June 16, 2026

UK Designates HTX: What the Biggest Crypto Sanctions Action Yet Means for Compliance Teams

TRM Team

UK Designates HTX: What the Biggest Crypto Sanctions Action Yet Means for Compliance Teams

Last week, TRM Labs convened a live webinar featuring TRM subject matter experts to break down the UK's sanctions package targeting HTX and the A7 network. With questions coming in from compliance professionals across the industry, TRM’s Tom Armstrong (Head of Compliance Advisory), Luke Dufour (Compliance Advisor, EMEA), Isabella Chase (Head of Policy, EMEA), and Kiera Sibřina (Senior Blockchain Intelligence Analyst) covered the designation in detail, what it means for firms subject to UK sanctions obligations, and how to structure both an immediate and longer-term response.

Key takeaways

The UK's Foreign, Commonwealth, and Development Office (FCDO) designated HTX and 17 other entities — the first time a crypto exchange of this scale has been sanctioned
UK-regulated firms must immediately block transactions with designated entities, freeze associated funds, and report to OFSI
Regulators expect look-back exercises; segment customers by exposure level and use a consistent review framework tied to sanctions evasion typologies
OFSI's three-to-five hop guidance is a minimum requirement; look at the frequency and pattern of indirect risk paths, in addition to hop count
Pre-designation transactions may not require OFSI reporting, but could trigger SAR obligations to the NCA under POCA if sanctions evasion activity is identified

‍

Designation details

The UK's Foreign, Commonwealth, and Development Office (FCDO) designated 18 entities and individuals as part of a package targeting crypto networks used to evade sanctions by Russia. HTX — formerly known as Huobi and one of the world's five largest crypto exchanges — drew a significant amount of attention due to both its size and significant connectivity to other services in the crypto ecosystem.

The FCDO alleges HTX moved approximately USD 1.5 billion for Kremlin-aligned entities. The broader A7 network is alleged to have absorbed roughly USD 838 million after the Garantex takedown in March 2025. Four individuals were also named, including Sergei Mendeleev, co-founder of Garantex.

For a full breakdown of who was designated, read: UK Designates Huobi, Exmo, Bitpapa, and 11 Other Entities for Russian Crypto Sanctions Evasion

Understanding the A7 network

A7 is a centrally coordinated sanctions evasion tool with well-established connections to the Kremlin that gained prominence in the years following Russia's full-scale invasion of Ukraine in 2022. A7 LLC, one of the primary A7 sanctioned entities is owned by Moldovan oligarch Ilan Shor and Promsvyazbank (PSB) — a sanctioned bank that finances Russia's military — and has been used to fund military procurement, channel proceeds from oil sales, and absorb illicit flows following the Garantex takedown. The A7 network relies on a network of different services and entities to move value.

Two entities beyond HTX also deserve attention:

Rapira: A Georgia-based payment processor with an exchange office in Moscow. Rapira has moved hundreds of millions of dollars alongside other entities in the A7 network.
ABCEX: A Russia-based exchange with a Georgian legal entity. It has been central to the post-Garantex ecosystem and, along with Rapira, TRM tracked as a potential Garantex replacement prior to this designation.

Firms without direct on-chain activity still face compliance exposure. The designation explicitly prohibits correspondent banking and payment processing services to the named entities, covering both fiat and crypto flows.

Where compliance teams should focus now

For firms subject to UK sanctions obligations, there are three things to address immediately.

1. Stop new exposure

Wallet screening and transaction monitoring controls should already be blocking transactions to or from any of the designated entities. Firms with sanctions rules covering ownership risk, counterparty risk, and indirect risk categories should find their existing controls cover this exposure from designation date forward. In addition to direct transactions, this package also prohibits offering correspondent relationships or processing payments to the designated entities.

2. Freeze funds

Any balances attributable to designated persons must be frozen in line with UK sanctions obligations. This applies to both crypto and fiat holdings.

3. File reports

Firms must report frozen assets to the Office of Financial Sanctions Implementation (OFSI). Depending on what a look-back surfaces, there may also be a Suspicious Activity Report (SAR) requirement with the National Crime Agency (NCA).

