Intelligence Report: The Zedxion Corporate Nexus for Illicit Iranian Financial Funds Transfer for IRGC Entities.

Foreword

DomainTools Investigations began investigating the Zedxion Cryptocurrency Exchange in July 2025 thanks to an external partner coming to us with the question “Does anything look strange about this domain?”
‍
We continued our investigation into the Zedxion Exchange in partnership with TRM Labs who first published their own research on the Exchange in January 2026. Publishing in threat intelligence can be a tough balance to navigate. At the time, we determined holding the information closely and relaying only to trusted partner agencies was the right call. Given the attention Zedxion and Babak Zanjani have received this year, we now feel comfortable releasing our full writeup on not just the cryptocurrency angle but the much larger sanctions evasion mechanisms involved, including commodity goods and more.
‍
Signals point to BZ Group (and likely IRGC) moving towards establishing regional banking app(s) in order to more effectively obscure their transactions and mitigate disruption or takedown. We release this report to provide fuller context on the network and mechanisms involved to inform future enforcement efforts.
‍

Executive Summary

This report documents a multi-jurisdictional corporate and digital network centered on the ZEDXION and ZEDCEX exchanges, the ZedPay payments layer, and the broader BZ Group ecosystem spanning the United Kingdom and the United Arab Emirates. When examined holistically, the constellation does not resemble a conventional cryptocurrency enterprise. Instead, it presents as a layered financial architecture in which legal entities, branding assets, governance actors, and digital infrastructure perform distinct and compartmentalized functions.

At the corporate level, the UK serves as a recurring incorporation platform. Companies are formed with high nominal capitalization, frequently £1,000,000, yet file dormant or non-trading accounts and exhibit no verifiable operating revenue. These entities are restructured, mirrored, or dissolved as exposure increases. ZEDXION EXCHANGE LTD and ZEDCEX EXCHANGE LTD reflect this pattern: structurally similar exchange vehicles, one absorbing litigation and regulatory pressure while the other preserves brand continuity and operational optionality. The dissolution of BZ BROKER LIMITED and the short lifecycle of BZ DIAMOND LTD reinforce the conclusion that UK entities function primarily as disposable regulatory interfaces rather than durable operating companies.

Governance patterns further support this interpretation. The record shows coordinated, short-tenure director appointments during restructuring phases, including the appointment of Mehdi Rezazadeh as a director of Mining Consultancy Ltd from December 2017 to March 2018. His synchronized appointment and resignation alongside parallel officers align with a formation-phase governance layer rather than sustained executive control. Such actors appear during transitional moments and withdraw before long-term consolidation occurs. In contrast, operational authority becomes progressively centralized after 2022 under Elizabeth Newman, whose directorship and PSC status coincide with infrastructure persistence rather than operational contraction. Earlier officers exit filings, but brand continuity and digital control remain intact.

Above this governance layer sits a durable digital infrastructure. Core domains, mail hosts, and token assets persist across corporate restructuring events. The ZEDXION token, issued on ERC-20 and BEP-20 standards, extends the exchange narrative into a capital-formation mechanism that operates independently of dormant UK filings. ZedPay adds a further segmentation layer: a payments-branded rail aligned with the exchange ecosystem yet not structurally identical to the exchange shells themselves. This separation of exchange, token, and payments branding reduces concentration risk and allows functional continuity even if individual entities become legally encumbered.

The broader branding architecture relies heavily on financial nomenclature designed to imply regulated status. IBAN-branded entities and bank-evocative domains adopt institutional terminology without corresponding licensing in the claimed jurisdictions. This pattern of confidence laundering is consistent across exchange, brokerage, and payments branding. The effect is the projection of legitimacy through corporate form and semantic signaling rather than through demonstrable regulatory compliance.

The upstream origin of the ecosystem traces to Babak Morteza Zanjani, whose early directorship of ZEDXION EXCHANGE LTD and broader BZ-branded commercial footprint provide the strategic and brand foundation from which subsequent entities descend. Although his formal withdrawal from UK filings creates the appearance of disengagement, domain persistence, brand continuity, and UAE-based operational anchoring suggest strategic repositioning rather than structural separation.

The risk profile escalates materially with the intersection of litigation and sanctions enforcement. U.S. federal court filings allege that Zedxion Exchange facilitated the laundering of fraud-derived proceeds. More significantly, the U.S. Department of the Treasury’s Office of Foreign Assets Control designated Zedxion-associated entities for sanctions-evasion and financial facilitation activity benefiting the Islamic Revolutionary Guard Corps. These actions shift the analytical frame from regulatory non-compliance to national-security-relevant sanctions exposure.

Taken together, the evidence describes a deliberate operational doctrine: companies are cycled, governance is stratified, infrastructure persists, and branding is diversified across exchange, payments, and trade narratives. The United Kingdom functions as a flexible incorporation venue, while the United Arab Emirates anchors the durable operational and branding base. Short-tenure formation actors such as Rezazadeh appear during transitional phases, while centralized control consolidates around trusted operators as risk intensifies.

This inversion where people and domains are stable while companies are ephemeral is characteristic of mature, risk-managed financial facilitation networks operating in the gray space between crypto-assets, offshore jurisdictions, and sanctions exposure. Whether ultimately categorized as fraud-facilitating infrastructure, sanctions-evasion-adjacent finance, or high-risk offshore exchange activity, the Zedxion / Zedcex / ZedPay / BZ constellation presents a structured system engineered for resilience, exposure management, and continuity under scrutiny rather than for transparent, regulated commercial exchange operations.
‍

How these connections could be leveraged:

The ecosystem mapped across the Zedxion, Zedcex, ZedPay, IBAN-branded entities, and the broader BZ Group can be rationalized as a vertically layered financial architecture capable of transforming commodity-derived value such as proceeds from sanctioned oil into mobile digital assets insulated from traditional banking enforcement.

