In March 2013, the Financial Crimes Enforcement Network (FinCEN) entered the “virtual currency” space when it issued guidance on “Application of FinCEN's Regulations to Persons Administering, Exchanging, or Using Virtual Currencies.” In September 2015, the Commodity Futures Trading Commission (CFTC) defined virtual currencies, such as bitcoin, as “commodities,” under Section 1a(9) of the Commodity Exchange Act. After massive amounts of capital began to be raised from investors for initial coin offerings (ICOs), the U.S. Securities and Exchange Commission (SEC) joined the party and issued a “Report of Investigation” involving The DAO, a decentralized autonomous organization. In its report, the SEC concluded that, depending on the facts and circumstances, crypto tokens and coins can be “securities” and subject to regulation under the federal securities laws.

Now, the Office of Foreign Asset Control (OFAC) appears to be getting in on the crypto regulatory action. OFAC administers and enforces economic and trade sanctions based on U.S. foreign policy and national security goals against targeted foreign countries and regimes, terrorists, international narcotics traffickers, those engaged in activities related to the proliferation of weapons of mass destruction, and other threats to the national security, foreign policy or economy of the U.S.

In March, OFAC announced five “FAQs” related to cryptos. FAQ 559 defined “virtual currency,” “digital currency,” “digital currency wallet,” and “digital currency address.” Notably, the term “digital currency” includes sovereign cryptocurrency, virtual currency (nonfiat), and a digital representation of fiat currency. FAQ 560 clarified that OFAC obligations are the same, regardless of whether the transaction is in digital currency or traditional fiat currency. FAQ 561 puts the world on notice that “OFAC will use sanctions in the fight against criminal and other malicious actors abusing digital currencies and emerging payment systems as a complement to existing tools, including diplomatic outreach and law enforcement authorities.” In FAQ 562, OFAC stated that it may add digital currency addresses to the Specially Designated Nationals and Blocked Persons List (SDN List). FAQ 563 provides how the digital currency address field will be listed on the SDN List—the unique alphanumeric identifiers for the digital currency address and a reference to the digital currency (e.g., bitcoin (BTC), ether (ETH), litecoin (LTC), neo (NEO), dash (DASH), ripple (XRP), iota (MIOTA), monero (XMR), and petro (PTR)). Finally, FAQ 594 noted that digital wallet addresses are not currently searchable on OFAC's SDN List search tool.

The SDN List includes individuals and companies owned or controlled by targeted countries and individuals, groups, and entities, such as terrorists and narcotic traffickers. If an individual, company, or digital wallet address appears on the SDN List, their assets are blocked and U.S. persons are generally prohibited from dealing with them.

OFAC's enforcement jurisdiction is broad. It does not just apply to banks and other financial institutions. It covers all U.S. citizens and permanent resident aliens, U.S.-based companies, overseas branches of U.S. companies, and in some cases, overseas subsidiaries of U.S. companies (collectively, “U.S. Persons”). U.S. persons who violate OFAC laws and regulations can be criminally prosecuted or assessed civil penalties.

For example, in May, Texas-based Ericsson Inc. and Sweden-based Ericsson, AB (collectively, “Ericsson”), agreed to pay $145,893 for an apparent violation of Sudanese Sanctions Regulations because, based on OFAC's investigation, it appeared Ericsson employees conspired with employees of a Lebanese company to export and re-export a satellite hub and related services from the U.S. to Sudan.

In another example, in September 2017, New York-based Richemont North America Inc., d/b/a Cartier, paid $334,800 for apparent violations of the Foreign Narcotics Kingpin Sanctions Regulations when it exported shipments of jewelry to an entity in Hong Kong listed on OFAC's SDN List.

With OFAC's indication that digital wallet addresses may soon be added to the SDN List, this will add costs and risks for U.S. persons. If U.S. persons deal or transact with digital wallet addresses, they will need to run OFAC checks on the counterparty wallet address, or they risk: (1) being investigated and possibly sanctioned by OFAC; or (2) having their wallet address flagged as being associated with an SDN List entry and, as a result, possibly being added to the SDN List.

Adding digital wallet addresses to the SDN List will be like whack-a-mole. As aptly noted by a business associate, Robert Whitaker, director of forensics and investigations at Blockchain Intelligence Group, “The problem here, as we all know, is that addresses can be generated and cryptocurrency moved around very easily.” So it is unclear how effective adding digital wallet addresses to the SDN List will be to stop transactions with rogue nations, terrorists, and drug traffickers, but the approach is another tool in the government's “whole-of-government strategies to combat global threats.”

The impact on U.S. persons, however, will be significant. Another layer of letters, i.e., regulation, will be added. Business of all types (from banks and crypto exchanges to retailers) and individuals that transact in crypto will need to comply with OFAC laws and regulations. Or else …

And one more thing: you may want to bookmark https://sanctionssearch.ofac.treas.gov/ in case you need to run some OFAC searches.

Robert Long and Ross A. Williams are partners with Bell Nunnally in Dallas.