OFAC Issues Cryptocurrency Compliance Guidance

As part of the ongoing efforts of the federal government, agencies and financial market regulators to respond to the growing cryptocurrency market, the Office of Foreign Asset Control (OFAC) of the Department of Treasury recently added a “Questions on Virtual Currency” section to its Sanctions Compliance Frequently Asked Questions (FAQs).

View PDF version here.

OFAC’s responses to the FAQs (#559-563) effectively act as guidance on how its sanctions programs will scrutinize cryptocurrencies and related transactions, which have faced increased regulatory attention following a meteoric rise in popularity. Most notably, the FAQs state that U.S. persons or persons otherwise subject to OFAC jurisdiction engaged in transactions bear the same compliance obligations whether the transaction is denominated in cryptocurrency or traditional currency.

Compliance

Generally, OFAC advises covered entities — “including firms that facilitate or engage in online commerce or process transactions using digital currency” — must ensure they “do not engage in unauthorized transactions prohibited by OFAC sanctions, such as dealing with blocked persons or property, or engage in prohibited trade or investment-related transactions,” including any transactions that successfully, or attempt to, evade, avoid or cause a violation of any OFAC-imposed prohibitions. Specifically, the FAQs instruct covered entities to ensure that they block the property and interests in property of anyone named on OFAC’s Specifically Designated Nationals and Blocked Persons (SDN List), or any entity owned in the aggregate, directly or indirectly, 50% or more by one or more blocked persons; and that they do not engage in trade or other transactions with such persons named on the SDN List, which identifies individuals and companies owned, controlled by or acting on behalf of targeted countries, as well as individuals, groups and entities, such as terrorists and narcotics traffickers. Additionally, OFAC instructs that persons providing “financial, material, or technological support for or to a designated person may be designated by OFAC under the relevant sanctions authority.”

Sanctions

OFAC’s FAQs continue to outline how it will extend the use of its existing authorities in response to the use of cryptocurrency and other emerging payment systems for illicit purposes, such as terrorism, malicious cyber activity and human rights abuses. It states that OFAC will use sanctions “as a complement to existing tools, including diplomatic outreach and law enforcement authorities,” and that it “may include as identifiers on the SDN List specific digital currency addresses associated with blocked persons” in order to strengthen its efforts under existing authorities.

SDN List Identifiers

Finally, the FAQs outline how OFAC will delineate information regarding cryptocurrencies on the SDN List. First, it states that OFAC “may add digital currency addresses to the SDN List to alert the public of specific digital currency identifiers associated with a blocked person.” As a result, those who identify digital currency identifiers or wallets they believe may be owned by or associated with an SDN “should take the necessary steps to block the relevant digital currency and file a report with OFAC that includes information about the wallet’s or address’s ownership, and any other relevant details.” In regard to the structure that digital currency addresses will take on the SDN List, the FAQs elaborate that the field will provide unique alphanumeric identifiers of up to 256 characters, and that the addresses will also identify the specific digital currency to which the address corresponds, such as Bitcoin, Ether or Litecoin.

Clients should take this guidance into account when implementing their compliance policies in this space. One lurking question not addressed in these FAQs is how firms should comply with these rules when their firm has been hacked and in order for the firm to regain access to its systems, the hacker requires the payment of cryptocurrency to an account that would constitute a violation of the OFAC rules.