At the apex sits Babak Morteza Zanjani, whose historical association with sanctions exposure and oil-linked financial maneuvering provides the strategic origin point of the structure. His early directorship of ZEDXION EXCHANGE LTD, alignment with BZ-branded entities, and continued gravitational presence through UAE-linked commercial infrastructure suggest that the exchange ecosystem did not arise independently, but rather descends from a pre-existing trade and finance network. In this configuration, Zanjani functions less as a visible operator and more as a systemic architect whose commercial footprint anchors the broader constellation.

If sanctioned oil is monetized, the primary constraint is not the physical commodity, but the financial settlement. Sanctions regimes target correspondent banking channels, dollar clearing systems, and SWIFT connectivity. Therefore, the initial objective of any sanctions-evasion mechanism is to convert commodity shipments into funds outside the reach of U.S.-controlled banking rails. The UAE provides a permissive trade environment and access to regional banking relationships, while Turkey historically functions as a corridor for metals and commodity clearing. Within this ecosystem, the UAE-based BZ Group entities form the durable commercial base capable of anchoring trade activity, issuing invoices, and receiving settlement in regional currencies such as dirhams.

Once oil-derived value is monetized regionally, the next problem is abstraction. Funds tied directly to commodity transactions remain vulnerable if traceable through conventional banking channels. This is where IBAN-branded and bank-evocative entities become relevant. Entities such as IBAN 2 IBAN TRANSACTION & PAYMENT SOLUTIONS LTD and CAISSE REGIONALE DE CREDIT AGRICOLE MUTUEL FINANCE LTD adopt institutional nomenclature that implies regulated settlement authority without corresponding licensing. Whether functioning as active financial intermediaries or as narrative scaffolding, they provide a settlement layer that distances trade proceeds from their origin through layered transfers and inter-entity routing.

The introduction of ZedPay adds a critical intermediary stage. As an exchange-adjacent payments rail, ZedPay bridges fiat settlement structures and crypto conversion platforms. In architectural terms, it sits between trade monetization and exchange liquidity. Funds aggregated through trade or banking-façade entities can be routed into ZedPay-branded channels, creating the appearance of platform-based payment processing rather than direct commodity settlement. This segmentation reduces exposure concentration and separates liability across corporate wrappers.

The exchange layer ZEDXION EXCHANGE LTD and ZEDCEX EXCHANGE LTD then provides the conversion mechanism. Once funds enter the exchange environment, they can be transformed into stablecoins or other cryptocurrencies, transferred internally across accounts, or moved on-chain beyond conventional banking controls. At this stage, the value no longer depends on correspondent banking systems. It exists as digital assets capable of rapid cross-border movement, layering, or reintegration into financial systems under altered provenance. The designation of these exchanges by OFAC for sanctions-evasion activity underscores the risk profile inherent in this conversion capability.

Governance stratification reinforces the structural logic. Zanjani occupies the upstream strategic position. Elizabeth Newman consolidates operational control at the UK corporate interface after 2022. Transitional actors, including Mehdi Rezazadeh and others, appear during formation or restructuring windows, then recede. UK companies cycle through incorporation and dormancy, absorbing regulatory pressure when necessary. The UAE layer persists as the durable operational anchor. This separation between strategic origin, operational control, formation-phase actors, and corporate wrappers is characteristic of risk-managed financial structures rather than linear commercial enterprises.

Viewed as a whole, the architecture functions as a sequence of transformations: commodity to regional currency, regional currency to settlement abstraction, abstraction to platform-based payment routing, payment routing to crypto conversion, and crypto conversion to globally mobile digital value. Each stage introduces distance from the original sanctioned commodity transaction. Each layer distributes exposure across jurisdictions and entities. The system does not rely on a single company or officer; it relies on structural segmentation and persistence of digital infrastructure.

This narrative does not assert that every participant knowingly facilitates sanctions violations. Rather, it explains how the ecosystem’s design, its jurisdictional arbitrage, disposable corporate shells, banking-style nomenclature, payments segmentation, and exchange conversion capability could operate as a contemporary sanctions-evasion mechanism consistent with oil-derived value movement and subsequent crypto-based mobility.
‍

Key Judgments (High Confidence)

1. Elizabeth Newman (Potential cutout individual personna) is the post-2022 operational nexus
   She appears across governance, infrastructure, token promotion, and litigation, with evidence of operational involvement preceding formal directorships.
2. UK corporate entities are disposable; digital infrastructure is not
   Domains, mail servers, and token branding persist across dissolved or dormant companies.
3. Babak Zanjani represents strategic origin, not day-to-day control
   His withdrawal from UK filings coincides with governance “clean-up,” not shutdown.
4. The BZ UAE group provides the enduring commercial backbone
   UAE-based entities and branding outlast UK shells and anchor operations in a permissive jurisdiction.
5. Financial branding materially exceeds regulatory reality
   “Bank,” “IBAN,” and “exchange” labels create implied legitimacy without licenses.
   ‍

Principal Individuals

The network of entities associated with Zedxion, Zedcex, and the broader BZ constellation is best understood through the individuals who occupy key control, transitional, and peripheral roles within it. Rather than presenting as a conventional corporate management structure, the pattern of personnel observed across filings, infrastructure, and operational touchpoints reflects a deliberate, layered approach to governance. Authority, risk, and visibility are distributed unevenly, allowing the network to preserve operational continuity while periodically reconfiguring its formal corporate face.

From an analytical perspective, the principal individuals serve distinct functions within this architecture. Some operate as upstream strategic figures, shaping branding, capital flows, and ecosystem design without remaining visible in day-to-day corporate governance. Others function as operational controllers, consolidating formal directorships and PSC status during periods of heightened regulatory or legal exposure. A third category consists of transitional or nominee-like actors, whose brief appearances align with early formation phases or entity restructuring, and who do not persist as the network matures. Finally, certain individuals occupy commercial or retail-facing roles, providing legitimate-appearing business activity that coexists alongside more opaque financial or exchange operations.

This section introduces the principal individuals within the Zedxion–BZ ecosystem and situates them within this control framework. It traces how leadership and ownership evolve over time, how technical and commercial responsibilities are compartmentalized, and how branding and infrastructure persist despite changes in formal governance. Understanding these individuals and their respective roles is essential to interpreting the network not as a series of isolated companies, but as an integrated system designed to manage risk, obscure attribution, and sustain long-term operational capability.

