The Ghost CEO: How a Stock-Footage Model Fronted Iran's IRGC Crypto Empire Through London

A woman named Elizabeth Newman supposedly runs two UK-registered cryptocurrency exchanges processing billions of dollars for Iran's Islamic Revolutionary Guard Corps. She doesn't exist. The exchanges do. And while filing as dormant businesses with Companies House, they moved $94 billion - funneling IRGC funds, financing Houthi terror in the Red Sea, and exploiting the world's most lax corporate registry.

The financial architecture behind Iran's sanctions evasion runs through some of the world's most legitimate-looking jurisdictions. Photo: Unsplash

The promotional video starts like any other fintech pitch. A polished executive - short hair, smart blazer, direct gaze - introduces herself to the camera as Elizabeth Newman, executive director of Zedcex Exchange. Behind her: the usual montage of globe graphics and upward-trending charts. The company's website lists offices in Covent Garden, London. A Dubai skyscraper. A beachfront property in the Caribbean.

There is one problem. Elizabeth Newman is a stock-footage model from a Shutterstock clip titled "Pretty black woman talking to camera." The company's supposed finance administrator and team leader are also stock images. The Caribbean address, the London office, the 68-story Dubai tower - none of them house any actual business operation.

And yet Zedcex, along with its corporate twin Zedxion, have been among the most financially active cryptocurrency exchanges in the world. Not on paper - on paper, both companies filed as dormant with the UK's Companies House every single year. In reality, according to U.S. Treasury and blockchain intelligence firm TRM Labs, the two exchanges together processed $94 billion in transactions, with approximately $1 billion in funds directly linked to Iran's Islamic Revolutionary Guard Corps (IRGC) - the military-intelligence body designated a foreign terrorist organization by the United States, Canada, and Australia.

The man allegedly behind it all: Babak Zanjani, one of Iran's most notorious sanctions evaders, who went from death row in Tehran to running a multi-sector conglomerate with publicly stated ambitions to rebuild Iran's entire banking system on blockchain infrastructure. The UK's corporate registry handed him the perfect launchpad. He handed the IRGC a financial lifeline.

A Registry Built on the Honor System

London's financial reputation has long attracted shell companies seeking legitimacy by association. Photo: Unsplash

To understand how Elizabeth Newman - a fictional woman built from stock imagery - became the registered director of two multi-billion-dollar crypto exchanges in the United Kingdom, you have to understand how the UK's corporate registry actually works.

For decades, Companies House operated what anti-money-laundering expert Graham Barrow described to OCCRP as an "honesty box." Submitting the name of a fictitious executive, he told reporters, was "actually the easiest thing in the world to do." The registry accepted whatever information companies submitted. No verification. No cross-checks against identity documents. No questions asked.

Under this system, Zedxion Exchange Ltd was incorporated in May 2021, registered to a virtual office address at 71-75 Shelton Street in London's Covent Garden - a building that houses hundreds of shell companies. Its founding director was listed as a Dutch national named Mehmet Hasancebi. Five months later, a UAE passport holder named Babak Morteza took over as director and person of significant control. His identifying details matched those of Babak Morteza Zanjani, the Iranian financier previously sanctioned by both the U.S. and EU in 2013 for funneling money to an IRGC-linked company.

Then, in August 2022, Zanjani formally stepped back from Zedxion. Within days, Zedcex Exchange Ltd was incorporated - at the same Covent Garden address, with the same corporate structure. And Elizabeth Newman appeared: first as director, then as person of significant control over both companies. Nominally the most important executive in a billion-dollar operation. In reality, a face from a stock photo library.

Both companies filed dormant accounts with Companies House every year. In the UK's regulatory framework, a dormant company is one with no significant accounting transactions. Zedcex and Zedxion declared themselves dormant while, according to TRM Labs' blockchain analysis, processing $94 billion in total transactions through wallets attributable to the exchanges.

The UK passed the Economic Crime and Corporate Transparency Act in 2023, which for the first time requires company directors and persons with significant control to actually verify their identity with Companies House. But existing directors were given a grace period of up to one year. Elizabeth Newman's compliance deadline for Zedcex was May 19, 2025. The billions were already moved.

From Death Row to Crypto Kingpin: The Zanjani File

Babak Morteza Zanjani is not a minor figure in Iran's financial architecture. He is the architect of one of the most sophisticated sanctions-evasion operations ever documented - a man who moved billions of dollars in Iranian oil revenue through a web of front companies across dozens of jurisdictions, helped the Islamic Republic survive international financial blockades, and was rewarded for his service by being tried for embezzlement and sentenced to death.

