In a landmark enforcement action, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has designated eight Canadian money services businesses for facilitating financial transactions on behalf of the Iranian regime. The decisive move marks a first-of-their-kind enforcement focus on Canadian cryptocurrency and over-the-counter (OTC) providers, signaling a strategic shift in how Washington targets the shadowy financial pipelines supporting Tehran’s illicit network.
However, a deeper forensic analysis of the transaction flows reveals that these Canada-based digital asset platforms were not operating in a geopolitical vacuum. According to recent intelligence findings, the designated businesses catered to a vastly broader criminal clientele. Beyond assisting Iranian regime-linked actors in moving digital assets and circumventing international sanctions, these exact same OTC providers supplied the crucial liquidity required to launder dirty cash for some of the most notorious transnational drug trafficking syndicates operating globally.
How Canadian OTCs Serve a Wide Array of International Illicit Networks
The operational blueprint uncovered across these designated Canadian entities highlights a consistent and alarming pattern. A significant portion of incoming cryptocurrency funds originated from the Islamic Revolutionary Guard Corps (IRGC) and other heavily sanctioned actors. In turn, outgoing transfers flowed directly into the hands of violent international criminal enterprises.
Among these beneficiaries are affiliates of the Canada-based Wedding Criminal Enterprise, a sprawling transnational network formerly led by high-profile fugitive and former Olympic snowboarder Ryan Wedding. Wedding, widely known by aliases such as "El Jefe," was apprehended by law enforcement authorities in January on severe charges including murder, witness intimidation, and massive international drug trafficking.
This financial convergence reflects two complementary and highly profitable uses of the exact same underlying cryptocurrency infrastructure. Iranian crypto holders, state-backed agents, and their intermediaries can leverage these Canadian services to shift digital assets across borders while obscuring their ultimate origins. Simultaneously, industrial-scale drug trafficking organizations utilize the exact same desks to convert bulk cash proceeds from street-level narcotics sales into stablecoins and other digital assets.
Consequently, even though these Canada-based OTC platforms frequently marketed their services in Farsi and actively courted Iranian diaspora customers, their operational model naturally attracted enterprise-level criminal organizations operating within the same regions. Ultimately, these digital asset intermediaries functioned as clandestine bridges connecting distinctly different and dangerous illicit economies.
How the OTCs Moved Millions in Cryptocurrency from Iran’s Sanctioned Exchanges and IRGC-Linked Actors
The sheer financial scale of the activity processed by these designated Canadian OTCs is substantial. Investigators have identified more than $6 million in inflows originating directly from sanctioned jurisdictions, alongside an additional $3.7 million stemming from specifically designated entities. Furthermore, forensic tracking uncovered roughly $2.3 million funneled from digital wallets explicitly attributed to terrorist-financing networks, including cells linked to the IRGC, Hamas, and the Houthis.
Transaction mapping illustrates how multiple sanctioned OTC providers routinely received funds from wallets flagged on both international counter-terrorism seizure lists and broader U.S. sanctions registries, while simultaneously dispersing funds to OFAC-listed entities. The individual inbound transfers varied wildly in size, ranging from modest amounts of several hundred dollars to massive institutional-grade transfers worth hundreds of thousands of dollars in cryptocurrency.
The underlying Iranian connections run remarkably deep. Among the sanctioned corporate entities appearing consistently within these transaction flows were several prominent Iranian cryptocurrency exchanges, including Aban Tether Exchange, Nobitex, Ramzinex, and Wallex. Furthermore, the Canadian OTC desks received capital directly from digital wallets associated with sanctioned Iranian individuals, such as financier Arash Estaki Alivand and Keyvan Fayyaz Gharen Blagh, an alleged cyber threat actor operating directly on behalf of the IRGC.
Detailed examinations have established direct operational links between newly sanctioned entities like Million Exchange and individuals such as Fayyaz. Reports indicate that Fayyaz, an employee of the Iran-based Mabna Institute, was heavily involved in sophisticated hacking and extortion operations targeting U.S. entertainment and media corporations at the behest of the Iranian military apparatus. His digital footprint also includes participation in aggressive cyberattacks directed against several critical U.S. defense contractors, a major U.S. communications technology provider, a vital Saudi energy facility, and various other international targets.
