introduction

On October 15, 2021, the Office of Foreign Assets Control of the US Treasury Department (“OFAC“) has published an industry-specific brochure,”Sanctions Compliance Guide for the Virtual Currency Industry”, To help members of the virtual currency industry navigate and comply with OFAC sanctions. Typically, OFAC administers and enforces economic sanctions programs against designated foreign governments, individuals and entities.[1]

As stated in OFAC guidelines, members of the virtual currency industry who facilitate or engage in online commerce, or process transactions using digital currency, are responsible for ensuring that they do not engage in transactions involving sanctioned persons.[2]

This means that once an entity determines that it holds the virtual currency to be blocked, for example by facilitating the digital wallet of a sanctioned person, that entity must block access to the currency and ensure that ” it complies with OFAC regulations relating to the holding and reporting of blocked assets. and implement controls that align with a risk-based approach.[3]

Guide to virtual currency

OFAC’s guidelines emphasize the importance of implementing a personalized, risk-based approach to sanction compliance and are directed to members of the virtual currency industry, including “businesses”. technology, exchangers, miners and wallet providers ”.[4] This article will help members of the virtual currency industry to:

• Evaluate the risks associated with sanctions in their businesses;
• Build a risk-based sanctions compliance program;
• Protect businesses against sanctions violations and the misuse of virtual currencies by malicious actors; and
• Understanding of OFAC’s record keeping, reporting, licensing and enforcement process.[5]

Digital currency vs virtual currency

Terms “Digital currency” and “Virtual currencyHave the following meaning for the purposes of OFAC sanctions:

• Digital currency: A sovereign cryptocurrency, virtual currency and a digital representation of fiat currency (for example, the US dollar). It is important to note that OFAC’s definition of digital currency covers all forms of Virtual currency.
• Virtual currency: A numerical representation of value that functions as: (i) a medium of exchange; (ii) a unit of account; and / or (iii) a store of value; and is not issued or guaranteed by any jurisdiction.[6] In addition, OFAC’s sanctions also apply to transactions involving digital tokens, which include non-fungible tokens (“TVN“).

Who must comply with OFAC sanctions?

As a general rule, all US nationals must comply with OFAC regulations, including: (i) all US citizens and lawful permanent residents, regardless of location; (ii) all persons and entities in the United States; and (iii) all entities organized in the United States and their foreign branches.[7] Thus, members of the US virtual currency industry should be made aware of OFAC’s sanction requirements.

Strict liability for sanctions violations

OFAC can impose civil penalties for violations of the penalties “on the basis of a legal standard of strict liability”.[8] This means that an entity can be held liable for sanctions violations even without knowing or knowing that it was engaging in such violation.

OFAC does not require companies to maintain a compliance program. However, OFAC will consider a company’s implementation of a risk-based compliance program and corrective actions taken in response to an apparent violation when determining its enforcement response.[9] This is important given OFAC’s strict liability standard.

Sanctions compliance obligations

OFAC’s sanctions compliance obligations are the same for all sectors and also apply to transactions involving digital and fiat currencies.[10]

Members of the virtual currency industry who facilitate or engage in online commerce, or process transactions using digital currency, are responsible for ensuring that they do not engage in transactions involving sanctioned persons.[11] Currently, over 9,000 designated individuals are subject to OFAC sanctions.[12]

Typically, prohibited transactions include those that “escape or avoid, cause a violation or attempt to violate” OFAC restrictions.[13] In addition, entities that “provide financial, material or technological support to or to a sanctioned person” may be sanctioned by OFAC.[14]

How to “block” virtual currency?

Entities must freeze the property and interests in the property of sanctioned persons or any entity owned, directly or indirectly, by a sanctioned person and ensure that “they do not engage in prohibited transactions with such persons” .[15]

This means that once an entity determines that it holds the virtual currency to be blocked, for example by facilitating the digital wallet of a sanctioned person, that entity must block access to the currency and ensure that ” it complies with OFAC regulations relating to the holding and reporting of blocked assets. and implement controls that align with a risk-based approach.[16]

OFAC operates an online research tool called “Search in the sanctions listTo facilitate the monitoring and use of OFAC’s sanctions lists for compliance purposes.

