OFAC’s new compliance guide for the virtual currency industry provides information on OFAC’s compliance expectations that are useful to both the virtual currency industry and the business community as defined. large
The Office of Foreign Assets Control (“OFAC”) of the Department of the Treasury Sanctions Compliance Guide for the Virtual Currency Industry (“Guidance”) alerts companies operating in this industry to the unique and growing risks they face with countries and individuals targeted by US economic sanctions laws.
In the Guide, OFAC recognizes that while virtual currencies play an increasing role in legitimate transactions across the global economy, these currencies also play a prominent role in the pursuit of illicit activities, for example through their use in the increasing frequency of ransomware attacks and transactions designed to evade sanctions laws. The Guide is particularly useful for businesses operating in this industry, as it signals OFAC’s expectations that virtual currency businesses take these risks seriously by dedicating appropriate resources to mitigate those risks. The Guide’s discussion of sector-specific compliance measures is also relevant and interesting for the business community at large to read, as it is much more detailed than any previously published OFAC guidance on compliance measures. economic sanctions.
As the office responsible for the implementation and enforcement of U.S. economic sanctions laws (which include laws targeting countries and governments, such as Iran, Venezuela, and North Korea, as well as persons involved in illicit activities, such as terrorism, cybercrime and drug trafficking), OFAC has stepped up its efforts to provide advice and guidance to particular industries or sectors at risk of harm. ” engage in sanctions objectives. One such area of concern is the virtual currency industry, which she defines as “tech companies, exchangers, administrators, miners, wallet providers and users”.
The OFAC guide has three main characteristics. First, it provides a comprehensive introduction to how transactions in the virtual currency industry are held on par with transactions involving traditional fiat currencies. Second, it alerts the industry to the risks inherent in virtual currency transactions. Third, it provides detailed guidance on compliance measures to mitigate these risks.
Transactions in virtual currency and fiat currency are subject to the same rules
Perhaps recognizing that participants in the digital or virtual currency industry view virtual currency as a different and alternative way to generate value and conduct business compared to fiat money, OFAC thoroughly lays out how virtual and fiduciary transactions are subject to the same rules, including the prohibition on facilitating transactions with sanctioned targets and the obligation to “block” virtual currency in which a sanctioned target has a proprietary interest, until ‘on the mundane topic of record keeping responsibilities. OFAC also stresses that the virtual currency industry will be subject to the same standards as more traditional financial institutions in any enforcement action.
Specific risks associated with virtual currency transactions
The Guide highlights the growing use of virtual currency in illicit activities, with particular emphasis on ransomware attacks. Echoing its earlier and recently published updated review on the risks associated with ransomware payments (See O’Melveny’s Customer alert of October 9, 2020) and the FinCEN report of October 15, 2021 on ransomware (See O’Melveny’s Customer alert October 19, 2021), the guide highlights the recent designation by OFAC of the Russian digital currency exchange Suex OTC to facilitate transactions with ransomware players.
OFAC’s discussion of compliance strategies is of practical use. This discussion is relevant and worth reading not only for companies in the virtual currency industry, but also for the business community at large, as it is much more detailed than any published OFAC guidance. previously on economic sanctions compliance measures.
Beyond its general advice to adopt a “risk-based” compliance approach, OFAC offers detailed advice on the following:
- the essential characteristics of an effective sanctions screening program, such as the use of “fuzzy” logic;
- the expectation that a strong compliance program uses geolocation and IP address blocking controls;
- know-your-customer procedures which will involve reviewing all information gathered in the ordinary course of business;
- the expectation that higher risk transactions will be subject to increased due diligence;
- the value of transaction monitoring software; and
- examples of red flag indicators.
All of these characteristics are worth reading by those responsible for enforcing sanctions in all sectors at risk of economic sanctions.