Introduction
In recent years, economic sanctions have become an increasingly important U.S. foreign policy tool and the digital asset industry has become a key focus of sanctions regulators and prosecutors. Regulators and courts have been clear that U.S. economic sanctions laws apply to digital assets, but a number of questions remain regarding the application of economic sanctions to certain digital asset contexts, and the nature of blockchain technology can create complex compliance challenges that are not present in the fiat context.
This chapter provides a high-level background on U.S. economic sanctions generally and then discusses how those sanctions have been applied to digital assets. It also provides a summary of key sanctions enforcement actions in the digital asset industry and discusses compliance expectations and challenges specific to the industry.
OFAC sanctions background
In the United States, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) is the regulatory agency with primary responsibility for implementing U.S. economic sanctions programmes. OFAC is also responsible for civil enforcement while criminal enforcement is conducted by the Department of Justice (DOJ).
U.S. sanctions can be divided into two general categories: primary sanctions; and secondary sanctions. Primary sanctions are applicable to transactions and activities with a U.S. nexus, including transactions and activities occurring in the United States or in which U.S. persons, including individuals and entities, are involved. U.S. secondary sanctions typically apply to conduct undertaken by non-U.S. persons, even if there is no direct U.S. nexus, where the U.S. government has determined that the conduct is counter to a U.S. national security or foreign policy interest.
Primary sanctions
Primary sanctions can apply to specific persons, specific industries or sectors, or to entire countries or regions. The sanctions can also vary in terms of the relevant prohibitions, with some sanctions prohibiting nearly all activity involving the sanctions target and the United States or U.S. persons, wherever located. Other sanctions prohibit a narrower range of conduct, such as certain dealings in debt or equity of the sanctions target.
The United States currently maintains a comprehensive sanctions regime against Cuba, Iran, North Korea, Syria, the Crimea region of Ukraine, and the so-called Donetsk People's Republic (DNR) and Luhansk People's Republic (LNR) regions of Ukraine. U.S. persons are broadly prohibited from dealing with those jurisdictions in any capacity, absent a specific exemption or a licence authorising the conduct in question. Other jurisdictions, such as Russia and Venezuela, are subject to a broad array of sanctions, but are not subject to the same comprehensive measures applicable to the jurisdictions listed above.1
Persons (including entities and individuals) can be targeted by sanctions under a variety of different sanctions programmes and can be identified on a number of lists published by OFAC. The most significant of these lists is the Specially Designated Nationals and Blocked Persons List (SDN List).2 When a person appears on the SDN List, the property and interests in property of such person must be "blocked" (i.e., frozen) when within the United States or the possession or control of a U.S. person, and U.S. persons are generally prohibited from dealing with specially designated nationals (SDNs). Entities owned 50% or more by one or more SDNs are also considered blocked.
Persons can be added to the SDN List for a broad range of conduct, such as human rights abuses, corruption, nuclear proliferation, engaging in destabilising activity in certain regions, and undermining the democratic nature of certain regimes, among many other activities.
Primary sanctions are a "strict liability" regime, meaning that no knowledge or intent is needed for a civil violation to arise. Criminal violations can arise only from wilful conduct.
Secondary sanctions
Secondary sanctions authorise the imposition of sanctions against persons determined to engage in "sanctionable" conduct. The most common type of secondary sanction is inclusion on the SDN List. However, a range of other sanctions can be imposed. Sanctionable conduct can include a variety of activities; for example, providing material support or goods or services to certain SDNs or "knowingly" engaging in a "significant transaction" for or on behalf of "any person subject to sanctions imposed with respect to the Russian Federation".3
OFAC has significant discretion in deciding when to impose secondary sanctions and, generally speaking, is most likely to impose such sanctions where the relevant conduct is both knowing (including having a reason to know) and "material" or "significant" (in certain cases, satisfaction of those elements is a legal requirement for the imposition of secondary sanctions).
OFAC sanctions and digital assets
OFAC guidance indicates that the agency interprets its regulations broadly with regard to digital assets and treats digital assets in largely the same manner as fiat currency. For example, OFAC FAQ 560 states that the OFAC compliance obligations for digital currency transactions and fiat currency transactions are the same, and goes on to explain, "US persons and persons otherwise subject to OFAC jurisdiction, including firms that facilitate or engage in online commerce or process transactions using digital currency, are responsible for ensuring that they do not engage in unauthorized transactions prohibited by OFAC sanctions".4
Blocked wallet addresses
OFAC now routinely identifies digital asset wallet addresses as blocked property of SDNs and publishes those wallet addresses in the relevant SDN List entry. Bitcoin wallet addresses form the majority of these wallets, but OFAC has begun identifying wallet addresses associated with a number of other digital assets as well.
Importantly, a wallet address may constitute or contain blocked property regardless of whether it is identified on the SDN List. OFAC's inclusion of an identified wallet in an SDN List entry is intended to assist industry by publicly identifying the wallet address, but any wallet in which an SDN has a property interest must be blocked, regardless of whether the wallet has been identified by OFAC.