Additionally, although entities are not required to convert blocked virtual currency into traditional fiat currency or hold such blocked assets in an interest-bearing account, blocked virtual currency “must be reported to OFAC within 10 working days”And thereafter on an annual basis, as long as“ the virtual currency remains blocked ”.[17]

Best practices recommended by OFAC

The growing importance of virtual currency as a method of payment leads to greater exposure to the risk of OFAC sanctions.

On September 21, 2021, in a one-of-a-kind action, OFAC imposed sanctions on SUEX OTC, SRO, a Russian virtual bureau de change, for allegedly facilitating transactions involving illicit proceeds from at least eight different ransomware cyber attacks.[18]

OFAC’s guidelines summarize its sanctions requirements and offer examples of recommended best practices to help members of the virtual currency industry establish adequate compliance programs and avoid sanctions violations and actions. potential execution. More specifically, OFAC encourages a Risk-based approach compliance with sanctions for the virtual currency industry.[19]

An adequate compliance program will depend on a variety of unique risk factors, including “the type of business involved, its size and sophistication, the products and services offered, the customers and counterparties, and the geographic locations served”.[20]

As described in OFAC guidelines, each program should be based on and incorporate the following compliance elements: (i) management commitment; (ii) risk assessment; (iii) internal controls; (iv) tests and audits; and (v) training.[21]

Management commitment

Management of virtual currency entities can demonstrate commitment to sanctions compliance by: (i) reviewing and approving sanctions compliance policies and procedures early in the development process; (ii) ensure that adequate resources support compliance; (iii) delegate sufficient powers to the compliance unit; and (iv) the appointment of a person responsible for compliance with sanctions with the required technical expertise.[22]

Risk assessment

Typically, in the virtual currency industry, sanctions risks are technological vulnerabilities which, if mismanaged, can lead to violations of OFAC regulations and subsequent enforcement actions. OFAC encourages companies developing a compliance program to “perform a routine and ongoing risk assessment to identify potential penalty issues they are likely to encounter. prior to provide services or products to customers.[23]

A virtual currency company’s risk assessment process should reflect its “potential customer base or customer base, products, services, supply chain, counterparties, transactions and geographic locations”, and may also include “assess whether counterparties and partners have adequate compliance procedures”.[24]

Internal controls

An effective compliance program will include controls to “identify, report and maintain records of transactions prohibited by OFAC sanctions”.[25]

Properly implemented internal controls should enable a company to exercise sufficient due diligence on customers, business partners and transactions using: (i) geolocation tools; (ii) Know your customer (“KYC“) Procedures; (iii) Sanctions control; (iv) Investigation; and (v) transaction monitoring software to identify“ red flags ”.[26] Red flags are indications that compliance failures may occur.

Internal controls should be applied and weaknesses identified, through root cause analysis of compliance breaches, and corrected to prevent any activity that may violate sanctions. OFAC has encouraged the use of internal or third-party software as tools for an effective compliance program.[27]

Tests and audits

The best way to make sure that a compliance program is working is to test the effectiveness of the program. Recommended best practices for testing compliance programs include: (i) filtering the sanctions list to ensure that the filtering appropriately flags transactions for further investigation; (ii) keyword filtering to ensure that filtering tools flag geographic keywords as part of transaction filtering; and (iii) IP blocking to ensure that IP address software prevents users in sanctioned jurisdictions from accessing products and services.[28]

Coaching

OFAC training should be provided to all employees, including “compliance, management and customer service personnel,” and should be provided periodically and, at a minimum, once a year.[29] Specifically, OFAC training for the virtual currency industry should take into account updates to sanctions programs and emerging technologies.

OFAC updates

Common OFAC problems Sanctions List Updates and Regulations of enforcement measures. Entities that conduct financial transactions with non-U.S. Individuals may find it helpful to register with OFAC recent action notifications to receive updates to existing guidelines.