Iran’s local exchange links show sanctions and AML exposure

At a glance

What this is: Chainalysis analyses how Iran’s local exchanges remain active despite international restrictions, with the core issue being sanctions and AML exposure through ecosystem connectivity.

Why it matters: For AML, sanctions, and identity teams, the article shows that counterparty screening alone is insufficient when local exchanges still connect into broader regulated transaction flows.

Context

Iran’s crypto market shows how sanctions pressure reshapes exchange behaviour without eliminating exposure. When international venues restrict access, activity shifts toward local platforms and cross-ecosystem pathways that still create compliance risk for counterparties, transaction monitoring, and beneficial ownership tracing.

The identity problem is not just user onboarding at a single exchange. It is the ability to trace who controls accounts, how funds move between venues, and where sanctioned or high-risk exposure enters the transaction graph. That makes this a governance issue for AML, sanctions, and digital identity programmes, not only a crypto market issue.

Key questions

Q: How should AML teams handle exchange exposure when local venues connect to sanctioned markets?

A: Treat exchange exposure as a network risk rather than a venue-by-venue screen. AML teams should combine entity resolution, transaction tracing, and counterparty clustering so they can see whether apparently local activity is actually feeding broader regulated or sanctions-sensitive flows. The key is to preserve a defensible provenance trail for each high-risk exposure.

Q: Why do sanctions controls fail when transaction provenance is incomplete?

A: Sanctions controls fail when teams cannot explain where funds came from, how they moved, and who controlled the receiving accounts. Incomplete provenance breaks the link between screening and enforcement, especially when the same wallet or actor touches multiple exchanges. Without that continuity, high-risk activity can look fragmented and less actionable than it really is.

Q: What are the warning signs that exchange network risk is being undercounted?

A: Common warning signs include repeated transfers through the same exchange clusters, inconsistent KYC quality across venues, and investigations that rely on a single platform view. If compliance decisions are made without adjacency analysis, teams are likely missing the broader route of funds. That usually means the control set is too local for the real risk surface.

Q: Should compliance teams prioritise counterparty tracing over simple user screening?

A: Yes, when the article’s risk comes from exchange connectivity rather than a single onboarding event. User screening is necessary, but it is not sufficient if funds can move through local exchanges into regulated venues or higher-risk networks. Counterparty tracing gives compliance teams the context they need to decide whether the exposure is acceptable or escalates to sanctions concern.

Technical breakdown

How exchange connectivity creates sanctions exposure

Cryptocurrency exchanges do not operate as isolated silos. Even when a local exchange serves only domestic users, transaction paths, counterparty reuse, and wallet-to-wallet movement can connect it to regulated venues and sanctions-sensitive flows. The compliance risk arises when those connections are not visible at the time of screening or monitoring, leaving the exchange ecosystem as the real unit of analysis rather than any one platform.

Practical implication: design monitoring around transaction pathways and counterparty clustering, not just the identity of the originating exchange.

Why AML controls depend on transaction and identity traceability

AML controls need enough traceability to link wallets, accounts, and counterparties across venues. That requires more than KYC at onboarding, because the same actor can move value through multiple exchanges and maintain a changing identity footprint. In practice, the control problem is one of identity continuity across a fragmented ecosystem, where network analysis and case investigation have to compensate for incomplete participant data.

Practical implication: join KYC, blockchain analytics, and case-management evidence so investigators can follow entity behaviour across venues.

What regulated-exchange exposure means for compliance teams

Regulated exchanges become part of the risk surface when they receive funds from or send funds to higher-risk local venues. The issue is not merely whether a transaction is technically possible, but whether controls can explain its provenance, counterparty legitimacy, and sanctions relevance. That makes exchange exposure a governance and assurance problem as much as a detection problem.

Practical implication: assign explicit escalation criteria for high-risk exchange exposure and require documented rationale for accepted exceptions.

Threat narrative

Attacker objective: The end state is not necessarily a single compromise, but the ability to move value through exchange networks while obscuring counterparties and weakening compliance enforcement.