Procedures to block crypto assets
OFAC FAQ 646 provides guidance on how persons holding digital assets required to be blocked by OFAC regulations should handle those assets.5 According to OFAC, an institution may choose, for example, to block each digital currency wallet in which a blocked person has an interest, or may use its own wallet to consolidate wallets that contain the blocked digital currency (similar to an omnibus account), titled, for example, Blocked SDN Digital Currency.6
The FAQ adds that each of these methods is satisfactory if there are compliance controls that will allow the digital currency to be unblocked only when the legal prohibition requiring the blocking of the digital currency ceases to apply. The FAQ also explains that holders of blocked digital currency are not obligated to convert the blocked digital currency into traditional fiat currency. Persons holding blocked assets are also required to submit certain reports to OFAC.7
OFAC sanctions compliance guidance
In October 2021, OFAC published Sanctions Compliance Guidance for the Virtual Currency Industry (VC Compliance Guidance).8 The guidance reiterates that OFAC rules apply to activity conducted in digital assets, highlights the strict liability nature of OFAC regulations, and summarises the general scope and structure of OFAC sanctions regimes.
The guidance also lays out sanctions compliance best practices for the digital asset industry, which it breaks into five general categories, in keeping the agency's general approach to compliance programmes, including: (1) management commitment; (2) risk assessment; (3) internal controls; (4) testing and auditing; and (5) training.
Among other measures, the guidance highlights the importance of using geolocation tools, such as IP address blocking controls, and conducting appropriate know-your-customer (KYC) due diligence during customer onboarding and throughout the lifecycle of the customer relationship. The guidance also emphasises the value of blockchain transaction monitoring and investigation software and provides non-exhaustive lists of red flags and remedial measures taken by digital asset companies that have been subject to prior OFAC enforcement actions.
OFAC ransomware guidance
On October 1, 2020, OFAC published an Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments.9 A similar, updated version of this advisory was published on September 21, 2021.10 The advisory notes that OFAC has designated a number of ransomware attackers as SDNs. Other ransomware attackers may not be included on the SDN List but could be located in a jurisdiction subject to comprehensive U.S. sanctions or may be affiliated with the governments of those jurisdictions.
The advisory highlights that OFAC's primary sanctions are a strict liability regime (as discussed above), which can present significant complications for victims of ransomware attacks and those assisting victims, who are often unable to definitively determine the identity of the attacker.
The advisory further notes that companies that facilitate ransomware payments to cyber actors on behalf of victims, including financial institutions, cyber insurance firms, and companies involved in digital forensics and incident response, encourage future ransomware payment demands and also may risk violating OFAC regulations.
The advisory encourages persons to self-report ransomware attacks to appropriate law enforcement agencies. According to OFAC, the agency considers a company's self-initiated and complete report of a ransomware attack to law enforcement or other relevant U.S. government agencies, made as soon as possible after the discovery of an attack, to be a voluntary self-disclosure and a significant mitigating factor in determining an appropriate enforcement response.
Country-specific considerations
Russia
Following Russia's invasion of Ukraine in February 2022, the United States imposed significantly heightened sanctions and export controls measures targeting Russia. The potential use of digital assets by Russia or Russian persons to evade or circumvent those restrictions has been a focal point of U.S. government officials.
For example, Executive Order (EO) 14024, entitled Blocking Property With Respect To Specified Harmful Foreign Activities of the Government of the Russian Federation, specifically authorises the SDN designation of persons determined to be responsible for or complicit in "deceptive or structured transactions or dealings to circumvent any United States sanctions, including through the use of digital currencies ..." where such action is for or on behalf of, or for the benefit of, directly or indirectly, the Government of the Russian Federation.11
OFAC FAQ 1021 further reiterates that the prohibitions imposed on Russia via EO 14024 extend to transactions in virtual currency.12 The FAQ explains, "Sanctioned Russian persons are known to employ a wide variety of measures in their efforts to evade U.S. and international sanctions. As such, U.S. persons, wherever located, including firms that process virtual currency transactions, must be vigilant against attempts to circumvent OFAC regulations and must take risk-based steps to ensure they do not engage in prohibited transactions".
The FAQ then provides a number of examples of activity involving digital assets that would be prohibited under OFAC rules, such as "virtual currency transactions involving the Central Bank of the Russian Federation, National Wealth Fund of the Russian Federation, or the Ministry of Finance of the Russian Federation", among others.
The FAQ concludes by noting that "OFAC is closely monitoring any efforts to circumvent or violate Russia-related sanctions, including through the use of virtual currency, and is committed to using its broad enforcement authorities to act against violations and to promote compliance".
Venezuelan petro
On March 19, 2018, President Trump issued EO 13827, entitled Taking Additional Steps to Address the Situation in Venezuela.13 The order prohibits "[a]ll transactions related to, provision of financing for, and other dealings in, by a United States person or within the United States, any digital currency, digital coin, or digital token, that was issued by, for, or on behalf of the Government of Venezuela".14
The action was specifically aimed at the petro, which is a Venezuelan government-issued digital asset that is purportedly backed by oil and mineral reserves in the country.
