A filter, not a firewall
A sanction is not a firewall. It is a claim about who holds the right to move value, and that claim is only as strong as the enforcement budget standing behind it. Firewalls block. Sanctions sort. They divide the world into parties who can absorb the compliance cost and parties who cannot, and they do it in the least romantic rooms of the financial system: correspondent banking desks, marine insurance underwriters, ship classification registries, and — since the autumn of 2022 — the relay layer of a proof-of-stake blockchain.
When the E3 formally notified the United Nations Security Council of Iran's non-compliance in late August 2025, and when the pre-2015 sanctions architecture returned to force at the end of September, the obvious things moved first. Freight rates. Hull and cargo insurance premia. Currency forwards. The obvious things always move first, because the obvious things have desks staffed by people whose entire job is to move them.
The unobvious thing did not move at all. Block time held at twelve seconds. Median gas in the quiet hours sat below two gwei. Nothing on the chain acknowledged that the legal status of an entire economy had changed. That silence is the story, and almost nobody in this market measured it.
I went looking for the measurement where it actually lives: the builder pipeline. Public relay and builder dashboards — the ones operators like me check the way a structural engineer checks a strain gauge — showed something the price charts could not. In several twenty-four-hour windows I sampled after the snapback notice, a little under half of all Ethereum blocks were built by relays that filter transactions touching designated addresses. In a handful of windows, the share ran higher. I derived those figures from publicly readable builder data, and anyone with a terminal can reproduce them, which is the only kind of claim worth making in this industry.
The number matters far less than its direction. The chain did not choose anything. The builders chose. And builders are not anonymous. They are legal entities with corporate counsel, insurance policies, banking relationships, and a fiduciary duty to a token-holding community that will not pay their legal bills when a subpoena arrives. They respond to the same cost function as everyone else in this business.
Which is the whole insight, and it fits in one sentence: the censorship resistance of a permissionless network is a property of its validator and builder market structure, not of its consensus rules. The protocol can only promise that no rule inside the protocol prevents inclusion. It cannot promise that no entity outside the protocol prevents it, and it has never claimed to.
I keep the worksheet. That is a habit I acquired in Lagos in 2017, when I was a junior compliance analyst at a fintech that wanted to issue a utility token into the most fevered months of the ICO boom. My colleagues were chasing the raise. I was reconciling the vesting schedule against the contract logic, and somewhere in the fourth week I found an integer overflow that would have released eleven months of tokens early, all at once, to everyone. I refused to sign the whitepaper until it was patched. That decision cost me the job. Three projects with the same construction and no patch discovered the error later, with other people's money. Trust is a protocol, not a promise — and I have been reading enforcement as an engineering artifact ever since.
So when a nuclear non-proliferation file surfaces in a crypto feed, I do not read it as geopolitics with a blockchain garnish. I read it as a governance event whose enforcement surface happens to run directly through the machines this market trades on.
What actually happened, and why I am being pedantic about the mechanism
Here is where precision matters more than narrative. The referral everyone compressed into a single clause is not a single clause.
The IAEA's Board of Governors is a technical body. It is not a court and not a legislature, but under Article XII.C of the Agency's Statute it holds a power that is functionally both: when it finds a state in non-compliance with its safeguards obligations, it must report that finding to the Security Council and the General Assembly. Reporting is not a diplomatic gesture. It is the statutory hinge that converts a verification finding into the raw material of Chapter VII measures.
In June 2025, the Board passed a resolution finding Iran in non-compliance — the first such finding in roughly two decades. The reported vote was nineteen in favor, three against, eleven abstaining, with China, Russia, and Burkina Faso in opposition. Read the eleven abstentions carefully, because that is the more interesting number. A technical non-compliance finding with nearly a third of the Board unwilling to take a position is not a verdict. It is a fracture with a majority attached.
