Crypto Sanctions Compliance: OFAC Requirements for Digital Assets

[cryptolaw_takeaway]OFAC sanctions compliance applies to cryptocurrency transactions without exception. Crypto businesses must screen customers, counterparties, and blockchain addresses against sanctions lists. Recent enforcement actions—including the Tornado Cash designation—demonstrate OFAC willingness to pursue novel sanctions applications in the digital asset space.[/cryptolaw_takeaway]

OFAC Jurisdiction Over Crypto

The Office of Foreign Assets Control administers U.S. economic sanctions programs, which apply fully to cryptocurrency transactions. U.S. persons—including companies operating in the U.S. or with U.S. touchpoints—are prohibited from transacting with sanctioned parties regardless of the payment method.

OFAC has made clear that the underlying technology does not change sanctions obligations. Cryptocurrency transactions with SDN-listed persons, blocked entities, or sanctioned jurisdictions violate U.S. law.

Sanctions Screening Requirements

Crypto businesses must implement sanctions screening programs addressing:

• Customer Screening: Checking customers against SDN List and other sanctions lists at onboarding and periodically
• Transaction Screening: Reviewing counterparties and beneficiaries for sanctions connections
• Address Screening: Using blockchain analytics to identify connections to sanctioned addresses
• Jurisdiction Screening: Blocking access from comprehensively sanctioned countries

OFAC publishes cryptocurrency addresses associated with sanctioned persons, which must be blocked like any other sanctioned property.

The Tornado Cash Designation

In August 2022, OFAC designated Tornado Cash—a decentralized mixing protocol—as a sanctioned entity. This unprecedented action raised fundamental questions about sanctioning software and decentralized protocols.

The designation prohibits U.S. persons from using Tornado Cash or interacting with associated addresses. Legal challenges have questioned OFAC authority to sanction immutable code, with ongoing litigation testing these boundaries.

Enforcement Actions

OFAC has brought enforcement actions against crypto platforms for sanctions violations:

• BitPay (2021): $507,000 settlement for processing transactions with sanctioned jurisdictions
• Bittrex (2022): $24 million settlement (combined with FinCEN) for sanctions and AML failures
• Various Individual Actions: Enforcement against persons using crypto to evade sanctions

Compliance Best Practices

Effective sanctions compliance programs should:

• Screen all customers and transactions against current OFAC lists
• Subscribe to OFAC updates and implement changes promptly
• Use blockchain analytics tools to identify sanctioned address connections
• Block services from comprehensively sanctioned jurisdictions
• Document compliance decisions and maintain audit trails
• Train staff on sanctions obligations and red flags
• Establish escalation procedures for potential violations

The Compliance Challenge

Cryptocurrency presents unique sanctions compliance challenges:

• Pseudonymous transactions complicate counterparty identification
• Mixing services and privacy features obscure transaction history
• DeFi protocols may lack ability to implement traditional screening
• Fast-moving transactions may outpace screening capabilities

Despite these challenges, OFAC expects compliance commensurate with the risks presented. Crypto businesses cannot cite technical difficulty as an excuse for non-compliance.

This article provides general information about OFAC sanctions compliance for cryptocurrency. Sanctions violations carry severe civil and criminal penalties. Consult qualified legal counsel for guidance on your compliance program. Seth Goettelman is licensed in Wisconsin and Florida.