A Tech Transparency Project investigation has found that X, the platform formerly known as Twitter, is providing premium, paid services to accounts for two leaders of a U.S.-designated terrorist group and several other organizations sanctioned by the U.S. government.

TTP identified more than a dozen X accounts for U.S.-sanctioned entities that had a blue checkmark, which requires the purchase of a premium subscription. Along with the checkmarks, which are intended to confer legitimacy, X promises a variety of perks for premium accounts, including the ability to post longer text and videos and greater visibility for some posts.

The accounts identified by TTP include two that apparently belong to the top leaders of Lebanon-based Hezbollah and others belonging to Iranian and Russian state-run media. The fact that X requires users to pay a monthly or annual fee for premium service suggests that X is engaging in financial transactions with these accounts, a potential violation of U.S. sanctions.

A blue checkmark account that bears the name and profile image of Hassan Nasrallah, the secretary-general of Hezbollah, also indicates it is “ID verified,” a service that X offers to premium subscribers as a way to prevent impersonation. X requires users to submit a government-issued ID and a selfie to get verified in this way, though it is unclear if Nasrallah did so. X says these accounts get “prioritized support.”

Two other accounts for U.S.-sanctioned entities, Iran’s Press TV and Russia’s Tinkoff Bank, had gold checkmarks. A gold checkmark indicates the account is a “Verified Organization,” and at the time of TTP’s research, cost $1,000 per month. (X has since introduced a Basic tier that costs $200 per month.) Gold checkmark accounts get all the benefits of X’s Premium+ tier plus a $1,000 ad credit per month.

The individuals and organizations associated with these accounts are listed by the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) as “Specially Designated Nationals” subject to economic sanctions. TTP identified an additional four blue checkmark accounts linked to the government of Iran, which is under multiple U.S. sanctions.

For years, Twitter, as X was previously known, allowed U.S.-sanctioned individuals and entities to use free accounts on the platform, an arrangement that some legal experts said was permissible under U.S. sanctions law. But by providing a premium, paid service to sanctioned entities, X may be raising new legal issues.

According to OFAC, U.S. nationals and “U.S. incorporated entities” are prohibited from engaging in transactions with sanctioned entities unless they receive a license, or waiver, from the government. The prohibited activity includes the “making of any contribution or provision of funds, goods, or services by, to, or for the benefit of any blocked person and the receipt of any contribution or provision of funds, goods, or services from any such person.”

It isn’t publicly known if X has sought or received waivers for any of the accounts detailed in this report. But X’s own policies state that its premium services, which include the blue checkmark, are off limits to U.S.-sanctioned entities, including those under OFAC sanctions.

X owner Elon Musk has gifted blue checkmarks to some celebrities in the past, and X at one point reportedly planned to drop verification fees for top advertisers and most-followed organizations. It seems unlikely that X has given people connected to Hezbollah or Iran free blue or gold checkmarks, but even if it has, the sanctions may still apply. OFAC prohibits the “contribution or provision” of services “for the benefit of any blocked person”—language that indicates the sanctions apply regardless of whether fees are involved.

TTP’s investigation also found that some checkmark accounts associated with U.S.-sanctioned entities had ads running in the replies to their posts, raising the possibility that they could get a cut of that ad revenue. If any of the accounts identified by TTP did participate in this revenue sharing, that would raise further questions about sanctions violations by X.

Asked about the accounts identified by TTP, an X representative said he would look into it but did not provide a comment.

Hours after this report was published, X removed all of the checkmarks mentioned in the report and suspended one account for the Iranian-sponsored militia Harakat al-Nujaba. Among those losing blue checkmarks were accounts for Hezbollah leader Hassan Nasrallah and Houthi rebels in Yemen.

Days later, X suspended nine of the accounts, including the Nasrallah account and accounts for Hezbollah's news site Al-Ahed; the Houthis (Ansarallah) and the Houthi television channel Al-Masirah; Iran's Al-Alam news network; and Mizan, the official news agency of the Iranian judiciary.

On X, blue checkmarks indicate that an account has paid for X’s Premium or Premium+ service tier. The Premium tier costs $8 per month or $84 annually, and Premium+ costs $16 per month or $168 annually. (X also offers “local” prices in other currencies.) These premium accounts have the ability to edit posts; post longer text and videos; and get an algorithmic boost for their reply posts. Premium+ subscribers also get access to X’s new AI-powered chatbot, Grok.