What followed was mechanical. Under the snapback provision of Resolution 2231 — the 2015 resolution that endorsed the nuclear deal and, in its paragraph 11, preserved a reversion mechanism — a participant state could notify the Council of significant non-performance. The E3 notified in late August. The measures returned at the end of September. Resolution 2231's own architecture terminated in mid-October. Two decades of layered Security Council practice, from the 2006 reporting of Iran's file through Resolutions 1696, 1737, 1747, 1803, and 1929, had been constructed around the assumption that the escalatory ladder runs one way. Snapback proved it runs both ways, and that the reverse direction takes about six weeks.
I want to be honest about the epistemic status of that paragraph. The crypto outlet pieces that carried this story gave us two facts: that the Agency referred Iran to the Security Council, and that the move raises geopolitical tension and complicates future negotiations. No vote counts. No resolution numbers. No article citation. No dates. I reconstructed the mechanism from the public record of the institutions involved, and I am flagging that reconstruction as mine, not theirs. The difference between reporting a fact and reconstructing a mechanism is the difference between journalism and aggregation, and this market's information layer has been blurring it for years.
That is not a small problem for an industry that keeps asking institutions to trust its numbers. A settlement network that sources its macro context from content farms is telling its counterparties something about its standards, and the counterparties are reading it.
Silence in the chain speaks louder than noise. The silence in that coverage — the missing citations, the absent votes, the mechanism left unstated — told me more about this industry's information layer than anything the coverage said out loud.
Now the crypto surfaces. There are three, and they are not equally exposed.
The first is the compliance perimeter: the screening stack, the sanctions lists, the attestations that centralized venues publish to demonstrate they are not touching what they should not touch. The second is the settlement layer: the stablecoin float, the mining fleets, the over-the-counter desks that convert local currency into dollar-denominated instruments without a correspondent bank ever seeing the trade. The third is the governance layer, which almost nobody discusses and where the real fragility lives: who, precisely, has the authority to exclude a transaction, under what mandate, with what accountability, and for how long.
The snapback presses on all three. It presses hardest on the third, because the third is the one this industry never finished building.
This governance layer is unglamorous and mostly invisible. It is the screening vendor whose false-positive rate nobody publishes. It is the multisig where four of seven signers are employees of a company with a banking relationship. It is the foundation council that can amend a parameter set without a token vote. It is the block builder that removes a transaction and never has to explain why. None of these entities is a protocol. All of them decide what the protocol means in practice.
My own experience of that gap is specific. In 2021 I managed governance token distribution for a community-owned gallery built with a Lagosian digital artist collective, five hundred participants, each with an equal vote. We deliberately over-indexed on inclusion, because the women in that collective had been structurally sidelined in every technical circle we had tried to join. Anonymous, hyper-financialized projects were being drained that year by governance attacks. Ours was not, and the reason was not clever cryptography. It was that the voters knew each other, had a shared stake in a shared thing, and could not be bought out cheaply. Inclusive governance is not only ethically superior; it is a security property. The people who can be excluded are also the people who cannot be relied upon when the system is stressed, because they have nothing to lose inside it.
That principle is about to be tested at a scale the industry has not seen.
The perimeter widens. It does not deepen.
There is a distinction that gets lost in every sanctions cycle, and it is worth stating plainly. Adding an address to a list is an act of publication. Proving that value moved through that address is an act of measurement. The two are not the same, and the gap between them is where most compliance theatre lives.
The perimeter has been widening for three years, and the snapback accelerates it. The clearest recent illustration was the August 2025 designations around a ruble-denominated settlement token and its exchange infrastructure, accompanied by language warning that foreign parties transacting with that instrument could themselves be exposed. Read that carefully. The designation did not merely target an operator. It targeted the counterparty, which means the perimeter is reaching for the transaction rather than the institution.
That is a structural change in what compliance costs. When the exposure attaches to counterparties, every venue must price the probability that an unknown counterparty is downstream of a designated flow. Probability is not knowledge. Probability is an appetite.
And appetite is procyclical. This is the part that a bull market cannot see about itself. In a euphoric tape, compliance risk budgets get treated as a drag on growth, vendors get squeezed on price, and screening thresholds get tuned with a thumb on the scale. In a bull market, every firm quietly lowers its risk threshold; in a bear market, every firm quietly raises it. The legal text never changes. The enforcement action rate does. What changes is the cost of being wrong, and the cost of being wrong rises with the size of the market, which is precisely when nobody is watching.