However, the order applies more broadly to any other digital assets issued by, for, or on behalf of the government of Venezuela. The action marks the first and only time that OFAC issued a blanket ban on dealings in a given digital asset. However, as more countries, including those subject to comprehensive U.S. sanctions, explore central bank digital currencies (CBDCs) or other types of government-backed digital assets, it is possible that OFAC will take additional, similar actions in the future.
OFAC enforcement actions against digital asset platforms
Beginning in December 2020, with an enforcement action against BitGo,15 OFAC has brought a series of enforcement actions against digital asset platforms. In addition to BitGo, the targeted companies include BitPay, Bittrex,16 Kraken, Poloniex, CoinList Markets, and Binance.17 While each enforcement action was factually unique, all of them involved the use of the platform by users located in comprehensively sanctioned jurisdictions including Cuba, Iran, Sudan, Syria, and the Crimea region of Ukraine. In a number of cases, OFAC found that the platforms had reason to know of the location of the users based on either KYC documents or geolocation data associated with a user's IP address used to access the platform. One case also involved dealing with SDNs.
Among other takeaways, the actions demonstrate the importance of using all available risk-relevant data to assist in sanctions compliance and taking measures to prevent users located in comprehensively sanctioned jurisdictions from accessing the platforms.
SDN designation of non-U.S. exchanges, mixers, and tumblers
Starting in late 2021, OFAC began a string of SDN designations focused on non-U.S. digital asset exchanges, mixers, and tumblers. The targeted platforms include SUEX, Chatex, Garantex, Blender.io, Hydra Market, Tornado Cash, Sinbad.io, and Bitpapa, among many others.18 OFAC has also designated many entities and individuals that purportedly used digital assets for nefarious purposes, including money laundering, ransomware, and sanctions evasion, among other conduct.19
These actions highlight the significant discretion of OFAC to target actors that it believes are acting contrary to U.S. foreign policy or national security objectives, regardless of the jurisdiction of those actors and regardless of whether there is any U.S. nexus.
The SDN designations have implications both for U.S. persons and persons acting within the United States, who are generally prohibited from dealing with SDNs, and for non-U.S. persons outside the United States. Most EOs authorising the issuance of SDN designations also authorise OFAC to designate any person determined to have "materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services in support of ... any person whose property and interests in property are blocked pursuant to this order".20 In other words, persons who deal with SDNs also risk being designated as SDNs themselves. Therefore, any person dealing with an SDN digital asset platform may face sanctions risk from OFAC.
Tornado Cash and implications for DeFi platforms
Perhaps the most contentious and widely followed OFAC action in the digital asset space has been its designation of Tornado Cash as an SDN.21
OFAC designated Tornado Cash in 2022 under EO 13694, as amended, and EO 13722,22 which pertains to North Korea. OFAC cited the use of Tornado Cash by the Lazarus Group, a North Korean state-sponsored hacking group, to launder hundreds of millions of dollars for the benefit of North Korea as the primary reason for the designation.23
When designating Tornado Cash, OFAC determined that Tornado Cash was a "person" that was eligible for designation under the relevant authorities. OFAC also identified the smart contracts underpinning the Tornado Cash protocol as property in which Tornado Cash has a "property interest" (i.e., OFAC concluded that the smart contracts were blocked property). Those findings were challenged in Joseph Van Loon, et al. v. Department of Treasury, et al.24 and Coin Center, et al. v. Yellen, et al.25 and ultimately upheld by the district court in both cases.
The Van Loon decision
The district court in Van Loon found that Tornado Cash was a "person", which is defined in the relevant EOs to include "entities" and, in particular, "associations". While the term "association" is not defined in the EOs or elsewhere in applicable OFAC rules, the court defined an association as "[a] body of persons who have combined to execute common purpose or advance a common cause".26 The court explained that the Tornado Cash "association" is "composed of its founders, its developers, and its [decentralised autonomous organisation, or] DAO".27
The court then explained that the underlying smart contracts were "property" in which the association had an interest (and, therefore, were subject to blocking pursuant to OFAC rules). The court first noted that "property" is broadly defined in existing OFAC rules to include a wide range of items, including "contracts of any nature whatsoever" and "services of any nature whatsoever".28 It found that the smart contracts were "contracts", and even if some of the underlying code could not be accurately described as a contract, "Tornado Cash promoted and advertised the contracts and its abilities and published the code with the intention of people using it—hallmarks of a unilateral offer to provide services".29
The court also found that the association had an "interest" in this property, pointing to OFAC's broad regulatory definition of "interest" as "an interest of any nature whatsoever, direct or indirect".30 It explained, "Tornado Cash has a beneficial interest in the deployed smart contracts because they provide Tornado Cash with a means to control and use crypto assets. The smart contracts generate fees in the form of TORN tokens for the DAO when users execute a relayer-facilitated transaction".31
It is worth noting that, at the time of this writing, the district court decision is being appealed, as is the decision in Coin Center. Therefore, the Van Loon decision may not be the last word on this matter in U.S. courts. Nonetheless, it marks a significant victory for OFAC and a decision to which the decentralised finance (DeFi) industry must pay careful attention.