Elizabeth Newman

Role: Director, PSC, operational controller
Residency: UK (corporate address), UAE (operational residence)

Newman emerged as the central node of the network from mid-2022 onward. She is the sole or dominant director across ZEDXION EXCHANGE LTD, ZEDCEX EXCHANGE LTD, and BZ BROKER LIMITED, and is linked to operational infrastructure via:

• An early-2022 Zendesk profile referencing developer@zedxion[.]com, predating her UK directorship.
• Public token-exchange correspondence (VinDAX) signed in her name.
• Service of U.S. federal court summons at the Shelton Street address used across Zedxion entities.

Her consolidation coincides with the removal of higher-risk legacy figures from UK filings while maintaining functional continuity.
‍

Babak Morteza Zanjani

Role: Strategic founder / upstream controller (historic)

Zanjani served as an early director of ZEDXION EXCHANGE LTD (2021–2022). His wider business footprint, Sorinet Group, Avan Financial & Economic Development Group, and BZ Group AE (UAE) forms the upstream ecosystem from which Zedxion branding and infrastructure appear to descend.

Although he exited UK governance in 2022, branding continuity, domain persistence, and UAE group activity suggest strategic rather than operational disengagement.
‍

Solmaz Bani aka Sara Bani

Role: Director and PSC, BZ DIAMOND LTD

Bani controlled BZ DIAMOND LTD, a short-lived UK entity with EU-denominated shares and UAE service addresses. The company exhibits classic shell characteristics: sole controller, rapid rebranding, and dissolution once utility is exhausted.
‍

Bahareh Zanjani

Open-source corporate and technical records identify BZ Diamond (bzdiamond.ae) as a Dubai-based commercial entity operating under the BZ- branding convention observed elsewhere in the broader BZ ecosystem. Bahareh Zanjani is identified through professional and commercial listings as the owner-operator of BZ Diamond, exercising apparent managerial and commercial control over the business.

Independent domain-registration data for bz-diamond[.]com attributes the creation and administrative registration of the domain to Solmaz Bani, indicating a separation between technical control of digital infrastructure and public-facing commercial ownership. This division where domain creation and control are held by an individual distinct from the listed owner-operator is consistent with patterns observed elsewhere in the network, in which branding and operational continuity are maintained through shared infrastructure rather than transparent corporate filings.

The use of BZ-prefixed branding by BZ Diamond aligns it nominally with other BZ-associated entities, though no formal regulatory filings or enforcement actions currently place BZ Diamond (bz-diamond[.ae]) itself under sanctions or name it directly in OFAC designations. Nevertheless, the convergence of (a) the Zanjani surname, (b) shared branding conventions, and (c) domain-level control by a separate affiliated individual warrants analytical treatment of BZ Diamond as part of the extended commercial perimeter of the BZ constellation, rather than as an isolated retail enterprise.

From an intelligence perspective, BZ Diamond appears to function as a legitimate-appearing commercial node within a wider environment characterized by shell-company cycling, branding persistence, and infrastructure reuse. While distinct from the crypto-exchange operations of ZEDXION / ZEDCEX, its ownership and technical-control structure reflects the same compartmentalization logic, separating public ownership, operational control, and digital infrastructure to reduce transparency and complicate attribution.
‍

Mehmet Hasancebi and Sara Bani

Role: Transitional directors

Both appear in IBAN 2 IBAN TRANSACTION & PAYMENT SOLUTIONS LTD, an early payments-branded entity. Their short tenures and lack of downstream continuity are consistent with nominee or transitional governance during early network formation.
‍

Erol Bulbul and Mustafa Ozkan

Role: Directors / PSCs, IBAN-branded entities

These individuals control or initially controlled IBAN 2 IBAN LTD / CAISSE REGIONALE DE CREDIT AGRICOLE MUTUEL FINANCE LTD, a renamed UK company whose branding deliberately evokes legitimate European banking institutions despite no such affiliation.
‍

Corporate Entity Analysis (UK)

The UK-registered companies associated with the Zedxion and BZ ecosystem do not operate as conventional commercial enterprises. Instead, they function as a regulatory interface layer, a set of entities designed to absorb legal exposure, project legitimacy, and provide corporate scaffolding, while remaining operationally thin, dormant, or short-lived. When examined collectively, these companies exhibit recurring structural features: high nominal capitalization with no corresponding trading activity, rapid director consolidation, parallel or mirrored entity creation, and timely dissolution aligned with rising litigation or reputational risk.

This section analyzes the principal UK corporate entities within the network and situates them within the broader organizational logic. The evidence indicates that UK companies are not the durable core of operations, but rather disposable shells used for branding, exchange presentation, payments signaling, and regulatory positioning. Governance changes — most notably the transition from Babak Morteza Zanjani to Elizabeth Newman — are best understood as risk-management maneuvers rather than indicators of operational disengagement or restructuring.

By contrast, the behavior of these UK entities becomes intelligible when viewed alongside the network’s UAE-based companies. While UK firms cycle through incorporation, dormancy, and dissolution, the UAE layer persists, anchoring branding, officer residency, and service locations. The UK therefore appears to function as a sacrificial jurisdiction, optimized for flexibility and deniability, whereas the UAE serves as the durable operational base.

The following analysis evaluates each UK entity in turn ZEDXION EXCHANGE LTD, ZEDCEX EXCHANGE LTD, BZ BROKER LIMITED, BZ DIAMOND LTD, and the IBAN-branded companies focusing on their stated function, governance profile, lifecycle, and role within the wider network. Together, these entities illustrate a coherent pattern of shell-company cycling, confidence signaling, and continuity planning that is inconsistent with ordinary commercial practice and indicative of a mature, risk-aware corporate architecture.

‍

ZEDXION EXCHANGE LTD

Function: Flagship exchange / alleged laundering node
Capitalization: £1,000,000 (nominal)
Status: Dormant

Zedxion presents itself publicly as a high-volume crypto exchange while filing dormant accounts. It is explicitly named in U.S. litigation alleging facilitation of fraud proceeds laundering. Governance shifts from Zanjani to Newman align with reputational risk management rather than operational change.

