What sanctioning SUEX changed for banks that serve crypto firms
Treasury’s September 2021 designation of SUEX moved sanctions pressure from the ransom payment to the cash-out. Because SUEX worked through other exchanges, banks serving crypto businesses had to decide how far down three layers of exposure to look, and pay for it.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On September 21, 2021, the Treasury Department’s Office of Foreign Assets Control designated SUEX OTC, a virtual currency exchange, for facilitating transactions for ransomware actors. It was the first OFAC designation of a virtual currency exchange. Treasury said that more than 40 percent of SUEX’s known transaction history was associated with illicit actors and that it had handled proceeds from at least eight ransomware variants. The designation listed digital currency addresses linked to SUEX. Blockchain analytics firms described SUEX as a nested service, operating through accounts at larger exchanges rather than as a standalone platform. The same day, OFAC updated its 2020 advisory on the sanctions risks of facilitating ransomware payments, It restated that the government strongly discourages paying, and named meaningful cybersecurity steps and prompt reporting to law enforcement as significant mitigating factors.
Earlier in this series we looked at OFAC’s October 2020 advisory, which put sanctions exposure on ransomware victims and the firms that help them pay. SUEX moved the pressure to the other end of the chain. A ransom is only useful to criminals once it can be turned into spendable money, and that conversion runs through exchanges and over-the-counter desks. By designating one, Treasury targeted the off-ramp, not the payment.
For banks, that shift landed in a different place from the 2020 advisory. Few banks process ransom payments directly. Many more, by 2021, served businesses in the virtual asset economy: exchanges, payment processors, crypto ATM operators, fintechs and over-the-counter desks that held accounts for fiat settlement. The question SUEX raised for them was economic as much as legal. How far into a customer’s activity should the bank look for designated parties, and what is that worth paying for? The nested structure of SUEX made the answer harder, because exposure arrives through three layers, each costlier to see than the last: direct, where the bank’s customer or its immediate counterparty is designated; nested, where a designated service operates inside a customer’s platform; and indirect, where funds reach the customer after passing through designated addresses.
Direct exposure: cheap to screen, rarely the problem
The first layer is the familiar one. Banks screen customers and counterparties against the Specially Designated Nationals list, and a designated exchange that opened an account at a US bank would be caught at onboarding or on designation. OFAC’s inclusion of digital currency addresses in the SUEX listing extended this layer slightly: a bank or its fintech customer can screen addresses as well as names.
This layer is cheap because the tools already exist. It is also the least likely place to find a SUEX. Exchanges serving ransomware gangs did not bank in the United States, and their listed addresses were a snapshot. Banks that stopped at this layer were compliant with the obvious requirement and blind to how SUEX actually operated.
One extension matters for banks with fintech partners. Where a partner runs the customer-facing crypto product and the bank holds the accounts, the bank’s direct screening depends on the partner’s. The partnership agreement should require address screening against OFAC listings, set how quickly new designations are applied, and give the bank the results.
Nested exposure: a sanctioned business inside a customer
The second layer reflects SUEX’s design. A nested service has no platform of its own. It holds accounts at larger exchanges and offers conversion to its own clients through them, so its flows look like ordinary customer activity on the host exchange. A bank whose customer is the host exchange is one step removed from the designated party, but the money is the same.
Seeing this layer means diligence on the customer’s controls, not just on the customer. Does the exchange identify nested services among its users? Does it screen deposit and withdrawal addresses against designations and analytics-based risk scores? What did it do with SUEX-linked accounts on September 21? A bank serving virtual asset businesses needs those answers in its onboarding file and its periodic reviews. Gathering them costs analyst time and, often, specialist expertise the bank must hire or contract.
Indirect exposure: funds that passed through designated hands
The third layer is the most expensive. Blockchains are public, so a bank or its customer can trace whether funds arriving from a wallet had passed through designated addresses one, two or more transactions earlier. Blockchain analytics firms sell that tracing as a service, with risk scores for addresses and alerts on exposure.
Indirect exposure is not itself a sanctions violation in most cases, and a policy that treated every trace of contact as prohibited would block large volumes of legitimate activity. It is, however, a signal for suspicious activity monitoring, and a large or repeated pattern can point to a customer that is functioning as an off-ramp. Deciding how many hops to examine, what risk score triggers review, and who adjudicates alerts is a policy choice with direct cost: licences, analysts, and the friction imposed on customers.
Taken together, each layer adds cost, and the bank has to recover it from the relationship. Some banks concluded that virtual asset customers could not be served profitably at the level of diligence the layers required, and closed accounts. That avoids the cost but carries its own: lost deposits and fees, customers moving to less scrutinized providers, and supervisory questions about whether exits were risk-based. Others built a specialized program, priced accounts to cover analytics and staff, and accepted the work. Either path is defensible if it is chosen deliberately. Drifting into this business, with direct-layer screening only, is the expensive option, because it bears the risk without paying for the means to see it. Organizations should check with counsel on how sanctions and anti-money laundering obligations apply to their specific relationships.
With hindsight
From 2026, SUEX began a long campaign against crypto off-ramps. OFAC designated the Chatex exchange in November 2021 and the Russia-based Garantex in April 2022. In January 2023, FinCEN named the Bitzlato exchange a primary money laundering concern. In 2022 OFAC sanctioned the Tornado Cash mixing service, a designation lifted in 2025 after a federal appeals court ruled that its immutable smart contracts could not be sanctioned as property. Law enforcement seized Garantex’s domains in March 2025, and OFAC later designated its apparent successor. Blockchain analytics firms reported that ransomware payments fell by about a third in 2024, attributing part of the fall to enforcement pressure. For banks, address screening and blockchain analytics have become standard in virtual asset programs. Stablecoin legislation passed in 2025 has made the decision whether to serve such businesses, and at what level of diligence, more pressing for more institutions.