The Second Laundromat on Bartycka Street. How a Shell Company With $1,400 in Capital Landed on America’s Terrorism Sanctions List

2026-08-16

Washington ties the Shelbit network to billions in crypto moved for Iran’s Revolutionary Guard. Its Warsaw node is the second sanctioned company registered in the same mail-drop suite. That is not a coincidence; it is a business model.

The United States has sanctioned a crypto network that, by OFAC’s account, laundered money for Iran’s Islamic Revolutionary Guard Corps, and one of the designated companies is Polish. The August 7th addition to the Specially Designated Nationals list, the government’s ledger of people and companies Americans are forbidden to deal with, had the usual geography of an Iran action: an exchange operator registered in Tbilisi, trading firms in Dubai free zones, a platform in Tehran. A few lines down, though, sits an entry that reads like a typesetting error: SHELBIT TECHNOLOGIES LTD SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ W LIKWIDACJI. The words are Polish; they mean “limited-liability company in liquidation.” The address is 22B Bartycka Street, unit 21A, Warsaw, on a stretch of the Vistula’s left bank better known to Varsovians for lumberyards and bathroom-tile showrooms than for the financing of terrorism. The entry supplies the company’s Polish tax number, its statistical number, its court-registry number, and its official line of business, rendered in the deadpan English of a statistical code: “other monetary intermediation.” Washington, it turns out, reads Poland’s public registers more attentively than Warsaw ever has.

I have practiced financial law in Warsaw for more than two decades, and for the past year I have been telling anyone who would listen that something like this was coming. What surprised me was not the designation. It was the return address. Ten months ago, another company from Poland’s national register of crypto businesses surfaced in a U.S. Treasury action, that time for laundering billions on behalf of a Cambodian syndicate with North Korean clients. It, too, was registered at 22B Bartycka Street, unit 21A.

The collapse of the Shelbit network’s cover took about two weeks. On July 24th, Dubai’s virtual-asset regulator, VARA, posted a notice accusing the exchange of violating anti-money-laundering and counterterrorism rules and warned of cross-border flows threatening the integrity of the Emirati financial system. On July 31st, Reuters published a long investigation identifying Shelbit as the hub of a four-billion-dollar sanctions-evasion scheme: the platform, the agency found, had moved crypto for Iran’s central bank, for one of the world’s largest illegal online-gambling networks, and to addresses that the Israeli government links to the Islamic Revolutionary Guard Corps. A week later, OFAC moved.

The Treasury’s findings are unusually specific, because blockchains keep receipts. Wallets belonging to the Guard sent the equivalent of more than a million dollars to Shelbit’s addresses; more than two million flowed back the other way. Wallets controlled by Siavash Kayvanpour, the network’s founder, sent a further two million dollars to Nobitex, Iran’s largest crypto exchange, itself blacklisted on June 2nd alongside three smaller platforms. Tens of millions more came from a Persian-language gambling empire run by two Iranian influencers who live in conspicuous comfort abroad; both were convicted of illegal gambling in Iran in 2023, yet their sites retain access to Iran’s online-payment rails, which the central bank supervises tightly. The Treasury read this as proof of the regime’s hypocrisy and corruption. (The action was developed, the release notes, in coördination with the I.R.S.’s criminal-investigation arm.)

The scale came from the blockchain-analytics firm TRM Labs: some $6.3 billion moved through Shelbit’s infrastructure between May of 2024 and March of 2026, about eighty-eight per cent of it in dollar-pegged stablecoins on the Tron network. The platform’s wallets were, at any given moment, nearly empty; what came in left almost immediately, and the whole address architecture was rebuilt every one to four months. TRM described a pattern consistent with “a settlement conduit rather than an exchange.” A pipe, in other words, dressed as a marketplace.

Kayvanpour, who was born in Iran, holds additional citizenship from Dominica and Afghanistan, and has lived in the Emirates, was designated under Executive Order 13224, the counterterrorism authority that George W. Bush signed twelve days after the September 11th attacks, for materially supporting the Guard and Nobitex. His companies followed him onto the list as entities he owns or controls: SHPS Shelbit in Georgia; Shelbit General Trading, Crypto Home, and NFT Home in the U.A.E.; and the one in Warsaw. The State Department, for its part, is offering up to fifteen million dollars for information that helps dismantle the Guard’s financial machinery. The share capital of the network’s Warsaw node is five thousand złotys, about fourteen hundred dollars. The bounty exceeds the company by four orders of magnitude.