Gold checkmarks indicate an account has paid X to be a “Verified Organization.” At the time of TTP’s research in November-December 2023, X charged users $1,000 per month to be a Verified Organization, giving them access to all of the benefits of X Premium+ and a $1,000 ads credit. In January 2024, X introduced a second, Basic tier for Verified Organization status, costing $200 per month. Current X policy states that the $1,000-per-month tier, now called “Full Access,” receives $1,000 in ads credits every 30 days “for a limited period of time.”

X has made clear that “legacy” verified accounts that got a blue checkmark under the platform’s old system, which distributed them to notable individuals and organizations for free, now have to subscribe to premium service to retain the checkmarks. X said it began “winding down” the legacy verification program on April 1, 2023.

X’s rules for blue checkmark accounts state, “You may not purchase X Premium if you are a person with whom X is not permitted to have dealings under US and any other applicable economic sanctions and trade compliance law.” X’s Purchaser Terms also expressly prohibit sanctioned entities from accessing the platform’s paid services:

X users who pay for Premium or Premium+ service can receive a share of the revenue from ads displayed in the replies to their posts. These accounts must meet a certain threshold of organic impressions and number of followers to be eligible. X’s terms for the ad revenue sharing program specify that entities sanctioned by OFAC may not participate.

Of the 28 X accounts identified by TTP, 18 show they got verified after April 1, 2023, when X began requiring accounts to subscribe to paid plans to get a checkmark. The other 10 were legacy verified accounts, which are required to pay for a subscription to retain their checkmarks.

TTP also found advertising in the replies to posts in 19 of the 28 accounts.

Below are blue and gold checkmark accounts identified by TTP. The follower counts were collected on Feb. 13, 2024.

The following four entities are “Specially Designated Nationals” subject to Global Terrorism Sanctions Regulations and “secondary” Hizballah Financial Sanctions Regulations. (See program details here.) “Secondary sanctions” apply to parties outside U.S. legal jurisdiction. Hezbollah is also a U.S.-designated foreign terrorist organization.

Hassan Nasrallah, the leader of Lebanon-based Hezbollah, appears to have a blue checkmark account. The account’s handle is @SH_NasrallahEng and features photos of Nasrallah in its banner image and profile photo. The account, which has 93,600 followers, posts English-language Hezbollah messages and memes disparaging Israel and the U.S. It was created in October 2021 and verified in November 2023, the same month that Nasrallah threatened further escalation of Israel’s war with Hamas. In early December 2023, the account had a pinned post at the top of its feed with the message, “We are coming…..” over a Hezbollah video of rocket fire and militants firing weapons. The post featured ads in the reply section.

The @SH_NasrallahEng account also indicates it is “ID verified,” a service that X offers to premium subscribers who send the platform an image of a government-issued ID and a selfie. X says the service, which is only available to individual users, can help “prevent impersonation” and allow accounts to “benefit from increased trust.” ID-verified accounts receive “prioritized support” and may be eligible for future benefits such as “greater flexibility” in making changes to their account information.

In addition to the sanctions programs listed at the top of this sub-section, Nasrallah is also subject to Syria sanctions, according to OFAC’s sanctions database.

Naim Kassem, Hezbollah’s second in command, appears to have a blue checkmark account, @shnaimkassem, that was created in July 2022. At the time of TTP's research, the account showed it was verified in November 2023 and featured ads in the replies to its posts. (The account now shows it was verified in January 2024.) The account profile states in Arabic that it is the “official account of His Eminence Sheikh Naeem Qassem” and has 47,700 followers. It is one of the nine accounts followed by the Nasrallah-linked account described above. Kassem is listed as a Specially Designated National in OFAC’s sanctions database.

Hassan Moukalled, described by the U.S. Treasury Department as a key Hezbollah money exchanger, appears to have a blue checkmark account, @hasmokaled, that was created in July 2016 and verified in May 2023. The @hasmokaled account has 55,300 followers and featured ads in the replies to its posts. Moukalled was sanctioned by the U.S. along with his company CTEX in January 2023. (He has denied that he or his company have financial ties to Hezbollah.) A London-based defense and security think tank, the Royal United Services Institute, identified the @hasmokaled account as belonging to Moukalled in a May 2023 report.  Moukalled is listed as a Specially Designated National in the OFAC database.

