In recent years, the application of the United States (US) sanctions laws to the cryptocurrency industry has witnessed a significant surge. The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) and the U.S. government have become increasingly active in extending sanctions regulations to cover digital asset transactions. OFAC has issued clear guidance emphasizing that U.S. sanctions apply to cryptocurrency transactions just as they do to traditional ones, underlining the need for compliance within the crypto space.
Furthermore, OFAC has not only initiated enforcement actions against crypto companies found violating U.S. sanctions but has also imposed sanctions on crypto exchanges and entities within the crypto ecosystem that are perceived as threats to U.S. national security and foreign policy interests. Recent U.S. sanctions stemming from geopolitical events, such as Russia’s invasion of Ukraine, have further heightened concerns about the potential misuse of cryptocurrencies for US sanctions evasion.
US sanctions compliance guidance for the cryptocurrency space
US sanctions are legal restrictions that prohibit certain transactions involving comprehensively sanctioned countries and individuals/entities listed on OFAC’s Specially Designated Nationals and Blocked Persons (SDN) List. These sanctions extend to cryptocurrency transactions, and violations can result in civil penalties and even criminal prosecution. OFAC has clarified that these compliance obligations are the same for both virtual and traditional fiat currencies.
OFAC issued compliance guidance in October 2021 tailored to the cryptocurrency industry. This guidance offers a comprehensive framework for understanding and adhering to US sanctions within the crypto space. It includes an overview of sanctions, best practices for compliance, and steps to mitigate sanctions-related risks. OFAC emphasizes that this guidance applies not only to U.S. companies but also to non-U.S. entities conducting business with or through the United States or involving U.S.-origin goods.
Five pillars of an effective compliance program
OFAC’s guidance identifies five key pillars for an effective compliance program within the virtual currency space:
Management Commitment: Demonstrated commitment by leadership to prioritize sanctions compliance.
Risk Assessment: Identification and assessment of sanctions-related risks tailored to the company’s specific operations.
Internal Controls: Implementation of controls, including written policies, KYC procedures, and sanctions screening.
Testing/Auditing: Regular testing and auditing of compliance measures to ensure their effectiveness.
Training: Ongoing training for employees to ensure they are aware of and can navigate sanctions compliance.
Specific compliance measures may vary based on individual risk profiles. Common compliance measures include:
- KYC Procedures: Know-Your-Customer procedures to verify the identity of cryptocurrency users.
- Sanctions Screening: Screening of transactions and parties against the SDN List and other relevant lists.
- Geolocation Controls: Employing geolocation controls like IP blocking to detect involvement from comprehensively sanctioned jurisdictions and efforts to evade these controls, such as VPN usage.
- Risk Indicators/Red Flags: Identifying and monitoring risk indicators or red flags in cryptocurrency transactions and customers, helping detect potentially suspicious activity.
Enforcement actions against crypto companies
In recent years, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) has initiated enforcement actions against cryptocurrency companies found in violation of U.S. sanctions. These actions highlight compliance deficiencies within the crypto industry.
In December 2020, BitGo, Inc., a U.S.-based company providing secure digital wallet management services, settled with OFAC for $98,830. BitGo had facilitated transactions in apparent violation of sanctions against Ukraine, Cuba, Iran, Sudan, and Syria. BitGo failed to prevent individuals in comprehensively sanctioned jurisdictions from using its wallet services, resulting in 183 digital currency transactions totaling approximately $9,127 in sanctions violations.
In February 2022, BitPay, Inc., a digital currency payment service provider, settled with OFAC for $507,375. BitPay allowed individuals in sanctioned jurisdictions like Crimea, Cuba, Iran, North Korea, Sudan, and Syria to transact on its platform despite possessing location data showing their prohibited status. This failure to screen location data led to 2,102 digital currency transactions totaling approximately $129,000 in violations.
Criminal prosecution of sanctions violations
The U.S. Department of Justice (DOJ) may criminally prosecute sanctions violations, particularly when “wilful” conduct is involved. A notable case is that of Virgil Griffith, who pleaded guilty in September 2021 to conspiring to violate U.S. sanctions by providing cryptocurrency and blockchain-related services to North Korea. Griffith had offered guidance on using blockchain and cryptocurrency to evade sanctions during his participation in the “Pyongyang Blockchain and Cryptocurrency Conference” in North Korea.
DOJ’s focus on sanctions enforcement
The DOJ has intensified its focus on sanctions enforcement, especially in light of the unprecedented sanctions imposed on Russia following its invasion of Ukraine. The creation of the KleptoCapture Task Force in March 2022 underscores this commitment.
One of the task force’s key missions is to target efforts to use cryptocurrency for sanctions evasion, money laundering, or to circumvent U.S. responses to Russian military aggression. The DOJ and OFAC maintain strong working relationships to coordinate investigations, share resources, and leverage expertise in sanctions enforcement within the cryptocurrency space.
The evolving geopolitical landscape and emerging national security threats continue to shape sanctions policy and enforcement strategies, making it imperative for crypto industry participants to remain vigilant and adapt their compliance measures accordingly.
US sanctions designations in the crypto space
Sanctioned entities and individuals
The U.S. government has extended sanctions to cryptocurrency-related entities and individuals, addressing the evolving nature of digital currencies.
In response to Venezuela’s attempt to evade sanctions through the launch of the “petro” cryptocurrency, the U.S. President issued Executive Order 13827 in 2018. This order prohibited U.S.-related transactions involving any Venezuelan “digital currency, digital coin, or digital token,” including petro.