Despite its dormant corporate filings, exchange-branded infrastructure, token promotion, and exchange-adjacent payment mechanisms continue to operate in parallel, suggesting functional continuity independent of UK corporate reporting.
‍

ZEDCEX EXCHANGE LTD

Function: Parallel exchange entity
Capitalization: £1,000,000 (nominal)

Zedcex mirrors Zedxion structurally but is “cleaner”: single director (Newman), no legacy officers, and identical capital patterns. This suggests continuity planning — a ready replacement entity if Zedxion becomes legally encumbered.

The parallel existence of Zedcex further reinforces the network’s entity-redundancy doctrine: one exchange vehicle may absorb litigation or regulatory pressure while another preserves brand continuity and operational optionality.
‍

ZEDPAY / ZED-PAY

Function: Payments-layer adjunct / exchange-adjacent payment rail
Corporate Status: Branding-layer entity (no confirmed UK-registered exchange license)

ZedPay operates as the payments-facing extension of the Zedxion ecosystem. While not structured as a standalone UK exchange company in the same manner as Zedxion or Zedcex, it functions as a transactional bridge within the broader network, aligned with the zed-pay[.]com domain infrastructure identified in Appendix C.

The presence of a payments-branded node separate from the exchange entities reflects layered architecture design:

• Exchange front-end (Zedxion / Zedcex)
• Token layer (ZEDXION token)
• Payments rail (ZedPay / Zed-Pay)

This segmentation reduces concentration risk. Should exchange entities face regulatory constraint, payment-branded infrastructure may continue facilitating value transfer under a distinct commercial narrative.

Unlike Zedxion and Zedcex, ZedPay does not appear in dormant UK filings with declared £1,000,000 capital; instead, it operates primarily at the digital-brand and infrastructure level. This divergence further illustrates the inversion observed throughout the ecosystem: operational functionality persists at the domain and branding layer even where corporate shells remain dormant or are dissolved.

BZ BROKER LIMITED

Function: Brokerage shell
Status: Dissolved 2025

This entity follows the same pattern: high nominal capital, sole director/PSC (Newman), no trading, and short lifespan. Its dissolution coincides with heightened litigation risk around Zedxion.

BZ DIAMOND LTD

Function: Trade / commodities branding node
Status: Dissolved 2022

BZ Diamond connects the UK shell ecosystem to BZ trade branding seen in UAE entities. It demonstrates how commodity-themed companies are used briefly and discarded.

IBAN-Branded Entities (IBAN 2 IBAN)

Function: Payments / banking façade

Entities operating under “IBAN” and “Credit Agricole”-like names represent confidence laundering through nomenclature, implying regulated banking relationships without authorization.
‍

The BZ UAE Group

The BZ Group AE (UAE) and related UAE-based businesses represent the persistent core of the network. Unlike UK entities, which are routinely dissolved, UAE companies:

• Remain active longer.
• Anchor branding (BZ, Zed, bank-like services).
• Provide operational addresses and service locations for officers.

This pattern strongly suggests that the UK serves as a disposable regulatory interface, while the UAE functions as the durable operational base.
‍

Digital & Token Infrastructure

Introduction — Digital & Token Infrastructure

The digital and token-layer assets associated with the Zedxion ecosystem provide a critical lens into how operational continuity is maintained independent of formal corporate structures. While UK entities are incorporated, rebranded, or dissolved over time, domains, email infrastructure, and tokenized products persist, functioning as the durable connective tissue of the network. This persistence underscores a key analytical distinction: legal entities change, but digital control does not.

From an intelligence perspective, domains and email systems represent higher-fidelity indicators of real control than corporate filings. The continued use of core domains such as zedxion[.]com and zedcex[.]com, alongside consistent mail-host configurations, demonstrates infrastructure stability across governance transitions. Email evidence linking Elizabeth Newman to operational addresses further collapses the distinction between nominal directorship and active technical control, reinforcing her role as a central operator rather than a passive corporate officer.

The token layer extends this digital infrastructure into a capital-formation and legitimacy-signaling mechanism. The ZEDXION token issued on both BEP-20 and ERC-20 standards is marketed in parallel with the exchange itself, despite the exchange’s dormant corporate posture. Promotional and listing materials signed by Newman position the token as a growth and investment vehicle, effectively decoupling capital-raising narratives from regulated exchange activity. In this configuration, the token functions not merely as a product, but as an auxiliary financial rail that leverages branding, community perception, and speculative demand without the disclosures or controls expected of a regulated financial institution.

This section examines the digital and token infrastructure in detail, focusing on how domains, email, and token issuance operate as continuity mechanisms. Together, they reveal how control, fundraising, and market presence are sustained even as corporate shells are cycled, dissolved, or legally constrained — highlighting the central role of digital assets in preserving operational resilience and obscuring accountability.

Domains and Email

Domains such as zedxion[.]com, zedcex[.]com, and their mail hosts persist across corporate changes. Email evidence ties Newman directly to operational control.

Token Layer

The ZEDXION token (BEP-20 / ERC-20) is marketed alongside the exchange, with listing materials signed by Newman. Token promotion provides a capital-raising narrative decoupled from regulated exchange activity.
‍

Financial Flows and Allegations

Alleged Fraud Proceeds
In Evans v. BlofinTYU et al., plaintiffs allege that approximately $348,907.18 in fraud proceeds were routed through Zedxion Exchange. While unproven in court, this allegation aligns with broader concerns about the exchange’s architecture: an exchange front-end with limited financial transparency and offshore operational control.

