of the issuing wallet is obtained by custodians. New intelligence may subsequently link that address or a set of related addresses to the designated entity after completion.

Initially unrecognized receipts do not automatically constitute a crime. The timeline may instead become crucial evidence.

A reliable record may need to show transaction time, available wallet risk data at the time, counterparty information, when attribution alerts appeared, the basis and confidence of that alert, whether the value remains accessible, and the response after escalation.

Receiving and retaining may also occur at different points in time. Network-level finality may prevent the recipient from revoking the original transfer, while separate account or token controls may affect what happens next.

Custodians may be able to restrict account access, block subsequent withdrawals, investigate sources, or seek appropriate consent routes. The necessary response depends on the facts and applicable legal regime.

UK connections follow the funds

Section 17C can apply to conduct completely carried out overseas when the benefit is provided within the UK or from the UK, the actor is a UK person, or there are specific royal connections. A UK person includes British nationals, individuals residing in the UK, entities established under UK law, and unincorporated entities formed under UK law.

This coverage will bring more entities outside regulated trading venues into scrutiny. UK-related exchanges and custodians are the most obvious examples, as they receive and hold customer assets.

Payment processors, OTC platforms, merchants, and other businesses may facilitate or retain on-chain value. Some stablecoin issuers, depending on their token architecture and permissions, may limit subsequent token use after attribution. Ordinary UK-related users can also receive value, similarly constrained by the connection to designated entities and knowledge thresholds.

The government's impact assessment states that the bill does not create new reporting obligations for businesses. Nevertheless, it considers businesses receiving, holding, or transferring funds on behalf of designated entities and encourages using existing suspicious activity and consent processes. Applying the same logic to crypto goes beyond what the law explicitly demands.

Governance may affect risks. Under Section 35 of the 2023 National Security Act, officials may be held responsible alongside entities if the offenses in Part 1 are committed with the official's consent or collusion, or are attributable to official negligence. Directors will not automatically be held responsible for every flagged wallet, but escalating ownership and written follow-up now carries higher risks.

Designation separate from sanctions freezing

Schedule 6A and UK financial sanctions enforcement have different legal functions. The government explanatory note states that organizations listed solely by sanctions do not fall under the designated entity offense, unless they are also designated for these offenses.

Adding an entity to Schedule 6A does not trigger asset freezes, trade prohibitions, and reporting obligations arising under financial sanctions law. It also does not change stablecoin smart contracts. Issuer freezing depends on separate sanction obligations, other legal bases, or actions taken under the issuer's control.

The case of Tether freezing 134 wallets illustrates the technical aspect. The issuer uses control over its tokens to freeze addresses in the context of sanctions. The new UK issue is different: whether a person accepted or retained benefits related to a designated entity while having the required knowledge, including when no issuer froze anything.

Thus, the workflow of mere sanctions presents loopholes. Businesses may need to separate Schedule 6A attribution alerts from OFSI asset freezes and then determine which legal and operational escalation paths apply.

A wallet may trigger issues under both regimes, but the presence or absence of sanctions freezing does not resolve liability under Section 17C.

Control requires evidence timeline

For UK relevant crypto businesses receiving, holding, transferring, or facilitating value, actual measures may involve reviewing how existing controls retain the temporal order behind decision-making.

The bill itself does not impose this crypto-specific checklist, but offenses and official crypto risk materials support reviewing how companies:

Map designated entities, aliases, and relevant counterparties separately from financial sanctions lists;

Record the source, confidence, and timing of wallet attribution;

Re-screen earlier deposits when reliable attribution changes;

Link on-chain discoveries to customer, company, and intermediary information;

Escalate uncertain matches without treating proximity to Iran-related wallets as evidence; and

Record decisions regarding access, retention, withdrawals, and existing reporting or consent pathways.

UK crypto asset exchanges and custodial wallet providers have already operated within the FCA’s anti-money laundering framework, which expects proportional transaction monitoring and internal escalation. Schedule 6A adds a separate potential criminal risk to the facts these systems may uncover.

Targeted statutory protections are not equivalent to a general safe harbor for due diligence, unsolicited transfers, or network-level irreversibility. Suspicious activity reports or requests proposed through existing consent processes may constitute part of escalation, but official materials do not treat both as automatic defenses under Section 17C. Analysis remains tied to benefits, their connection to the IRGC, known facts about the actor, and subsequent actions.

The recipient typically cannot network-level refuse or revoke incoming blockchain transfers, although separate account or issuer control may limit their subsequent use.

Therefore, the first crypto test of this designation will focus on whether UK relevant recipients and intermediaries can reconstruct reliable records about attribution and knowledge as wallet intelligence changes.

Since July 17, this evidence timeline could lead to years of criminal risk, even if the transfer itself is completed within seconds.