For firms without direct on-chain transaction flows — banks with virtual asset service provider (VASP) relationships, non-custodial wallets, or other intermediaries — entity monitoring tracks counterparty risk profiles automatically, alerting when risk scores shift materially.

Conducting a look-back exercise

The Office of Foreign Assets Control (OFAC)'s 2021 virtual currency guidance — which TRM's compliance advisory team reads as establishing look-backs as a compliance best practice — and OFSI has conveyed similar expectations to VASPs operating in the UK. Even absent explicit regulatory direction, firms running sound programs will want to know whether any customers had meaningful connectivity to the designated entities before the designation date.

Drawing on the Panama Papers response as an analogy, TRM's compliance advisory team recommended a structured approach over case-by-case triage:

1. Map your blast radius

Identify all points of connectivity to the designated entities, including transactional exposure, customers who are the subject of the designation, structural integrations (such as tokenization projects or consortium memberships), and shared networks.

2. Segment by risk

Not every customer with any HTX connection warrants a line-by-line review. Group customers into cohorts by exposure level, transaction volume, frequency, and counterparty characteristics. Retail customers with small, infrequent transactions form one population; institutional-sized flows showing classic sanctions evasion patterns form another.

3. Use a consistent review framework

For higher-risk cohorts, run each case against the same set of factors — a Know Your Customer (KYC) check, jurisdictional check, transactional check, and indirect risk check — so analysts across the first and second line can work cases consistently and at scale.

4. Document your decisions

Document the scope of the look-back, the rationale for each scoping decision, and any pivots made along the way. That documentation will matter in supervisory examinations.

The factors you're looking for should reflect the actual typology you're investigating: sanctions evasion. That means prioritizing transaction size (TRM data shows A7-linked settlements running from USD 2 million to USD 40 million per transaction), connections to high-risk jurisdictions, shell company structures, and intermediary addresses flagged as conduits.

The three-to-five hop question

OFSI's 2024 guidance specifying three to five hops as the threshold for indirect risk in transaction monitoring came up repeatedly. But looking at frequency and pattern is more useful than counting hops alone.

TRM's platform captures not just aggregate indirect risk exposure, but the number of distinct indirect risk paths between a wallet and a sanctioned entity. A wallet with three or four indirect risk paths to HTX looks very different from one with dozens or hundreds of recurring paths. Starting from the frequency and systemic nature of indirect risk — rather than a fixed hop ceiling — produces a more defensible and accurate risk picture. Compliance programs that rely solely on a fixed hop count may systematically miss evasion patterns specifically designed to stay within the three-to-five hop threshold.

Reporting obligations: OFSI and beyond

Two separate reporting obligations apply here, and they're often conflated.

OFSI reporting is required for frozen assets. For pre-designation transactions — those that were fully permissible when they occurred — OFSI has indicated there may not be a reporting requirement, provided no post-designation transactions are also involved. Where activity spans both sides of the designation date, all of it should be reported.

SAR obligations require separate consideration. Sanctions evasion is a predicate offense to money laundering under the UK's Proceeds of Crime Act (POCA). A firm may not have breached sanctions regulations itself, but if a look-back surfaces activity consistent with facilitating sanctions evasion — rapid movement through intermediary addresses, use of cross-chain swaps, use of location-obfuscating technology — a SAR filing obligation to the National Crime Agency may apply.

The typologies to watch for in HTX-related activity are large transaction sizes, rapid movement of funds through intermediary addresses, use of privacy-enhancing tools, and cross-chain swapping behavior consistent with layering.

Future-proofing your controls

This designation will not be the last. The UK enforcement approach explicitly connects HTX and the A7 network to Operation Destabilize, the NCA-led operation targeting Russian money laundering infrastructure. As the panelists noted, the pace of designations targeting crypto infrastructure suggests more are likely — something TRM also observed in the recent OFAC action against Iran's domestic crypto exchanges.

The compliance teams best positioned for what comes next treat each designation as an input into an ongoing controls improvement cycle.