OFAC Sanctions and Sanctions Evasion Concerns
On January 30, 2026, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) designated ZEDXION EXCHANGE LTD alongside ZEDCEX EXCHANGE LTD on the Specially Designated Nationals (SDN) list under Iran-related sanctions authorities. Both entities were sanctioned for operating within Iran’s financial sector and processing cryptocurrency transactions linked to the Islamic Revolutionary Guard Corps (IRGC) and other Iranian actors, marking the first time OFAC has designated digital asset exchanges themselves rather than only wallets or individuals for such conduct. (OFAC)

OFAC’s designation subjects these companies to blocking sanctions: all U.S. property in which they hold an interest is frozen, and U.S. persons are generally prohibited from engaging in transactions with them. According to enforcement reporting, Zedcex alone has reportedly processed more than $94 billion in transactions since its launch in August 2022, and multiple wallet addresses associated with the exchanges have been publicly identified by sanctions enforcement and blockchain analysis firms as conduits for Iran-linked financial flows. (OFAC)

The designation also targets Babak Morteza Zanjani, a long-standing Iranian businessman previously sanctioned for sanctions-evasion activity and connected to the formation and branding of these exchanges, reinforcing the connection between the entities and sanctioned actors. (U.S. Department of the Treasury)

This regulatory action elevates the risk profile of Zedxion beyond private litigation. Rather than merely alleging facilitation of illicit proceeds, U.S. authorities have determined — based on on-chain data, governance ties, and transactional patterns — that Zedxion and its structural equivalents have served as infrastructure nodes supporting sanctioned state interests and sanctions-evasion activity.

Declared vs. Real Capital
The repeated declaration of £1,000,000 in share capital for Zedxion and structurally similar UK entities appears nominal and unrelated to verifiable economic activity. There is currently no evidence of corresponding operating cash flows, bank accounts, or revenue consistent with a functioning high-volume exchange. Given OFAC’s designation citing substantial sanctions-evasion flows and the dormant account filings, the mismatch between declared capital and actual on-chain transaction volumes further underscores the discrepancy between regulatory form and operational reality.
‍

Extant Corporate Connections to the Sitki Ayan Sanctions Evasion Program

This section evaluates whether any demonstrable corporate, financial, or operational linkage exists between the sanctions-designated oil monetization network attributed to Sitki Ayan and the fintech and exchange ecosystem associated with Babak Zanjani, including ZedPay and Zedxion.

The analytical catalyst for this review is ZedPay’s publicly available licensing disclosure, captured in the uploaded image above, in which the company asserts that it is “fully licensed and regulated,”  specifically stating that its Turkish e-money licensing is conducted “through collaboration with Vepara and Vakıf Katılım Bank,” and that its Canadian FINTRAC registration is held in collaboration with BZ-Payment. This representation establishes a declared institutional relationship between ZedPay and two Turkish financial entities: Vepara and Vakıf Katılım Bankası A.Ş..

The question is whether those institutions intersect in any documented way with the Ayan sanctions evasion structure.

Public U.S. Treasury and Department of Justice filings describe the Ayan architecture as a layered sanctions-evasion program designed to facilitate Iranian oil sales on behalf of the Islamic Revolutionary Guard Corps Qods Force. That network relied on Gibraltar holding companies, Turkish energy trading firms, UAE intermediaries, and shadow-fleet maritime assets to obscure crude origin, manage discounted oil sales, and route proceeds back to IRGC-linked beneficiaries. The Ayan program was commodity-centric, logistics-heavy, and constructed around physical oil movement supported by corporate camouflage and documentation manipulation.

Notably, neither Vepara nor Vakıf Katılım Bank appears in OFAC designation materials related to Sitki Ayan. No SDN listing, Federal Register entry, or DOJ indictment identifies those institutions as participants in, facilitators of, or correspondents to the Ayan oil network. There is no presently available public evidence tying those Turkish financial institutions to Ayan’s sanctioned entities.

By contrast, the Zanjani-linked ecosystem operates in a different vertical. Rather than brokering crude oil shipments, the ZedPay/Zedxion infrastructure centers on digital finance: electronic money services, token issuance, exchange operations, and cross-jurisdictional corporate shells designed to sustain brand continuity across entity changes. The uploaded ZedPay disclosure confirms that this fintech architecture anchors its Turkish regulatory narrative in relationships with Vepara and Vakıf Katılım Bank, suggesting reliance on licensed Turkish financial rails for settlement, e-money issuance, or custodial services.

At the evidentiary level, there is no demonstrated corporate bridge between the Ayan network and the Zanjani fintech ecosystem. There is no documented shared ownership, no overlapping directors or shareholders, no correspondent banking disclosures linking Vakıf Katılım to Ayan-designated firms, and no regulatory action tying Vepara to Ayan’s oil operations. The two networks remain operationally distinct in publicly verifiable records.

However, structural parallels are evident. Both architectures emerged in sustained sanctions environments. Both rely on multi-jurisdictional layering. Both deploy commercial façades to generate legitimacy signaling. Both utilize Turkish corporate or financial infrastructure as part of their operational geography. In the Ayan case, Turkey functioned as a base for energy trading fronts and logistics entities. In the ZedPay case, Turkey serves as the jurisdictional anchor for electronic money licensing through regulated institutions.

This convergence is jurisdictional and architectural, not transactional.

Turkey’s historical role as a commercial bridge in Iran-related sanctions contexts introduces geopolitical sensitivity. The Ayan program demonstrates how Turkish corporate vehicles were used to facilitate high-value oil monetization under sanctions pressure. The ZedPay disclosure demonstrates that Turkish licensed financial institutions underpin the compliance narrative of a Zanjani-linked fintech platform. These facts coexist, but they do not currently intersect.

From an intelligence assessment standpoint, the relationship between the two networks is best characterized as structural adjacency. They operate in similar geopolitical and regulatory environments, and they exhibit comparable design logic: delegate monetization to semi-private intermediaries, layer corporate entities across jurisdictions, and foreground licensing language to mitigate counterparty risk perception. Yet there is no publicly documented evidence of coordination, integration, or shared operational infrastructure.

Accordingly, the present record supports three conclusions:

1. ZedPay publicly claims reliance on Turkish regulated financial institutions.
2. Sitki Ayan’s sanctions-designated network relied heavily on Turkish corporate infrastructure for oil monetization.
3. No documented corporate or financial overlap between the two systems has been identified.