Al-Manar TV, a Hezbollah-linked television operation, has a blue checkmark account, @ProgTvM, that was created in December 2020 and verified in October 2023. The account has 24,100 followers and featured ads in the replies to its posts. Al-Manar’s official Telegram account (linked from its website) promotes the @ProgTvM account on X. The station is listed as a Specially Designated National in the OFAC database. The U.S. Treasury Department has also sanctioned Al-Manar’s parent company, the Lebanese Media Group.

The following two entities appear to be linked to Hezbollah, which is a Specially Designated National and falls under multiple sanctions programs, including Global Terrorism Sanctions Regulations, Foreign Terrorist Organizations Sanctions Regulations, and Syria sanctions, as well as secondary Hizballah Financial Sanctions Regulations.

Al-Ahed has been identified in multiple media reports as a Hezbollah news site. It appears to have blue checkmark accounts in Arabic, English, and French.

• The Arabic-language account @alahdnews2, which has 10,900 followers, was created in February 2020 and verified in April 2023. Al-Ahed’s Arabic website links to this account.
• The English-language account, @English_AlAhed, was created in November 2019 and verified in November 2023. Al-Ahed’s English-language site links to this account.
• The French-language account, @AhedFrench, was created in August 2020 and verified in November 2023. Al-Ahed’s French site links to this account.

Resistance Monitor, a blue checkmark account that used the handle @Moqawamah_eng, featured Hezbollah’s official logo as its profile photo, used the hashtag #Hezbollah in its bio section, and posted Hezbollah propaganda videos, pro-Hezbollah messages, and anti-Israel memes. The English-language account, which had more than 16,000 followers, showed it was created in December 2020 and verified in November 2023. The account featured ads in the replies to its posts. X suspended the @Moqawamah_eng account sometime after Dec. 23, 2023. Hezbollah previously used the term “moqawama,” the Arabic word for “resistance,” in a web domain seized by the U.S. Justice Department in May 2023.

Press TV, the English-language satellite channel of Iran’s state broadcaster, Islamic Republic of Iran Broadcasting (IRIB), has an X account with a gold checkmark. The @PressTV account, which has nearly 329,000 followers, was created in September 2010 and verified in August 2016. The fact that the account has a gold checkmark suggests it may be paying X for Verified Organization status. Press TV’s official website links directly to this X account. The account featured ads in in the replies to its posts, including an ad for The Dispatch, a conservative U.S. publication.

Press TV is a Specially Designated National subject to Iran sanctions from a 2018 executive order and secondary sanctions, according to OFAC’s database. IRIB is also a Specially Designated National subject to sanctions under the Iran Threat Reduction and Syria Human Rights Act of 2012 and secondary sanctions.

Palestine Declassified, an English-language show on Press TV, also appears to have an X account with a blue checkmark. The account, @PDeclassified, has 14,100 followers. It was created in January 2022 and verified in April 2023, and featured ads in in the replies to its posts.

Tasnim News Agency is an Iranian news outlet that, according to the U.S. Treasury Department, was founded by two commanders of Iran’s Islamic Revolutionary Guard Corps (IRGC). Tasnim has a blue checkmark account, @Tasnimnews_EN, that was created in August 2013 and verified in April 2015. It has 41,200 followers. The fact that the account has retained its blue checkmark suggests it may now be paying for premium service. Tasnim’s English-language website links directly to this X account.

According to OFAC’s database, Tasnim News Agency is a “Specially Designated National” subject to Iranian Financial Sanctions Regulations, an executive order sanctioning the government of Iran over human rights abuses, and secondary sanctions. The Islamic Revolutionary Guard Corps, a U.S.-designated foreign terrorist organization, is also a Specially Designated National subject to multiple sanctions.

The following two entities are linked to Iran’s state broadcaster, Islamic Republic of Iran Broadcasting (IRIB), which a Specially Designated National subject to sanctions under the Iran Threat Reduction and Syria Human Rights Act of 2012 and secondary sanctions.

