Regulatory Patterns, Blockchain Investigations, and Implications for Financial Institutions
Recent enforcement actions involving cryptocurrency exchanges and virtual asset businesses demonstrate a significant evolution in the way regulators and law-enforcement agencies are identifying and disrupting illicit financial networks.
Actions taken by the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC), the U.S. Department of Justice (DOJ), Dubai’s Virtual Assets Regulatory Authority (VARA), and other authorities increasingly show that enforcement is moving beyond the designation of individual wallet addresses or entities. Instead, authorities are examining the financial infrastructure that enables sanctioned actors, criminal organizations, and other illicit networks to move and convert value.[1-2, 4]
Recent cases have involved virtual-asset businesses allegedly facilitating sanctions evasion, terrorist financing, ransomware, illegal gambling, and other criminal activity. The common theme is increasingly clear: Regulators and law enforcement are following the funds and the infrastructure behind them, rather than relying exclusively on conventional sanctions screening controls.[1, 4]
What Recent Enforcement Actions Are Showing
Recent actions involving Iranian and Russian-linked virtual asset networks illustrate several recurring characteristics. First, authorities are focusing on intermediaries that provide connectivity between sanctioned economies and the wider financial system. These may present themselves as exchanges or payment businesses, but blockchain analysis can indicate that their primary economic function is closer to settlement or value transfer.[1, 3]
Second, enforcement increasingly extends beyond the initial entity. OFAC actions have targeted founders, executives, associated entities, front companies, and successor businesses across multiple jurisdictions. Authorities are therefore increasingly targeting not only the ultimate sanctioned actor but also the infrastructure that provides access to liquidity and the wider financial system.[1, 5]
Third, regulators are examining how virtual assets interact with traditional financial infrastructure. Cryptocurrency may be one component of a wider network involving corporate entities, bank accounts, payment providers, fiat settlement arrangements, gambling businesses ,and other commercial structures. The result is an increasingly integrated model of financial investigation in which blockchain analytics, traditional forensic accounting, corporate intelligence, and regulatory information are analyzed together.[1, 3]
How Are These Networks Being Identified?
The recent cases provide particularly useful insight into the investigative indicators that can expose illicit virtual asset infrastructure. One of the strongest indicators is transaction behavior inconsistent with the stated business model.
In a recent TRM Labs investigation, analysts identified more than USD $6.3 billion in blockchain flows over approximately 23 months. Yet wallets attributed to the operation retained virtually no balances: Value entering the wallets was rapidly transferred onwards, with aggregate inbound and outbound values matching to within approximately 0.1%. TRM assessed this pattern as consistent with a settlement conduit rather than an exchange holding customer funds.[3]
One particularly active wallet received approximately USD $357.59 million and transferred approximately USD $357.58 million across more than 16,500 transactions, ultimately retaining almost no meaningful balance. A business may describe itself as an exchange, but the blockchain may reveal that its infrastructure is functioning primarily as a settlement conduit. The distinction illustrates the importance of analyzing what an entity does, rather than simply how it describes itself.[3]
Following the Network, Not Just the Wallet
A second recurring feature is that direct wallet screening provides only part of the picture. TRM’s recent investigation identified approximately USD $318 million involving a sanctioned Russian payment network, alongside exposure to other sanctioned services. Separately, approximately USD $72.6 million of exposure was identified across 55 online gambling platforms.[3]
Importantly, TRM found that indirect exposure through intermediary wallets could substantially exceed the value visible through direct wallet-to-wallet relationships. A transaction does not necessarily become low risk simply because neither the sending nor receiving wallet appears on a sanctions list.[3]
Effective analysis therefore increasingly requires investigators to understand the transaction graph: where funds originated, where they ultimately traveled, what intermediaries they passed through, and whether apparently unrelated wallets form part of the same operational infrastructure.
Wallet Rotation as an Evasion Technique
Another recurring indicator is deliberate or systematic wallet rotation. TRM observed infrastructure in which high volume wallets were retired and replaced approximately every one to four months, with individual successor wallets processing approximately USD $100 million to USD $350 million before becoming dormant.[3]
Similar behavior has emerged in law enforcement investigations elsewhere. DOJ has described cases in which operational cryptocurrency addresses were regularly changed in an alleged attempt to make attribution more difficult and reduce the effectiveness of sanctions controls.[4]
This exposes a fundamental limitation of static wallet screening. An institution may successfully identify and block a known address, but the underlying network can migrate to another address. Controls therefore need to identify relationships and behavioral characteristics, not merely exact matches against previously identified wallets.
Stablecoins and Settlement Infrastructure
Stablecoins have featured prominently in recent investigations. In TRM’s recent analysis, approximately 88% of the identified USD $6.3 billion in flows traveled over TRON, predominantly using dollar-pegged stablecoins.[3]
Stablecoins have important legitimate applications. Their speed, liquidity, and comparatively low transaction costs make them useful for international payments and settlement. Those same characteristics, however, can also be exploited to move substantial dollar equivalent value without funds traveling through the traditional correspondent banking chain.
For investigators, this means that understanding sanctions exposure increasingly requires looking beyond conventional payment messages and bank accounts. The financial trail may move between fiat currency, stablecoins, exchanges, private wallets, and other payment infrastructure before ultimately returning to the regulated financial system.
The Convergence of On-Chain and Off-Chain Investigation
Blockchain analytics alone does not answer every investigative question. The blockchain can provide a highly detailed record of where assets traveled, but it does not necessarily establish who controlled a wallet, why a transaction occurred, or what an organization knew at the time.
