1.24 - Office of Foreign Assets Control (OFAC)

Previous1.22 - Office of the Comptroller of the Currency (OCC)Next1.30 - Federal Reserve Board (the Fed)

Last updated 2 years ago

Was this helpful?

1.24 - Office of Foreign Assets Control (OFAC)

Overview

The Office of Foreign Asset Control is a component of the Department of the Treasury, and operates under the Office of Terrorism and Financial Intelligence. It implements, administers, and enforces sanctions issued to protect U.S. national security and foreign policy. In carrying out that mission, it can impose penalties and fines, freeze assets, and bar parties from operating in the United States. It can also make referrals to the Department of Justice for criminal prosecution.

It is perhaps most well known among financial services firms for maintaining the Specially Designated Nationals and Blocked Persons List (SDN List) that provides a complete list of individuals, entities, and nations with whom it is illegal to transact, designations which it is permitted to make — and which carry the force of law — pursuant to the International Emergency Economic Powers Act (IEEPA), , or the Trading with the Enemy Act (TWEA), , and more recently, , as amended by .

Although perhaps lesser known than agencies like the , , or , it has become increasingly more involved in enforcement actions to protect U.S. interests domestically and abroad by identifying specific virtual currency addresses that are barred from transacting, and more recently, sanctioning an entire exchange and multiple virtual currency mixers. Understanding OFAC's role in the financial infrastructure of the United States is critical for crypto industry players who do business internationally to any extent or who have customer accounts that may attempt to interact with individuals or entities identified on OFAC's SDN list.

Specially Designated Nationals and Blocked Persons List (SDN)

The SDN List is the comprehensive list of all individuals, entities, geographic regions, and countries that OFAC has designated as actors with which U.S. persons may not transact with for any reason. Designation on the list also extends the prohibition to entities that are owned, directly or indirectly, 50% or more by blocked persons. Once OFAC has made the designation, it is immediately illegal to make any contribution or provision of funds, goods, or services by, to, or for the benefit of any blocked person or entity or to receive any contribution or provision of funds, goods, or services from any such person.

Violations of these prohibitions come with strict liability — it does not matter if an individual intends to violate the sanctions or is even aware of them. The simple act of carrying out a transaction with a blocked person or entity potentially carries significant civil fines and criminal penalties. See . It is thus absolutely critical for digital asset businesses to understand how these sanctions work and to have a plan for complying with them to avoid crushing fines and penalties, potentially levied not just against the business but against individual executives directly.

Virtual Currency Addresses

OFAC began its focus on designating terrorist and criminal enterprises engaged in virtual currency activity in late 2018. Those efforts began by targeting specific virtual currency addresses and creators of cryptocurrencies blatantly used for criminal purposes:

Designating two Iranian individuals who helped launder funds through the SamSam ransomware and their associated bitcoin addresses. OFAC, Press Release, (2018.11.28)
Designating two North Korean individuals and their bitcoin addresses associated with the Lazarus Group involved in hacking multiple cryptocurrency exchanges. OFAC, (2020.03.02)
Designating a Chinese individual who launched cryptocurrencies to further criminal enterprises across Southeast Asia. OFAC, (2020.12.09)
Designating ten individuals and two entities associated with Iran’s Islamic Revolutionary Guard Corps (IRGC), and associated bitcoin addresses, for their role in ransomware attacks. OFAC, Press Release, (2022.09.14)

Specific Entities / Markets

It then expanded from individual actors/addresses to entire cryptocurrency enterprises:

Virtual Currency Mixers

More recently, the efforts have increased significantly in intensity by sanctioning not just particular entities or virtual wallet addresses, but protocols known as virtual currency mixers. The mixers are designed to allow transactions to occur anonymously on public blockchains by obscuring the origin and destination of particular amounts of funds. While stemming from the same goals as all of OFAC's other actions, these more recent actions pose vexing questions, including constitutional questions.‌

This initial move by OFAC drew little objection from most observers, perhaps because Blender.io was a custodied protocol with central control. Thus sanctioning of the software was a proxy for the custodians who (presumably) refused to cooperate in changing the protocol to achieve compliance.

This sanction proved to be far more controversial, although not for a reason acknowledged by OFAC itself in its press release. Almost immediately, industry groups protested the sanction as an attack on decentralized protocols generally, which are not controlled by any one person or entity. Hailey Lennon commented:

OFAC merely identified a URL and a series of Ethereum contract addresses. Sanctioning a tool and noncustodial smart contract address that are not a direct alias of any person meriting sanction is substantively different from typical usage of the SDN list," and appeared to fail to acknowledge Treasury's own "clear guidance [via FinCEN] in 2019 [that] stressed the important difference a custodial wallet (hosted) and a noncustodial wallet (unhosted).

Expanding on that point, Coin Center argued:

If a contract is credibly decentralized then the original authors of that contract could be hit by a bus and the service would continue to work. As such, today’s action does not seem so much a sanction against a person or entity with agency. It appears, instead, to be the sanctioning of a tool that is neutral in character and that can be put to good or bad uses like any other technology. . . . It is a ban on a technology and not a sanction against a person.

As others have noted, if there are not legitimate tools in place to spend money anonymously, this could stifle meritorious free speech, access to medical services like abortion, or otherwise legal businesses that bear a social stigma like pornography. As crypto adoption accelerates, solving the balance between privacy and national security will become more critical.