The Van Loon decision did not find that OFAC could designate the underlying code itself, but rather that OFAC did and could designate an "association" of individuals connected to an underlying protocol or software and who have a "property interest" in that code, or at a minimum, in transactions that are executed by that code.
The ruling, unless reversed, indicates that OFAC can designate any DeFi platform that it determines has engaged in sanctionable conduct, so long as the platform is developed, operated, or governed by an "association" of persons engaged in a "common purpose" or is otherwise able to be construed as an "entity", as defined under applicable OFAC regulations. That holding is likely to apply to a broad array of DeFi platforms currently in operation.
The Van Loon court also relied heavily on the specific facts of Tornado Cash, which may not necessarily be present in all cases. For example, it is unclear how the court's ruling would apply to a situation where a developer wrote code, published it on GitHub (or another platform) for free public use, and then walked away with no further involvement, management, or financial stake in how the code operates or executes transactions. Similarly, it is unclear whether the court would have reached the same conclusion if there had been no DAO and no financial benefit flowing to the DAO from the execution of relayer-facilitated transactions. Therefore, Van Loon may not necessarily apply to all decentralised blockchain protocols, particularly those with facts that are significantly different from Tornado Cash.
Nonetheless, because many, if not most, DeFi projects have some level of ongoing involvement from the founders, a DAO, or otherwise, the Van Loon ruling is likely to have significant implications for those platforms.
The Coin Center Decision
Following the ruling in Van Loon, the district court in Coin Center issued a similar ruling upholding OFAC's actions. That case focused on whether the protocol founders, developers, and DAO had an "interest" in the underlying protocol such that interactions with the protocol could constitute a prohibited dealing in blocked property. The court rejected Coin Center's argument because "it is built on the faulty premise that the 'interest' required under the IEEPA is 'property interest' or 'ownership interest' in the technical legal sense".32 The court found that an interest existed because "without those [smart] contracts, the service and the TORN [tokens] held by the founders, developers, and DAO would not function and would be less valuable".33 The court explained that this constituted a "financial" interest in the "increased use and popularity of the Tornado Cash service as a whole".34
The court also rejected Coin Center's arguments that OFAC acted in an "arbitrary and capricious" manner under the Administrative Procedure Act and that OFAC's actions violated the First Amendment.35
As with the plaintiffs in Van Loon, Coin Center is appealing the decision.
Designation of Tornado Cash founder and DOJ indictment
Shortly after the Van Loon ruling, OFAC announced the SDN designation of Roman Semenov, one of three alleged co-founders of Tornado Cash,36 and DOJ charged Semenov and Roman Storm, another Tornado Cash founder, with multiple alleged criminal violations related to anti-money laundering (AML) and economic sanctions laws.37 Semenov and Storm allegedly coded Tornado Cash, held a significant number of governance tokens, and developed a frontend user interface, over which both individuals retained control, that helped users access the protocol. Users were not required to access the protocol via this frontend user interface, but, according to the indictment, the significant majority of users did use the interface.
The indictment alleges that the defendants were aware that the Tornado Cash protocol was being used by a number of bad actors to launder the proceeds of hacks and other illegal conduct. It also alleges that the defendants profited from such activity through their holding of TORN tokens (the governance token of the Tornado Cash DAO) and the implementation of a "relayer register" that required Tornado Cash relayers to purchase TORN tokens in order to be chosen to process withdrawals from the Tornado Cash frontend user interface.
The indictment further alleges that the founders made changes to the frontend user interface to prevent transactions flowing directly from wallets that had been identified as blocked property of the Lazarus Group (and others), but privately acknowledged that the measures were inadequate because they could easily be bypassed by transferring tokens from the identified wallets into a new wallet and then using the Tornado Cash frontend.
Storm and Semenov were charged with three counts, including (1) conspiracy to commit money laundering, (2) conspiracy to operate an unlicensed money-transmitting business, and (3) conspiracy to violate the International Emergency Economic Powers Act (IEEPA).38 Given the sanctions focus of this chapter, we focus on the third count related to IEEPA (although the first two counts raise a number of important considerations with respect to AML laws in the DeFi context).
At the time of this writing, Storm and Semenov are seeking dismissal of the IEEPA-related charges, arguing that (1) the indictment seeks to penalise the defendants for making "informational materials" available on the Internet, which is activity exempted from the scope of IEEPA, and (2) the defendants did not engage in a "wilful" violation of IEEPA, which is required for criminal violations to arise.39 The court has not yet ruled on the motion to dismiss, but the ruling is likely to provide important insights for industry with respect to the sanctions compliance obligations for founders of DeFi protocols.