Recent enforcement actions demonstrate authorities combining blockchain intelligence with customer and accounting databases, exchange information, corporate records, servers, KYC data, and other evidence. In a major 2025 enforcement action, U.S., German, and Finnish authorities seized or obtained access to infrastructure including servers and customer and accounting databases, while cryptocurrency assets were frozen.[4]
The investigative question therefore evolves from “Did this wallet transact with a sanctioned address?” to “What network was moving the funds, who controlled it, what was its economic purpose, what counterparties did it ultimately serve, and what did the relevant parties know?”
What Does This Mean for Financial Institutions and VASPs?
The practical lesson from recent enforcement is that sanctions and AML controls cannot stop at name and wallet screening. A wallet does not need to appear on a sanctions list to present material sanctions exposure. A wallet does not need to appear on a sanctions list to present material sanctions exposure. A previously unseen address can become part of a sanctioned or illicit network almost immediately. Conversely, illicit operators can retire known wallets and replace them with fresh infrastructure. Institutions need to redesign their controls to response to emerging threats, geo-political developments, and most recent regulatory enforcement actions, specifically:
- Blockchain transaction tracing and wallet cluster analysis, including previously flagged suspicious activity patterns.
- Direct and indirect exposure to sanctioned and high-risk wallets.
- Wallet clusters and common ownership or control indicators.
- Rapid pass-through or settlement behavior and unusually high transaction velocity.
- Repeated wallet replacement or infrastructure rotation.
- Concentration in particular stablecoins or blockchains.
- Exposure to unlicensed or high-risk VASPs and high-risk ecosystems, such as gambling, ransomware, darknet markets, or fraud.
- Fiat on- and off-ramp transactions associated with cryptocurrency activity.
- Inconsistencies between a customer’s stated business model and its actual on-chain behavior.
This also requires closer integration between sanctions screening, transaction monitoring, KYC, blockchain analytics, and investigations. Treating these as separate control environments risks missing relationships that only become visible when the data is analyzed collectively.
What Does This Mean for the UAE?
These developments have particular significance for the UAE. Dubai has developed into an important global virtual assets center while building a specialized regulatory framework for the sector. VARA maintains public licensing, enforcement, and warning notices relating to virtual asset activity in Dubai.[2]
Recent events demonstrate that local and international enforcement are becoming increasingly interconnected. In one recent case, local regulatory action against an unlicensed virtual asset business preceded a subsequent OFAC designation, and the U.S. Treasury expressly referenced the earlier VARA enforcement when announcing its action.[1-2]
International sanctions lists should therefore not be viewed as the beginning and end of sanctions-risk identification. UAE institutions should consider incorporating VARA enforcement notices, unlicensed VASP information, local regulatory intelligence, adverse media, and blockchain intelligence into their risk frameworks.
Recent developments also reinforce the need for UAE institutions to understand the economic substance and ultimate purpose of cross-border flows, particularly where those flows connect the UAE with higher risk jurisdictions or potentially sanctioned networks. Effective controls are important not only from an individual institution’s compliance perspective but also to protect the integrity and international reputation of a rapidly developing digital assets ecosystem.
From Blockchain Tracing to Regulatory and DOJ Investigations
The same developments have implications once an organization becomes involved in a regulatory or criminal investigation. A subpoena involving cryptocurrency transactions can rapidly expand beyond identifying individual wallet addresses. Investigators may need to reconstruct several years of transactions, attribute wallets and counterparties, trace assets across blockchains and exchanges, identify fiat on- and off-ramp transactions, assess direct and indirect sanctions exposure, and reconcile blockchain evidence against internal banking, KYC, transaction monitoring, and communications data.
A defensible investigation may need to determine who controlled the wallets; why transactions were undertaken; the source and ultimate destination of funds; what information was available to the institution at the relevant time; whether its controls should have identified the activity; and what documentary and transactional evidence supports those conclusions.
That requires the integration of blockchain investigation with forensic accounting, data analytics, eDiscovery, and traditional financial crime investigation.
Conclusion
The key lesson from recent cases is that cryptocurrency does not necessarily make financial activity invisible. Public blockchains create a persistent record of transactions that can be reconstructed long after the funds have moved. The challenge for financial institutions — and increasingly the regulatory expectation — is having the data, technology, and investigative capability to follow that record through multiple wallets, counterparties, and financial systems and turn it into actionable intelligence and, where necessary, defensible evidence.
References
1. U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC), “Treasury Sanctions Crypto Exchanges Funding Iran’s IRGC and Enabling Illicit Finance,” 7 August 2026. https://home.treasury.gov/news/press-releases/sb0598
2. Dubai Virtual Assets Regulatory Authority (VARA), Licensing and Enforcement Notices and Warnings; including enforcement notices issued in January 2025 and July 2026 in relation to an unlicensed virtual-asset business. https://www.vara.ae/en/regulations/regulatory-notices/
3. TRM Labs, “How Shelbit Became a USD 6.3 Billion Settlement Layer for Iran’s Illicit Economy,” 7 August 2026. https://www.trmlabs.com/resources/blog/how-shelbit-became-a-usd-6-3-billion-settlement-layer-for-irans-illicit-economy
4. U.S. Department of Justice, Office of Public Affairs, “Garantex Cryptocurrency Exchange Disrupted in International Operation,” 7 March 2025. https://www.justice.gov/opa/pr/garantex-cryptocurrency-exchange-disrupted-international-operation
5. U.S. Department of the Treasury, OFAC, “Treasury Sanctions Cryptocurrency Exchange and Network Enabling Sanctions Evasion and Cyber Criminals,” 14 August 2025. The article body intentionally discusses the regulatory pattern without naming the relevant private-sector entities. https://home.treasury.gov/news/press-releases/sb0225
© Copyright 2026. The views expressed herein are those of the author(s) and not necessarily the views of Ankura Consulting Group, LLC, its management, its subsidiaries, its affiliates, or its other professionals. Ankura is not a law firm and cannot provide legal advice.