The move by OFAC to sanction the decentralized protocol thus appears to cut off nearly 90% of legitimate funds being moved through an anonymizing tool. In apparent protest of the sanction, one anonymous Twitter user claimed to be sending small amounts of ETH to hundreds of high profile wallets like Coinbase CEO Brian Armstrong and TV host Jimmy Fallon in a practice that became known as "dusting."

Been accumulating a pretty big list of major CT users ETH addresses and their .ens official addresses Withdrawing .1 ETH to all of them from tornado throughout the rest of the day

Despite the industry outcry, until OFAC alters or removes the designation, all U.S. individuals and businesses must be extremely careful in their compliance programs to avoid inadvertent or technical violations of the sanction. Developers of protocols — whether centralized or not — should also take into consideration how compliance features will work to avoid a similar outcome for their work.

entity known as Tornado Cash, which is a “partnership, association, joint venture, corporation, group, subgroup, or other organization” that may be designated pursuant to IEEPA. Tornado Cash’s organizational structure consists of: (1) its founders and other associated developers, who together launched the Tornado Cash mixing service, developed new Tornado Cash mixing service features, created the Tornado Cash Decentralized Autonomous Organization (DAO), and actively promoted the platform’s popularity in an attempt to increase its user base; and (2) the Tornado Cash DAO, which is responsible for voting on and implementing new features created by the developers.

This explanation still leaves open many questions about sanctioning smart contracts, what the permissible uses are of the underlying code of the sanctioned addresses, and whether or how individuals transacting on public distributed ledgers can legally shield their transactions from public view.

Enforcement

Placing individuals and entities (or their aliases) on the SDN List is only the first step. OFAC also has significant enforcement authority to fine entities that violate its sanctions. It has used that authority twice in the crypto space, levying significant fines.

The fine is particularly notable in that it is nearly five times the "$129,000 worth of digital currency-related transactions with BitPay's merchant customers" that violated the sanctions. The agency "emphasize[d] that OFAC obligations apply to all U.S. persons, including those involved in providing digital currency services." Crypto services should also take note that simply screening the SDN List is not sufficient for full compliance. Rather, full-field awareness of user data is necessary to ensure ongoing compliance.

There were 183 apparent violations resulting in a settlement of $98,830; the transactions themselves were valued at only $9,127.79. This apparently was a mitigated penalty based on BitGo's significant cooperation with OFAC and implementation of an OFAC Policy, appointing a chief compliance officer, and screening all accounts against the SDN List.

Guidance

SDN list and geographic screening;
Developing a culture of sanctions compliance, particularly at the senior management level, supported by adequate resources, including a dedicated compliance officer;
Implementing a sanctions compliance plan "during the testing and review process so that sanctions compliance can be accounted for as technologies are being developed and prior to launching a new product";
Conducting routine (and perhaps ongoing) risk assessments "to identify potential sanctions issues the company is likely to encounter";
Making use of all data available about users to effect compliance — including, e.g., IP addresses provided on login not just initial registration, and related geolocation tools;
Transaction monitoring of both historical and ongoing transactions, both for apparent violations and to fully inform the risk assessment;
Know Your Customer (KYC) procedures that collect detailed information about individuals and entities "during onboarding and throughout the lifecycle of the customer relationship."
Depending on the individual/entity, this could include "examining customer transaction history for connections to sanctioned jurisdictions or transactions with virtual currency addresses that have been linked to sanctioned actors." (emphasis added). OFAC also advises that:

[V]irtual currency companies may consider conducting a historic lookback of transactional activity after OFAC lists a virtual currency address on the SDN List to identify connections to the listed address. A lookback could also identify connections to unlisted addresses that have previously transacted with the listed address, as such unlisted addresses could also pose sanctions risk depending on the nature of those transactions. Companies in the virtual currency industry may consider deploying blockchain analytics tools that help identify and mitigate these sanctions risks.

The guidance provides many additional details for implementing an effective OFAC compliance program and crypto industry compliance officials should closely parse its suggestions.

FAQs

OFAC has issued a number of short, plain language frequently asked questions, with easy to follow answers on a number of basic but essential compliance topics. They are organized by category below and are best read directly from the source.

Digital Currency Basics

Customer Relations

Tornado Cash

Specific Territories

Statements & Testimony

Adeyemo stated, however, that "mixing services, darknet markets, and nested exchanges used to launder or cash out illicit funds are at the top of our list of concerns." He concluded by advising virtual currency service providers to include compliance "at the product launch and [to build it] into the fundamental architecture of your companies," and to not wait for the Treasury department to act.

In those remarks, Mandelker warned that bad actors frequently use new methods of value transfer to evade sanctions and that Treasury had already seen extensive efforts on the part of sanctioned entities to both use existing virtual currency channels to evade sanctions and to invent their own (e.g., national digital currencies on the part of Venezuela and Russia). She stressed the need for virtual currency businesses to establish compliance protocols at the foundation of the business, identifying through points:

These sorts of compliance protocols, Mandelker noted, had resulted in FinCEN receiving over 47,000 SARs since 2013 mentioning bitcoin or virtual currency, half which "were filed by virtual currency exchangers or administrators themselves."

Finally, regarding specific compliance with OFAC sanctions, she described four elements of a successful program, which she said must be dynamic and adapt to changing market conditions: (1) a tailored, risk-based program; (2) know-your-customer procedures; (3) preventing transactions with individuals/entities on the SDN List; (4) clear communication to customers.

Index of Sources

Sources are listed in reverse chronological order.

Authors

Previous1.22 - Office of the Comptroller of the Currency (OCC)Next1.30 - Federal Reserve Board (the Fed)

Last updated 2 years ago

Was this helpful?