Regardless of the outcome of the case, the indictment highlights the importance of founders and developers considering economic sanctions compliance at the design, build, and operational stages of any new DeFi projects. It also highlights the need to take action when a founder or developer becomes aware that a project may be used by sanctioned parties and for that action to be meaningful. The indictment identifies "KYC procedures, transaction monitoring, [and] blockchain tracing" as other measures that Storm and Semenov could have taken.40
Digital assets and export controls
While this chapter is focused principally on economic sanctions, it makes sense to briefly address the closely related area of export controls. Particularly since the Russian invasion of Ukraine in February 2022, the U.S. government has become increasingly focused on the potential role of financial institutions and others involved in international payments in identifying and reporting potential export controls violations. For example, the Department of Commerce's Bureau of Industry and Security and the Department of the Treasury's Financial Crimes Enforcement Network (FinCEN) have issued joint alerts urging financial institutions to exercise "increased vigilance" with respect to potential Russia and Belarus export controls evasion attempts.41
In terms of enforcement, on October 19, 2022, DOJ charged five Russian nationals and two Venezuelan nationals with using a complex series of transactions involving digital assets and shell companies to unlawfully obtain U.S. military technology and sanctioned Venezuelan oil.42
As U.S. export controls continue to expand and increase in complexity, this trend is likely to continue and digital asset platforms should consider export controls compliance in addition to OFAC sanctions.
Compliance programme considerations
OFAC regulations do not technically require any entity to implement an OFAC compliance programme. However, because of the strict liability standard under U.S. primary sanctions and OFAC's broad discretion with respect to secondary sanctions, many entities elect to implement a robust sanctions compliance programme.43 Moreover, many digital currency projects operating in the United States are subject to the AML and KYC requirements of the Bank Secrecy Act (BSA), whether as money services businesses or as certain Securities and Exchange Commission (SEC) or Commodity Futures Trading Commission (CFTC) registrants. These BSA obligations, in turn, effectively impose sanctions screening as a part of an effective compliance programme.
OFAC and DOJ, which enforces criminal sanctions penalties, have made clear in a number of instances that maintaining a compliance programme is an important factor when they determine whether to bring an enforcement action and what penalty to impose. For example, OFAC's Economic Sanctions Enforcement Guidelines, which set out general parameters regarding how OFAC approaches enforcement in the event of a violation of OFAC regulations, include maintenance of a compliance programme as one of the general factors affecting OFAC's enforcement response to an apparent violation.44 Specifically, the agency will consider – as either a mitigating factor or an aggravating factor – the existence, nature, and adequacy of a person's risk-based OFAC compliance programme at the time of the apparent violation.
OFAC has also issued guidance entitled A Framework for Compliance Commitments, which outlines the key elements OFAC expects to see when reviewing an entity's compliance programme.45 It also cites the lack of a formal OFAC sanctions compliance programme as a primary root cause of OFAC sanctions violations and notes that OFAC frequently cites the absence of such a programme as an aggravating factor in its enforcement analysis.
With respect to criminal enforcement, DOJ publishes a reference guide for prosecutors known as the Justice Manual, which includes a section on Principles of Federal Prosecution of Business Organizations that outlines various factors that federal prosecutors consider when taking action against a business. One of those factors is the adequacy and effectiveness of the entity's compliance programme at the time of the offence. The manual explains, "the critical factors in evaluating any program are whether the program is adequately designed for maximum effectiveness in preventing and detecting wrongdoing by employees and whether corporate management is enforcing the program or is tacitly encouraging or pressuring employees to engage in misconduct to achieve business objectives".46 Moreover, the recently revised National Security Division (NSD) Enforcement Policy for Business Organizations, updated on March 7, 2024, reiterates the importance of a demonstrated commitment to maintaining an effective compliance programme specifically in the context of evaluating remedial efforts in the face of sanctions violations.
OFAC's VC Compliance Guidance, discussed above, also notes that all companies in the digital asset industry are encouraged to develop, implement, and routinely update a tailored, risk-based sanctions compliance programme.
Digital asset-specific compliance programme considerations
In addition to the above general sanctions compliance considerations, there are several sanctions considerations that are unique to digital asset companies. The use of blockchain analytics is a particularly important tool for the industry, and the ability to trace many digital asset transactions on public blockchains can provide detailed insight into the transactions of a given wallet, including any links to known bad actors or sanctioned persons.
Many blockchain analytics service providers offer services that can help identify whether a given wallet is specifically included on the SDN List, is associated with an SDN, or has otherwise interacted with a wallet known to belong to a sanctioned person. For privacy-enhanced blockchains with more limited information publicly available on the blockchain, companies should consider whether alternative means exist to mitigate the potentially heightened sanctions compliance risk of these blockchains and whether using these blockchains falls within their risk tolerance.
Both OFAC's enforcement actions and its sanctions compliance guidance highlight the importance of geolocating a user's IP address to identify whether a user is accessing a digital asset platform from a device located in a comprehensively sanctioned jurisdiction. While sophisticated users can obscure their IP address by using a VPN or through other means, many users do not take these measures, as evidenced by OFAC's enforcement actions.
As noted above, OFAC has issued specific guidance on blocking digital assets. Digital asset companies should familiarise themselves with this guidance and consider creating written procedures for how the company will handle blocked assets, which may include procedures for periodic testing to ensure that compliance controls deployed to block digital assets are functioning properly.
There are additional and significant challenges that come with implementing compliance measures in a decentralised context, including identifying who is responsible for determining and implementing the appropriate measures and how to achieve compliance objectives while maintaining the decentralised nature of the protocol. These challenges are heightened by the fact that the movement toward greater centralisation can have important implications under other legal regimes, such as securities law and even the AML rules of certain jurisdictions that do not extend to fully decentralised platforms.