I have audited controls that existed only in a policy document. The tell is always the same: the process describes what happens when a system flags something, and never describes what happens when a human overrides the flag. Every real control has an override path, and every override path is a governance decision hiding inside an operational one.
Blocks do not censor. Builders do.
The architecture of proposer-builder separation is elegant and it is worth understanding before you repeat the word censorship. A validator running MEV-Boost does not construct its own block. It receives headers from builders, hands the winning header to a relay, and signs whatever the relay returns. The validator never inspects the contents. It cannot inspect them without giving up the auction that makes the whole arrangement profitable.
A relay that refuses to include transactions touching designated addresses therefore does not need the validator's consent. The refusal is baked into the header. The validator signs it, earns its fee, and never touches a screening decision.
After the Tornado Cash designations in August 2022, this ceased to be theoretical. By most public measurements, a majority of Ethereum blocks — at the peak, above two-thirds on several trackers — were built by relays enforcing a sanctions list. The March 2025 delisting of the Tornado Cash addresses pulled that number down substantially. It did not return it to zero, and the reason is path dependence. Once a filtering capability is built into a production pipeline, exists in documented policy, and is priced into a relay's cost of capital, it does not disappear when one designation is withdrawn. It becomes the default. Defaults are the hardest kind of policy to reverse, because reversing them requires someone to volunteer for risk they do not currently bear.
Vision without verification is just hallucination. If a network claims censorship resistance, that claim needs a published metric: relay set diversity, block-level inclusion rates, builder concentration, measured continuously and reported whether or not the number flatters the narrative. This market has those dashboards. It rarely reads them. That is a cultural failure, not a technical one.
Sanctions do not destroy value. They fragment it.
This is the observation that reframes the entire discussion, and it is the one I would put in front of any regulator who believes a designation reduces activity.
When screening tightens, value does not evaporate. It relocates. Centralized venue deposit addresses thin out. Self-custodied balances thicken. Bridge volumes tick up. Over-the-counter desks absorb what exchanges will no longer touch. The total economic quantity is roughly conserved; what collapses is the legibility of that quantity. Enforcement does not reduce flow; it reduces the observable surface of flow, and enforcement depends on exactly that surface.
There is a version of this pattern I have watched up close, and it is the Layer 2 problem in a different costume. Dozens of rollups launched on the promise of scaling, and what they actually did was slice one scarce pool of liquidity into dozens of shallow fragments, each too thin to support deep markets and each requiring its own bridge, its own risk surface, its own fee market. The sector called that scaling. It was division.
Sanctions produce the same geometry with lists instead of chains. Dozens of jurisdictions, dozens of screening regimes, dozens of slightly different interpretations of the same underlying measure, all applied to one pool of value. The result is not a wall. It is a lattice. Value moves through the gaps, and the gaps multiply in proportion to the number of authorities attempting to close them.
Iran's crypto economy is the case study, and I would rather cite what is checkable than what is convenient. Iran recognised industrial crypto mining in 2019 and required licensed miners to sell output to the central bank, which converted the industry into a sanctioned-adjacent channel for earning hard currency. Chain analytics firms have consistently ranked the country among the largest grassroots crypto economies in the world by adoption metrics. In June 2025, the country's largest domestic exchange suffered a breach in the range of ninety million dollars, claimed by a group operating under a nationalist banner. Notice what that sequence establishes: Iranian crypto infrastructure had already migrated from the financial domain into the military one. When digital asset venues become targets in a shooting war, the argument that crypto sits outside geopolitics is no longer available to anyone.
The most measurable exposure is the least glamorous one.
Among all the crypto surfaces that sanctions touch, exactly one leaves a physical trace: mining.
