Blockchains are often described as transparent, however this transparency lacks attributability: while transactions can be traced and some information is available on the blockchain, the wallets themselves cannot always be attributed to off-chain individuals/entities, this makes intelligence collection even more important. A key driver of this is the ‘Travel Rule’. The rule was introduced on 1 September 2023 and resulted in the expectation that firms must collect and verify certain attributes about who is sending and receiving funds. 

The problem of self-custodian wallets

Cryptoassets have expanded the scope and scale of sanctions evasion risks by creating more ways to move funds while obscuring ownership and control. Sanctioned actors can, for example, hold value in self-custodian wallets and then use non-authorised or weakly-governed exchanges to swap, aggregate and cash-out these wallets with limited KYC taking place, these services create key attribution problems. 

The scale of crypto adoption makes these risks operationally significant. By the end of 2025, it was forecast that there would be between 750 and 900 million users of cryptocurrencies. Additionally in 2025 59% of crypto wallet users preferred non‑custodial wallets. The non‑custodial wallets market is expected to reach around $10 billion in value by 2028. In parallel, crypto is increasingly being used by sanctioned parties; in 2025 the value sanctioned entities received through crypto rose by 694% to $104 billion. 

In this context, one of the biggest challenges is posed by self-custodial wallets. Unlike wallets managed by regulated firms, the ownership of these wallets cannot always be verified with confidence, raising a difficult risk-appetite question of firms: to process payments that have passed through self-custodial wallets, or avoid them altogether? On one hand, processing these payments can risk a sanctions breach; on the other hand, refusing to do so may block perfectly legitimate transactions. The challenge posed by self-custodial wallets lies therefore in the gap that they create between transaction transparency and attributability.

Against this backdrop, the challenge for firms is whether they can reliably attribute wallets to sanctioned parties and how they set their risk-appetite to determine their willingness to process related payments.

Regulatory expectations and compliance risk

In response to the increased crypto sanctions risk, the UK has started regulating exchanges, stablecoin networks and infrastructure providers. For financial institutions, this expansion in scope creates both direct and indirect risk. Direct risk arises when a firm engages with the blockchain itself. Indirect risks arises when a firm does not engage directly with the blockchain but is nonetheless exposed through activities tangential to it. UK sanctions regulations do not distinguish between these categories of risk, nor do they differentiate between cryptoassets and other ‘more traditional’ assets. In its Cryptoasset Threat Assessment, the Office for Financial Sanctions Implementation (OFSI) recommends that financial institutions screen at least three to five hops minimum in transaction history or continue screening until the crypto assets reach an attributed service provider. 

Traditional sanctions compliance is built around identifying account holders. A firm screens a customer, verifies their identity and monitors their transactions. This model is centred around knowing the identities of the people or entities involved. Crypto disrupts this assumption because, on a public blockchain, activity is not attached to a name, but to a wallet address. As a result, sanctions compliance increasingly takes on an investigative function that combines intelligence and information from a variety of on-chain and off-chain sources. The UK travel rule requires UK-registered cryptoasset businesses to collect and verify sender and recipient information for crypto transfers; however, this requirement does not necessarily extend to other jurisdictions or to self-custodial wallets. 

This creates a fundamental challenge for sanctions compliance frameworks that were originally designed around identifiable account ownership and regulated intermediaries. In practice, firms are increasingly required to make complex attribution judgements based on fragmented or incomplete information, often without clear regulatory benchmarks for what constitutes sufficient confidence. 

As crypto adoption grows, the debate is no longer simply about transaction transparency, but whether firms can reliably determine who ultimately owns, controls or benefits from the movement of value. The future effectiveness of sanctions implementation in crypto will therefore depend not only on tracing transactions, but on improving attribution methodologies, intelligence sharing and international regulatory alignment.

Generally, the UK allows firms to take reasonable steps where information is missing, or where counterparty jurisdictions have not implemented the ‘Travel Rule’. These steps should be based on the individual firm's risk appetite.

The limits of blockchain transparency: transparency is not attribution

Blockchain transparency is often overstated in the sanctions context. Attributing funds to designated parties is challenging. When self-custodial wallets are involved, attribution is even more challenging. Even when a wallet is attributed to a named entity, establishing who ultimately controls and benefits from that entity is not straightforward. When funds engage self-custodial wallets, or VASPs, in jurisdictions that do not enforce a ‘travel rule’, the decision to proceed with processing funds must be based on an individual firm's risk appetite.

Firms need to consider how involved in payments involving self-custodial wallets they want to be. While blockchains may show funds moving, only attribution shows who is behind it, when attribution is not guaranteed firms need to exercise their risk appetite to determine their willingness to engage in these transactions.