USDT sanctions risk: the Senate's Iran report puts Tether's freeze record on trial — what it means for merchants who accept USDT

What the Senate report on USDT and Iran found (September 28, 2026)

On Monday, September 28, 2026, Senator Richard Blumenthal released Tethered to Terrorism: Crypto & Iran's Shadow Banking Network. Blumenthal is ranking member of the Senate Permanent Subcommittee on Investigations (PSI), and the subcommittee's minority staff wrote the 28-page report. It is the most detailed public attempt so far to measure which stablecoin Iran's sanctioned networks actually use.

The method is forensic, not a survey. Staff analysed on-chain transaction data for 846 unique wallets that were sanctioned or targeted for seizure over links to Iran and its regional proxies. Each was designated between June 2021 and August 2026, either by the US Treasury's Office of Foreign Assets Control (OFAC) or by Israel's National Bureau for Counter Terror Financing (NBCTF).

• 84% of the 846 wallets transacted exclusively or nearly exclusively in USDT.
• The two lists differ sharply. 87% of the 757 NBCTF-designated wallets mostly used USDT, compared with 57% of the 101 OFAC-designated ones. Some wallets appear on both lists, so the subtotals add up to more than 846.
• $603 million through one network. Two sanctioned oil smugglers, Alireza Derakhshan and Arash Estaki Alivand, moved more than $603 million in USDT between 2021 and 2025, through a network that reached Hizballah, the Houthis and Iranian financial institutions.
• Freezing before 2024. The report says Tether did not "comprehensively and consistently freeze" designated wallets before 2024. It also notes that Tether has called its OFAC compliance "voluntary," and contrasts that with what banks are legally required to do.

Blumenthal sent the findings to Treasury Secretary Scott Bessent and Attorney General Todd Blanche, asking both departments to examine Tether's sanctions and anti-money-laundering controls. His letter asks Treasury for records by October 9, 2026. His summary: Tether and its flagship token "have become central to Iran's shadow banking system."

The finding that matters most is a timing gap

The volume figures got the headlines, but the operational finding is about speed. American Banker summarised the key example. In June 2023, Israel's NBCTF flagged 39 addresses tied to Hezbollah money laundering, and Tether froze five of them. The remaining 34 kept moving funds, more than $34.6 million in total, for another nine months.

That gap is the real subject of the report: the time between an authority publicly naming an address and the token on it actually stopping. Blumenthal put the conclusion plainly: "Solely relying on the reactive freezing of wallets after designations will not work." The report also criticises Tether for not acting on wallets that showed "strong indicators of illicit finance" before any designation.

Read that as a policy direction. If the pressure works, freezes will start earlier. Instead of waiting until a government designates an address, issuers would act once analytics suggest an address is linked to illicit activity. Earlier freezes catch more bad actors. They also cast a wider net, and a wider net catches more people at its edges: counterparties, exchanges, and occasionally a business that took a payment without knowing where the money had been.

Tether's response, and what the numbers don't show

Tether replied the same day with a statement that did not address the report directly. It said it had helped freeze nearly $550 million in Iran-linked USDT in 2026, and more than $4.9 billion in assets worldwide across more than 2,900 investigations. CEO Paolo Ardoino said "USD₮ is not a haven for sanctioned actors, terrorist organizations or criminal networks," and added that public blockchains give authorities a visibility into fund movements "that simply does not exist with cash." Tether has not been charged with any sanctions offence.

A fair reading also has to note the report's limits:

• The sample was selected. These 846 wallets were studied because authorities had already flagged them. The 84% describes where sanctioned money went. It says nothing about what share of USDT's roughly $184 billion supply is illicit.
• Most of the headline comes from one list. USDT accounts for 57% of the OFAC-designated wallets and 87% of the Israeli ones. Since the Israeli list is about seven times larger, the 84% headline mostly reflects it.
• The report is preliminary and partisan. It is minority-staff work, labelled preliminary, with no Republican signature. The underlying addresses are not published, so nobody outside the subcommittee can reproduce the analysis.
• The market didn't react. USDT held its dollar peg in the days after publication.

None of those limits closes the timing gap, and the timing gap is what links this report to the law.

