Guide for the Crypto Industry

The crypto industry is required by law to carry out sanctions and AML screenings.

The Office of Foreign Asset Control (OFAC) has made it clear that the crypto industry must, as a top priority, ensure cryptocurrency is not used to evade sanctions.

OFAC is committed to using its authority to counter the use of digital assets for illegal activities. In line with this, the body has expressed that any US person, who engages in crypto transactions, is responsible for confirming that their exchanges do not violate sanctions.

The regulator has already taken steps to act against providers that fail to screen their customers against sanctions and watch lists – and it expects to have more involvement as the industry evolves.

For example, OFAC has:

• Cracked down on crypto transactions involving blocked persons and specially designated nationals (SDNs).
• Identified digital currency addresses known to be tied to these individuals and created a public list, so organisations can more easily screen for this activity.
• Restricted crypto transactions that involve exchanges that indirectly benefit SDNs. So, if an SDN or blocked entity is involved in or benefits from a cryptocurrency transaction taking place, the firm could face serious penalties.
• Criminalised transactions with entities that are 50% or more owned by an SDN.

The property of a blocked person, and any assets that they have an interest in, will continue to be sanctioned regardless of how many times it is transferred away from them. Crypto providers should be alerted to chain hopping, tumblers, and other methods used to obscure the true parties involved in the transaction.

It is important that organisations understand the sanctions regions that apply, based on the countries they operate in.

Because many nations use sanctions against imports to curb illegal behaviour and prevent the corruption of their financial systems, transactions with these regions should be avoided or closely monitored, depending on how comprehensive the sanctions are.

The Venezuelan Petro

In 2018, a US Executive Order was signed to prevent users from exchanging or dealing with crypto that was issued by, for, or on behalf of the Venezuelan government. This action was driven by the launch of their sovereign digital token, the Petro, which was designed by Maduro’s regime to get around US sanctions.

BitPay

In 2021 BitPay – a company that enables merchants to accept payments via cryptocurrencies received a fine of almost half a million dollars by OFAC for violating sanctions.

BitPay repeatedly violated sanctions programmes by carrying out transactions from their merchant’s buyers with names, phone numbers,

IP addresses, and other identifying data that indicated they resided in sanctioned jurisdictions.

During their investigation, OFAC determined that BitPay did not do their due diligence to screen the location of their ultimate customers: the buyers that were transacting with the merchants on their platform.

It is important to note that this penalty could have been significantly more severe, but OFAC gave BitPay credit to implement measures that would prevent sanctions violations in the future:

1. BitPay must fully block IP addresses that appeared to come from Iran, Syria, North Korea, and Cuba.
2. BitPay must launch an ID programme. The company duly launched a new customer identification process, BitPay ID.
3. Any merchants who want to process invoices of $3 000 or more must now provide proof of identification to utilise BitPay. Failing to provide the appropriate information blocks transaction.
4. BitPay needs to check the physical and email addresses of the merchant’s customers if the data is provided. Should the customer belong to a sanctioned jurisdiction, the invoice cannot be completed.

Aside from the legal requirements, companies that operate in the crypto industry also need to consider how AML Sanctions Screening processes can protect their organisation.

1. Reputation damage: Imagine what would happen to a company’s reputation if news came out that it had aided money launderers and terrorists through their platform. This would push sers away and encourage them to take their business elsewhere.
   
   
2. Insurance implications: Many insurers have previously agreed to pay out claims for ransomware payments – but now they are unwilling to reimburse companies due to the extensive cost of rebuilding the blockchain and recovering lost data. OFAC has identified companies like SamSam, Cryptolocker, and Dridex to be directly associated with malware. As such, any ransomware payments to these firms are strictly prohibited.