Cryptocurrencies and sanctions: Why companies should reassess their risks

Financial sanctions are most effective where economic activities remain subject to scrutiny. This applies to existing business relationships as well as to assets and cash flows. Banks and other financial intermediaries play a key role in this regard, as they verify customer data and monitor transactions. They are required to report any irregularities.

Cryptocurrencies are changing this landscape. They enable transfers of value via blockchain addresses, often across borders, quickly and without the involvement of traditional financial intermediaries. This can offer advantages for legitimate business models. From a sanctions compliance perspective, however, new risks arise when payments no longer pass through established control points.

This therefore raises a practical question for businesses: can existing compliance processes detect whether crypto-related payment flows, wallets or service providers are linked to sanctioned individuals, regions or networks?

Cryptocurrency transactions: To what extent do risks materialise?

The need to take action is growing for a number of reasons.

Entities subject to sanctions are increasingly seeking alternative ways to circumvent restrictions on international financial and trade flows

Cryptocurrencies can be used to conceal payment flows and transfer assets illegally – and to circumvent traditional control mechanisms.
The crypto market continues to grow, and the asset class is becoming increasingly mainstream

In its ‘Focus Risks 2026’ – its annual assessment of key risks to the financial market – the Federal Financial Supervisory Authority (BaFin) points out that cryptocurrency is gaining in importance amongst consumers and that traditional financial institutions also intend to expand their offerings in this area.
Regulation is taking shape

Under the new EU Anti-Money Laundering Regulation, financial sanctions will become an integral part of risk analysis in future. Obligated firms must therefore also assess where risks of non-compliance with or circumvention of financial sanctions might arise within their business model.

Ready to talk?

Contact us

auto_stories

Our study shows how companies assess the threat of AI-based attacks.

Download now

Where traditional controls reach their limits

To date, many companies have relied primarily on list checks when it comes to sanctions: business partners, beneficial owners and payments, as well as the parties involved, are cross-checked against sanctions lists.

In the crypto environment, this is often insufficient. Transactions can pass through multiple wallets, be processed via decentralised exchanges or be fragmented by technical obfuscation mechanisms. Smart contracts and decentralised applications can also mean that a traditional operator or intermediary is not readily identifiable.

The risk then lies less in a direct match on a sanctions list. Rather, indirect links become relevant – for example, via transaction chains, intermediary wallets, mixing services or wallets linked to high-risk regions.

Cryptocurrencies: Not anonymous, but complex

A common misconception is that crypto transactions are completely anonymous. However, public blockchains store transactions permanently and can be analysed using specialised methods. Regulatory authorities and analytics providers are increasingly able to cluster wallets, trace transaction chains and identify links to sanctioned networks.

At the same time, analysis remains challenging. Mixing services, privacy coins, decentralised exchanges and transactions across multiple blockchains can make tracking considerably more difficult. For businesses, this means that crypto risks are not invisible, but they do require different control approaches to those used for traditional banking transactions.

Sanctions risk analysis: Cryptocurrency needs to be on the agenda

In future, the key consideration will be whether crypto-related risks could arise in existing business relationships, payment channels, customer structures or supply chains.

An effective sanctions risk analysis should therefore also identify any points of contact with crypto. These include, in particular:

Business relationships with crypto service providers
Payments via wallets or crypto-related payment service providers
Customers or business partners presenting an increased geographical risk
Use of decentralised trading venues or unregulated platforms
Links to wallets that may be associated with sanctioned entities, high-risk regions or suspicious transaction patterns

For compliance officers, this means that the focus is on transparency regarding the company’s actual risk of sanctions and on whether existing compliance structures are still appropriate for its risk profile.

What businesses should do

Crypto-related sanctions risks can affect operational business decisions, supplier relationships, payment processes, M&A due diligence, financing issues and a company’s reputation. Companies should therefore review the following four areas of action in the short term:

Identify crypto touchpoints: Organisations should analyse whether and where cryptocurrency plays a role in their own business model, amongst customers, suppliers, payment channels or service providers.
Integrate crypto into sanctions risk analysis: Crypto-related risks should form part of the risk analysis for financial sanctions.
Define red flags: Anomalies such as payments via unregulated platforms, links to high-risk regions, unusual wallet structures or transaction chains via mixing services should be clearly described and operationalised.
Further developing controls and escalation procedures: Companies need clear processes to determine when an in-depth review is required, who makes the decision and how the results are documented.

Promoting transparency

Cryptocurrencies are increasingly becoming a significant factor in the international sanctions landscape. At the same time, regulatory expectations are becoming more specific and technical analysis capabilities are becoming more sophisticated.

Companies should therefore not wait until a specific case of suspicion arises. Those who establish transparency regarding crypto-related risks today will be better placed to meet regulatory requirements, justify investments in controls more effectively and assess critical business relationships more thoroughly.

Our experts support companies in making crypto-related sanctions risks transparent, further developing existing risk analyses, and establishing effective governance, monitoring and control mechanisms for an increasingly complex sanctions environment. Please contact us directly.

Interested in our services?

Submit RFP now