In Poland, a company’s life is a public text. The National Court Register, known as the KRS, records it in numbered entries, and the file for KRS No. 0001053647 reads like a short story with a body in the last paragraph. The founding deed was signed on August 19, 2023; the court entered the company in the register five days later, under the name Rovataler, a coinage with the vowel pattern of a password suggestion. Its share capital was the statutory minimum. Its sole founding shareholder was a company-formation outfit from Wrocław, in Poland’s southwest, whose registry footprint repeats like wallpaper: identical five-thousand-złoty companies, the same nominee president, the same virtual address on Bartycka Street, the same financial-activity code, produced, stamped, and sold. The stated main business was management consulting.

Eleven days after incorporation, on September 4, 2023, Rovataler was entered in Poland’s register of virtual-currency businesses, entry No. RDWW-922. The entry conferred the full statutory menu: exchanging crypto for money, exchanging crypto for crypto, brokering both, and running crypto accounts for clients, which is to say holding other people’s coins. The price of admission was a declaration of a clean criminal record, a declaration of relevant knowledge or experience, a filing fee of six hundred and sixteen złotys (about a hundred and seventy dollars), and a fourteen-day statutory clock after which the entry was, in practice, automatic. Nobody verified the declarations; the law did not require it. Poland had built an entry regime for financial custodians with roughly the friction of a newsletter signup.

In March of 2024, the product found its buyer. A single amendment to the charter, recorded on March 13th, changed everything at once: the name became Shelbit Technologies Ltd; the sole shareholder and president of the board became Siavash Kayvanpour; and the main business code flipped to 64.19.Z, “other monetary intermediation,” the phrase OFAC would later copy into its sanctions entry. Entry No. RDWW-922 travelled with the company, like a transferable season ticket. Nothing in Polish law required anyone to take a fresh look at the new owner.

Then the calendar accelerates. On January 2, 2025, VARA issued its first cease-and-desist orders against the network’s Emirati companies. On February 10th, a little under six weeks later, the Warsaw company’s shareholder resolved to dissolve it and open liquidation, appointing Kayvanpour liquidator. The dates require no commentary. On October 30, 2025, the company filed, all on a single day, financial statements covering its entire existence. And on August 7, 2026, it landed on the SDN list, liquidation status and all: quite possibly the first time that particular Polish legal formula, w likwidacji, has been transliterated into a federal sanctions entry.

A point of precision. OFAC does not accuse the Warsaw company of operations of its own; it was designated because Kayvanpour owns it and it acted on his behalf. That is exactly what makes the story uncomfortable. Poland was not where the money was washed. Poland was where the credibility was bought.

The suite has a history. Huione Crypto sp. z o.o., the Polish limb of the Cambodian conglomerate Huione, which by American accounts laundered at least $4 billion, including proceeds stolen by North Korea’s Lazarus Group, was registered at the same address, and, being likewise a company in liquidation, formally still is. In May, Gazeta Wyborcza, Poland’s leading daily, ran an investigation under the headline “The Cambodian Laundromat on Bartycka Street.” Three months later, the same building and the same unit surfaced in a communiqué about financing the Revolutionary Guard. On paper, the money men of North Korea and Iran, the two most heavily sanctioned regimes on earth, shared a Warsaw mail drop.

None of this is the address’s fault; unit 21A is a mass-registration point, one of many in the city. But the registry entries arrange themselves into a business model: a specialist firm incorporates twin after twin (the same founding shareholder, the same nominee president, the same fourteen hundred dollars of capital, the same address, the same code), obtains the crypto-register stamp for each, and sells the package, company and stamp together. Let me be precise about what I am and am not alleging. Selling shelf companies is legal in Poland, and I make no accusation against the middlemen. The flaw is a register that allowed a permission to hold strangers’ crypto to change hands like a domain name, with no fresh look at anyone.