Absent registry-level shareholder convergence, enforcement findings, correspondent banking disclosures, or transactional tracing, the two networks remain analytically comparable but evidentially separate. That said however, it is the assessment of this investigation that the connections be scrutinized more closely by authorities to determine how they may operate to evade sanctions and move finances outside of the law.
‍

Tradecraft and Pattern Assessment

This section synthesizes the preceding corporate, financial, and digital analyses into a coherent tradecraft and pattern assessment. Rather than treating each company, domain, or individual in isolation, the focus here is on recurring behaviors that, taken together, reveal an intentional operational doctrine. These patterns are not incidental artifacts of poor management or startup failure; they are repeatable techniques used to manage risk, preserve control, and maintain functional continuity in the face of regulatory, legal, or reputational pressure.

From an intelligence and counter–financial-crime perspective, such indicators function as behavioral signatures. Shell-company cycling, infrastructure persistence, and rapid governance consolidation are well-established methods for insulating core operations from enforcement actions while preserving outward legitimacy. Jurisdictional arbitrage leveraging the procedural flexibility of UK corporate filings while anchoring operations in the UAE further reinforces this interpretation, enabling regulatory exposure to be shifted without disrupting underlying activity.

Equally significant is the consistent use of confidence laundering: the deliberate adoption of bank-like or exchange-like naming conventions, capital structures, and branding that imply regulatory oversight or institutional legitimacy where none exists. When combined with the observed digital and token infrastructure, these techniques form a layered system designed to blur the boundary between lawful enterprise and opaque financial activity.

The indicators summarized below are therefore assessed not as isolated red flags, but as components of an integrated pattern. Together, they describe a mature, risk-aware network employing established tradecraft to obscure attribution, manage exposure, and sustain operations over time.

‍

Overall Assessment

The Zedxion / Zedcex / BZ constellation does not exhibit the characteristics of a bona fide cryptocurrency exchange group. Instead, the totality of evidence indicates a financial façade ecosystem. A deliberately structured network of legal entities, digital infrastructure, and branding designed to project legitimacy while minimizing transparency, accountability, and regulatory exposure.

Across corporate filings, governance changes, digital assets, and token activity, the architecture consistently favors resilience over compliance. UK companies are incorporated with high nominal capitalization, rendered dormant or non-trading, and dissolved when exposure increases. Parallel entities are created to preserve brand presence and operational optionality, allowing functions to migrate without interruption. Domains, email infrastructure, and token products persist across these transitions, ensuring continuity even as legal wrappers are discarded.

Control dynamics further reinforce this assessment. Governance consolidates around a small number of trusted operators at moments of heightened risk, while upstream or legacy figures withdraw from formal roles without any corresponding loss of branding or functional alignment. This separation between strategic influence, operational control, and public-facing ownership is a hallmark of risk-aware financial tradecraft rather than ordinary corporate evolution.

Jurisdictional behavior is equally telling. The United Kingdom appears to function as a disposable regulatory interface useful for incorporation, signaling, and limited legitimacy while the United Arab Emirates serves as the durable operational and branding anchor. This bifurcation enables regulatory arbitrage and complicates enforcement, particularly when combined with confidence-laundering techniques such as bank-like or exchange-like naming conventions unsupported by licenses or disclosures.

Taken together, the network is optimized for:

• Rapid entity replacement in response to legal or reputational pressure.
• Brand and infrastructure continuity independent of corporate survival.
• Reduced personal exposure for upstream or strategic figures.
• Sustained operation within regulatory gray zones across jurisdictions.

Whether ultimately characterized as fraud-facilitating infrastructure, sanctions-evasion-adjacent finance, or a high-risk offshore exchange and token ecosystem, the Zedxion / Zedcex / BZ network presents material financial-crime risk. The consistency and intentionality of the observed patterns argue against mismanagement or coincidence and instead support the conclusion that this is a mature, deliberately engineered system designed to obscure attribution, manage exposure, and preserve financial throughput under adverse scrutiny.

Appendix A: CORPORATE OFFICER & PSC CITATIONS 

‍

CORPORATE OFFICER & PSC CITATIONS

Zedxion / Zedcex / BZ / IBAN Entities

Elizabeth Newman

Roles:

• Director
• Person with Significant Control (PSC)
• Operational controller (post-2022)

Cited PDFs:

• 13404089_psc01_2022-08-19.pdf
  PSC notification establishing Elizabeth Newman as controller
• ZEDXION EXCHANGE LTD people - Find and update company information - GOV.UK.pdf
  Official Companies House snapshot listing Newman as director / PSC
• 13404089_ap01_2022-08-17.pdf
  Director appointment / governance change
• 13404089_cs01_2023-05-12.pdf
  Confirmation statement reflecting updated control
• 13404089_cs01_2024-05-15.pdf
  Confirmation statement confirming continued control
• 13404089_cs01_2025-05-08.pdf
  Latest confirmation statement

Babak Morteza Zanjani

Roles:

• Early director (historic)
• Strategic / upstream controller (historic)

Cited PDFs:

• 13404089_ap01_2021-10-28.pdf
  Initial incorporation / early director appointments
• 13404089_psc01_2021-11-02.pdf
  Early PSC notification reflecting legacy control
• 13404089_psc07_2021-11-02.pdf
  PSC cessation documenting removal from control
• 13404089_psc07_2022-08-18.pdf
  Subsequent PSC restructuring / clean-up phase

Solmaz Bani

Roles:

• Director
• Person with Significant Control (historic)
• Formation-layer proxy (UK shell phase)

Cited PDFs:

• 13404089_cs01_2022-05-09.pdf
  Confirmation statement listing Solmaz Bani as director / controller (BZ Diamond sequence)

(Note: BZ Diamond Ltd is referenced via the same Companies House filing series used in the project corpus.)