Open questions and enforcement outlook
While OFAC has noted that compliance obligations for transactions involving digital assets are the same as for fiat currency transactions, there are still many open questions with respect to how OFAC views the application of its regulations to the digital asset space. For example, the agency has not issued any formal guidance on how it views the obligations of persons such as:
- crypto miners and other validators;
- coders and developers;
- governance token holders in DeFi projects; and
- persons serving in foundations associated with specific blockchains.
In many of these instances, participants may have limited or no visibility into persons with whom they are directly or indirectly dealing or have no ability to limit the group of users with whom they directly or indirectly interact. For example, a miner validating a block in a blockchain typically has no ability to limit the transactions in that block and only limited insight into the parties to the transactions in the block.
There are also significant questions regarding the obligations of developers and coders that create and release protocols. The indictment of Tornado Cash's founders, discussed above, provides some insight into how DOJ views the compliance obligations of such persons. However, given a number of the unique facts in that case, it is unclear how broadly the lessons from that indictment can be applied.
While the industry continues to wait for additional guidance and clarity on some of these questions, it seems likely that OFAC SDN designations and enforcement actions both from OFAC and DOJ will continue and, perhaps, increase.
Recent organisational and personnel changes within DOJ point toward increased focus on the nexus between financial crimes, including those conducted in digital assets, and sanctions violations. Such prosecutions can require expertise from a number of areas within DOJ, including the NSD, the Money Laundering and Asset Recovery Section, and the criminal division and money laundering units of the various U.S. attorneys' offices. A number of DOJ initiatives, including Task Force KleptoCapture, the National Cryptocurrency Enforcement Team, and the recent appointments of a Chief Corporate Enforcement counsel and Deputy Corporate Enforcement counsel within NSD, are intended to enhance cooperation and expertise across the Department and may lead to additional prosecutions involving digital assets and sanctions going forward.
Proposed legislation
Several members of Congress have taken an increased interest in sanctions compliance in the digital asset space and have proposed legislation that would seek to expand the sanctions compliance obligations of certain persons involved with digital assets. For example, the Crypto-Asset National Security Enhancement and Enforcement Act of 2023 (S.2355) seeks to make certain "digital asset protocol backers" and "digital asset facilitators" responsible for sanctions compliance across the entirety of a "digital asset protocol" they back or on which they facilitate transactions.47 The bill would do this by making them subject to penalties under IEEPA "to the same extent as" a person that violates OFAC rules using the protocol.48 It is somewhat unclear how such a bill would be implemented in practice. Similarly, the Lummis-Gillibrand Responsible Financial Innovation Act (S.2281) requires Treasury to issue guidance "clarifying the sanctions compliance responsibilities and liability of an issuer of a payment stablecoin with respect to downstream transactions".49 At the time of this writing, neither piece of legislation appears likely to be passed imminently, but the bills demonstrate Congress's interest in this space, and indicate that the industry should monitor for legislative changes going forward.
Footnotes
1 See U.S. Dep't Treas. Off. Foreign Assets Control, Sanctions Programs and Country Information, available at https://ofac.treasury.gov/sanctions-programs-and-country-information
2 See U.S. Dep't Treas. Off. Foreign Assets Control, Specially Designated Nationals and Blocked Persons List (SDN List), available at https://ofac.treasury.gov/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists
3 22 U.S.C. § 8909; see Countering America's Adversaries Through Sanctions Act (CAATSA), Pub. L. No. 115-44 (Aug. 2, 2017).
4 U.S. Dep't Treas. Off. Foreign Assets Control, Questions on Virtual Currency: FAQ 560, available at https://ofac.treasury.gov/faqs/560#:~:text=Are%20my%20OFAC%20compliance%20obligations,currency%20or%20traditional%20fiat%20currency%3F&text=Yes%2C%20the%20obligations%20are%20the%20same
5 See U.S. Dep't Treas. Off. Foreign Assets Control, Questions on Virtual Currency: FAQ 646, available at https://ofac.treasury.gov/faqs/646
6 See id.
7 31 C.F.R. § 501.603.
8 U.S. Dep't Treas. Off. Foreign Assets Control, Sanctions Compliance Guidance for the Virtual Asset Industry (Oct. 2021), available at https://ofac.treasury.gov/media/913571/download?inline
9 Ransomware typically involves a hacker breaching a company's IT infrastructure and encrypting a company's data or other systems. The attacker then typically demands that the victim pay a ransom in exchange for a decryption key that allows the victim to unlock the IT systems or data. The ransom is almost always demanded in cryptocurrency.
