FATF Blacklist Explained: Iran, North Korea & Myanmar Crypto Bans 2025

6

February

FATF Blacklisted Countries: Crypto Impact Explorer

Select a country below to learn about its current FATF designation and associated cryptocurrency risks:

Iran
Full Countermeasures

Domestic exchanges channel billions abroad; Bitcoin used for capital flight.

North Korea
Full Countermeasures

State-sponsored ransomware and exchange hacks (e.g., $1.5B ByBit theft).

Myanmar
Enhanced Due Diligence

Emerging P2P platforms with limited KYC compliance.

When the FATF Financial Action Task Force, the global watchdog for anti‑money‑laundering and counter‑terrorism financing standards publishes its "FATF blacklist", three nations instantly become the focus of heightened scrutiny.

TL;DR

  • The FATF blacklist still lists Iran, North Korea and Myanmar as the highest‑risk jurisdictions (June2025).
  • All three face crypto‑related sanctions, but Iran and North Korea trigger full countermeasures while Myanmar is subject to enhanced due diligence.
  • North Korea’s cyber‑crime unit generated $1.5billion from the ByBit hack in Feb2025, underscoring the crypto threat.
  • Global compliance gaps remain - three‑quarters of FATF members are non‑ or partially compliant on virtual‑asset rules.
  • Expect tighter AML/CFT reporting, more address‑level sanctions, and expanded cooperation among FinCEN, OFAC and foreign FIUs.

What the FATF Blacklist Means in 2025

The Financial Action Task Force an intergovernmental body created in 1989 to set standards for tackling money laundering and terrorist financing maintains a list called “High‑Risk Jurisdictions Subject to a Call for Action”. As of 13June2025 the list still contains only three countries: Iran an Islamic Republic in the Middle East classified as a high‑risk jurisdiction for AML/CFT, North Korea the Democratic People’s Republic of Korea, also deemed a high‑risk jurisdiction and Myanmar formerly Burma, listed for weak anti‑money‑laundering controls. The FATF calls on all member states to apply **countermeasures** to Iran and North Korea, while Myanmar triggers only **enhanced due‑diligence** requirements.

Why Crypto Is At The Center of the Blacklist

Cryptocurrency’s borderless nature makes it the preferred vehicle for sanctioned actors seeking to move value outside traditional banking channels. The FATF’s 2024‑2025 reports highlight three trends:

  1. Sanctioned jurisdictions received $15.8billion in crypto flows in 2024 - roughly 39% of all illicit crypto transactions worldwide.
  2. North Korea has become the most aggressive crypto‑focused threat actor, using state‑run hacking groups to steal and launder digital assets.
  3. Iran’s domestic crypto market exploded as citizens flee economic isolation, turning Bitcoin into a de‑facto “portable reserve”.

These patterns force regulators to extend sanctions from bank accounts to wallet addresses, smart contracts and mixing services.

Country Snapshots: Crypto Activity & Sanctions

Sanction Measures for FATF‑Blacklisted Countries (2025)
Country FATF Action Key Crypto Threats Recent Enforcement Highlights
Iran Full countermeasures (asset freezes, transaction bans) Domestic exchanges funnel billions abroad; Bitcoin used for capital flight. OFAC added 4 Iranian crypto wallets in 2024; FinCEN proposed tighter VASP reporting.
North Korea Full countermeasures (global AML/CFT blocks) State‑sponsored ransomware, exchange hacks (e.g., $1.5b ByBit theft), laundering via mixers. US Treasury designated the Lazarus Group’s crypto wallets; chainalysis traced $2b of stolen assets.
Myanmar Enhanced due‑diligence (higher monitoring, no full bans) Emerging peer‑to‑peer platforms; limited KYC compliance. EU added Myanmar‑linked mixers to its watch list; local FATF‑style reforms remain stalled.
International Enforcement: From OFAC to FinCEN

International Enforcement: From OFAC to FinCEN

The United States has taken the lead in extending sanctions to the crypto layer. The Office of Foreign Assets Control U.S. Treasury agency that administers and enforces economic and trade sanctions issued 13 cryptocurrency‑related designations in 2024, a record high for the past decade. These designations target wallet addresses, exchange accounts and even blockchain infrastructure firms.

The Financial Crimes Enforcement Network U.S. Treasury bureau that implements AML/CFT regulations and gathers financial intelligence has proposed a rule to treat the “Huione Group” as a primary money‑laundering concern, reflecting a broader push to tax the crypto supply chain. Meanwhile, the International Community, through FATF‑driven peer reviews, is pressuring jurisdictions to bring their virtual asset service providers (VASPs) into compliance - a massive undertaking given that 75% of FATF members were still non‑ or partially compliant in April2024.

Compliance Challenges for Global Financial Institutions

From a compliance officer’s perspective, three practical hurdles dominate:

  • Address‑level sanction screening. Traditional watch‑lists focus on legal entities, not cryptographic public keys. Banks now need automated tools that can parse blockchain data in real time.
  • Enhanced due‑diligence on VASPs. Entities operating in Iran or North Korea can appear as “off‑shore” providers. Regulators demand proof of KYC, transaction monitoring and AML controls before any correspondent relationship is approved.
  • Cross‑border information sharing. FinCEN’s CIFT (Counter Illicit Finance Teams) training program pairs U.S. investigators with foreign FIUs, but language, legal‑system differences, and data‑privacy rules still slow down joint actions.