The secondary market operates in the open. As recently as May, the international marketplace Coincub was offering a Polish VASP for thirty-five thousand euros, bundled with a ready-made anti-money-laundering binder and live accounts at Paydo, Binance, Bybit, and Kraken; the transfer of ownership, the listing promises, “can be completed fully online,” through S24, the government portal that lets Poles create or sell a company without leaving their chairs. The listing is still up as I write. Next to it, nineteen thousand euros buys a dormant Warsaw entity with the 64.19.Z code and an implicit three-step manual: activate, rebrand, go. In these catalogues, the Polish jurisdiction shares a shelf with a Comoros banking license and a brokerage permit from the island of Anjouan. That is not an editorial insult. It is market segmentation, performed by the sellers themselves.

As of a count taken on March 19th of this year, the register held twelve hundred and thirty-nine entities. Supervision of that population, in all of 2025, consisted of seven inspections by GIIF, Poland’s financial-intelligence unit, three of which touched the crypto market. In the same year, the national bank inspected three hundred and twenty-five currency-exchange businesses, running four hundred and eighty-eight kiosks among them (the storefront heirs of the cinkciarze, the black-market money-changers of the Communist era), and found violations at fifty-four of the firms. A walk-in kiosk swapping euros for złotys was many times more likely to see an inspector than a company entitled to hold the keys to strangers’ coins. A state that polices its money-changers more energetically than its crypto custodians has made a strategic choice, and the wrong one.

Nor is this the private grievance of one Warsaw law office. MONEYVAL, the Council of Europe body that grades countries’ defenses against money laundering, has three times declined, in December of 2023, December of 2024, and December of 2025, to raise Poland’s rating on the standard covering new technologies, citing, among other things, a definition of crypto providers narrower than the global one and the absence of the Travel Rule, which requires identifying information to move with a transfer. In December of 2025, Poland was also placed under the first step of the committee’s compliance-enhancement procedure: the country rates compliant or largely compliant on twenty-seven of the forty international recommendations, and what triggered the procedure is that, of the six core recommendations, Poland remains only partially compliant with two, the criminalization of terrorist financing and the reporting of suspicious transactions. The European banking and securities authorities, for their part, have pointed to Polish registrations as a textbook case of letter-box entities and regulatory arbitrage.

The map says it plainest. Germany, which folded crypto into its banking law under the full supervision of BaFin, admitted roughly twenty-three firms. France licensed between a hundred and a hundred and seventeen; Malta, thirty-one; Spain, ninety-nine; the Netherlands, forty-three; Ireland, twenty-two; Luxembourg, fourteen. Poland: twelve hundred and thirty-nine, under a registrar whose competence is tax administration, with no market supervisor at all. More crypto businesses operated only in the Czech Republic, which kept no dedicated register at all and let the trade run on ordinary business licenses (its financial-intelligence office counted more than nine thousand such firms, most of them sole traders), and in pre-reform Estonia. Estonia is the instructive case: after it required a real connection to the country, raised its fees, and adopted the Travel Rule, its licensed population fell by roughly eighty per cent, from more than thirteen hundred to about a hundred. The reform itself functioned as an audit; it revealed how many licensees had never had an Estonian operation to begin with. Twelve hundred entries against two dozen German licenses is not the measure of a crypto sector. It is the measure of a form’s throughput.

None of this is hindsight. I wrote in December of 2025, after the Huione designations and the first presidential veto of Poland’s crypto statute, that the register had become a facade lending legitimacy to firms nobody had ever examined. I said it on “Fakty,” the evening news of TVN, Poland’s main private network. In May, I handed Gazeta Wyborcza a dossier: the MONEYVAL reports, the financial-intelligence unit’s annual reports, a comparative survey of European supervision. The Finance Ministry answered with a polemic to the effect that the system works. Three months later, Washington answered, too.

Fairness requires giving the ministry its strongest case. The register, it argues, was never a license: it was an evidentiary listing required by the E.U.’s 2015 anti-money-laundering directive; an entry certified nothing and conferred nothing. Nor was the state idle: the tax administration ran four hundred and sixty-five inspections, found three hundred and fifty-nine violations, and struck six hundred and thirty-seven names from the register, two hundred and seventy-five of them after formal proceedings; eleven hundred and seventy-one registered firms were connected to the financial-intelligence unit’s reporting system. Poland, the ministry assured the press this spring, has an effective system for countering money laundering and the financing of terrorism.

All of it is true. All of it misses, for three reasons.