Al-Alam, an Arabic news network of the IRIB, has a blue checkmark account. The account, @alalam_arabic, was created in May 2020 and featured ads in the replies to its posts. At the time of TTP's research, the account showed it was verified in September 2023. (It now shows it was verified in January 2024.) The account has 27,300 followers. Al-Alam’s website, which indicates it is an IRIB brand, links directly to this X account.

HispanTV is the Spanish-language news network of the IRIB. HispanTV’s blue checkmark account, @nexo_latino, was created in January 2021 and verified by the platform in June 2023. The account, which has 17,200 followers, featured ads in the replies to its posts. HispanTV’s official website links to this X account.

Harakat al-Nujaba, an Iranian-sponsored militia that has been active in Iraq and Syria, has an X blue checkmark account with the handle @alnoujaba. The account features the militia’s logo as its profile photo and identifies itself, in Arabic, as “The Islamic resistance of ‘Nujaba.’” The English-language account, which has 11,800 followers, shows it was created in August 2020 and verified in November 2023. The militia’s official website links to this X account. The account featured ads in the replies to its posts. One of these ads, which appeared below a Dec. 18 video post of Iranians at a day of mourning for Qassem Soleimani, the Iranian general killed in a U.S. drone strike in 2020, promoted an anti-Hamas message from the government of Israel.

Harakat al-Nujaba is a Specially Designated National subject to Specially Designated Global Terrorist sanctions, according to the OFAC database.

Ansarallah, the Iran-backed Yemeni movement commonly referred to as the Houthis, has a blue checkmark account with handle @ansarollah2. The account shows it was created in March 2015 and verified by X in February 2024, just weeks after the U.S. announced it would designate Ansarallah as a Specially Designated Global Terrorist group over its attacks on shipping in the Red Sea and Gulf of Aden. The account, which has 23,900 followers, features the Ansarallah logo in its profile photo and is directly linked from Ansarallah’s official website. According to OFAC, the sanctions will take effect on February 16, 2024. (By taking this step, the Biden administration is partially reimposing measures it lifted three years ago.)

Al-Masirah, which multiple news reports have identified as a Houthi television channel, has at least four blue checkmark accounts on X. U.S. authorities seized the web domain of Beirut-based Al Masirah as part of a June 2021 crackdown on 33 websites used by Iran’s Islamic Radio and Television Union (IRTVU) and three websites used by the Iran-aligned Iraqi militia Kata’ib Hizballah. (Both IRTVU and Kata'ib Hizballah are Specially Designated Nationals under U.S. sanctions.) Here are details on the X blue checkmark accounts:

• The account @alosbou, which has 785,300 followers, was created in December 2016 and verified in October 2017. It featured ads in the replies to its posts. Al Masirah’s current website was down when TTP conducted its research, but an archived version of the site links to this X account as one of its social media channels.
• The account @ShahidAlmasirah, which has 79,600 followers, was created in December 2021 and verified in March 2023. It featured ads in the replies to its posts. Al Masirah’s official Telegram account points to this X account.
• The account @TvAlmasirah, which has 61,500 followers, was created in November 2022 and verified in July 2023. It featured ads in the replies to its posts. Al Masirah’s official Telegram account points to this X account.
• The account @Mubashermasirah, was created in September 2023 and verified in January 2024. It livestreams Al-Masirah TV videos and Ansarallah speeches. Another Telegram account connected to Al Masirah TV points to this X account.

Al-Saadi Gadhafi, a son of the late Libyan leader Moammar Gadhafi, appears to have a X account with the handle @SaadiQaddafi. The account has a blue checkmark and more than 9,700 followers. It shows it was created in December 2022 and verified in September 2023. The U.S. sanctioned Saadi Gadhafi and other members of the Gadhafi family and regime in March 2011, and he is listed by OFAC as a Specially Designated National subject to Libya-related sanctions. At the time TTP conducted its research in November-December 2023, the @SaadiQaddafi account had one X subscription—to Elon Musk. According to X, “creators” can earn money from subscriptions, though it is not clear if Musk did so in this case. The Gadhafi account appears to have stopped subscribing to Musk sometime in January 2024.

Bashar Sabawi Ibrahim Hasan Al-Tikriti—a son of the Sabawi Ibrahim al-Tikriti, the half-brother and advisor to the late Iraqi leader Saddam Hussein—appears to have a blue checkmark account. The account, which uses the handle @BasharSabaawi70, was created in September 2014 and verified in March 2023. It has 12,600 followers. The U.S. sanctioned Bashar and five of his brothers in July 2005, and he is listed in the OFAC database as a Specially Designated National subject to Iraq-related sanctions.

