The UK’s designation of Iran’s Islamic Revolutionary Guard Corps took effect on July 17, creating a new criminal exposure for UK-linked people and businesses that receive or retain value supplied by or on behalf of the group.
Under the designation instrument, the IRGC became one of the first three bodies added to Schedule 6A of the National Security Act 2023.
The new section 17C offense can carry as much as 14 years in prison when a person obtains, accepts or retains a qualifying material benefit and knows, or in light of other matters known to them ought reasonably to know, that it came from the designated body.
The rules still leave some room for judgment. An Iran-linked payment is not automatically a crime, and a Schedule 6A designation does not itself trigger the asset freezes and dealing restrictions used under UK sanctions. The key questions are whether the value can be tied to the IRGC and what the recipient knew at the time. Freezing stablecoins would still require separate action from an issuer or another legal authority.
The law never mentions crypto assets, but its wording is broad enough to catch them. It covers money or anything of value supplied directly or indirectly, including through companies, which could bring stablecoins and other on-chain transfers within scope.
For an exchange, custodian, issuer, payments business or UK user, that makes wallet attribution and timing the operational problem. A blockchain network may settle an incoming transfer before the recipient can refuse it, and an address may be linked to a designated body only later.
The central questions become what was known about the wallet and counterparty, when it became known, and what happened to the value afterward.
The offense follows the value, not the payment rail
Section 17C(1) goes beyond payments made directly to someone. It can also apply when a person secures or accepts a benefit for someone else, or keeps a benefit already received. The key question is whether the benefit came from a designated body and whether the recipient knew, or should reasonably have known, about that link.
The words “by or on behalf of” and “directly or indirectly” matter in a market built around intermediaries. A payment need not arrive from a wallet labeled “IRGC” or from an entity using the group’s name.
The chain of provision can run through companies or other intermediaries. Yet an Iranian counterparty, an Iran-linked wallet or a crypto payment alone does not establish that the IRGC supplied the benefit. The prosecution would still need the designated-body connection and the required mental element.
The maximum sentence depends on the conduct. On conviction on indictment, a section 17C(1) offense involving obtaining, accepting or retaining the benefit carries up to 14 years and a possible fine.
The section 17C(2) offense of agreeing to obtain, accept or retain it carries up to 10 years and a possible fine. The Home Office announcement describes the regime generically as carrying up to 14 years, while the statutory text supplies that split.
Sending value in the other direction follows a separate statutory route. Section 17B covers conduct intended materially to assist a designated body in carrying out UK-related activities. It also reaches conduct likely to provide that assistance when the person knows, or ought reasonably to know from matters known to them, that it is likely to do so. Receipt and assistance are distinct offenses with distinct elements, and neither creates a blanket prohibition on Iranian crypto activity.
The law also preserves targeted protections. A financial benefit is excluded when it is reasonable consideration for goods or services and providing them is not itself an offense. Other provisions cover reasonable excuses for retention or information, qualifying legal obligations and public functions, and humanitarian activity conducted consistently with internationally recognized applicable principles and standards. Their application remains fact-specific.
On-chain settlement makes timing the hard part
The Office of Financial Sanctions Implementation’s cryptoassets threat assessment, which concerns sanctions rather than the new designated-body offence, says crypto firms cannot reject incoming blockchain transactions. It also notes that addresses may be attributed later and that analytics can identify historical direct or indirect exposure.
Those observations describe the same technical sequence that UK-linked recipients now need to consider. A deposit can settle before a custodian has a reliable identity for the sending wallet. New intelligence may then connect that address, or a cluster of related addresses, to a designated body after completion.
An initially unidentified receipt is not automatically criminal. The timeline instead becomes potentially important evidence.
A defensible record may need to show the transaction time, wallet risk data available then, counterparty information, when an attribution alert appeared, the basis and confidence for that alert, whether the value remained accessible, and the response after escalation.
Receipt and retention can also occur at different points. Network-level finality may prevent a recipient from unwinding the original transfer, while separate account or token controls can affect what happens next.
A custodian may be able to restrict account access, stop a later withdrawal, investigate the source or seek an appropriate consent route. The necessary response depends on the facts and on which legal regime applies.
