With the widespread arrival of Initial Coin Offerings (“ICOs”) over the last several years,1 U.S. authorities have made deliberate progress toward keeping pace with the fast-growing crypto industry.2 The Department of Treasury’s Office of Foreign Assets Control (“OFAC”) has arguably been slower to action than either the U.S. Department of Justice (“DOJ”) or the U.S. Securities and Exchange Commission (“SEC”), both of which have taken an aggressive approach resulting in high-dollar settlements.3 With that said, however, OFAC has more recently taken steps that suggest cryptocurrency regulation and enforcement will be a high-priority item moving forward.
I. OFAC’s Historical Regulation of Cryptocurrency
OFAC first demonstrated its interest in regulating cryptocurrency in January 2018 after Venezuela announced its plans to launch a state-sponsored digital coin called the petro.4 In response to this offering, OFAC published an FAQ admonishing that, “U.S. persons that deal in the prospective Venezuelan digital currency may be exposed to U.S. sanctions risk.”5 This guidance was quickly supplemented by President Trump’s Executive Order 13827, issued in March of 2018.6 The Executive Order went further than OFAC’s admonition, expressly prohibiting all U.S. persons from transacting in or financing any digital currency, coin, or token issued by the Venezuelan government.7 With firmer ground to stand on, OFAC soon after rewrote its FAQs on the petro and began to weigh in with greater detail on how it viewed compliance obligations surrounding the digital currency industry at large.8 For example, the FAQs state that OFAC’s compliance obligations are no different for digital currency users than they are for persons or companies who transact using traditional fiat currency.9 OFAC also specifically recommended that parties who deal in cryptocurrency “develop a tailored, risk-based compliance program, which generally should include sanctions list screening and other appropriate measures” and advised that it would use sanctions against “criminals and other malicious actors abusing digital currencies.”10
The publication of its own sanctions roadmap sent a clear message that sanctions were fast on the horizon. Nearly sixteen months later, OFAC has not yet taken aggressive action to illustrate the full application and extent of its intention to regulate cryptocurrency from an enforcement perspective. Indeed, it has only taken one enforcement action against two Iranian individuals using cryptocurrency for illicit purposes.11 That action, however, did set a precedent in that it marked the first time OFAC added digital currency addresses to its Specially Designated Nationals and Blocked Persons (“SDN”) List.12 The Iranian individuals had used those digital addresses to conduct extortion-style ransomware attacks on their victims.13 Not only is it significant that OFAC specifically attributed these addresses to SDNs, but it also suggests that OFAC will focus on intersections between schemes involving digital currencies and potential cybersecurity and ransomware threats.14
II. The Road Ahead
Through its guidance and clear messaging that it will target schemes involving digital currencies, OFAC has already made clear that regulation and enforcement of cryptocurrency are key priorities. Standing alone, however, exchange platforms could hardly have viewed these steps as a shot across the bow indicating that more enforcement activity was to come until more recently. In particular, recent commentary suggests that OFAC is actively collecting information from upwards of a dozen exchange platforms, with at least one digital currency exchange receiving a subpoena over the last year.15
What OFAC intends to do with that information remains to be seen. OFAC could merely be establishing a knowledge base in order to identify additional individuals transacting in cryptocurrencies with individuals or entities on the SDN list or for illicit purposes. It could also be signaling its intention to sanction and blacklist exchange platforms which fail to screen their user base against the SDN list. Regardless of OFAC’s intention with these requests, given recent trends, one can fairly assume that whatever information OFAC receives from subpoenaed parties may be shared with other government agencies in order to collaborate in enforcement actions, or for other agencies’ independent use.16 For example, information provided by a subpoenaed party regarding internal controls could be shared with the SEC’s Office of Compliance Inspections and Examinations (“OCIE”) for use in entity examinations. Indeed, OCIE designated digital assets as a key item in its 2019 Examination Priorities, focusing on “portfolio management of digital assets, trading, safety of client funds and assets, pricing of client portfolios, compliance, and internal controls.”17 Similarly, information provided to OFAC suggesting involvement of coins or exchanges implicating potential money laundering violations could be shared with the DOJ Criminal Division’s Money Laundering and Asset Recovery Section for further action. Furthermore, as international coordination between agencies has become a hallmark of recent enforcement activity implicating criminal conduct in multiple jurisdictions, information obtained by OFAC could be shared with authorities abroad potentially leading to parallel prosecutions for violations of laws in other countries.
Recent activity by OFAC in the digital currency space suggests that individuals and companies with an interest in utilizing cryptocurrency or participating in an ICO—state sponsored or otherwise—should proceed with caution. To that end, the following key takeaways can be drawn from OFAC’s recent activity.
- Know Your Counterparty: Just as digital currencies are now at the core of AML/Know Your Customer (“KYC”) due diligence, even entities that are not subject to AML/KYC requirements should conduct sufficient due diligence when transacting in digital currencies to ensure that a counterparty does not appear on, or affiliate with anyone that appears on, OFAC’s SDN list.
- Know Your Exchange Platform: Do your research as to which exchanges are fully compliant with OFAC’s regulations. Many exchanges are in the process of developing platforms customized for their U.S. customer base, which are compliant with U.S.-based trade restrictions.18 Several prominent exchanges have blocked U.S. customers to avoid regulatory issues.19 While U.S. customers should be blocked from accessing those platforms or designated cryptocurrencies within the exchange, do not attempt to bypass those restrictions through any means.20
- Monitor OFAC Guidance: Monitor OFAC’s FAQs regarding state-sponsored ICOs to ensure that any transaction involving a state-sponsored coin complies with all applicable laws, rules, and regulations. Although it may be apparent, do not engage in transactions that involve coins issued by sanctioned countries or digital addresses appearing on OFAC’s SDN list.
- Maintain a Record of Transactions: Although the blockchain can create an immutable public ledger of transactions in theory, ensuring that an independent, auditable trail of digital currency transactions has been created could prove key toward establishing a compliance record in the event of an OFAC inquiry.