UK turns delayed wallet identification into a 14-year criminal risk for crypto firms
What just happened (and why you should squint at your wallet)
On July 17 the UK added Iran’s Islamic Revolutionary Guard Corps to a special list that creates a new criminal offence for people and businesses in the UK who get or keep value that can be tied to that group. The headline: if you obtain, accept or retain a benefit that came from a designated body and you knew — or ought reasonably to have known — about the link, you could face up to 14 years behind bars.
The law doesn’t say “crypto” by name, but it’s written broadly enough to sweep in money or “anything of value” provided directly or indirectly. Translation: stablecoins and on-chain transfers are squarely in the frame if the benefit can be connected to a designated body.
This isn’t an automatic freeze-the-world rule. A Schedule 6A designation does not itself trigger the asset-freeze and dealing restrictions that live in sanctions law. The prosecution still needs to show the chain of provision and the required mental element — i.e., what did the recipient know (or should have known) and when did they know it?
The practical headache is timing and attribution. Blockchains settle in seconds; intelligence and wallet attribution can arrive later. That means a deposit can be final before anyone knows the sending address links to a designated group. Whether that later discovery creates criminal liability hinges on the facts: what was known at the time, what happened next, and whether the recipient took reasonable steps afterward.
What to do if you run a UK-linked crypto business (or use one)
Good news: the law includes carve-outs for reasonable commercial transactions, legal obligations, public functions and bona fide humanitarian activity. Bad news: those are fact-specific and won’t automatically save you. The safe(ish) route is to treat this like an evidentiary puzzle you must be able to explain in court.
Practical moves that actually help:
– Keep a clear, time-stamped audit trail. Record the transaction time, the wallet metadata and risk score available at the moment of receipt, any counterparty info, when an attribution alert arrived, the rationale and confidence level behind that alert, whether the funds were still accessible, and what you did next.
– Be ready to separate network-level finality from account-level controls. You often can’t “unsend” a blockchain transfer, but you may be able to lock an account, block withdrawals, quarantine tokens, or seek statutory consent routes depending on the situation and who has control over the token.
– Treat alerts seriously and escalate. Document who owned the escalation, what steps were taken and why. Under the Act an officer can be liable if an offence occurred with their consent, connivance or neglect — so ownership and paperwork matter.
– Keep existing suspicious-activity processes and consent channels in place. The new offence doesn’t create a fresh reporting duty, but current AML and OFSI-focused workflows are useful tools in the playbook. Don’t assume sending a suspicious-activity report is an automatic Get-Out-Of-Jail-Free card — it’s evidence of your process, not an ironclad defence.
– Coordinate with stablecoin issuers and custodians. Some issuers have technical ability to restrict token use; others don’t. Whether an issuer freeze exists is a separate legal step from the designated-body offence, so don’t rely on another party to solve your attribution problem.
– Train teams on the knowledge threshold. The legal test isn’t just “did the funds come from X?” — it focuses on what the recipient knew or should reasonably have known at the time. Good KYC, risk scoring, and a defensible decision trail will help.
– Remember the reach: the offence can apply where the benefit is provided in or from the UK, to UK persons (nationals, residents, UK-incorporated entities and some associations), or where other Crown connections exist. That widens the roster of actors who need to care beyond regulated exchanges.
Bottom line: blockchain moves fast, but the legal clock can start ticking later. The new regime doesn’t automatically criminalise every Iranian-linked payment, but it raises the stakes for UK-linked businesses and users. If you can’t reconstruct a sensible chronology of what you knew and when, you may find yourself explaining a few seconds of settlement to a jury and a prosecutor — and that’s not the kind of time travel any of us wants.