10 U.S. Dep't Treas. Off. Foreign Assets Control, Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments (Sept. 21, 2021), available at https://ofac.treasury.gov/media/912981/download?inline
11 Exec. Order No. 14024, 86 Fed. Reg. 20249 (Apr. 19, 2021).
12 See U.S. Dep't Treas. Off. Foreign Assets Control, Russian Harmful Foreign Activities Sanctions: FAQ 1021, available at https://ofac.treasury.gov/faqs/1021
13 Exec. Order No. 13827, 83 Fed. Reg. 12469 (Mar. 19, 2018).
14 Id.
15 See Enforcement Release, U.S. Dep't Treas. Off. Foreign Assets Control, OFAC Enters Into $98,830 Settlement with BitGo, Inc. for Apparent Violations of Multiple Sanctions Programs Related to Digital Currency Transactions (Dec. 30, 2020), available at https://ofac.treasury.gov/media/50266/download?inline
16 The case against Bittrex involved a joint action between OFAC and the U.S. Department of the Treasury's Financial Crimes Enforcement Network (FinCEN), which issued a consent decree regarding alleged violations of the Bank Secrecy Act (BSA) and its implementing regulations, in addition to the sanctions violations identified by OFAC.
17 See Enforcement Release, U.S. Dep't Treas. Off. Foreign Assets Control, OFAC Enters Into $507,375 Settlement with BitPay, Inc. for Apparent Violations of Multiple Sanctions Programs Related to Digital Currency Transactions (Feb. 18, 2021), available at https://ofac.treasury.gov/media/54341/download?inline ; Enforcement Release, U.S. Dep't Treas. Off. Foreign Assets Control, OFAC Settles with Bittrex, Inc. for $24,280,829.20 Related to Apparent Violations of Multiple Sanctions Programs (Oct. 11, 2022), available at https://ofac.treasury.gov/media/928746/download?inline ; Enforcement Release, U.S. Dep't Treas. Off. Foreign Assets Control, OFAC Settles with Virtual Currency Exchange Kraken for $362,158.70 Related to Apparent Violations of the Iranian Transactions and Sanctions Regulations (Nov. 28, 2022), available at https://ofac.treasury.gov/media/929541/download?inline ; Enforcement Release, U.S. Dep't Treas. Off. Foreign Assets Control, OFAC Settles with Poloniex, LLC for $7,591,630 Related to Apparent Violations of Multiple Sanctions Programs (May 1, 2023), available at https://ofac.treasury.gov/media/931701/download?inline ; Enforcement Release, U.S. Dep't Treas. Off. Foreign Assets Control, OFAC Settles with Binance Holdings, Ltd. for $968,618,825 Related to Apparent Violations of Multiple Sanctions Programs (Nov. 21, 2023), available at https://ofac.treasury.gov/system/files/2023-11/20231121_binance.pdf [joint action with DOJ]; Enforcement Release, U.S. Dep't Treas. Off. Foreign Assets Control, OFAC Settles with CoinList Markets LLC for $1,207,830 Related to Apparent Violations of the Ukraine-/Russia-Related Sanctions Regulations (Dec. 13, 2023), available at https://ofac.treasury.gov/media/932406/download?inline#:~:text=CoinList%20Markets%20LLC%20(%E2%80%9CCLM%E2%80%9D,in%20apparent%20violation%20of%20OFAC's
18 See Press Release, U.S. Dep't Treas. Off. Foreign Assets Control, Treasury Takes Robust Actions to Counter Ransomware (Sept. 21, 2021), available at https://home.treasury.gov/news/press-releases/jy0364 ; Press Release, U.S. Dep't Treas. Off. Foreign Assets Control, Treasury Continues to Counter Ransomware as Part of Whole-of-Government Effort; Sanctions Ransomware Operators and Virtual Currency Exchange (Nov. 8, 2021), available at https://home.treasury.gov/news/press-releases/jy0471#:~:text=Suex%20was%20sanctioned%20on%20September,posed%20by%20criminal%20ransomware%20actors ; Press Release, U.S. Dep't Treas. Off. Foreign Assets Control, Treasury Sanctions Russia-Based Hydra, World's Largest Darknet Market, and Ransomware-Enabling Virtual Currency Exchange Garantex (Apr. 5, 2022), available at https://home.treasury.gov/news/press-releases/jy0701 ; Press Release, U.S. Dep't Treas. Off. Foreign Assets Control, U.S. Treasury Issues First-Ever Sanctions on a Virtual Currency Mixer, Targets DPRK Cyber Threats (May 6, 2022), available at https://home.treasury.gov/news/press-releases/jy0768 ; Press Release, U.S. Dep't Treas. Off. Foreign Assets Control, U.S. Treasury Sanctions Notorious Virtual Currency Mixer Tornado Cash (Aug. 8, 2022), available at https://home.treasury.gov/news/press-releases/jy0916 ; Press Release, U.S. Dep't Treas. Off. Foreign Assets Control, Treasury Sanctions Mixer Used by the DPRK to Launder Stolen Virtual Currency (Nov. 29, 2023), available at https://home.treasury.gov/news/press-releases/jy1933#:~:text=The%20Treasury%20Department's%20designation%20of,proceeds%20from%20their%20illicit%20activities. ; Press Release, U.S. Dep't Treas. Off. Foreign Assets Control, Treasury Designates Russian Companies Supporting Sanctions Evasion Through Virtual Asset Services and Technology Procurement (Mar. 25, 2024), available at https://home.treasury.gov/news/press-releases/jy2204
19 See, e.g., Press Release, U.S. Dep't Treas. Off. Foreign Assets Control, Treasury Designates Virtual Currency Money Launderer for Russian Elites and Cybercriminals (Nov. 3, 2023), available at https://home.treasury.gov/news/press-releases/jy1874 ; Press Release, U.S. Dep't Treas. Off. Foreign Assets Control, United States Sanctions Affiliates of Russia-Based LockBit Ransomware Group (Feb. 20, 2024), available at https://home.treasury.gov/news/press-releases/jy2114 ; Press Release, U.S. Dep't Treas. Off. Foreign Assets Control, United States Sanctions Senior Leader of the LockBit Ransomware Group (May 7, 2024), available at https://home.treasury.gov/news/press-releases/jy2326
