Summary
- A group of Canadian OTCs have helped move millions for Iranian illicit financial networks: On Friday, OFAC designated eight Canadian over-the-counter (OTC) money service businesses for facilitating financial transactions on behalf of the Iranian regime. Our analysis has identified millions of dollars in inflows to these OTCs from IRGC-linked wallets, Iranian exchanges, and other sanctioned actors.
- The same OTCs have also enabled major drug trafficking networks: These OTCs also sent funds to major criminal networks, including more than $6.8 million sent to the Ryan Wedding Criminal Enterprise and over $2.5 million to other cartel-linked money laundering wallets. These transactions reveal the OTCs’ role in converting illicit cash into USDT for criminal organizations.
The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) designated eight Canadian money services businesses for facilitating financial transactions on behalf of the Iranian regime. The designations mark a first-of-their-kind focus on Canadian crypto and OTC providers as part of Iran’s illicit financial infrastructure.
Our analysis shows, however, that these services cater to a far broader criminal clientele. Beyond helping Iranian regime-linked actors move crypto, these OTCs also provide the liquidity needed to launder illicit cash for some of the world’s most notorious drug traffickers.
How Canadian OTCs serve a wide array of international illicit networks
Our analysis reveals a consistent pattern across these designated OTCs: a large portion of inflows originated from IRGC and other sanctioned actors, while outgoing transfers flowed to illicit criminal enterprises, including affiliates of the Canada-based Wedding Criminal Enterprise, which was led by former Olympic snowboarder Ryan Wedding. Wedding was arrested in January on murder and drug trafficking charges.
This pattern reflects two complementary uses of the same OTC infrastructure. Iranian crypto holders and their intermediaries can use these services to move crypto and obscure their origins, while drug trafficking organizations can use them to convert bulk cash proceeds into stablecoins. So while these Canada-based OTCs advertise in Farsi and look to attract Iranian customers, they also attract enterprise-level criminal organizations operating in the same region.
Ultimately, these OTCs serve as financial intermediaries between distinct illicit economies.
How the OTCs moved millions in cryptocurrency from Iran’s sanctioned exchanges and IRGC-linked actors
The scale of activity by these OTCs is significant. We identified more than $6 million in inflows originating from sanctioned jurisdictions, alongside $3.7 million from sanctioned entities. An additional $2.3 million came from wallets we attribute to terrorist-financing actors, including networks linked to the IRGC, Hamas, and the Houthis.
The Reactor graph above illustrates how five sanctioned OTCs received funds from wallets identified on both the NBCTF Seizures List and the OFAC sanctions list, as well as sent funds to OFAC sanctioned entities. The incoming transfers varied significantly in value, ranging from several hundred dollars to hundreds of thousands of dollars in cryptocurrency.
And the Iranian connections run deep. Among the sanctioned entities appearing in the transaction flows were Aban Tether Exchange, Nobitex, Ramzinex, and Wallex, all Iranian exchanges. The OTCs also received funds from wallets linked to sanctioned Iranian individuals, including financier Arash Estaki Alivand and Keyvan Fayyaz Gharen Blagh, an alleged cyber threat actor working on behalf of the IRGC.
As shown below, we uncovered links between the newly sanctioned Million Exchange and Fayyaz. Fayyaz’s reported activities offer a glimpse into the significance of these connections. An employee of the Iran-based Mabna Institute, he was involved in hacking and extortion operations targeting a U.S. entertainment and media company at the behest of the IRGC. He also participated in cyberattacks against several U.S. defense companies, a U.S. communications technology provider, a Saudi energy company, and other targets.
The OTCs also received hundreds of thousands of dollars from laundering networks associated with Iranian state oil proceeds, alongside funds from Iranian OTC services. Among the more striking counterparties we identified was an Al-Qassam Brigades Money Mover, a financial facilitator associated with Hamas’s military wing.
How the OTCs served Ryan Wedding, one of the world’s most wanted drug traffickers
Our analysis identified millions of dollars in outflows to the Wedding Criminal Enterprise (the Wedding Cartel).
Arrested in January, Wedding is known by the alias “El Jefe.” He faces multiple charges, including drug trafficking, witness intimidation, and murder-for-hire. U.S. authorities allege that he led a sophisticated transnational criminal enterprise responsible for moving massive quantities of cocaine from Colombia through Mexico and into the United States and Canada.