First, a stamp’s legal taxonomy does not govern its market function. In the Polish statute, the entry is a listing; on Coincub, it is a Polish VASP with accounts at the world’s largest exchanges; in a scammer’s pitch to a retiree, it is a license from a European Union member state. The appearance of legality is manufactured not in the statute books but in the customer’s head and in a bank’s onboarding queue. A state that issues a stamp carrying no verification, yet looking exactly like verification, owns what that stamp does out in the world.

Second, the chronology of detection. Both flagship cases, Huione and Shelbit, surfaced from Washington, not Warsaw. Huione Crypto was struck from the register, by the ministry’s own account, on October 6, 2025, after a little more than two undisturbed years on the list, and only once the Americans had made the case public. On Shelbit, as of this writing, no action by any Polish authority has been made public. Six hundred and thirty-seven removals describe housekeeping. The two loudest cases in the register’s history were both slept through.

Third, the system conceded the point before reality did. The state’s Supreme Audit Office examined the anti-money-laundering apparatus in 2024, and the financial-intelligence unit’s own report for 2025 credits the audit’s conclusions with improving its analytical and inspection work. There is no better confirmation of a diagnosis than its acceptance by the patient. The dates supply the closing irony: in the spring, the ministry vouched for the system’s effectiveness against terrorist financing; in August, a company from the Polish register was designated under an order whose full title concerns blocking the property of persons who commit, threaten to commit, or support acts of terrorism.

What the designation means in practice: every asset of the listed entities within reach of U.S. jurisdiction is frozen, Americans may not transact with them, and, under OFAC’s fifty-per-cent rule, the block extends automatically to any entity that designated persons own half of or more. For readers in Poland, the sharper edge is the secondary-sanctions clause attached to these designations: a foreign financial institution that knowingly conducts significant transactions for a listed party risks being cut off from the American financial system itself, and the Treasury pointed banks to its guidance on Iranian crypto exchanges. Formally, the OFAC list is not law in Poland; Polish institutions apply the U.N. and E.U. sanctions regimes, and Kayvanpour and his companies appear on neither, so far. Practice is less formalist. Banks that clear dollars treat the SDN list as gospel, and the de-risking of crypto clients, already brisk, will now accelerate. For compliance departments, the entry contains a quiet instruction: it lists the Warsaw company’s tax, statistical, and court-registry numbers, so screening counterparties by brand name alone is, as of this month, negligence. The network traded under at least six names in four jurisdictions.

And there is a puzzle that belongs in a corporate-law casebook. The Warsaw company’s sole liquidator is now a designated global terrorist. Liquidation requires a bank account; any bank holding that account steps into secondary-sanctions territory; striking the company from the court register requires completing a liquidation that nobody will service. The company may simply hang there, too dead to operate, too radioactive to bury. Polish practice offers no settled procedure for that condition.

There is a final piece of context, without which this is merely true crime. President Karol Nawrocki has vetoed Poland’s crypto-market statute three times, most recently on June 11th. MiCA, the European Union’s crypto rulebook, has applied directly in Poland since December 30, 2024; regulations, unlike directives, need no national transposition. The vetoed statute was the plumbing, chiefly the naming of the financial regulator as the competent authority. Meanwhile, on July 1st, MiCA’s transition period expired. The old register entries now authorize nothing; the only ticket to the market is a CASP license; and in Poland there is no one empowered to issue it. Honest firms are licensing elsewhere in the Union and serving Polish customers on a European passport, supervised from other capitals. What remains at home is the husk of a register, marketplace listings for companies with VASP history that formally entitle their buyers to nothing but still do their work in a sales pitch, and the reputation of a jurisdiction written up twice in ten months by the U.S. Treasury and once by the Council of Europe.

Three lessons, then. A register built on self-declarations is not a neutral filing cabinet; it is an export product, and the exporter does not choose its customers. The difference between a listing and supervision is not semantic; it is the difference between two dozen firms under BaFin’s eye and twelve hundred entries among which Washington twice found what Warsaw was not looking for. And until Poland has a statute, an authority, and a licensing procedure, the de-facto supervisors of its crypto market will remain OFAC and the investigative press. The first case could pass for an industrial accident. The second, from the same street and the same suite, is a system.

Legal and factual status as of August 15, 2026.