The story requires the full timeline to make sense.

Zanjani first came to international attention in 2012 and 2013, when the U.S. Treasury and EU sanctioned him for providing financial services to the IRGC and helping Tehran sell oil in defiance of international sanctions. He had reportedly moved more than $2.5 billion in oil money through a network of holding companies, airlines, hotels, and commodity traders. The U.S. called him "a key financial facilitator" for the Iranian regime.

When Iran signed the Joint Comprehensive Plan of Action (JCPOA) nuclear deal in 2015, Zanjani's U.S. and EU sanctions were lifted as part of broader financial normalization. But his problems were not over - they were coming from the other direction. Iran's own judiciary, having concluded that he had embezzled funds from the National Iranian Oil Company, arrested him and tried him for financial crimes. In 2016, he was sentenced to death and ordered to repay the missing money.

Then he disappeared into the Iranian prison system - or so it seemed. Prison records obtained by OCCRP suggest Zanjani may have been allowed to leave prison as early as 2019, five years before his sentence was formally commuted. By 2021, when Zedxion was incorporated in London, Babak Morteza was listed as a founding director. The identifying details matched Zanjani's known documents.

"Treasury will continue to target Iranian networks and corrupt elites that enrich themselves at the expense of the Iranian people. This includes the regime's attempts to exploit digital assets to evade sanctions and finance cybercriminal operations." - U.S. Treasury Secretary Scott Bessent, January 30, 2026

By April 2024, Zanjani's death sentence was formally commuted - reportedly after he repaid the embezzled funds. By 2025, he had re-emerged publicly. He posted on X about advising the Governor of the Central Bank of Iran in 2023 to migrate the country's banking infrastructure to blockchain. He claimed DotOne Holding Group, his new conglomerate spanning cryptocurrency, foreign exchange, logistics, aviation, and telecommunications, had designed and implemented a blockchain banking system with approval from Iran's Supreme National Security Council.

The breadth of DotOne's stated business lines is not coincidental. It mirrors precisely the infrastructure needed to move value under sanctions: crypto rails for digital settlement, logistics for trade-based money laundering, aviation for physical cash movement, and telecommunications for encrypted communications. Zanjani, it appears, learned from his first operation and built something harder to dismantle.

Following the Chain: The IRGC's Financial Lifeline

Blockchain analytics firms can now trace IRGC-linked wallet flows across exchange infrastructure - but regulation has struggled to keep pace. Photo: Unsplash

TRM Labs, the blockchain analytics company retained by governments and financial institutions worldwide, spent months mapping the on-chain activity attributable to Zedcex and Zedxion. What they found rewrites the conventional understanding of how Iran's Revolutionary Guard finances its operations.

In 2023, approximately $23.7 million flowed through IRGC-linked Zedcex wallets - accounting for roughly 60 percent of the exchange's total transaction volume. That figure then surged dramatically: in 2024, IRGC-linked flows hit $619.1 million, representing 87 percent of all Zedcex transactions. Even in 2025, as overall activity diversified, IRGC-linked flows still accounted for $410.4 million, or approximately 48 percent of the exchange's volume.

TRM Labs described the two exchanges as functioning as "a single exchange operation spread across multiple UK legal shells rather than as independent businesses." The overlapping directors, shared registration address, identical corporate architecture, and the precise timing of Zanjani's formal withdrawal from Zedxion followed immediately by Zedcex's incorporation - all of it pointed to deliberate structural design rather than coincidence.

The preferred instrument was not Bitcoin or Ethereum but Tether (USDT), the dollar-pegged stablecoin. Stablecoins have become the IRGC's instrument of choice for sanctions evasion: they hold value in dollars without using the U.S. banking system, they are fast to transfer, and they are pseudonymous enough to provide operational cover. Zanjani himself, responding to the U.S. Treasury's January 2026 sanctions action, claimed on X that the accusations were "merely a pretext for seizing 660 million Tether."

The Tether connection matters beyond the IRGC. TRM Labs identified direct wallet transfers from Zedcex to Sa'id Ahmad Muhammad al-Jamal, a Yemeni national designated by the U.S. Treasury as a senior Houthi financial official backed by the IRGC. According to TRM's analysis, transfers totaling over $10 million moved from Zedcex-attributed wallets to al-Jamal's network. The Houthis have since 2023 deployed missiles, aerial drones, and naval mines against commercial shipping in the Red Sea - attacks that have disrupted global supply chains, raised insurance costs, and forced shipping companies to reroute around the Cape of Good Hope at enormous additional expense.