Prosecutors state that Wedding operated under the protection and collaboration of Mexico’s Sinaloa Cartel, moving approximately 60 metric tons (around 60,000 kilograms) of Colombian cocaine through Mexico and Southern California into the U.S. and Canada. U.S. and federal investigators state the organization generated roughly $1 billion annually. His organization is also accused of using violence and intimidation to protect its operations, eliminate rivals, and obstruct law enforcement investigations, including the murder of a potential witness.
Wedding’s organization allegedly laundered billions of dollars in drug proceeds through money exchange businesses operating in the Vancouver and Toronto areas, as by OFAC. The operation reportedly relied on a cash-to-digital-asset pipeline: couriers delivered bulk cash to exchange businesses, which converted the proceeds into digital assets before transferring the funds overseas.
Our own analysis provides a closer look at how these funds moved through this network. As illustrated in the Reactor graph below, Farah, one of the sanctioned OTC exchanges, sent funds to multiple intermediary wallets that subsequently transferred funds to the Wedding Cartel. Farah also sent a sum of 2 million USD directly to wallets associated with the organization. Further, two additional Canada-based, Farsi-language OTCs that Chainalysis has independently identified have ties to the Enterprise via the same intermediary wallets.
The designations expand efforts to disrupt Iranian crypto networks
Uncovered is a financial ecosystem in which the same intermediaries can serve the interests of the Iranian regime, terrorist-financing networks, and powerful drug trafficking organizations. These actors may have different objectives, but they increasingly rely on overlapping financial infrastructure to move and obscure their money.
The lesson is clear: illicit financial networks do not operate in silos. Disrupting one requires understanding the broader ecosystem around it. And as this designation demonstrates, following the money can expose connections between criminal enterprises that might otherwise appear to have nothing in common.
The action builds on previous OFAC designations of Iranian exchanges accused of moving funds for the regime, including Nobitex, Wallex, Bitpin, and Ramzinex in June 2026, and Aban Tether Exchange and SHPS Shelbit in August 2026. By targeting Canadian businesses connected to these exchanges, OFAC is extending its reach beyond these exchanges themselves to the intermediaries facilitating cross-border transactions.
FAQs
Why did OFAC sanction Canadian cryptocurrency OTCs?
OFAC sanctioned eight Canadian money services businesses for allegedly facilitating cryptocurrency transactions on behalf of the Iranian regime and other sanctioned actors. The businesses were identified as part of Iran’s broader illicit financial infrastructure, helping move funds through cryptocurrency networks and cross-border intermediaries.
How were the Canadian OTCs connected to Iran’s Islamic Revolutionary Guard Corps (IRGC)?
Blockchain analysis identified millions of dollars in inflows to the OTCs from wallets linked to the IRGC, sanctioned Iranian individuals, and Iranian cryptocurrency exchanges. These connections included wallets associated with alleged IRGC cyber threat actors and other entities involved in Iran’s illicit financial networks.
How much cryptocurrency did the sanctioned Canadian OTCs receive from illicit sources?
The analysis identified more than $6 million in inflows originating from sanctioned jurisdictions, approximately $3.7 million from sanctioned entities, and an additional $2.3 million from wallets attributed to terrorist-financing actors, including networks linked to the IRGC, Hamas, and the Houthis.
How were the Canadian OTCs connected to Ryan Wedding’s criminal organization?
Blockchain analysis identified more than $6.8 million in transfers to the Ryan Wedding Criminal Enterprise, also known as the Wedding Cartel. The funds moved through direct transactions and intermediary wallets connected to Canadian OTC providers, including Farah.
How do drug trafficking organizations use cryptocurrency OTC services to launder money?
Drug trafficking organizations can use OTC services to convert bulk cash proceeds into digital assets such as USDT (Tether). Couriers deliver cash to exchange businesses, which convert it into cryptocurrency and transfer it to intermediary wallets or overseas destinations. This process can make it harder to trace the origins and movement of illicit proceeds.
What is the significance of the connection between Iranian networks and international drug cartels?
The findings demonstrate how seemingly unrelated criminal organizations can rely on overlapping financial infrastructure. Iranian regime-linked actors, terrorist-financing networks, and international drug trafficking organizations may have different objectives, but they can use the same cryptocurrency intermediaries to move funds and obscure their origins.
This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.
This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.
Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.