Hashrate requires electricity, electricity requires generation, generation requires fuel or turbines or sunlight, and all of those are observable from orbit or from a metering report. In an economy where industrial power is heavily subsidised and administratively allocated, mining activity is visible to the state in ways that wallet activity is not. That creates an asymmetry worth naming. Hashrate is the only part of the crypto stack where a sanctions policy can be enforced with an ammeter.
Iran's mining sector has been repeatedly curtailed during peak summer demand, with government-ordered shutdowns timed to protect the residential grid. Those curtailments are not sanctions enforcement. They are load balancing. But the effect is identical, and it is instructive: the enforcement lever that works on mining is the power contract, not the address list. Every regulator reading the snapback file should internalise that. Chain-level enforcement is probabilistic and expensive. Choke-point enforcement on physical inputs and energy is deterministic and cheap.
I expect that asymmetry to shape the next three years of enforcement practice more than any change in screening technology.
Tokenization inherits the legal character of the underlying.
In 2025 I took a role as governance architect on an Africa-focused Layer 2 protocol, negotiating the integration of real-world asset tokenization into a system whose stated values were financial inclusion rather than throughput. That job forced me to defend a proposition in front of institutional counterparties who badly wanted it to be false.
The proposition is this: a tokenized claim is the claim. Tokenize a treasury bill and you have a treasury bill with an additional settlement layer and a worse legal posture. Tokenize a commodity receivable and you have a commodity receivable. The wrapper changes custody, transfer mechanics, and settlement latency. It does not change legal character, and legal character is what sanctions attach to.
This is where the snapback becomes a live risk model rather than a headline. Snapback demonstrated something the RWA narrative has been quietly assuming away: that legal discontinuity is cheap. Six weeks from notification to restoration. A mechanism dormant for a decade activated in a single quarter. Any tokenization product whose risk disclosure assumes legal continuity across a multi-year horizon is mis-specified, and mis-specified in the direction that flatters yield.
The bull market makes this worse, because bull markets reward the shortest possible time between term sheet and issuance. Projects that launched in the last eighteen months are pricing jurisdictional risk using a legal environment that has already changed once since they wrote the deck.
We govern the gray areas between blocks. That is true inside a protocol, where an ambiguous state can be resolved by a vote and a patch. It is not true between jurisdictions, where the gray areas are resolved by whoever has the enforcement budget. A multisig cannot arbitrate between two incompatible legal regimes. It can only pick one and pretend the other agrees.
The rate curves have no term for political risk.
The lend-borrow markets embedded in this industry price risk using curves that are governance parameters dressed as market outcomes. A utilization function, a base rate, a slope, a set of optimal-utilization constants — these are chosen, voted upon, and revised by people. They are not discovered by price. They respond to borrowing demand and to the finite supply of depositors, and they contain no term for the probability that a jurisdiction's legal regime changes in six weeks.
That is a specific, nameable model risk. When a snapback restores a sanctions architecture, the true discount rate on cross-border settlement changes everywhere at once. Capital that was priced for open corridors discovers that the corridors are conditional. The on-chain curve does not move, because the on-chain curve was never wired to that input.
So the industry ends up with a curious inversion: a system that advertises transparency with respect to its own state, and opacity with respect to the world that determines the value of that state. The most underpriced risk in on-chain credit is the political risk of the jurisdiction the collateral sits in, and no interest rate model this market has shipped contains a parameter for it. That is not a bug in the math. It is a scope decision that the math made for us, and it will be discovered the way scope decisions usually are.
A payment rail is not a sanctions policy.
Every sanctions cycle revives the same fantasy: that a second-layer payment network can substitute for the correspondent banking relationships that sanctions sever.
I have watched this argument for seven years, and it has not become better with age. Routing reliability on the Lightning Network has remained a persistent operational problem, liquidity is fragmented across channels that must be individually managed, and inbound capacity is a resource that has to be purchased or begged for. Channel management is a job. Most merchants will not hire anyone to do it.
