US Treasury guidance sets out sanctions compliance duties for virtual currency industry

OFAC said the virtual currency industry – including technology companies, exchangers, administrators, miners, wallet providers and users – had an increasingly critical role in preventing sanctioned persons or entities from exploiting virtual currencies to evade sanctions.

The sanctions compliance guidance (28 page / 2.13MB PDF) reminds the industry that compliance obligations apply equally to transactions involving virtual currencies and those involving fiat currency.

OFAC requires any US person or firm holding virtual currency subject to sanctions to block it, and deny all parties access to the virtual currency to comply with OFAC regulations. The blocked virtual currency must be reported to OFAC within 10 business days, as well as any rejected transaction reporting related to virtual currency.

Compliance obligations apply equally to virtual and fiat currency.

Financial crime and investigations expert Hinesh Shah of Pinsent Masons, the law firm behind Out-Law, said there were some key differentiators that needed to be factored into the sanctions screening processes of virtual currency companies which differ from traditional banking.

“Geolocation data points, such as IP addresses, can help identify transactions taking place in sanctioned jurisdictions. Sophisticated analytical tools exist which can help identify IP misattribution and improbable or unusual logins,” Shah said.

“In addition, virtual currency companies need to ensure their sanctions screening processes also incorporate virtual currency addresses that, since 2018, have been included on OFAC’s specially designated nationals list,” Shah said.

The OFAC guidance encourages members of the currency industry as well as financial institutions with exposure to virtual currency, to develop and implement a risk-based compliance programme, to include screening sanctions lists, geographic screening and other appropriate measures depending on the company’s risk profile.

OFAC said it was essential for senior management to commit to a sanctions compliance programme to ensure it is adequately resourced and integrated into a company’s daily operations.

The guidance also recommends routine and ongoing risk assessment, tailored to the types of products or services offered by a virtual currency firm. Companies should also consider evaluating whether their partners and counterparties have adequate compliance procedures in place.

Although OFAC acknowledged the internal controls implemented by a company would vary depending on its risk profile, it said a variety of tools and practices would help strengthen these controls.

Suggestions of useful tools included geolocation tools and IP address blocking controls, to identify and prevent IP addresses that originate in sanctioned countries from accessing a company’s website and services for activity that is prohibited by OFAC.

Virtual currency companies should carry out know-your-client checks, and use the information obtained to conduct due diligence or sanctions screening to mitigate potential sanctions risks.

OFAC added that transaction monitoring and investigation software could be utilised to identify transactions involving virtual currency addresses or other information linked to sanctioned individuals or entities.

The guidance also encourages virtual currency companies to implement effective and immediate measures to compensate for any weaknesses in their controls until a root cause can be identified and remediated.

The sanctions compliance programme should also include a comprehensive and independent testing or audit function in order to assess how it is functioning and whether it needs enhancing, updating or recalibrating.

The audit should ensure that sanctions list and keyword screening is effective; IP blocking is preventing users from sanctioned jurisdictions from accessing services; and that the company has the right procedures in place to investigate any transactions flagged as having a potential sanctions nexus and to report blocked or rejected transactions to OFAC.

OFAC said virtual currency industry members should provide sanctions-specific training to all appropriate employees, taking into account the frequent changes in the virtual currency sector, the regular updates to sanctions programmes and new or emerging technology.

Financial crime and investigations expert Stacy Keen of Pinsent Masons said: “Although the guidance relates to OFAC sanctions and the virtual currency industry, the best practices advocated can be adopted by those operating in a range of sectors to drive compliance with other sanctions regimes.

“The release of the guidance is part of OFAC’s commitment to engaging with the virtual currency industry to promote understanding of, and compliance with, sanctions requirements. OFAC has also demonstrated its willingness to adopt a tough stance on the industry. Early this year OFAC designated a virtual currency exchange, Suex, as a sanctions target for complicity in facilitating financial transactions for ransomware actors.”