UK Crypto Asset Freezes: What OFSI Sanctions Guidance Means in Practice
A wallet alert is only the beginning. UK crypto firms must establish who owns or controls assets, what an effective freeze requires and when OFSI must be told. This analysis unpacks the legal and operational traps, from pooled custody to licensing, and explains why defensible evidence matters more than labels.
London, England
Oct 10, 2026
A cryptoasset does not escape an asset freeze because it sits in a blockchain wallet rather than a bank account. For a UK exchange or custodian, the decisive questions are more demanding: who owns or controls the asset, what rights the customer holds, and whether the firm’s next action would breach a sanctions prohibition.
That is the practical significance of the Office of Financial Sanctions Implementation’s UK Financial Sanctions FAQs, read alongside its financial sanctions guidance for cryptoassets. The framework does not require a separate sanctions system for digital money. It requires firms to apply existing prohibitions to assets whose ownership, custody and movement may be harder to establish.
For the industry, the difficult work begins where a screening alert ends. Identifying a potentially sanctioned wallet is not the same as proving ownership, and blocking a withdrawal is not necessarily the same as freezing every asset or claim belonging to a designated customer.
The law follows the asset, not the technology
UK sanctions regulations made under the Sanctions and Anti-Money Laundering Act 2018 establish the applicable prohibitions. OFSI’s guidance explains their operation; it does not replace the regulations or create permission to transact.
An asset freeze generally prohibits dealing with funds or economic resources owned, held or controlled by a designated person. Separate prohibitions restrict making funds or economic resources available, directly or indirectly, to designated persons or for their benefit. The precise wording, exceptions and licensing grounds must be checked against the relevant regime.
Cryptoassets can fall within these categories. A token’s classification depends on its characteristics: it may constitute funds, or an economic resource capable of being used to obtain funds, goods or services. Calling something a governance token, a digital collectible or a protocol position does not settle the legal question.
The jurisdictional reach also matters. UK financial sanctions generally apply to conduct within UK territory and to UK persons, including UK-incorporated companies, wherever they operate. Moving infrastructure abroad does not, by itself, remove a UK company from that framework.
A freeze is not confiscation. It restricts dealings with property; it does not ordinarily transfer ownership to the government. Nor should a firm assume it can sell, convert or relocate frozen cryptoassets simply because it considers the move prudent. Those actions may themselves constitute dealing and require a licence or an applicable exception.
A wallet address is evidence, not an identity
Blockchains provide transaction records, but those records do not automatically identify the legal owner of an asset. A wallet label from an analytics provider is an investigative lead whose reliability depends on the attribution behind it.
A defensible assessment may require customer records, beneficial-ownership information, deposit and withdrawal histories, custody agreements, communications and evidence about who can authorise transactions. Firms should distinguish a confirmed connection from a probabilistic association—and retain the reasoning behind that distinction.
The opposite error is equally serious. An address without a customer name attached is not evidence that nobody designated owns or controls its contents. Nominees, intermediaries and corporate structures can obscure a sanctioned person’s interest without extinguishing it.
OFSI’s general financial sanctions guidance explains ownership and control, including majority ownership or voting rights, powers over board appointments and circumstances in which an entity’s affairs can reasonably be expected to follow a person’s wishes. These tests concern substance, not simply whether a name appears on a sanctions list.
In crypto markets, that demands care with multisignature arrangements, treasury structures and decentralised organisations. Holding a governance token or possessing one signing key does not automatically establish legal control. Equally, a nominally distributed structure does not rule out control where one person can, in practice, direct its affairs.
What an exchange can actually freeze
For a custodian holding assets for a designated customer, the immediate task is to prevent prohibited dealings. That may involve disabling withdrawals, transfers and trading while identifying the full extent of the customer’s property and preserving relevant records.
But the customer’s dashboard may not describe the legal position accurately. A displayed token balance could represent identifiable assets held in custody, a share of assets in an omnibus wallet, or a contractual claim against the platform. Each arrangement requires an assessment of what is owned, held or controlled and which proposed actions are prohibited.
Pooled custody creates a particularly important operational challenge. A firm must identify the designated customer’s interest without assuming that every asset in a shared wallet belongs to that customer. It must also ensure that internal ledger movements, settlement processes or automated transactions do not undermine the restriction.
Self-hosted wallets present a different problem. A firm without the private keys may be unable to immobilise tokens at the address. It can nevertheless prevent transactions through systems it controls, refuse prohibited dealings and report information where the law requires it.
The distinction should be recorded precisely. Blocking access to an exchange is not the same as stopping an asset from moving across a blockchain. A compliance record should explain what was restricted, what remained technically possible and which assets or claims were affected.
Reporting is not optional—and a licence is not a waiver
Reporting obligations depend on the applicable regulations and the firm’s status. Cryptoasset exchange providers and custodian wallet providers are among the businesses brought within the relevant-firm reporting framework. Where the statutory conditions are met, knowledge or reasonable cause to suspect that a person is designated, or that a sanctions breach has occurred, can trigger a report to OFSI.
An effective report needs more than an unexplained address list. Transaction hashes, timestamps, asset amounts, attribution evidence, customer information and a clear account of the firm’s involvement can help investigators reconstruct both the movement of value and the decisions made around it.
Sanctions reporting should also be distinguished from suspicious activity reporting to the National Crime Agency. The obligations serve different purposes; making one report does not automatically discharge the other.
Licensing is similarly specific. An OFSI licence can authorise conduct that would otherwise be prohibited, but only within its scope, conditions and the available legal grounds. Applying for a licence is not permission to proceed, and a licence covering one activity should not be treated as general clearance for a customer relationship.
The enforcement stakes are substantial. Since 15 June 2022, OFSI has been able to impose civil monetary penalties for financial sanctions breaches without having to establish that the person knew, or had reasonable cause to suspect, that their conduct breached the prohibition. That civil standard does not erase the separate legal requirements for criminal liability, but it makes weak controls and poorly documented decisions a serious regulatory exposure.
The compliance test is the quality of the decision
A bridge, mixer or intermediary does not automatically sever a designated person’s connection to assets. Nor does historical contact with a suspicious address automatically prove a sanctions breach. Firms need to establish the relevant parties, the ownership or control relationship, the conduct involved and the prohibition potentially engaged.
This is where serious compliance differs from a screening exercise. The strongest response combines reliable attribution with legal analysis, operational restrictions and an auditable record of what the firm knew and did. Decentralisation may explain a technical limitation; it does not answer the legal question.
Crypto’s long-term legitimacy depends in part on whether its firms can make those distinctions consistently. An asset freeze must be effective where a business has the power to enforce it, and accurately described where that power is limited. Neither a clean-looking wallet nor a dramatic analytics alert substitutes for evidence.
Publication note: A purported FAQ revision dated 9 October 2026 has not been independently verified. The analysis above concerns the established sanctions framework and the official guidance linked throughout; it does not attribute a new legal requirement to that date.