OFAC issues guidance for virtual currency industry

On Friday, October 15, 2021, the US Department of the Treasury's Office of Foreign Assets Control (OFAC) issued guidance on sanctions compliance specifically geared toward the virtual currency industry. Along with the guidance, OFAC also updated two Frequently Asked Questions relating to virtual currencies (FAQs 559 and 646).

While the guidance largely tracks with the general sanctions advice that OFAC has previously issued in other contexts, this latest publication reflects the growing attention being paid to cryptocurrency and other virtual currencies, specifically with regard to their use in facilitating ransomware payments.

This guidance follows up on other actions taken by OFAC last month, including the first-ever designation of a cryptocurrency exchange to the SDN List and an updated advisory on potential sanctions risks for facilitating ransomware payments. For more information on those measures, please see our previous update.

The guidance was released in conjunction with the publication of a report by the Financial Crimes Enforcement Network (FinCEN) on pattern and trend information in Bank Secrecy Act data specifically relating to ransomware. The FinCEN report concludes that "ransomware is an increasing threat to the US financial sector, businesses and the public."

Additionally, on Monday, October 19, 2021, the Treasury Department released a review of US sanctions programs in which it noted that "technological innovations such as digital currencies, alternative payment platforms and new ways of hiding cross-border transactions all potentially reduce the efficacy of American sanctions."

Taken together, these recent developments demonstrate the current administration's heightened focus on cryptocurrency and other forms of digital assets.

Guidance for virtual currency companies

The OFAC guidance is aimed at all companies in the virtual currency industry, including technology companies, exchangers, administrators, miners and wallet providers, as well as more traditional financial institutions that may have exposure to virtual currencies or their service providers.

The guidance notes that the growing prevalence of virtual currency as a payment method brings greater exposure to sanctions risks, such as the risk that a sanctioned person or a person in a jurisdiction subject to sanctions might be involved in a virtual currency transaction.

The guidance further serves to remind companies that the compliance obligations for OFAC sanctions apply to transactions equally whether they involve virtual currencies or traditional fiat currencies, and that companies are responsible for ensuring that they do not engage, directly or indirectly, in transactions prohibited by OFAC sanctions, such as dealings with blocked persons or property, or engaging in prohibited trade- or investment-related transactions.

OFAC encourages companies in the virtual currency industry to adopt best practices for risk-based sanctions compliance programs, including screening for persons on sanctions lists and geographic screening.

Specifically, OFAC indicates that it has observed many cases in which members of the virtual currency industry have implemented sanctions policies and procedures months, or even years, after commencing operations. It urges companies that are still in the beta testing stage of their operations to consider sanctions compliance, so that potential sanctions risks can be accounted for as technologies are being developed and prior to launching a new product.

Risk assessments

In discussing the importance of conducting risk assessments, the guidance mentions a settlement agreement that OFAC entered into earlier this year with a US virtual currency payment service provider. It notes that while the company conducted sanctions screenings of its direct customers—merchants located in the United States and elsewhere—it failed to screen available information about the individuals who used its payment processing platform to buy products from those merchants.

Accordingly, the guidance notes that a "comprehensive risk assessment that includes understanding who is accessing a company's platform or services may help members of the virtual currency industry identify the appropriate screening standards to set for each of its products and services."

Internal controls

In discussing the different types of internal controls that virtual currency companies might implement, the guidance mentions another settlement agreement from last year involving a US company that offers digital asset custody, trading and financial services internationally. It notes that the company did not use the IP address information it collected from users to screen for and prevent potential sanctions violations and, as a result, failed to prevent use of its non-custodial secure digital wallet management service by individuals with IP addresses located in sanctioned jurisdictions.

Accordingly, the guidance also notes that "[i]mplementing internal controls to screen available data and block activity involving certain IP addresses can prevent sanctions violations." Some best practices discussed in the guidance include geolocation tools, know your customer (KYC) procedures, and transaction monitoring and investigation software, as well as implementing remedial measures upon learning of a weakness in a company's internal controls.

Updated FAQs on digital currency

OFAC also updated two related FAQs that provide additional guidance on topics specifically related to virtual currencies.

First, FAQ 559 defines the terms "digital currency," "digital currency wallet," "digital currency address" and "virtual currency" for the purposes of OFAC sanctions. OFAC considers "digital currency" to include "sovereign cryptocurrency, virtual currency (non-fiat) and a digital representation of fiat currency." Additionally, according to OFAC, one type of digital currency is "virtual currency," which is defined as "a digital representation of value that functions as (i) a medium of exchange; (ii) a unit of account; and/or (iii) a store of value; and is neither issued nor guaranteed by any jurisdiction."

Second, FAQ 646 addresses blocking digital currency. The FAQ notes that once US persons determine that they hold virtual currency that is required to be blocked pursuant to OFAC's regulations, they must deny all parties access to that virtual currency, ensure that they comply with OFAC regulations related to the holding and reporting of blocked assets and implement controls that align with a risk-based approach. OFAC also notes that US persons are not obligated to convert the blocked virtual currency into traditional fiat currency (e.g., US dollars) and are not required to hold such blocked property in an interest-bearing account. However, blocked virtual currency must be reported to OFAC within 10 business days, and thereafter on an annual basis, so long as the virtual currency remains blocked.

We will continue to monitor these developments and provide updates as warranted.

Special thanks to law clerk Eddie Skolnick (Washington, DC) for his assistance in the preparation of this content.