Sa'd Sabawi Ibrahim Hasan Al-Tikriti, another son of Sabawi Ibrahim al-Tikriti, appears to have a blue checkmark account with the handle @SabawiSaad. The account was created in October 2021 and verified in March 2023, and it featured ads in its replies. The U.S. sanctioned Sa'd in July 2005, and he is listed in the OFAC database as a Specially Designated National subject to Iraq-related sanctions.

NTV is a Russian state-owned television station that has a blue checkmark account, @ntvru, with 1.5 million followers on the platform. The account was created in February 2009 and verified in May 2014, and may have retained its checkmark through an X Premium subscription. An archived version of the NTV website links to the @NTVru account on Twitter (now X) as one of its official social media channels. (Many Russian media outlets have since removed American social media links from their websites after the Kremlin began blocking access to Facebook and X in the country.)

NTV is a “Specially Designated National” subject to Russian Harmful Foreign Activities Sanctions from a 2021 executive order, according to OFAC.

Tinkoff Bank, a commercial bank in Moscow, has an X gold checkmark account. The account, @tinkoff_bank, was created in December 2009 and verified in February 2015. It has 140,000 followers and featured ads in the replies to its posts. The fact that it has a gold checkmark suggests it may be paying X to be a Verified Organization. The Tinkoff Bank website links to @tinkoff_bank on Twitter (now X) as one of its official social media channels.

Tinkoff Bank is a Specially Designated National subject to the same Russia sanctions that apply to NTV. OFAC targeted Tinkoff Bank in July 2023 as part of an effort to degrade Russia’s access to the international financial system due to its invasion of Ukraine.

The following three accounts are not Specially Designated Nationals but appear to be linked to the government of Iran, which is subject to sanctions enforced by OFAC and the U.S. Commerce Department’s Bureau of Industry and Security (BIS). According to U.S. regulations, the government of Iran includes “any entity owned or controlled directly or indirectly” by the government.

OFAC has issued a number of “general licenses” carving out exemptions in the Iran sanctions. One of these pertains specifically to social media and internet services. The general license, issued in September 2022, allowed U.S. tech companies to offer platforms and services to the Iranian people to help them evade digital surveillance and censorship amid widespread anti-government protests. The license also specified that the government of Iran can access such services provided they are “publicly available” and “at no cost.” That appears to rule out U.S. tech companies selling or providing special services to Iranian government entities.

Dolat.ir, the official information website for the government of Iran, has a blue checkmark account, @PadDolat, that was created in June 2014 and verified in February 2017. It has 84,000 followers. X has said that legacy verified accounts must purchase premium service to retain the blue checkmark, which suggests @PadDolat may now be paying the platform for premium. The account featured ads in the replies to its posts. The Dolat.ir government information website links directly to the @PadDolat X account.

The Islamic Republic News Agency (IRNA), a state-run media operation of the government of Iran, has two blue checkmark accounts. One is an Arabic-language account under the handle @IRNA_1313. The account has 79,700 followers and shows it was created in September 2016 and verified in September 2023. It featured ads in the replies to its posts.

The other blue checkmark account is IRNA’s English-language handle, @IrnaEnglish. This account, which has 56,900 followers, was created in December 2016 and verified in September 2017, and featured ads in the replies on its posts. The account also shows it is “ID verified,” the service that X offers to premium subscribers who send the platform an image of their government-issued ID.

The FAQ section on IRNA’s website includes both @IRNA_1313 and @IrnaEnglish in its list of social media accounts.

Mizan is the official news agency of the Iranian judiciary, which is largely controlled by the country’s Supreme Leader, Ayatollah Ali Khamenei. It has a blue checkmark account, @MizanNewsAgency, that was created in August 2016 and verified in May 2023. The account has 18,900 followers and featured ads in the replies to its posts. Mizan Online’s official website directly links to this X account. The Iranian judiciary is part of the government of Iran, which is subject to U.S. sanctions, as is Khamenei, who is on OFAC’s Specially Designated National list.

Note: Updated with X’s removal of all the checkmarks mentioned in this report and suspensions of multiple accounts.