As an increasing number of investors, both within the United States and internationally, begin to buy and sell digital assets, a U.S. regulator has again reminded the virtual currency industry that it is subject to the same compliance obligations as more traditional industries. Last week, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) issued specific guidance regarding the application of U.S. sanctions requirements to the virtual currency industry. While this guidance does not break new ground or offer any surprises to experienced sanctions practitioners, it helpfully summarizes how sanctions apply in the virtual currency space and sets out OFAC’s expectations in a user-friendly manner that should be well-received by business teams and others who are less familiar with U.S. economic sanctions requirements.

Mounting regulatory focus on virtual currency

The guidance is only the latest example of the mounting regulatory focus on virtual currency. It follows the U.S. Department of Justice’s (DOJ) recent announcement of the creation of the National Cryptocurrency Enforcement Team. U.S. Regulators beyond the DOJ also have announced enforcement actions and reviews with respect to digital assets more generally:

• the Securities and Exchange Commission announced charges against cryptocurrency lending platform BitConnect in connection with an alleged $2 billion fraud;
• the Treasury’s Financial Crimes Enforcement Network (FinCEN) published its analysis of ransomware trends that found that virtual currencies were often used for ransomware-related payments; and
• the Commodity Futures Trading Commission and FinCEN announced a $100 million consent decree against the BitMEX cryptocurrency derivatives trading platform for, among other things, willfully failing to implement and maintain a Bank Secrecy Act compliant anti-money laundering program and customer identification program, and failing to report certain suspicious activity.

Press reports even suggest that a White House task force is considering an Executive Order to establish oversight of so-called stablecoins. The fast-moving pace and expanding reach of virtual currency regulation is a trend that is unlikely to change.

Guidance specific to virtual currencies

OFAC views participants in the virtual currency industry as playing “an increasingly critical role in preventing sanctioned persons from exploiting virtual currencies to evade sanctions and undermine U.S. foreign policy and national security interests.” The guidance, much like the guidance OFAC has published with respect to other industries (e.g., shipping and transportation) is designed to assist industry participants in understanding and mitigating the risks that are unique to their sector.

The guidance begins with a high-level primer on U.S. sanctions, but with practical takeaways for the virtual currency industry, such as explanations on how U.S. persons can “block” virtual currencies and examples of recent enforcement actions highlighting sanctions risks in the virtual currency space.

While the categories of sanctions and compliance obligations described by OFAC are not new, they are described in the guidance in a way that is designed to speak to a less familiar audience: individuals with a tech background that may not be accustomed to compliance in the financial services sector, or with compliance best practices that are otherwise relevant to the facilitation of cross-border transactions.

Along with the guidance, OFAC also published updates to FAQs 559 and 646 that, respectively, address:

• the definition of “digital currency,” “digital currency wallet,” “digital currency address,” and “virtual currency” for purposes of OFAC sanctions programs; and
• how to block a virtual currency from being transferred or released once a person holding the virtual currency determines that it is subject to blocking, because a sanctioned person has an interest in the virtual currency, or the virtual currency is itself blocked.

OFAC recommendations for virtual currency industry participants

As with any sector of the economy, virtual currency industry participants are expected to evaluate a variety of factors in assessing their unique sanctions risks and formulating a risk-based compliance strategy.

Factors to be considered can include: the business type, size and sophistication, products and services offered, customers and counterparties, and geographic location, to determine a business’s unique sanctions risks, which should then inform the risk mitigation measures that a company implements.

In the guidance, OFAC identifies the following key measures that virtual currency industry participants should carefully consider in implementing their risk-based compliance programs:

• Geolocation Tools – these tools allow companies to determine the locations of IP addresses, in particular to identify any that are in comprehensively sanctioned jurisdictions; OFAC makes clear that a failure to use such tools could lead to enforcement actions if transactions occur in relation to comprehensively sanctioned jurisdictions.
• KYC Procedures for the Virtual Currency Industry – OFAC recommends that companies perform information gathering throughout a customer relationship’s lifecycle: in connection with onboarding, during periodic reviews, and when processing transactions.
• Transaction Monitoring and Investigation Software – through this technology, companies can determine whether transactions involve certain identifying information that is associated with persons who are either on a sanctions list or are located in a comprehensively sanctioned jurisdiction.
• Sanctions Screening – as in virtually any industry, particularly the financial services sector, OFAC expects the virtual currency industry to implement controls reasonably designed to screen customers and counterparties against sanctions lists; this includes:

(i) screening transactions themselves to determine if they involve sanctioned persons or comprehensively sanctioned jurisdictions;

(ii) applying screening tools’ fuzzy logic technology to avoid search results falling through the cracks because of name variations and misspellings; and

(iii) ongoing screening in case of updates to customer information, OFAC sanctions lists, and regulatory requirements. 

Screening is not enough

In short, simply screening customers against OFAC’s Specially Designated Nationals and Blocked Persons List (the SDN List) is not enough:

• Companies should design sanctions programs which actively identify red flags, and seek to block transactions with individuals and entities that are a target of sanctions, such as those located in a comprehensively sanctioned jurisdiction, even if those individuals and entities do not appear on a sanctions list. Indeed, addressing risk relating to comprehensively sanctioned jurisdictions is a key aspect of compliance for the virtual currency industry.
• Companies should also be prepared to dive deeper when required, under their risk-based approach, by requesting information like names of beneficial owners, and requesting additional information in connection with specific transactions to clear sanctions red flags.

Looking ahead – the industry is on notice

OFAC’s guidance makes clear that it means to hold all actors in the virtual currency industry accountable, from technology companies to exchangers, administrators, miners, wallet providers, and even traditional financial institutions exploring new virtual currency assets and services.

Designing effective, risk-based sanctions programs is complex, especially for many of the newer, leaner participants in the virtual currency industry, but in light of the guidance it will be difficult to argue in the future that OFAC has not put the industry on notice of its expectations. It is never too soon to begin implementing sanctions compliance steps in accordance with OFAC’s guidance.