Crypto Sanctions Compliance: OFAC Issues Guidelines Targeting Virtual Currency Industry | Sheppard Mullin Richter & Hampton LLP

[ad_1]

[co-author: Jonathan Wang*]

Background

Last Friday, the Office of Foreign Assets Control (OFAC) released more focused guidance for digital asset companies on sanction compliance and best practices to mitigate risk. This guide follows the OFAC’s first enforcement action against a cryptocurrency exchange, SUEX (which we discussed in our blog here). Given the increase in ransomware threats from malicious cyber actors who are often linked to sanctioned countries and individuals, the lack of very robust regulatory oversight of the virtual currency world, the emerging nature of the technologies and the growth of the market, it is clear that OFAC hopes that crypto companies will pay more attention to the risks of sanctions and compliance with the publication of these guidelines. While the guide covers a lot of familiar ground, below we outline a few key takeaways.

What’s in the guide and why you should care

At a high level, the guide reiterates OFAC’s 2019 guidance on sanctions compliance programs (available here) in the context of virtual currencies, including OFAC’s expectation that a company’s program should include, at a minimum: (1) management commitment; (2) risk assessments; (3) internal controls; (4) tests / audits; and (5) training.

The risk profile of each company in terms of sanctions varies. For virtual currency companies that have international users and where KYC and associated due diligence is more difficult than with other traditional financial institutions, having a risk-based sanctions compliance program will not only help you prevent and to detect potential violations, but also to mitigate penalties if you are faced with law enforcement. . Since sanctions violations are essentially strict liability offenses, it is in the interest of every virtual currency business to assess their risk and implement controls, especially in light of the recent scrutiny of the virtual currency industry by OFAC, the government is strengthening its staff for the application, and, more broadly, the Administration’s interest in limiting ransomware threats (see our article, here). For new businesses entering the world of virtual currency, the guide recommends developing sanctions compliance during the beta testing phase so that compliance can be considered when developing the technology ahead of launch.

Nuggets of useful information for the virtual currency industry

While the guidelines largely follow OFAC’s 2019 guidelines provided to companies with international contact points, they do provide some nuggets of useful information for companies operating in the virtual currency industry (e.g., companies technology, exchangers, administrators, miners, wallet providers and other institutions dealing with virtual currency).

Block virtual currency: US people with virtual currency deemed blocked by OFAC regulations must deny all parties that virtual currency. In particular, there is no need to convert virtual currency into fiat currency or place it in an interest-bearing account. The blocked virtual currency must be reported to OFAC within 10 working days, and then annually, as long as the virtual currency remains blocked. Filter Internet Protocol (IP) addresses: Businesses should find IP addresses from sanctioned jurisdictions and block all users there. The guide notes OFAC’s settlement with a company that has not prevented the use of its services by people with IP addresses located in sanctioned jurisdictions. Use geolocation tools: Geolocation tools allow companies to identify IP addresses that may come from sanctioned jurisdictions. This can help businesses prevent people in sanctioned jurisdictions from accessing their platform and services. Other analysis tools can recognize bad IP assignment by identifying users who may be hiding behind a different IP address (i.e. VPN users). SDN List Virtual Currency Addresses Screen: In 2018, OFAC started listing virtual currency addresses on the SDN list. The guide encourages companies to look for such addresses when filtering SDNs and to block any associated transactions. Unlisted virtual currency addresses that share a “wallet” with a listed virtual currency address may also present a risk of penalties and additional diligence may be required to ensure the transaction does not involve SDN.

* Jonathan Wang is a legal assistant in Sheppard Mullin’s Washington, DC office.

[ad_2]