A payment rail that fails a measurable fraction of the time is not a settlement system. It is a hobby with good marketing. If a rail cannot clear a payment with the reliability a trader requires on an ordinary Tuesday, it will not clear one under the conditions that make sanctions binding, when the amount at stake justifies attention from three intelligence services. The fantasy is not harmless. It keeps capital flowing toward a solution shape that has been tested for seven years and has not scaled into the problem.
The blind spot: enforcement is being built into a ladder
Here is where I part company with most of the coverage on the enforcement side of this file.
The received narrative treats snapback as pressure: pressure on Tehran, pressure on the negotiating track, pressure on the price of everything. That framing is not wrong, but it is incomplete in a way that matters for anyone building on public chains.
The mechanism does something subtler. It creates a compliance ladder — a series of rungs on which every escalatory action can be justified as the execution of an international decision rather than as a unilateral act. Rungs change the politics of escalation. A unilateral action invites a debate about legitimacy. An action framed as enforcement of a Security Council outcome absorbs that debate into procedure. Once the ladder exists, escalation becomes administratively cheaper, and the participants who climb it acquire a vocabulary that makes each step look inevitable.
That same ladder is being constructed on-chain, and this is the part the builders have not internalised. Every filtering relay adds a rung. Every screening vendor's threshold adds a rung. Every venue that pre-emptively de-risks a customer segment it has never measured adds a rung. One rung is a policy decision made under pressure, reviewed and reversible. Forty rungs are infrastructure. Infrastructure is what gets inherited, documented, and treated as a cost of doing business.
The contrarian claim is therefore not that censorship exists. It is that over-compliance, not evasion, is the durable risk to permissionless systems. Evasion is episodic, opportunistic, and priced. Over-compliance is structural, cumulative, and unpriced, because it never appears as a line item. It appears as a default in a configuration file that was set in a stressful quarter and never revisited.
The bull market is actively hostile to this insight. Euphoria rewards the removal of friction, and compliance friction is the easiest friction to remove without any visible consequence, until a counterparty's banking relationship disappears and nobody can trace why.
There is a second blind spot, and it is cultural rather than technical. When a system begins excluding participants, the exclusion decisions get made by whoever is fastest to respond to risk — which is rarely whoever understands the system best, and almost never whoever bears the cost of being wrong. That is how governance degrades without a governance failure. Culture compiles where logic fails. The ruleset stays correct; the tribunal that applies it quietly changes. I watched an anonymous protocol lose three years of accumulated trust in a single quarter because nobody had thought to specify who was allowed to be afraid on its behalf.
The final blind spot is the one this market is uniquely bad at seeing about itself. A bull market does not reward careful reading, and this file — a technical non-compliance finding, a dormant snapback clause, a fracture visible in eleven abstentions — was only ever legible to careful readers. The market priced the headline. It did not price the mechanism, because the mechanism required someone to look up an article number. Intuition audits the code before the compiler does, and in this case the most valuable audit available was simply checking whether the resolution the story referenced could be quoted at all. It could not.
What I am watching next
Three dashboards, and one document.
The dashboards are relay diversity, builder concentration, and block-level inclusion rates, tracked continuously and read as seriously as TVL. If the industry wants to defend the claim that public chains are neutral infrastructure, it has to publish the measurement that could falsify it. A claim that survives no test is not a claim. It is a brand.
The document is whatever disclosure an RWA issuer is willing to sign about legal continuity. Watch for a jurisdictional risk clause that quantifies how quickly legal character can change, because six weeks is now an empirically observed number, and any issuer who has not updated a risk model to reflect it is selling yield on an assumption that has already been falsified once.
And watch the low-probability, high-consequence question that nobody in this market wants to ask out loud: if a second-layer settlement network can substitute for a correspondent bank, why has seven years of development never produced one that clears a payment reliably enough for a mid-size exporter to depend on? Either the technology is not ready, or the problem was never technical. I have my position. The answer is that the problem was never technical, and the industry's habit of treating governance as an afterthought is the reason it keeps discovering, in each cycle, that the hardest layer to build was the one it never scheduled.
We build cathedrals in the bear market, they say. The snapback is a reminder that we also govern them there — and that the enforcement budget always arrives before the architecture does.