by Britt Mosman, David Mortlock, Elizabeth P. Gray, J. Christopher Giancarlo, and Samuel Hall

In recent years, the U.S. government has become increasingly focused on regulating the use of virtual currencies as a means of addressing a host of financial crimes and malign activities.  As entities and individuals (“persons”) in this space find themselves subject to various, sometimes overlapping regulatory regimes, the compliance environment has become increasingly treacherous.  One area of particular concern for those dealing with cryptocurrencies is U.S. economic sanctions, as is evidenced by the recent settlement between the Treasury Department’s Office of Foreign Assets Control (“OFAC”) and BitPay Inc. (“BitPay”), discussed below.  Indeed, sanctions hold some of the most complicated compliance issues in one hand, and some of the largest penalties in the other, and they do not always—or perhaps rarely—fit cryptocurrency transactions neatly. 

This post provides an overview of sanctions compliance principles for the cryptocurrency industry and discusses some key issues of which persons in the crypto space should be mindful, including:

• Sanctioned coins, persons, and regions;
• Restricted transactions; and
• Recommendations for compliance.

As this post makes clear, some of the relevant prohibitions remain ambiguous and leave significant questions unanswered.  In turn, some crypto transactions and related regulations may warrant license and guidance requests to OFAC or even legal challenges, including Administrative Procedure Act (“APA”) challenges, in U.S. courts to resolve those ambiguities.  But at a minimum, there are certain basic steps that should be taken to comply with U.S. sanctions.

Overview of Sanctions Compliance Issues for Cryptocurrency Industry

OFAC administers and enforces various economic sanctions programs against geographical regions, governments, groups, and individuals.  OFAC regulations generally prohibit U.S. persons[1] from engaging in transactions, directly or indirectly, with geographical regions or persons targeted by sanctions.  In addition, U.S. persons are generally prohibited from “facilitating” or assisting the actions of non-U.S. persons that would be prohibited for U.S. persons to perform directly due to U.S. sanctions.  Under OFAC’s definition of U.S. person, crypto exchanges, technology companies, payment processors, and administrators located or organized in the United States are U.S. persons, as are any users of digital currencies who are U.S. citizens or “green card” holders, regardless of where such individuals are located.  As a result, those persons are directly restrained by U.S. sanctions from generally providing benefits to a sanctioned jurisdiction or engaging in any transaction involving a designated person.

OFAC prohibitions apply equally to all U.S. persons, from traditional financial institutions to the cryptocurrency industry.  And the stakes are high.  Violations of sanctions can carry both civil and criminal penalties, with the latter ranging up to $1 million and/or 20 years in prison for each violation, a terrifying metric for those that process thousands of transactions a day.  What is more, OFAC may impose civil penalties for sanctions violations based on strict liability, meaning that a U.S. person may be held civilly liable even if it did not know or have reason to know it was engaging in a transaction with a person that is prohibited under OFAC-administered sanctions.[2]

To add to the risks for the cryptocurrency industry, OFAC has made clear that preventing sanctions evasion through cryptocurrency is a high priority for the agency, and it intends to use its sanctions authorities to counter the use of cryptocurrencies by sanctions targets and other malicious actors who abuse cryptocurrencies and emerging payment systems.[3]  Moreover, OFAC has emphasized that U.S. persons that are engaged in “online commerce or process transactions using digital currency, are responsible for ensuring that they do not engage in unauthorized transactions prohibited by OFAC sanctions[.]”[4]  Indeed, we are already starting to see enforcement actions brought by OFAC against providers of cryptocurrency services and anticipate seeing more.[5]

Given these potential penalties and the U.S. government’s current focus on the use of cryptocurrencies to engage in illicit activity, including evading OFAC sanctions requirements, crypto-industry participants should be aware, at a minimum, of a few broad categories of transactions that may pose risks. 

This is Part I of a three-part post. Part II will discuss blocked coins, blocked persons, and sanctioned regions. Part III will discuss restricted transactions, blocking and rejecting crypto transactions, and compliance considerations. 

Footnotes

[1] U.S. persons are defined to include (i) United States citizens and permanent resident aliens, wherever located; (ii) all entities organized in the United States (including their foreign branches); and (iii) all individuals, entities and organizations actually located in the United States.  For the U.S. sanctions against Cuba and Iran, all entities owned or controlled by U.S. persons, wherever organized or doing business (including foreign subsidiaries), are also generally required to comply with such sanctions.

[2] That said, OFAC generally considers knowledge, intent, recklessness, and negligence when determining which violations warrant an enforcement action.

[3] See, e.g., OFAC FAQ No. 561. 

[4] OFAC FAQ No. 560.

[5] See U.S. Department of the Treasury, Enforcement Release:  OFAC Enters Into $507,375 Settlement with BitPay, Inc. for Apparent Violations of Multiple Sanctions Programs Related to Digital Currency Transactions, Feb. 18, 2021, available online here (PDF: 223 KB).

Britt Mosman, David Mortlock, and Elizabeth P. Gray are partners, J. Christopher Giancarlo is senior counsel, and Samuel Hall is an associate, at Willkie Farr & Gallagher LLP.

Disclaimer

The views, opinions and positions expressed within all posts are those of the authors alone and do not represent those of the Program on Corporate Compliance and Enforcement or of New York University School of Law.  The accuracy, completeness and validity of any statements made within this article are not guaranteed.  We accept no liability for any errors, omissions or representations. The copyright of this content belongs to the authors and any liability with regards to infringement of intellectual property rights remains with them.