Failing to meet these expectations can trigger fines, bans from the U.S. financial system, or loss of correspondent banking relationships.

Impact on Legitimate Crypto Users in Blacklisted Countries

It’s not all criminals. Ordinary citizens in Iran, North Korea (for the few with internet access) and Myanmar turn to Bitcoin, Ethereum and stablecoins as a hedge against hyperinflation, currency controls, or outright banking shutdowns. The decentralized nature of crypto gives them a way to store value with just a seed phrase.

However, the growing sanctions regime forces them into a grey zone: any transaction flagged as “suspicious” can freeze the wallet, and exchanges that serve these markets risk being cut off by U.S. and EU regulators. The net effect is a chilling‑out of legitimate crypto adoption, even as the demand for censorship‑resistant money rises.

Looking Ahead: 2026 and Beyond

The FATF’s June2025 update added the British Virgin Islands and Bolivia to “jurisdictions under increased monitoring” while keeping Iran, North Korea and Myanmar on the blacklist. The agency also signaled a future focus on:

  1. Standardising “crypto‑address” identifiers in sanctions lists.
  2. Requiring VASPs to file Suspicious Activity Reports (SARs) for any transaction involving a high‑risk jurisdiction.
  3. Expanding joint‑training programs with the Netherlands Central Bank, which already ties its counter‑cyclical capital buffer adjustments to FATF watch‑list status.

For compliance professionals, the message is clear: stay ahead of address‑level screening tech, tighten VASP onboarding, and monitor FATF updates closely. For users in the blacklisted nations, the safest bet remains self‑custody with strong operational security, but even that carries the risk of future regulatory clampdowns.

Frequently Asked Questions

Frequently Asked Questions

What does being on the FATF blacklist mean for a country?

A blacklist designation signals that the jurisdiction fails to meet core AML/CFT standards. Member states must apply countermeasures (e.g., asset freezes, transaction bans) against entities linked to that country, and they must carry out enhanced due‑diligence on any financial activity involving it.

Why are Iran, North Korea and Myanmar the only three countries left?

Repeated peer‑review failures, persistent illicit crypto flows, and a lack of credible reform keep them from escaping the high‑risk label. All three also host state‑aligned actors that deliberately exploit crypto to evade sanctions.

How does the United States enforce crypto sanctions?

Through OFAC’s address‑level designations, FinCEN’s SAR filing requirements, and coordinated actions with foreign FIUs. Violators can face fines, loss of U.S. correspondent banking, and criminal prosecution.

What risks do legitimate crypto users in Iran face?

Their wallets can be flagged, exchanges may freeze accounts, and cross‑border transfers can be blocked. Self‑custody reduces some risk but does not prevent future regulatory actions that could target wallet infrastructure.

Will the FATF add more countries to the blacklist?

The FATF reviews its lists annually. If a jurisdiction shows measurable improvement-especially in crypto AML controls-it could move to the “enhanced monitoring” tier. Conversely, persistent non‑compliance could keep it on the blacklist.

17 Comments

Janelle Hansford
Janelle Hansford
6 Feb 2025

Wow, the way FATF is tightening the screws on crypto in those high‑risk jurisdictions really shows how the ecosystem is evolving. It’s a reminder that compliance teams need to stay ahead of the curve, especially with address‑level screening becoming the new normal. I love seeing the collaborative spirit between FinCEN and foreign FIUs – it’s the kind of global teamwork that makes a real difference. Keep pushing forward, everyone!

Krystine Kruchten
Krystine Kruchten
10 Feb 2025

These sanctions are not just political, they’re practical tools that force VASPs to upgrade their AML frameworks. The formal language in the report might seem dense, but the core idea is simple: tighter KYC, tighter reporting. Even with a few typos, the message is clear – if you’re operating in Iran or North Korea, you’re in the hot seat.