Where the GENIUS Act makes this a merchant question

The anti-money-laundering section of the GENIUS Act is section 8, codified at 12 U.S.C. § 5907. It says a stablecoin from a foreign issuer "may not be publicly offered, sold, or otherwise made available for trading in the United States by a digital asset service provider unless the foreign payment stablecoin issuer has the technological capability to comply and complies with the terms of any lawful order." Treasury has said that in the sanctions context, lawful orders include sanctions designations.

As written, the process has three steps:

1. Treasury identifies a foreign issuer whose coin trades in the US and that is not complying with lawful orders.
2. Within 30 days, Treasury may designate the issuer noncompliant and notify it in writing.
3. If the issuer has not come into compliance 30 days after that notice, Treasury publishes the determination with a Federal Register notice. The notice bars digital asset service providers from facilitating secondary trading of the coin, starting 30 days after publication. Waivers and licences are possible, and the issuer can appeal to the DC Circuit.

USDT is issued outside the United States. Tether's US-regulated product is a separate token, USA₮ (USAT), issued by Anchorage Digital Bank. Anchorage's latest attestation, published September 30, reported 175.73 million USAT outstanding, about a tenth of one percent of USDT's supply. For a US business, then, "USDT" and "Tether's regulated dollar" are two different instruments.

Nothing in section 8 bans a merchant from accepting USDT. The restriction falls on digital asset service providers: the exchanges, brokers, custodians and off-ramps around you. It applies only once the Act takes effect, expected January 18, 2027, and the broader permitted-issuer rule for US offers and sales follows on July 18, 2028. We covered those dates in which stablecoins US merchants can accept. What the Senate report adds is a documented case on the exact question the statute asks. Nobody knows whether Treasury will act on it, but the question is no longer hypothetical.

What USDT sanctions risk actually looks like for a merchant

Set the geopolitics aside and a business that accepts USDT faces three practical exposures. None of them is new, but the report makes all three more likely to tighten.

1. The issuer can freeze an address

USDT's contract lets Tether blacklist an address so the token on it can no longer move. The freeze applies to the address, not to individual coins, and it works the same whether the address sits in an exchange account or in your own wallet. Circle can do the same with USDC, and so can every major fiat-backed stablecoin issuer. We know of no public case where Tether froze an ordinary merchant over one customer payment; freezes target addresses that authorities have designated or that law enforcement has flagged. But if freezes start earlier, based on indicators rather than designations, there will be more edge cases.

2. The off-ramp screens what you deposit

The more common friction comes later. Exchanges and off-ramps screen deposits, and funds that trace back to a flagged address can be held for review while the platform asks you for documentation. A hold like that is a cash-flow problem, not a legal finding. But if all your stablecoin revenue leaves through one platform, a hold there stops your entire cash flow.

3. Platforms can lose the right to trade the token

Under section 8, a noncompliance designation would bar US platforms from facilitating secondary trading of the coin. Your balance wouldn't disappear. You would still hold it and could still send it peer-to-peer, but converting it through US platforms would no longer be routine. Europe has already seen a regional version of this: when Revolut wound down USDT in Europe after MiCA, balances left on the platform were converted on Revolut's schedule, not the customer's.

Should merchants stop accepting USDT? Usually not.

In much of the world, USDT is what customers actually hold. Data for the first half of 2026 showed USDT handling roughly seven times USDC's volume in real-world payments, with the widest gap in B2B and emerging markets (see our USDT vs USDC comparison). If a store in Buenos Aires, a freight forwarder in Dubai or an exporter selling into Lagos drops USDT, it doesn't remove sanctions risk. It loses customers.

The better question is what happens after the sale, because holding a token for 30 seconds and holding it for six months are very different exposures. This checklist works whatever Treasury decides:

1. Keep accepting the stablecoins your customers pay with. That means USDT and USDC, on the networks your customers actually use.
2. Decide what you hold after the sale. Set a default settlement asset, so balances don't pile up in whichever token each customer happened to use.
3. Separate receiving from treasury. Take payments into an operating wallet and move funds to treasury on a schedule. That way, a problem with one incoming payment never touches your reserves.
4. Know your large payers. For B2B invoices and big-ticket orders, know who you're invoicing. Apply the same diligence you would to an incoming wire.
5. Keep a record of every payment. Log the invoice, amount, network, transaction hash and timestamp. If an off-ramp asks where funds came from, you can answer in minutes, not weeks.
6. Don't depend on one exit. Keep a second off-ramp relationship and a second stablecoin you're comfortable holding.
7. Watch three dates: October 9, 2026 (the deadline for the records Blumenthal requested from Treasury), January 18, 2027 (the Act's expected effective date) and July 18, 2028 (the permitted-issuer rule for US offers and sales).