The money trail connects London company filings to Tehran's military command to Houthi missile launches in the Red Sea. That is not a metaphor. That is the documented transaction chain.

Financing a Massacre: The IRGC and the Iran Protests

The timing of the financial flows intersects with one of the bloodiest chapters in Iran's recent history. In January 2026, protests erupted across Iran, initially triggered by economic grievances - record inflation, currency collapse, and systematic government mismanagement that had hollowed out the middle class. They rapidly grew into the largest challenge to the Islamic Republic's rule since its founding in 1979.

The IRGC played a central role in the crackdown. On January 8 and 9, under cover of a near-total internet blackout, security forces including IRGC units carried out what human rights organizations described as massacres. Amnesty International and the Center for Human Rights in Iran estimate that over 20,000 people may have been killed across the days of unrest. The U.N. High Commissioner for Human Rights opened an emergency inquiry.

On January 19, British MP Alex Sobel raised the matter in Parliament:

"We know that the IRGC has used two registered cryptocurrency exchanges to move approximately $1 billion since 2023, evading international sanctions." - Alex Sobel, UK Parliament, January 19, 2026

Two weeks later, the UK sanctioned Zanjani personally, describing him as "an Iranian businessman who runs a network of companies which generates funds and enables the criminal activities of the IRGC, including its suppression of protesters." But the UK stopped short of sanctioning Zedcex and Zedxion themselves - a distinction that left operational financial infrastructure intact even as the man allegedly running it faced personal asset freezes.

The U.S. moved more decisively. On January 30, 2026, Treasury Secretary Scott Bessent's department sanctioned Zanjani alongside both crypto exchanges, freezing their assets and prohibiting U.S. persons from transacting with them. TRM Labs reported, as of that action, that Zedcex had processed over $94 billion in total transactions since its 2022 registration.

The Anatomy of the Cover: Shell Layers and Legal Gaps

The architecture behind the operation is worth examining in detail, because it will be replicated. Iran's state-linked financial engineers did not stumble onto this structure by accident. They mapped the regulatory gaps and built around them.

Layer one: UK corporate registration. Companies House, as noted, was an honesty box. Registering a fictional director required nothing more than typing a name. Registering at a virtual office address - used by hundreds of companies simultaneously - provided an appearance of London legitimacy without any real presence. The LBMA-equivalent for crypto due diligence simply didn't exist.

Layer two: dormancy declarations. UK law requires companies with significant accounting transactions to file active accounts. Zedcex and Zedxion declared themselves dormant. This is false by any measurable standard - $94 billion in crypto transactions is the opposite of dormancy. But proving it required blockchain analytics capability that regulators did not routinely apply to Companies House filings.

Layer three: stablecoin rails. The exchanges operated almost entirely in Tether (USDT), moving dollar-denominated value without touching the U.S. banking system. Tether itself has faced scrutiny over its compliance posture - a January 2025 U.S. Senate report found Tether transactions linked to terror financing across multiple designated groups. But the on-chain opacity of stablecoin transfers, combined with the speed of settlement, makes real-time interdiction difficult.

Layer four: corporate layering. Zanjani's formal exit from Zedxion followed immediately by Zedcex's incorporation at the same address, with the same structure, under a fictional director, created the appearance of separate entities. To a routine regulator, two different company numbers. To a blockchain analyst examining wallet clusters, one continuous operation.

Timeline: From Oil Billions to Ghost CEO

What Britain Missed - and Why It Matters

The UK's Economic Crime and Corporate Transparency Act came too late to prevent billions in IRGC-linked flows through London-registered exchanges. Photo: Unsplash

The UK's Economic Crime and Corporate Transparency Act 2023 was passed in response to exactly this problem. Britain had spent years earning the informal designation "Londongrad" - a city whose corporate registry, legal system, and property market had been systematically exploited by oligarchs, kleptocrats, and sanctions evaders. The new law required identity verification for company directors. It mandated more active gatekeeping from Companies House.

But the grace period handed to existing directors meant that the billions were already moved before verification requirements applied. And the UK's failure to sanction Zedcex and Zedxion themselves - as distinct from Zanjani personally - meant that the legal shells remained intact even after the January 2026 crackdown.

