UK wallet ID delays could expose crypto firms to 14-year risk

On July 17 the UK designated Iran’s Islamic Revolutionary Guard Corps under Schedule 6A of the National Security Act 2023. The designation creates a criminal offence for anyone in the UK who obtains, accepts or retains a material benefit supplied by or on behalf of the IRGC.

The new offence in section 17C can carry up to 14 years in prison and a possible fine on conviction on indictment for obtaining, accepting or retaining such a benefit. A related offence in section 17C(2) — agreeing to obtain, accept or retain a benefit — carries a maximum sentence of 10 years. Section 17B addresses conduct that materially assists a designated body and has separate elements and penalties. Under section 35, officers of a corporate body can face liability where an offence is committed with their consent, connivance or neglect.

The offence applies when a person knows, or in light of matters known to them ought reasonably to have known, that the benefit came from a designated body. The wording covers money or “anything of value” supplied directly or indirectly, which can include stablecoins and other on-chain transfers even though the statute does not name crypto assets.

Section 17C can reach conduct that occurs wholly overseas when the benefit is provided in or from the UK, when the actor is a UK person, or when other specified Crown connections exist. UK persons include UK nationals, UK residents and entities incorporated under UK law. That scope can bring exchanges, custodians, issuers, payment processors, OTC desks, merchants and individual UK users into view when they receive or hold assets tied to the IRGC.

Blockchain technical realities affect timing and operational response. Network-level transfers can settle before a recipient has identified a sender. Wallet attributions and clustering from analytics can emerge later, creating a sequence where a deposit appears innocent at receipt but is later linked to a designated body. Firms cannot reject incoming blockchain transactions at the network level; account or issuer controls may be the only means to restrict later use.

Schedule 6A designation is separate from UK financial sanctions. Listing under Schedule 6A does not itself trigger asset freezes, non-dealing obligations or reporting duties that follow from financial-sanctions law. Freezing tokens requires a separate sanctions instrument, another legal basis, or action by a token issuer where the issuer retains that control.

The National Security Act contains specific exceptions. A financial benefit is excluded where it represents reasonable consideration for goods or services provided lawfully. Other provisions cover qualifying legal obligations, public functions and humanitarian activity conducted in line with applicable principles. Application of those exceptions depends on the facts of each case.

The government impact assessment says the Act does not create a new statutory business reporting duty but encourages using existing suspicious-activity reports and consent processes. For crypto firms and users, relevant records include the transaction time, wallet risk data and counterparty information available at that time, when any attribution alert arose, the basis and confidence of the attribution, whether the value remained accessible, and actions taken after escalation. Initial enforcement will assess whether recipients can reconstruct what they knew at the time of receipt and the steps they took afterward.