The U.S. Treasury has designated Iranian cryptocurrency exchange BitBank, adding another crypto platform to its sanctions-enforcement campaign.
On September 17, the Treasury Department's Office of Foreign Assets Control, or OFAC, designated BitBank, its software developer Pishtaz Simorgh Electronic Trade Company and several individuals associated with sanctioned Iranian financier Babak Zanjani.
OFAC alleges that BitBank was used between June and July 2026 to facilitate hundreds of millions of dollars' worth of Bitcoin transfers to Iran's Islamic Revolutionary Guard Corps.
Treasury also said an already-designated maritime authority used BitBank to transfer payments it received to the Iranian government.
These are U.S. government allegations and sanctions findings, not independent findings by CEXVia.
The case nevertheless provides a useful framework for understanding sanctions risk around crypto exchanges.
Exchange Risk Is Not Limited to the Exchange Wallet
Crypto compliance often begins with blockchain analytics.
A platform screens wallet addresses for links to sanctioned entities, darknet markets, hacks or other high-risk activity.
That is necessary but incomplete.
The BitBank designation shows how sanctions exposure can exist across several layers:
- beneficial ownership;
- executives;
- software developers;
- affiliated companies;
- counterparties;
- payment flows;
- state-linked entities;
- wallet addresses.
An exchange may use clean-looking wallets while still creating sanctions exposure through ownership or business relationships.
Entity intelligence therefore matters alongside transaction monitoring.
Software Providers Can Become Part of the Sanctions Perimeter
OFAC did not designate only BitBank.
It also designated Pishtaz Simorgh, the company Treasury identifies as the developer of BitBank's digital-asset software.
That is significant.
Crypto infrastructure is modular.
An exchange depends on wallet technology, matching engines, custody systems, payment providers, liquidity partners and software vendors.
If a critical provider is owned or controlled by a sanctioned network, counterparties may face risk even when they never interact directly with the headline exchange.
This makes vendor due diligence a sanctions issue.
The 50 Percent Rule Matters
OFAC sanctions do not stop with names appearing on a list.
Under OFAC's 50 Percent Rule, entities owned 50% or more, directly or indirectly, by one or more blocked persons are generally also treated as blocked even if they are not separately named.
That creates a major challenge in crypto markets because corporate ownership can be opaque.
An exchange may operate through multiple holding companies, jurisdictions and brands.
A compliance team therefore needs to map ownership relationships rather than checking only the brand name shown to customers.
Blockchain Transparency Helps --- but Does Not Solve Attribution
Public blockchains provide investigators with transaction histories that are more visible than many traditional payment rails.
But a Bitcoin transfer does not identify the legal owner of a wallet by itself.
Attribution requires offchain evidence, exchange records, infrastructure links and investigative context.
Sanctions decisions can therefore combine blockchain analysis with corporate and intelligence data.
This is important for risk teams.
A transaction-monitoring vendor can flag exposure, but legal conclusions require understanding why an address or entity has been attributed to a particular network.
Why Strait of Hormuz Payments Matter to the Risk Model
Treasury said an OFAC-designated maritime authority used BitBank to move payments to the Iranian government, and linked the exchange to a broader network involving sanctions evasion and state-linked finance.
The implication for crypto compliance is broader than this specific geopolitical dispute.
Exchanges can become payment infrastructure for activities far outside normal crypto trading.
That may include trade settlement, commodity flows, shipping, cross-border payments or capital controls.
A platform's risk profile therefore depends partly on what economic activities it enables, not only which tokens it lists.
Why It Matters
Sanctions risk is becoming an exchange-architecture problem.
The old model was simple:
Check whether a customer appears on a sanctions list.
The crypto model is more complex:
Check the customer, wallets, counterparties, ownership, vendors, liquidity providers, jurisdictions and flow patterns.
That is especially important for exchanges operating across regions with inconsistent licensing and disclosure standards.
For users, a sanctions designation can also create sudden operational risk.
Assets may become difficult to withdraw, counterparties may stop servicing the platform and stablecoin issuers may freeze addresses associated with blocked entities.
Risks and Counterarguments
Sanctions designations reflect the position and legal authority of the sanctioning government.
Other jurisdictions may apply different rules.
Treasury's allegations should therefore be attributed to OFAC rather than presented as independent judicial findings.
Blockchain attribution can also evolve as investigators obtain new information.
For compliance teams, the correct response is not to assume every Iranian-linked crypto transaction is illicit.
Risk assessment should remain entity- and transaction-specific.
What to Watch Next
Watch for publication of additional wallet addresses, secondary sanctions actions, stablecoin freezes, exchange delistings or service restrictions involving BitBank-linked entities.
Also watch whether regulators increasingly target software developers and infrastructure companies that support sanctioned crypto businesses.
The durable lesson is that exchange verification needs an entity graph, not only a wallet-risk score.
FAQ
What did OFAC do?
OFAC designated BitBank, its software developer and several associated individuals on September 17, 2026.
What does the U.S. Treasury allege?
Treasury alleges that BitBank facilitated hundreds of millions of dollars in Bitcoin transfers to the IRGC and was part of a broader sanctions-evasion network.
Are these claims independent court findings?
No. They are allegations and findings published by the U.S. Treasury in support of its sanctions action.
Why was the software developer also designated?
Treasury identified Pishtaz Simorgh as the developer behind BitBank and as part of the associated corporate network.
What is the main compliance lesson?
Sanctions screening should include ownership, affiliates, vendors and counterparties in addition to blockchain wallet monitoring.