This is not simply a story about bad actors exploiting regulatory gaps. It is a story about regulatory design that consistently places compliance burden on the final layer - individual sanctioned persons - rather than the infrastructure through which they operate. You can freeze Zanjani's personal assets. As long as the exchanges remain incorporated and their wallets remain operational, the financial pipeline survives its nominal leadership.

The U.S. approach - sanctioning both the individual and the corporate entities - is structurally more effective. But even that has limits. Zedcex and Zedxion's wallets are pseudonymous. The stablecoins they hold can be moved before sanctions take effect. Zanjani himself has already demonstrated, twice, the ability to rebuild a financial network after being dismantled by Western regulators.

Graham Barrow, the anti-money-laundering expert who described the Companies House honesty box problem to OCCRP, has spent years documenting the abuse of UK corporate structures. His assessment of the new legislation was measured: the reforms are real, but they arrived decades late and will not catch those who already used the old system. "The U.K.'s moves to tighten its corporate register came too late to have any bearing on the financial networks supporting those responsible for the recent bloodshed on the streets of Iran," OCCRP concluded in its investigation.

The Next Phase: Blockchain Banking for a Sanctioned State

The most troubling element of this story is not the Zedcex operation itself, which is now at least partially disrupted. It is what Zanjani has said publicly about what comes next.

In a July 2025 post on X, Zanjani claimed that in 2023 he had advised the Governor of the Central Bank of Iran to transition the country's banking system to blockchain infrastructure. He claimed DotOne Holding Group had designed and implemented such a system, with formal approval from Iran's Supreme National Security Council - the body that oversees all strategic decisions for the Islamic Republic.

If that claim is accurate - and the Islamic Republic has every reason to pursue it - then what Zedcex and Zedxion represented was a proof of concept. Not a mature, permanent financial system, but a demonstration that crypto rails could move billions of dollars worth of value across international borders, in dollars, without touching the U.S. banking system, using UK corporate shells as a legitimacy layer.

The next version will be harder to find. It will not be registered to a single London postcode. The directors will not be traceable to a stock footage library. The stablecoins will be mixed through privacy protocols or converted through decentralized exchanges with no corporate structure to sanction. The DotOne conglomerate's logistics and aviation arms will provide physical cover for trade-based settlement.

TRM Labs noted in its 2026 Crypto Crime Report that crypto appears to be "playing an increasingly important role in the total IRGC-linked financing activity." The Zedcex investigation represents a documented, quantified window into that role. It will not be the last chapter.

"Crypto appears to be playing an increasingly important role in the total IRGC-linked financing activity... Zanjani is not a typical entrepreneur - he is one of Iran's most notorious sanctions evasion financiers." - TRM Labs, 2026 Crypto Crime Report

What Comes Next

The U.S. and UK sanctions imposed in January 2026 represent the most significant regulatory action against Iran's crypto sanctions-evasion infrastructure to date. But the full accounting of what the Zedcex network moved, where those funds went, and how much of the $94 billion in total transactions was IRGC-linked remains incomplete. TRM Labs attributes approximately $1 billion in IRGC-linked flows - but that is the amount they could confidently attribute through blockchain analytics, not necessarily the total that moved through the network.

Tether, the stablecoin at the center of the operation, has faced ongoing regulatory pressure over its role in sanctions evasion and terror financing. A January 2025 U.S. Senate report documented Tether transactions linked to multiple designated terror organizations. Tether's response has generally been to cooperate with individual freeze requests from law enforcement rather than adopt proactive compliance screening comparable to traditional financial institutions. That posture is likely to face increasing legislative pressure.

The UK Parliament's January 2026 debate on Zedcex and Zedxion signaled growing political will to close the specific gaps these companies exploited. Companies House's identity verification requirements, now that the grace period has passed for most existing directors, should prevent the Elizabeth Newman problem from recurring in its current form. But corporate service providers who enable nominee directors - a legal and widespread practice in UK corporate law - remain a gap. Any competent sanctions evader can replace a stock-footage model with a real but compliant nominee, which is harder to detect and equally effective as cover.

For Zanjani himself, the cycle has turned twice: first from celebrated sanctions-buster to death-row prisoner, then from prisoner to free man running a blockchain conglomerate. The sanctions architecture has not stopped him building, only slowed it. The question for Western regulators is whether the third iteration of his network - whatever DotOne becomes - will be stopped before it moves the next $94 billion.

Elizabeth Newman, at least, has been exposed. The real architects of what she represented are still in business.