Iva Djukić
Iva Djukić
14 Feb 2025

From a regulatory technology standpoint, the imperative to integrate blockchain analytics into existing sanction screening pipelines cannot be overstated; the convergence of traditional financial monitoring tools with on‑chain traceability mechanisms represents a paradigm shift in anti‑money‑laundering (AML) enforcement.
The FATF’s recent emphasis on address‑level designations mandates that compliance officers adopt heuristic clustering algorithms to detect wallet attribution patterns that were previously opaque.
Moreover, the rise of decentralized exchanges (DEXs) introduces a vector where transaction anonymity is amplified, compelling the development of decentralized identity (DID) solutions to reconcile pseudonymous activity with regulatory expectations.
In practice, this translates to VASPs needing to file Suspicious Activity Reports (SARs) for any transaction that interfaces with a high‑risk jurisdiction, a requirement that exponentially increases reporting volume.
To mitigate operational strain, institutions are deploying machine‑learning models trained on historical sanction breach data to prioritize alerts, thereby reducing false‑positive rates while maintaining vigilance.
Simultaneously, the cross‑border information-sharing frameworks championed by FinCEN and the International Monetary Fund (IMF) facilitate real‑time intelligence exchange, yet they are hampered by divergent data‑privacy legislations across jurisdictions.
Addressing these challenges necessitates a harmonized standard for crypto‑address identifiers, a goal that the FATF has signaled as a future focus area.
In the interim, compliance teams should adopt a risk‑based approach, calibrating due‑diligence intensity relative to the counterparties’ exposure to Iran, North Korea, and Myanmar.
For instance, enhanced due‑diligence (EDD) procedures might involve deep‑web monitoring of sanctioned entities’ social‑media footprints to anticipate emerging threat vectors.
On the technology front, blockchain forensics firms such as Chainalysis and CipherTrace are expanding their data repositories, offering APIs that integrate directly into transaction monitoring platforms.
This integration enables on‑chain address tagging, instantly flagging assets that intersect with sanctioned wallets, thereby automating a previously manual process.
Furthermore, the adoption of decentralized identifiers (DIDs) could provide a verifiable credentialing system for legitimate users in sanctioned regions, balancing privacy with regulatory compliance.
Nevertheless, the geopolitical landscape remains volatile; any shift in sanctions policy can retroactively impact historical transaction data, requiring robust archival solutions.
Ultimately, the symbiosis between regulatory mandates and technological innovation will dictate the efficacy of AML efforts in the crypto sphere, making it imperative for industry stakeholders to remain agile and forward‑looking.

WILMAR MURIEL
WILMAR MURIEL
18 Feb 2025

Reading through the enforcement highlights, it’s striking how many wallets have slipped through the cracks before the recent crackdown. The FATF’s push for address‑level sanctions really forces banks and crypto‑exchanges to rethink their risk models. Empathy for the average user is important, but we can’t ignore the systemic threats posed by state‑sponsored actors.

carol williams
carol williams
22 Feb 2025

Let’s be real – the crypto bans on Iran and North Korea are just the tip of the iceberg. While regulators scream about compliance, the underlying tech – mixers, privacy coins – keeps evolving. If we don’t address the root causes, these sanctions will be a game of whack‑a‑mole.

Kamva Ndamase
Kamva Ndamase
26 Feb 2025

Seriously, the FATF’s stance is a wake‑up call for every crypto‑startup out there. You think you’re safe because you’re off‑shore, but the new address‑level watchlists will hunt you down. Get your AML game tight or get ready to disappear.

bhavin thakkar
bhavin thakkar
3 Mar 2025

The data on North Korea’s ransomware operations is mind‑blowing. Their ability to siphon $1.5 billion from a single exchange hack shows just how sophisticated state‑backed cybercrime has become. It’s a stark reminder that crypto can’t be treated as a fringe issue.

Thiago Rafael
Thiago Rafael
7 Mar 2025

From a compliance perspective, the expansion of US Treasury designations to include wallet addresses fundamentally changes the risk landscape for VASPs. Those who fail to incorporate real‑time blockchain analytics into their sanction screening processes will face hefty fines and possible exclusion from the US financial system.

Anurag Sinha
Anurag Sinha
11 Mar 2025

i think the whole fatf thing is a massive con. they cant possibly control all the crypto flow, its all just a way to keep the big banks in power. plus, who's really watching the watchers? might as well just keep mining.

Henry Mitchell IV
Henry Mitchell IV
15 Mar 2025

Nice overview. 😊

Marie Salcedo
Marie Salcedo
19 Mar 2025

It’s encouraging to see that even with all these restrictions, people in Iran are still finding ways to protect their savings with crypto. Hope they get more tools to stay safe.

dennis shiner
dennis shiner
23 Mar 2025

Wow, because adding a few wallet addresses to a blacklist totally solves the problem 🙄

Mangal Chauhan
Mangal Chauhan
27 Mar 2025

Great points! 🌍 It’s essential for institutions worldwide to adopt a unified approach, sharing insights and best practices to combat illicit crypto flows while supporting legitimate users.

Darius Needham
Darius Needham
31 Mar 2025

From a cultural standpoint, these sanctions also reflect the broader geopolitical tensions shaping the global financial system. It’s fascinating to watch how technology and policy intersect here.

Maggie Ruland
Maggie Ruland
5 Apr 2025

Just another day of regulators trying to play catch‑up with crypto. 🙃

jit salcedo
jit salcedo
9 Apr 2025

Oh, look! Another report about FATF doing the same old dance. Meanwhile, the real puppeteers are pulling strings behind the scenes, and we’re all just dancing to their tune. If only someone would point out the hidden agenda, but hey, who reads the fine print?

Joyce Welu Johnson
Joyce Welu Johnson
13 Apr 2025

It’s heartbreaking to think about everyday folks trying to safeguard their families’ future, only to have their wallets frozen because of blanket sanctions. We need solutions that protect the innocent while still targeting malicious actors.

Write a comment

Your email address will be restricted to us