The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) published new guidance last week for the virtual currency industry. While OFAC's economic sanctions compliance obligations apply to all U.S. persons, the new guidance is designed to "assist the virtual currency industry in mitigating" the risk that sanctioned persons will exploit virtual currencies "to evade sanctions and undermine U.S. foreign policy and national security interests."
This new guidance comes after various U.S. government agencies, including OFAC and the U.S. Department of Justice (DOJ), have brought a series of enforcement actions against parties operating in the virtual currency sector. These enforcement actions include OFAC's designation of a virtual currency exchange as a Specially Designated National for its role in facilitating ransomware transactions; criminal and civil charges against a cryptocurrency exchange for violating various anti-money laundering provisions of the Bank Secrecy Act and Commodity Futures Trading Commission regulations; and criminal charges for a cryptocurrency mixer who concealed the origin of criminal proceeds. Further, the DOJ also has recently established a National Cryptocurrency Enforcement Team to investigate and prosecute crimes related to cryptocurrency. (See our related client advisory, National Cryptocurrency Enforcement Team Turns Up the Crypto Heat.) While these actions generally target larger cryptocurrency operations, OFAC's latest guidance is an important signal that the U.S. government intends to apply greater scrutiny to, and more strictly regulate, entities (and people) operating in the cryptocurrency space writ large.
While the new guidance largely consolidates existing best practices, it also emphasizes several important points:
- The guidance is aimed at "the virtual currency industry, including technology companies, exchangers, administrators, miners, wallet providers, and users." OFAC highlights its expectation that all of these industry players will implement a risk-based sanctions compliance program, which may include undertaking sanctions risk assessments, implementing internal controls, conducting testing and auditing, and delivering training to relevant personnel.
- Companies should screen customers and transactions. The guidance stressed the importance of both Know Your Customer (KYC) screening not only when onboarding new customers, but throughout the company's relationship with them. Further, the guidance highlighted the importance of monitoring transactions to "identify transactions involving virtual currency addresses or other identifying information … associated with sanctioned individuals and entities listed on the SDN List or other sanctions lists, or located in sanctioned jurisdictions."
- Screening should include IP addresses and any other location or identity information received. OFAC pointed to a recent settlement agreement with a company that was collecting IP addresses for security purposes, but not screening those IP addresses against sanctions lists, which resulted in transactions by individuals in sanctioned jurisdictions. OFAC also emphasized the use of geolocation and IP blocking tools.
- The guidance highlights strict liability for sanctions violations, meaning that civil penalties can be imposed even if a company or person is not aware that it was engaging in prohibited activity. This may be particularly relevant for technology companies whose products can be used by sanctioned parties because a service provider does not have sufficient controls in place.
In sum, any company involved in the virtual currency industry should assess its sanctions risk and implement controls to prevent potential violations. As OFAC notes in its new guidance, parties that do not take these steps risk incurring monetary penalties, as well as reputational harm.