What changes for different businesses

• A US online store taking USDT from crypto-native buyers. This store has the most exposure to section 8, because its off-ramps are US platforms. Keep USDT at checkout and turn on auto-conversion, so each day ends in the asset you chose rather than in a token that could lose its US trading venues.
• A shop or café in Latin America where customers pay in USDT. Keep taking it at the counter. With a POS that shows a fresh QR code for each sale, any phone works as a terminal, cashiers log in with a PIN, and the money reaches your wallet in seconds. The only decision is how much USDT you keep.
• An importer or exporter settling invoices in USDT. Tickets are large and counterparties are known. Issue invoices with expiry and overpayment detection, so every payment matches one invoice and one customer you can name if a bank or off-ramp asks.
• A business paying suppliers or contractors in stablecoins. The sanctions question applies to money going out as well as money coming in. Mass payouts in EVM stablecoins (on Polygon, Arbitrum, Optimism, Base, BNB Chain or Avalanche) let you choose which stablecoin you pay in and keep a per-payee record.
• An API seller paid by AI agents. Through x402, agents pay in USDC on Base for each call. Payzum sits in front of your API as a proxy, and payment is settled by an external facilitator. USDT doesn't come into it.

Where Payzum fits: no processor between you and your money

Payzum is a non-custodial, crypto-only payment processor. Payments settle directly to a wallet you control, and Payzum never holds, pools or controls the funds. That matters here because every custodial layer adds another party with its own compliance process that can hold your money: the processor's balance, its bank, its payout schedule. With non-custodial settlement the path is simply customer → blockchain → your wallet.

• Accept what customers hold. USDT, USDC and other crypto, across Bitcoin, Ethereum, Solana, Polygon, Base, Arbitrum, Optimism, BNB Chain and Avalanche.
• Choose what you end up holding. Optional auto-conversion to USDC or USDT means your settlement asset is something you decide, not an accident.
• Get a record of every payment. Signed webhooks, a REST API and a full audit log. Invoices carry expiry and overpayment detection.
• No chargebacks. Once an on-chain payment confirms to your wallet, it is final. Confirmation typically takes about 0.4 seconds on Solana and about 2 seconds on Base and Polygon.

Non-custodial settlement has limits. It does not override an issuer: if Tether or Circle freezes an address, that address stays frozen in your wallet just as anywhere else. Payzum doesn't decide who is sanctioned, can't unfreeze a token, and doesn't replace your own sanctions compliance or your lawyer's advice. What it removes is the processor as one more party that could hold, delay or reverse your money on its way to you.

How it works, step by step

1. Connect your wallet. Self-custody, hardware or multisig, whatever your treasury policy requires. Payzum settles into it and never holds the keys.
2. Set your asset policy. Choose which networks and stablecoins you accept, and whether incoming payments auto-convert to USDC or USDT.
3. Turn on the ways you charge. Online, use hosted checkout, payment links and buttons, drop-in plugins for WooCommerce, Magento 2, PrestaShop, Shopify and others, invoices, or subscriptions. In store, use the POS, with a fresh QR code for each sale and PIN-protected cashiers.
4. Get paid and reconcile. The chain confirms in seconds, signed webhooks push each payment into your systems, and the audit log keeps the trail.

USDT revenue held on a platform vs settled to your own wallet

Fair objections

"USDC can be frozen too. Why single out USDT?"

You're right: Circle can blacklist USDC addresses. The difference this report highlights isn't technical capability. It's policy and regulatory standing. USDC's issuer is regulated in the US, while USDT's future on US platforms will depend on section 8's lawful-order test. That's a reason to accept both and to decide deliberately what you hold. It isn't a reason to refuse either one.

"Doesn't self-custody make me the one responsible?"

You're responsible for your sanctions compliance either way. A custodial processor doesn't take that obligation off you; it just adds a party that can hold your funds. A business that holds its own funds and keeps a clean record of every payment is in a simpler position to explain to a bank or an auditor.

"We're outside the US. Does this matter?"

Section 8 restricts US platforms, but much of the world's USDT liquidity runs through firms with US exposure, and an issuer freeze applies everywhere. It's worth following even if you never sell to an American customer.