The Loophole Tehran Is Counting On

The largest forfeiture action in American history happened just eight months ago. Roughly 127,000 bitcoin (about $15 billion) was seized from the “Prince Group,” a conglomerate led by founder and chairman “Vincent,” a Cambodian national born Chen Zhi.

The Prince Group, notwithstanding the corporate trappings of its company name, was not a fun place to punch-in. Trafficked workers were enslaved in a compound and forced to run investment fraud schemes known “pig butchering” scams. Americans were targeted along with others around the world.

This is a rare case of success. Crypto scams are notoriously hard to uncover thanks to the hidden, complicated nature of the transactions. The United States has woken up to the fact that criminals no longer are foolhardy enough to even wash money through the traditional banking system. Indeed, these crimes by design operate totally outside of the world financial structure.

Of course, crypto scams are bad enough. But now state-level sponsors of terror are availing themselves of the protection “shadow banking” affords from Western eyes. The British firm Elliptic estimates that more than $21.8 billion in illicit and high-risk crypto flowed through these cross-chain channels last year, up from $7 billion in 2023.

Last month, the Treasury’s Financial Crimes Enforcement Network (FinCEN) warned American banks that Iran’s Islamic Revolutionary Guard Corps had assembled a multi-jurisdictional digital-asset infrastructure to launder oil revenue and pay for weapons and terror. Here the Treasury Department was able to freeze half a billion dollars in regime-linked crypto. Smaller hauls were made against Hamas, North Korea, and the Sinaloa Cartel.

But, again, this was the result of smart, if not lucky, financial hunting. In most cases, users (individual or otherwise) connect a personal wallet directly to self-executing software that transacts with no bank and no broker anywhere in the path. There is no banking intermediary that tracks who is sending the money or who receives it. This is both the allure and pitfalls of the world of decentralized finance.

So, what to do?

There is now a bill on the Senate calendar – the Digital Asset Market Clarity Act – which passed the House last year that promises to subject the centralized players that most Americans use (brokers, dealers, and exchanges) to anti-money-laundering, know-your-customer, and sanctions obligations. Its authors on the Banking Committee call it the strongest illicit-finance framework Congress has ever written for digital assets.

But, just like its subject matter, the CLARITY ACT is complicated. As drafted, this legislation carries forward language from the Blockchain Regulatory Certainty Act, which shields software developers who do not hold customer funds from being treated as money transmitters, and it leaves mixers, offshore platforms, and self-custodied “unhosted” wallets largely outside the perimeter.

The men and women who chase this money for a living see the gap clearly. Groups including the National Sheriffs’ Association and the National Association of Assistant U.S. Attorneys have pressed the warning for months, and four associations representing the nation’s police chiefs, sheriffs, and prosecutors recently took it directly to the acting attorney general. Their signatories speak for more than 70,000 law enforcement professionals, and they warned that the bill’s sweeping carve-outs would hand sophisticated criminals exactly the blind spots they rely on. The catalog of what already moves through these channels is not theoretical: narcotics trafficking, fraud, child exploitation, ransomware, sanctions evasion, and terror financing. Regulatory certainty, the coalition wrote, should not come “at the expense of accountability, transparency, victim protection, or public safety.”

The Bank Policy Institute, an advocacy organization representing the nation’s leading banks has warned that the result is insufficient, claiming that no single party is left responsible for the monitoring that investigators depend on. On the other side are companies like Coinbase and the developers who argue that a coder who writes neutral, open-source software and never touches a customer’s money should no more answer for a stranger’s crimes than the maker of a hammer or an encrypted messaging app.

The industry has not rested on the hammer analogy alone. The Blockchain Association recently sent the Senate a letter of its own, signed by former FBI agents, ex-federal prosecutors, and a onetime chief of the Justice Department’s money-laundering section, all vouching for the bill as written. What the letter presents as the disinterested judgment of seasoned investigators turns out to be closer to a payroll: 11 of its most prominent signatories now work for Coinbase and two for OKX, the very exchanges with the most to gain from the rules they endorse. Coinbase’s own policy director insists the loophole “does not exist,” pointing to a provision he says drags automated protocols back under anti-money-laundering law. The sheriffs and prosecutors, who answer to no exchange, remain unconvinced.

The real question is whether anyone at all remains accountable for compliance when a protocol that serves American customers and routes American dollars through the financial system can be used to launder the proceeds of, say, a North Korean weapons program. It would strike most Americans as amazing that platform should be able to shed its obligations by labeling itself decentralized and moving its letterhead offshore.

President Trump has said he wants America to be the crypto capital of the world. A capital is defined by its law, not by the absence of it. The Senate can write rules that make this the safest country on earth in which to build the technology, or it can write rules that make it the easiest in which to launder money through it. Tehran, Pyongyang, and Sinaloa are already placing their bets, and winning, on which one Congress will choose.