OFAC sanctioned Ali Khorashadizadeh and Mohammad Ghorbaniyan, two individuals based in Iran involved in converting digital currency payments into Iranian rials as part of a ransomware scheme. This marked the first time OFAC publicly attributed virtual currency addresses to individuals, aiding compliance efforts within the virtual currency community.
Designation of crypto companies
OFAC made its initial designations of cryptocurrency companies onto the Specially Designated Nationals and Blocked Persons (SDN) List.
In September 2021, OFAC designated virtual currency exchange SUEX OTC, S.R.R. (“SUEX”) for facilitating financial transactions on behalf of ransomware actors. This designation severed SUEX’s ties to the U.S. economy and disrupted a primary method for facilitating ransomware payments.
In November 2021, OFAC designated another virtual currency exchange, Chatex, along with its associated support network. These actions were taken in response to the rising threat of ransomware attacks targeting U.S. companies, where illicit cyber actors demanded cryptocurrency payments.
Advisory on facilitating ransomware payments
OFAC issued an advisory cautioning against facilitating ransomware payments. It highlighted the potential for such payments to advance the interests of bad actors, including those linked to sanctioned persons or comprehensively sanctioned jurisdictions. Facilitating ransomware payments could potentially violate OFAC regulations, leading to significant fines or penalties.
Expanding sanctions to crypto mixers
OFAC extended its sanctions reach to virtual currency mixers, such as Blender.io and Tornado Cash.
In May 2022, OFAC designated Blender.io, a virtual currency mixer that mixes deposited cryptocurrencies to obfuscate their origin, destination, and counterparties. Blender.io was alleged to have supported North Korea’s malicious cyber activities by processing a portion of stolen funds.
On August 8, 2022, OFAC designated Tornado Cash, another virtual currency mixer, for laundering billions of dollars in virtual currency, including funds associated with cybercrime. This expansion of sanctions to crypto mixers aims to deter their use in facilitating illicit transactions.
Controversy and legal challenges have arisen regarding the Tornado Cash designation, highlighting the complexities of applying traditional sanctions frameworks to cutting-edge cryptocurrency technologies. These developments underscore the need for crypto industry participants to stay informed and adaptable in their compliance efforts.
Impact of sanctions on the crypto industry
It is essential to examine the broader impact of U.S. sanctions on the cryptocurrency industry. This includes the challenges, uncertainties, and evolving regulatory landscape that crypto companies face as they navigate the intersection of cryptocurrency and sanctions.
Challenges and Uncertainties
Regulatory Ambiguity: The rapid evolution of cryptocurrencies and blockchain technology has outpaced regulatory clarity. Cryptocurrency companies often operate in a gray area, unsure of how sanctions laws apply to their specific activities.
Global Reach: Sanctions are not limited to the United States. Many countries have their own sanctions regimes, creating a complex web of international compliance requirements for crypto businesses with a global footprint.
Constantly Changing Landscape: The geopolitical landscape can change rapidly, leading to shifts in sanctions policies. Crypto companies must stay vigilant and adapt to these changes promptly.
Compliance Burden
Resource Intensive: Implementing robust sanctions compliance measures can be resource-intensive for cryptocurrency companies, especially smaller startups. This includes investing in technology for sanctions screening and hiring compliance experts.
Complexity of Transactions: Cryptocurrency transactions can be highly complex, involving multiple parties and intermediaries. Ensuring compliance at every step of these transactions can be challenging.
Evolving Regulatory Guidance
Lack of Precedent: The crypto industry often lacks precedent when it comes to sanctions compliance. Companies must rely on regulatory guidance that is continually evolving.
Interpretation Variability: Different crypto firms may interpret sanctions regulations differently, leading to inconsistencies in compliance efforts. Clearer regulatory guidance is needed to standardize compliance practices.
Impact on Innovation
Inhibiting Innovation: Stringent sanctions compliance requirements can potentially stifle innovation in the crypto space. Startups may face barriers to entry due to compliance costs and complexities.
Exclusion of Certain Markets: Sanctions can restrict access to certain markets for crypto companies, limiting their growth potential.
Legal and Ethical Considerations
Legal Challenges: Some crypto companies have challenged their sanctions designations in court, arguing that their technology is decentralized and beyond the reach of traditional sanctions. These legal battles introduce legal uncertainties.
Ethical Dilemmas: Crypto companies may face ethical dilemmas when dealing with customers from sanctioned jurisdictions. Balancing compliance with ethical considerations can be challenging.
Global Collaboration
International Cooperation: Given the global nature of cryptocurrencies, international cooperation is essential in enforcing sanctions. Cryptocurrency companies must collaborate with regulators and law enforcement agencies worldwide.
Standardization Efforts: Industry-wide initiatives to standardize sanctions compliance practices and technologies could simplify the compliance burden for crypto firms.
Educational Initiatives
Training and Awareness: Crypto companies need to invest in ongoing training and awareness programs for their employees. Ensuring that all staff members are well-versed in sanctions compliance is crucial.
Information Sharing: The crypto community should actively share information and best practices for sanctions compliance, fostering a culture of collaboration and learning.
Conclusion
The evolution of U.S. sanctions in the cryptocurrency space reflects a dynamic regulatory landscape. As we anticipate further guidance, enforcement actions, and designations, cryptocurrency companies must prioritize strengthening their sanctions compliance measures. Staying vigilant and informed about regulatory developments in the crypto industry and their intersection with illicit activities is imperative for maintaining legal and ethical operations in this evolving landscape.