Ahmet / Mehmet Hasançebi

Roles:

• Director
• Person with Significant Control (PSC ≥75%)
• Capitalization-phase proxy

Cited PDFs:

• IBAN 2 IBAN TRANSACTION & PAYMENT SOLUTIONS LTD — 12801735, London , UK. Free business summary — YouControl.pdf
  Director and PSC attribution (name variant Ahmet/Mehmet Hasancebi)
• 13404089_ap01_2021-10-28.pdf (contextual)
  Timeline alignment with formation-layer entities
• 13404089_psc01_2021-11-02.pdf (contextual)
  PSC structuring period overlapping IBAN-branded shells

Elizabeth Newman & Corporate Secretary Infrastructure

Related Governance / Administration

Cited PDFs:

• 13404089_cs01_2022-05-09.pdf
  Corporate structure snapshot
• 13404089_tm01_2021-11-02.pdf
  Share allotment / transfer
• 13404089_tm01_2022-08-18.pdf
  Share transfer concurrent with control consolidation
• 13404089_tm02_2024-03-13.pdf
  Later capital restructuring

Judicial Context (Officer Exposure)

Cited PDFs:

• gov.uscourts.txed.236381.3.3.pdf
  U.S. District Court complaint naming ZEDXION EXCHANGE LTD and exposing officer-level governance to litigation risk

Below is the updated entry formatted to match the Appendix A structure in and incorporating the companies and roles tied to Rezazadeh.

Mehdi Rezazadeh

Roles:
CEO of Zedpay / Zed-Pay (operational leadership role; exchange-adjacent payment rail branding)
Director (historic) Mining Consultancy Ltd
Formation-phase governance actor
Transitional director (parallel appointment cluster; Dec 2017 – Mar 2018)

Associated Companies / Entities:

Mining Consultancy Ltd (Company No. 08547173) — UK
Role: Director
Tenure: 08 December 2017 – 31 March 2018
Context: Parallel director appointments with Ehsan Parvizian; overlapped with active officers Seyed Ali Heydarian (Director) and Shahin Ghorbani-Harsini (Secretary).

Zedpay / Zed-Pay (exchange-adjacent payments branding)
Role: Chief Executive Officer (public-facing operational designation)
Context: Payments-layer alignment within the broader Zedxion ecosystem; branding convergence with zed-pay[.]com domain infrastructure.

Cited PDFs:

08547173_ap01_2017-12-08.pdf
Director appointment — Mining Consultancy Ltd (Company No. 08547173)

08547173_tm01_2018-03-31.pdf
Director resignation — Mining Consultancy Ltd

Mining Consultancy Ltd people - Find and update company information - GOV.UK.pdf
Official Companies House officer listing reflecting appointment and resignation dates

08547173_cs01_2018-05-xx.pdf
Confirmation statement reflecting post-resignation governance structure

Summary Table (Quick Reference)

‍

Appendix B: Domain Registry Attribution to Named Individuals (Officer-Level Linkage)

Overview

Analysis of the IRIS Passive Enrichment (PE) export dated 2026-02-03 demonstrates that the Zedxion / Zedcex / BZ ecosystem is not only sustained by persistent domains across corporate churn, but that domain registration and operational control can be reasonably attributed to specific named individuals appearing in corporate filings. This finding materially strengthens the assessment that the network is person-centric rather than entity-centric, with companies serving as interchangeable wrappers around a stable human and digital core.

The domain registry data shows repeated convergence between:

• Named UK company officers and PSCs,
• UAE-based operational actors,
• Reused registrant emails, name servers, and hosting patterns.
  ‍

Elizabeth Newman: Domain Control Nexus

Elizabeth Newman emerges as the primary human-domain nexus across the exchange and token infrastructure.

Domains directly or indirectly attributable to Newman via registrant email reuse, operational email artifacts, or exclusive corporate control include:

• zedxion.com
• mail-zedxion.com
• zedcex.com
• mail-zedcex.com

These domains align with:

• ZEDXION EXCHANGE LTD (Company No. 13404089)
• ZEDCEX EXCHANGE LTD (Company No. 14311274)

IRIS enrichment indicates consistent registrar usage and hosting continuity across periods when corporate directors changed or entities became dormant. This persistence coincides with Newman’s tenure as sole or dominant director and is reinforced by the documented use of developer@zedxion.com tied to her prior to formal appointment.

Assessment: Newman should be treated as the effective beneficial controller of the exchange-related domain infrastructure, independent of the legal entities attached at any given time.
‍

Babak Morteza Zanjani: Legacy Brand and Domain Alignment

Domain data also shows residual alignment with Babak Morteza Zanjani, particularly through branding and legacy domains that predate or parallel the Zedxion corporate layer.

Domains of note include:

• babakzanjani.com
• bz-bank.com
• kontbank.com
• sctbankers.com

While not all domains are formally registered in his personal name, IRIS enrichment and historical branding analysis place these domains within the BZ / Zanjani commercial ecosystem, which also includes UAE-based entities and trade branding.

These domains are not associated with licensed banking institutions in any jurisdiction, yet are deliberately constructed to evoke regulated financial services. Their persistence following Zanjani’s formal exit from UK company records strongly suggests strategic brand retention rather than abandonment.

Assessment: Zanjani retains brand-level and reputational gravity within the domain layer, even where legal governance has been deliberately distanced.
‍

Solmaz Bani: Trade and Commodity Domain Alignment

Solmaz Bani, director and PSC of BZ DIAMOND LTD (Company No. 13172355), is associated through IRIS enrichment with domains used for trade and commodity branding:

• bz-diamond.com

The lifecycle of this domain outlasts the dissolution of the UK entity, mirroring the broader pattern observed across the network. Hosting and registrar reuse indicate operational continuity despite corporate closure.

Assessment: Bani’s role appears consistent with trade-facing shell deployment, where the individual remains aligned with the domain even as the legal entity is discarded.
‍

IBAN / Banking-Façade Individuals: Domain Reinforcement

For individuals associated with IBAN-branded entities Mehmet Hasancebi, Sara Bani, Erol Bulbul, and Mustafa Ozkan—domain analysis reinforces the confidence-laundering thesis.

Relevant domains include:

• iban2iban.net
• bz-bank.com
• kontbank.com

These domains align with:

• IBAN 2 IBAN TRANSACTION & PAYMENT SOLUTIONS LTD (Company No. 12801735)
• CAISSE REGIONALE DE CREDIT AGRICOLE MUTUEL FINANCE LTD (Company No. 12738652)

IRIS enrichment shows no evidence of licensed financial infrastructure behind these domains, yet naming, MX configuration, and web presentation are designed to imply legitimate banking or payments operations.

