Guiding Through the Complex Cryptocurrency Regulations: Outlook on Threats by OFSI for 2025
UK Cryptoasset Firms Facing Significant Challenges in Compliance with Financial Sanctions, According to OFSI Report
The UK's Office of Financial Sanctions Implementation (OFSI) has published a sector-specific Cryptoassets Threat Assessment, highlighting the risks and challenges that UK cryptoasset firms face in complying with financial sanctions. The report, covering data from January 2022 to May 2025, reflects the growing momentum behind regulation of the sector.
Key Findings
The report reveals that cryptoassets are being increasingly exploited for sanctions evasion, especially by Russian designated persons (DPs). Over 90% of crypto-related suspected breach reports submitted to OFSI since 2022 involve Russia, with over 7% of all reports to OFSI of suspected sanctions breaches involving crypto firms in the period covered by the report, with almost all of those reports being made since April 2024.
The report identifies several red flags common in the crypto sector, including large or unusual transactions following sanctions announcements, exposure to known DPs or associated entities, sudden changes in transaction patterns, repeated payments from individual addresses for very low amounts, rapid movement of assets through multiple addresses, multiple wallets controlled by the same entity (address clustering), use of privacy coins, mixers, or VPNs, and transactions involving sanctioned jurisdictions.
Key Threats Identified
The assessment emphasises the importance of enhanced Know Your Customer (KYC) and Anti-Money Laundering (AML) processes, real-time and retrospective blockchain analytics to detect exposure to sanctioned virtual addresses, and timely reporting to OFSI. Key threats identified include inadvertent and delayed reporting of breaches, direct and indirect exposure to sanctioned entities, use of shell companies, offshore structures, and rotating wallets to obscure ownership and control, enabler activities by professionals and individuals aiding DPs in moving and concealing assets, and significant use of intermediary jurisdictions with weak oversight.
Recommendations for Cryptoasset Firms
The report recommends that cryptoasset firms include cryptoasset-related sanctions breaches explicitly in risk assessments and compliance programs. Enhanced due diligence and sanctions screening processes using blockchain analytics to identify and prevent sanctions circumvention are also encouraged. Timely and accurate reporting procedures to OFSI for suspected breaches are essential, as well as strengthening internal controls to detect and manage exposure to designated persons and sanctioned jurisdictions. Firms are urged to remain vigilant against sophisticated evasion tactics and the use of intermediaries to obscure ownership and transactions.
Regulatory Context
UK cryptoasset firms are required to register with the Financial Conduct Authority (FCA) and comply with AML regulations and financial sanctions under the Sanctions and Anti-Money Laundering Act 2018 (SAMLA) and the Financial Services and Markets Act 2023. The FCA's roadmap, published in November 2024, anticipates the publication of all policy statements and final rules in 2026. The UK Government published draft legislation in April 2025 aimed at bringing the operation of a cryptoasset trading platform, intermediation, cryptoasset lending and borrowing, staking, and decentralised finance (DeFi) within the FCA's remit.
The report serves as a critical resource for UK cryptoasset firms and stakeholders aiming to strengthen compliance and mitigate exposure to illicit activity. The FCA's discussion paper on stablecoins, published in November 2023, and the cryptoasset financial promotions regime introduced in October 2023 are also important considerations for firms operating in the sector.
Overall, the OFSI Cryptoassets Threat Assessment serves as a critical guide urging UK cryptoasset firms to prioritise sanctions compliance within their risk frameworks, improve detection and reporting mechanisms, and address the specific vulnerabilities exploited for sanctions evasion.
- In the rapidly evolving business landscape, it's crucial for UK cryptoasset firms in the finance sector to implement robust Know Your Customer and Anti-Money Laundering processes, as emphasized in the OFSI Cryptoassets Threat Assessment, to prevent sanctions evasion, especially by designated persons from Russia.
- For technology-driven crypto firms, it's crucial to be aware of the red flags identified in the threat assessment, such as the use of privacy coins, mixers, or VPNs, and take proactive measures like real-time blockchain analytics to detect exposure to sanctioned virtual addresses.