1. Entry occurs through local exchange participation in a restricted market where international venues have limited or no service coverage.
2. Escalation happens when funds move from local exchanges into wider cryptocurrency pathways that include regulated exchanges and higher-scrutiny counterparties.
3. Impact is increased sanctions and AML exposure for the venues involved, including harder attribution, more difficult casework, and greater regulatory attention.

Breaches seen in the wild

• Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Counterparty visibility is now a governance control, not an investigative luxury. When exchanges in restricted markets remain connected to broader crypto rails, the control gap is the inability to explain who the counterparty really is at the point of transfer. That means sanctions and AML teams need entity-level visibility, not just address-level alerts. The practitioner conclusion is to treat traceability as an operating control, not a post-incident forensics task.

Iran’s local exchange ecosystem exposes a broader identity continuity problem. KYC data collected at onboarding does not automatically preserve identity certainty once value moves across venues and wallets. The real failure mode is fragmented identity across transactions, where the same actor can appear differently at each hop. Practitioners should assume that AML enforcement depends on stitching together a persistent risk identity across systems.

Sanctions exposure is a network problem before it is a policy problem. A restricted user base on one platform does not eliminate risk if linked venues still provide paths into the regulated ecosystem. This is why compliance teams need to model transaction adjacency, not only direct customer screening. The practitioner conclusion is to assess exposure through ecosystem connectivity and not rely on isolated venue controls.

Transaction provenance is the named concept that matters here. The article illustrates that provenance is the missing control when local exchanges interact with international rails under sanctions pressure. If provenance cannot be shown cleanly, screening and case handling both become weaker. The practitioner conclusion is to build controls that can defend the origin, route, and destination of funds across venues.

What this signals

Transaction provenance is becoming a core compliance boundary. When local exchanges remain active inside a restricted market, the practical question is no longer whether screening exists, but whether investigators can defend the route of funds across venues. AML and sanctions teams should expect more scrutiny of ecosystem adjacency, not just direct customer checks.

The most durable control pattern is identity continuity across transactions. If a programme cannot stitch together wallets, accounts, and counterparties into a consistent risk picture, then sanctions enforcement will remain reactive and incomplete.

For practitioners

• Map exchange adjacency and counterparty clusters Identify which local venues, regulated exchanges, and wallet clusters create repeated exposure paths into sanctioned or higher-risk activity.
• Strengthen entity resolution across cases Merge KYC records, wallet intelligence, and transaction history so investigators can track the same actor across multiple exchange touchpoints.
• Set escalation rules for high-risk exchange links Require enhanced review when funds touch venues with sanctions sensitivity, poor transparency, or repeated proximity to regulated entities.
• Document provenance for accepted exceptions Record why a transaction or counterparty link was approved, including the evidence used to assess source, route, and destination risk.

Key takeaways

• The article shows that exchange risk in sanctioned markets is created by connectivity, not by any single platform acting alone.
• Compliance weakness emerges when teams cannot track counterparties and funding routes with enough clarity to support sanctions and AML decisions.
• The practical response is to combine transaction tracing, entity resolution, and documented exception handling for high-risk exchange exposure.

Key terms

• Counterparty Exposure: Counterparty exposure is the degree to which a platform, exchange, or issuer is connected to sanctioned or high-risk entities through direct or indirect transactions. In practice, it is a governance measure of how much operational and regulatory risk a business inherits from the addresses and services it interacts with.
• Commit Provenance: Commit provenance is the ability to prove who changed code, from where, and under what approved identity. In modern pipelines it depends on signed commits, device trust, and auditable approval paths so that repository history can stand up to incident review.
• Entity Resolution: Entity resolution is the process of determining which accounts, wallets, devices, or records belong to the same real-world actor. It is essential for sanctions and AML programmes because transaction data alone often hides related activity unless it is linked back to a trusted identity model.
• Indirect Sanctions Exposure: Indirect sanctions exposure occurs when an organisation does not transact with a listed address directly, but still touches the surrounding network through intermediaries, nested services, or linked counterparties. This is where simplistic list matching fails and network-aware monitoring becomes necessary.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. If your programme deals with trust, access, and lifecycle control, the course gives teams a common baseline for governance decisions.