In addition to state-sponsored cyber operations, these Canadian OTCs absorbed hundreds of thousands of dollars originating from laundering networks associated with Iranian state oil proceeds, alongside capital from domestic Iranian OTC services. Among the most striking counterparties identified in the transaction logs was an active financial facilitator associated directly with the Al-Qassam Brigades, the military wing of Hamas.
How the OTCs Served Ryan Wedding, One of the World’s Most Wanted Drug Traffickers
While the state-sponsored and terrorist-linked inflows highlight the geopolitical dangers of these platforms, the outflow data underscores an equally devastating domestic security threat. Investigators uncovered millions of dollars in outgoing transfers routed directly to the Wedding Criminal Enterprise, frequently referred to in law enforcement circles as the Wedding Cartel.
Following his high-profile arrest in January, Ryan Wedding faces a cascade of serious federal charges. U.S. prosecutors allege that he orchestrated a sophisticated transnational criminal organization responsible for shipping massive quantities of cocaine from source laboratories in Colombia, moving the narcotics northward through Mexico, and ultimately distributing the product across major metropolitan areas in the United States and Canada.
Federal indictments state that Wedding operated under the protection and direct collaboration of Mexico’s powerful Sinaloa Cartel. Investigators estimate that his network successfully moved approximately 60 metric tons—roughly 60,000 kilograms—of Colombian cocaine through transit corridors in Mexico and Southern California. Law enforcement estimates suggest the enterprise generated an astonishing $1 billion annually.
The organization is also accused of enforcing strict operational discipline through extreme violence and intimidation, utilizing contract killings to eliminate rivals, silence potential witnesses, and obstruct ongoing federal investigations. This violent strategy famously included the execution of a witness who threatened to expose the cartel’s inner workings.
To manage the staggering volume of revenue generated by these narcotics operations, Wedding’s organization reportedly laundered billions of dollars in drug proceeds through an extensive network of underground money exchange businesses operating quietly within the Greater Vancouver and Toronto areas. OFAC disclosures describe a classic cash-to-digital-asset pipeline: couriers delivered bags of bulk illicit cash directly to local exchange businesses, which promptly converted the physical proceeds into digital assets before transmitting the funds overseas to obscure the audit trail.
Detailed blockchain tracing provides a granular look at this mechanics in motion. Specific sanctioned OTC exchanges, such as Farah, acted as crucial conduits, transmitting funds through multi-layered intermediary wallets that ultimately deposited capital directly into the accounts controlled by the Wedding Cartel. In certain instances, Farah transferred sums as large as $2 million directly to wallets associated with the drug organization. Independent blockchain analysis confirms that at least two additional Canada-based, Farsi-language OTC providers maintained identical operational ties to the enterprise through the very same intermediary wallets.
The Designations Expand Efforts to Disrupt Iranian Crypto Networks
The cumulative findings expose a sprawling, interconnected financial ecosystem where the exact same intermediaries freely serve the divergent interests of the Iranian regime, international terrorist financing networks, and violent drug trafficking cartels. While these disparate actors pursue vastly different ideological and criminal objectives, they increasingly rely on a shared, overlapping financial infrastructure to move, hide, and launder their capital.
This enforcement action demonstrates that modern illicit financial networks rarely operate in isolated silos. Effectively disrupting transnational crime requires a comprehensive understanding of the broader financial ecosystem surrounding these illicit actors. By following the digital money trail, regulators and investigators can successfully expose hidden connections between criminal enterprises that might otherwise appear to have no operational relationship whatsoever.
This regulatory strike builds deliberately upon a series of prior OFAC designations targeting Iranian cryptocurrency exchanges accused of moving illicit funds for Tehran, including Nobitex, Wallex, Bitpin, and Ramzinex, as well as subsequent actions against Aban Tether Exchange and SHPS Shelbit. By formally extending sanctions to Canadian money services businesses linked directly to these exchanges, the U.S. Treasury is aggressively expanding its regulatory reach beyond domestic Iranian entities to target the critical international intermediaries facilitating cross-border digital asset transactions.
Crypto Wallets & Security
Crypto Wallets & Security
Crypto Wallets & Security