Review transaction monitoring and wallet screening rules to understand what the controls did and did not catch before the designation date, and why.
Update Know Your Customer (KYC) and Know Your Business (KYB) programs to capture risk factors consistent with the HTX pattern, including exposure to high-risk jurisdictions, shell company use, and intermediary addresses with no clear legitimate purpose.
Building a proactive threat intelligence function oriented toward identifying the next HTX before the designation arrives — entities with systemic indirect exposure to sanctioned actors, operating in high-risk third-country jurisdictions, with on-chain behavior consistent with evasion typologies.

Peer benchmarking is a useful tool here. Comparing a counterparty VASP's total illicit exposure against similar entities can surface whether a pattern reflects a control weakness or something more systemic, and help firms make better-informed decisions about counterparty due diligence. The FCA also published its sanctions review paper the same week as this designation — a useful broader reference on what good sanctions programs look like across regulated financial services.

Tell us how you’re operationalizing sanctions risk on-chain

TRM is gathering insights from VASPs and crypto asset service providers on how firms are operationalizing sanctions risk on-chain — including how they're applying the three-to-five hop guidance in practice. If you're interested in contributing to this research, contact Luke Dufour at TRM Labs.

For questions about how TRM's platform can support your response to this designation — including wallet screening, transaction monitoring, and entity due diligence — visit our sanctions compliance page or reach out to your customer success team.

‍

Frequently asked questions (FAQs)

1. What did the UK's HTX sanctions designation cover?

The UK's Foreign, Commonwealth and Development Office (FCDO) designated 18 entities and individuals as part of a package targeting crypto networks used to evade Russia sanctions. HTX — formerly known as Huobi and one of the world's largest crypto exchanges — is the largest entity by volume in the package. The FCDO alleges HTX moved approximately USD 1.5 billion for Kremlin-aligned entities. This is the first time a crypto exchange of this volume has been sanctioned.

2. What must UK-regulated crypto firms do immediately after the HTX designation?

UK-regulated firms subject to the FCDO designation must take three immediate steps. First, block new transactions: wallet screening and transaction monitoring controls should be blocking transactions to or from any designated entity from the designation date forward. Second, freeze funds: any balances attributable to designated persons must be frozen, covering both crypto and fiat holdings. Third, report to OFSI: firms must notify the Office of Financial Sanctions Implementation of frozen assets. Depending on what a subsequent look-back exercise surfaces, there may also be a Suspicious Activity Report (SAR) obligation with the National Crime Agency under POCA.

3. Is a look-back exercise required after a crypto sanctions designation?

Yes. Regulators treat look-back exercises as a compliance expectation, not an optional step. OFAC's 2021 virtual currency guidance establishes look-backs as a compliance best practice, and OFSI has conveyed similar expectations to VASPs operating in the UK. A structured approach — mapping connectivity to designated entities, segmenting customers by exposure level, applying a consistent review framework, and documenting decisions — is recommended over case-by-case triage. The review should focus on sanctions evasion typologies, including large transaction sizes, connections to high-risk jurisdictions, shell company structures, and intermediary addresses flagged as conduits.

4. How should compliance teams apply OFSI's three-to-five hop guidance for indirect risk?

OFSI's three-to-five hop threshold for indirect risk is a minimum floor. Compliance programs that rely solely on a fixed hop count risk missing evasion patterns specifically designed to stay within the published threshold, because sophisticated actors read the guidance too. A more defensible approach focuses on the frequency and pattern of indirect risk paths (e.g. a wallet with dozens or hundreds of recurring indirect paths to a sanctioned entity carries materially different risk than one with three or four). TRM's platform captures the number of distinct indirect risk paths between a wallet and a sanctioned entity, not just aggregate exposure, to support this kind of analysis.

5. What is the difference between OFSI reporting and SAR obligations after the HTX designation?

OFSI reporting applies to frozen assets. For pre-designation transactions — those that were fully permissible when they occurred — OFSI has indicated a reporting requirement may not apply, provided no post-designation transactions are also involved. Where activity spans both sides of the designation date, all of it should be reported. SAR obligations are distinct: sanctions evasion is a predicate offense to money laundering under the UK's Proceeds of Crime Act (POCA). Even if a firm did not breach sanctions regulations, a look-back that surfaces activity consistent with facilitating sanctions evasion — rapid fund movement, cross-chain swaps, privacy-enhancing tools — may trigger a SAR filing obligation to the National Crime Agency.