20 Exec. Order No. 13694, 80 Fed. Reg. 18077 (Apr. 2, 2015).
21 See Press Release, U.S. Dep't Treas. Off. Foreign Assets Control, U.S. Treasury Sanctions Notorious Virtual Currency Mixer Tornado Cash (Aug. 8, 2022), available at https://home.treasury.gov/news/press-releases/jy0916
22 Exec. Order No. 13722, 82 Fed. Reg. 17331 (Apr. 10, 2017).
23 See Press Release, U.S. Dep't Treas. Off. Foreign Assets Control, U.S. Treasury Sanctions Notorious Virtual Currency Mixer Tornado Cash (Aug. 8, 2022), available at https://home.treasury.gov/news/press-releases/jy0916
24 See Order, Van Loon v. Dep't Treas., No. 23-cv-312-RP (W.D. Tex. Aug. 17, 2023).
25 See Order, Coin Center v. Yellen, No. 3:22-cv-20375 (N.D. Fla. Oct. 30, 2023).
26 Order, Van Loon v. Dep't Treas., No. 23-cv-312-RP (W.D. Tex. Aug. 17, 2023) at 14.
27 Id. at 15.
28 Id. at 17.
29 Id. at 18.
30 Id. at 19.
31 Id.
32 Order, Coin Center v. Yellen, No. 3:22-cv-20375 (N.D. Fla. Oct. 30, 2023) at 12.
33 Id. at 14.
34 Id. at 15.
35 Id. at 19.
36 See Press Release, U.S. Dep't Treas. Off. Foreign Assets Control, Treasury Designates Roman Semenov, Co-Founder of Sanctioned Virtual Currency Mixer Tornado Cash (Aug. 23, 2023), available at https://home.treasury.gov/news/press-releases/jy1702
37 See U.S. v. Storm, No. 23-cr-430 (S.D.N.Y. Aug. 23, 2023).
38 See 50 U.S.C. ch. 35 § 1701 et seq. IEEPA is the federal statute underpinning the SDN designation of the Lazarus Group.
39 See Memorandum of Law in Support of Roman Storm's Motion to Dismiss, U.S. v. Storm, No. 23-cr-430 (S.D.N.Y. Mar. 29, 2024).
40 See U.S. v. Storm, No. 23-cr-430 (S.D.N.Y. Aug. 23, 2023).
41 See Joint Alert, Fin. Crimes Enf't Network & Bureau Indus., Fin-2022-Alert003, FinCEN and the U.S. Department of Commerce's Bureau of Industry and Security Urge Increased Vigilance for Potential Russian and Belarusian Export Control Evasion Attempts (Jun. 28, 2022), available at https://www.fincen.gov/sites/default/files/2022-06/FinCEN%20and%20Bis%20Joint%20Alert%20FINAL.pdf ; Joint Alert, Fin. Crimes Enf't Network & Bureau Indus., FIN-2-23-Alert004, Supplemental Alert: FinCEN and the U.S. Department of Commerce's Bureau of Industry and Security Urge Continued Vigilance for Potential Russian Export Control Evasion Attempts (May 19, 2023), available at https://www.fincen.gov/sites/default/files/shared/FinCEN%20and%20BIS%20Joint%20Alert%20_FINAL_508C.pdf
42 See Press Release, U.S. Dep't J., Five Russian Nationals and Two Oil Traders Charged in Global Sanctions Evasion and Money Laundering Scheme (Oct. 19, 2022), available at https://www.justice.gov/usao-edny/pr/five-russian-nationals-and-two-oil-traders-charged-global-sanctions-evasion-and-money
43 Some entities, such as U.S. financial institutions, may also be required or expected to have an OFAC compliance programme under other applicable regulatory regimes.
44 31 C.F.R. pt. 501, App. A.
45 See U.S. Dep't Treas. Off. Foreign Assets Control, A Framework for OFAC Compliance Commitments (2019), available at https://ofac.treasury.gov/media/16331/download?inline
46 Justice Manual, 9-28.800, 2019 WL 5864449, at *1. Judges also take into account an effective compliance and ethics programme when determining appropriate sentencing under the U.S. Sentencing Commission's Sentencing Guidelines (U.S.S.G. 8B2.1).
47 Crypto-Asset National Security Enhancement and Enforcement Act of 2023, S.2355, 118th Cong. (2023).
48 Id.
49 Lummis-Gillibrand Responsible Financial Innovation Act, S.2281, 118th Cong. (2023).
Originally published by Global Legal Insights
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.