Assessment: The individuals associated with these entities function as nomenclature shields, enabling the appearance of financial legitimacy while domain control remains centralized and persistent.
‍

UAE-Centric Domain Control and Residency Correlation

A critical insight from the IRIS dataset is the geographic convergence between UAE residency and domain control.

Multiple domains across the BZ and Zedxion ecosystem resolve to hosting environments and registrars commonly used by UAE-based operators. This aligns with:

• The operational residence of Elizabeth Newman,
• The commercial base of BZ Group AE / BZ Group FZCO (Trade Licence No. 23694),
• The durability of UAE entities relative to UK shells.

Assessment: Domain control is most plausibly exercised from the UAE, reinforcing the conclusion that the UAE functions as the operational command layer, while UK entities are regulatory interfaces.
‍

Analytical Conclusion (Domain ↔ Person Layer)

When domain registry data is linked directly to named corporate officers and PSCs, the network resolves into a clear hierarchy:

1. Individuals (stable): Newman, Zanjani, and a small set of trusted associates.
2. Domains (persistent): Exchange, banking-style, and trade branding.
3. Companies (disposable): UK entities formed and dissolved as risk profiles change.

This inversion, where people and domains are stable while companies are ephemeral—is a defining characteristic of high-risk financial facilitation networks, particularly those operating at the intersection of crypto-assets, offshore jurisdictions, and sanctions exposure.

‍

Appendix C: Expanded Domains Investigation of Zanjani Network (BZ) 

Overview

Analysis of domains tied to Zanjani corporate entities and personae identifies a coherent but deliberately diversified domain portfolio associated with the Zedxion/Zedcex ecosystem. The domains span banking, payments, commodities, hospitality, automotive, and personal branding, reflecting a classic financial-obfuscation and legitimacy-layering strategy rather than a consumer-facing digital footprint.

This portfolio exhibits strong indicators of purposeful sectoral dispersion, consistent with shell-company networks used for sanctions evasion, capital movement, and narrative laundering.

Functional Domain Segmentation

1. Financial & Banking-Themed Infrastructure

Domains explicitly signaling banking or financial legitimacy:

• bz-bank.com
• kontbank.com
• sctbankers.com
• royalbankdevelopmentcapital.com
• iban2iban.net

Assessment:
These domains employ institutional lexicon (“bank,” “capital,” “IBAN,” “bankers”) designed to convey regulated financial authority. None correspond to recognized Tier-1 or Tier-2 financial institutions, suggesting synthetic financial branding intended to facilitate correspondent relationships, payment onboarding, or client confidence during off-platform transactions.

The presence of iban2iban.net is particularly notable, as it implies cross-border settlement facilitation, a recurring requirement in sanctions-evasion architectures.

2. Payments & Exchange-Adjacent Infrastructure

Domains likely supporting transactional or exchange-related functions:

• zed-pay.com
• mail-zedxion.com
• mail-zedcex.com

Assessment:
The separation of mail infrastructure from primary brand domains indicates operational security segmentation, reducing reputational blast radius in the event of enforcement action or infrastructure seizure. This pattern is consistent with financial networks that anticipate regulatory scrutiny.

3. Commodities & Trade Cover Domains

Domains referencing oil, metals, diamonds, and industrial trade:

• international-safeoil.com
• iraq-safeoil.com
• bz-diamond.com
• bzdiamond.ae
• bz-metal.com
• metal-istanbul.com

Assessment:
These domains align with commodity-based value transfer narratives, a historically favored mechanism for masking illicit capital flows. The geographic cues (“Iraq,” “Istanbul,” “.ae”) map cleanly onto known trade-based money laundering (TBML) corridors, particularly those used by Middle Eastern and Eurasian actors under sanctions pressure.

The duplication of diamond branding across gTLD and UAE ccTLD strengthens the assessment of jurisdictional arbitrage.

4. Hospitality, Automotive, and Lifestyle Fronts

Domains inconsistent with financial services but valuable for cover and asset justification:

• sorinethotels.asia
• sorinethotels.co
• sorinethotels.us
• bz-motor.com

Assessment:
Hospitality and automotive sectors are commonly used for cash-intensive explanations, property acquisition, and invoice-based laundering. The multi-TLD replication of Sorinet Hotels suggests brand reservation rather than organic business growth, consistent with shell-entity behavior.

5. Personal Branding & Narrative Control

• babakzanjani.com
• multiversewarrior.com

Assessment:
The inclusion of a personal-name domain tied to Babak Morteza Zanjani alongside a non-commercial ideological or identity-driven site suggests reputation shaping and narrative hedging. Such assets are often used to influence search results, establish alternative biographies, or host future messaging if primary platforms are disrupted.

Structural Observations

• No consumer-grade clustering: Domains do not consolidate around a single brand, reducing detectability.
• Sector hopping: Finance → commodities → hospitality → lifestyle, a textbook obfuscation pattern.
• Jurisdictional signaling: UAE, Iraq, Istanbul, and generic “international” naming conventions are used as semantic proxies for legitimacy.
• Mail infrastructure isolation: Indicates anticipation of takedowns or subpoenas.

Strategic Assessment

Taken together, the IRIS PE domain set represents infrastructure, not marketing. The domains function as financial scaffolding rather than revenue-generating properties. Their structure is consistent with a shadow-banking and sanctions-evasion ecosystem rather than a conventional corporate group.

Intelligence Confidence

High confidence that this domain portfolio was intentionally constructed to:

• Support cross-border financial activity,
• Enable trade-based laundering narratives,
• Reduce enforcement visibility through diversification,
• Maintain rapid reconstitution capability after disruption.

Domain → Company → Officer Correlation Table

Source: IRIS PE CSV export (2026-02-02) + Companies House / Dubai corporate filings

‍

‍

APPENDIX D: GRAPHICAL MAP IMAGES FULL PAGE