The UK connection follows the money
Section 17C can apply to conduct carried out wholly overseas when the benefit is provided in or from the UK, when the actor is a UK person, or when the specified Crown connection exists. UK persons include UK nationals, individuals who live in the UK, bodies incorporated under UK law and unincorporated associations formed under UK law.
That reach brings more than regulated trading venues into the review population. UK-linked exchanges and custodians are the clearest examples because they receive and hold customer assets.
Payment processors, OTC desks, merchants and other businesses may facilitate or retain on-chain value. Some stablecoin issuers, depending on their token architecture and authority, can restrict later token use after an attribution. Ordinary UK-linked users can receive value too, subject to the same designated-body nexus and knowledge threshold.
The government’s impact assessment says the Act creates no new business reporting duty. It nevertheless considers businesses that receive, hold or transfer funds on behalf of a designated body and encourages existing suspicious-activity and consent processes. Applying the same logic to crypto goes beyond what the law explicitly requires.
Governance can affect the exposure. Under section 35 of the National Security Act 2023, an officer can face liability alongside a body when a Part 1 offense is committed with the officer’s consent or connivance, or is attributable to the officer’s neglect. Directors are not automatically responsible for every flagged wallet, but escalation ownership and documented follow-through now carry higher stakes.
Designation is separate from a sanctions freeze
Schedule 6A and UK financial sanctions perform different legal functions. The government factsheet says an organization listed only under sanctions is outside the designated-body offenses unless it is also designated for those offenses.
Adding a body to Schedule 6A does not itself trigger the asset-freeze, non-dealing and reporting duties that arise under financial-sanctions law. It also leaves stablecoin smart contracts unchanged. An issuer freeze depends on a separate sanctions obligation, another legal basis, or action taken under the issuer’s own controls.
CryptoSlate’s earlier coverage of Tether freezing 134 wallets illustrates that technical layer. The issuer used control over its token to freeze addresses in a sanctions context. The new UK question is different: whether a person accepted or retained a benefit tied to a designated body with the required knowledge, including when no issuer has frozen anything.
A sanctions-only workflow therefore leaves a gap. A firm may need to separate a Schedule 6A attribution alert from an OFSI asset-freeze match, then determine which legal and operational escalation paths apply.
One wallet can raise questions under both regimes, but the presence or absence of a sanctions freeze does not resolve section 17C liability.
Controls need an evidentiary timeline
For UK-linked crypto businesses that receive, hold, transfer or facilitate value, a practical response may be to review how existing controls preserve the chronology behind a decision.
The Act itself does not impose this crypto-specific checklist, but the offense and official crypto risk material support scrutiny of how a business:
- maps designated bodies, aliases and relevant counterparties separately from financial-sanctions lists;
- records the source, confidence and time of a wallet attribution;
- re-screens earlier deposits when reliable attribution changes;
- connects on-chain findings with customer, corporate and intermediary information;
- escalates uncertain matches without treating proximity to an Iran-linked wallet as proof; and
- documents decisions about access, retention, withdrawal and existing reporting or consent routes.
UK cryptoasset exchanges and custodian wallet providers already operate within an FCA anti-money laundering framework that expects proportionate transaction monitoring and internal escalation. Schedule 6A adds a separate potential criminal exposure to facts those systems may surface.
The targeted statutory protections do not amount to a generic safe harbor for due diligence, unsolicited transfers or network-level irreversibility. A suspicious activity report or a request through an existing consent process may form part of an escalation, but the official material does not present either as an automatic defense to section 17C. The analysis remains tied to the benefit, its connection to the IRGC, the facts known to the person, and the conduct that followed.
Recipients generally cannot reject or unwind an incoming blockchain transfer at network level, although separate account or issuer controls may restrict its later use.
The designation’s first crypto test will therefore center on whether UK-linked recipients and intermediaries can reconstruct a defensible account of attribution and knowledge as wallet intelligence changes.
Since July 17, that evidentiary timeline can sit behind criminal exposure measured in years even when the transfer itself settled in seconds.
