Virtual Assets And Sanctions: What Businesses Need To Know

As virtual assets explode in value, use, and popularity, governments around the world are taking notice, increasing sanctions-related scrutiny of companies that provide related services and focusing regulatory and enforcement oversight on these emerging systems. In recent years, the U.S. government has taken targeted enforcement action against virtual asset service providers (VASPs) that either engage in illicit activity or fail to put into place compliance programs that effectively mitigate money laundering and sanctions evasion risks. As new players in the virtual asset space continue to develop new products and services, such as those associated with decentralized finance (DeFi), the U.S. Department of the Treasury, including the Office of Foreign Assets Control (OFAC), its sanctions office, will likely in turn increase its regulatory and enforcement focus, introducing significant compliance risk. While this article focuses on sanctions enforcement by OFAC, it is important to note that other U.S. regulatory bodies also play a major part in the adoption or scrutiny of virtual assets. Those in the virtual asset space should take stock of their compliance program's ability to adhere to current and future regulatory standards, not only to mitigate potential regulatory action, but also to protect their business's integrity. 

Sanctions Exposure and Risks

While the U.S. government has focused on the illicit use of virtual currencies for almost a decade, the recent substantial increase in adoption of virtual currencies globally is of significant concern to policymakers due to its illicit financing risks. Certain virtual currencies and related products can introduce a high degree of anonymity, making it challenging to disrupt illicit networks relying on virtual assets for financing. Sanctioned entities and individuals—criminals, terrorist groups, and those acting on behalf of sanctioned jurisdictions such as North Korea—routinely try to use virtual currencies to raise and transfer funds.

As a result, U.S. regulatory and enforcement agencies have focused on ensuring that companies operating in the virtual currency space understand their compliance obligations and put into place robust compliance programs, pursuing aggressive enforcement actions against those that fail to do so. 

Recent Enforcement and Regulatory Actions Highlight the Risk

Action: In February 2021, OFAC announced a settlement with a payment-processing company that accepts virtual assets as payment for goods and services. The company allowed persons located in sanctioned jurisdictions to transact through the company with merchants in the United States using virtual assets and did not screen the location of buyers. The buyers were located in comprehensively sanctioned jurisdictions, such as Iran and North Korea.

Key Lesson: OFAC expects VASPs to conduct comprehensive sanctions screening of all available data fields on all sides of transactions, including counterparties and customers of customers, and to incorporate parties' locations/IP addresses into the transaction monitoring process. However, not all virtual asset providers are alike and sanctions compliance programs should be tailored to address risk and risk tolerance. OFAC will likely continue to take a proactive approach and increase scrutiny of VASPs for sanctions compliance programs; future enforcement actions may come with substantially larger penalties.

• Action: In April 2021, President Biden issued an Executive Order (EO) and OFAC announced designations on a foreign company and identified virtual asset addresses utilized by the company for assisting a Russian company in evading sanctions.

Key Lesson: The EO and accompanying designations identified specific virtual asset addresses used by certain sanctions targets. This identification builds on recent OFAC actions that identify virtual asset addresses and wallets considered to be the property of blocked persons and emphasizes OFAC's increased focus on the use of virtual currencies and assets in illicit activities and sanctions evasion.

• Action: OFAC established a dedicated Frequently Asked Questions page for guidance addressing compliance obligations for virtual asset providers.

Key Lesson: OFAC will continue to issue public guidance as the virtual asset space evolves and additional changes in the virtual asset landscape, such as developments in DeFi, likely result in additional regulatory changes. At times, OFAC may struggle to keep pace with the rapid rate of change in the industry. However, companies should be aware that the lack of an explicit prohibition by OFAC does not necessarily make an activity permissible or guarantee that OFAC will not pursue enforcement actions.

The FAQs clarify that sanctions compliance obligations apply to technology companies, administrators, exchangers, and users of virtual currencies and other payment processors. This makes it clear that OFAC can target any node or actor operating in the virtual asset space. Depending on the service provided by a particular company, underlying sanctions exposure may directly impact risk tolerance and obligations.

Regulatory and Enforcement Risks

The risk of dealing with sanctioned persons and jurisdictions when transacting in virtual assets will increase as criminals, terrorist groups, and sanctioned persons continue to seek new ways to illicitly move funds.

Based on OFAC's recent actions and clear focus on rooting out illicit behavior, companies operating in the virtual asset ecosystem should adhere to the following principles:

1. Expect regulatory and enforcement agencies to target “gatekeepers” in this industry, putting additional pressure on VASPs and other companies with visibility into potentially illicit transactions. Treasury has a long history of focusing its regulations and enforcement actions on key gatekeepers in certain industries. For example, by ensuring that financial institutions understand and take their compliance obligations seriously, Treasury is able to leverage its resources to more effectively root out illicit actors in the financial system. We expect that Treasury will likewise focus on certain gatekeepers in the virtual asset space, to include any exchange that offers crypto-to-fiat or fiat-to-crypto conversion. While the same regulatory requirements may apply to a range of different companies in the sector, VASPs and others with significant visibility into transactional flows will be under increased scrutiny. Such entities should develop and implement robust compliance programs.
2. Expect OFAC to use enforcement actions to signal to industry players what it considers to be prohibited. OFAC has previously used enforcement activity to signal key lessons for the private sector. For example, OFAC's recent focus on mergers and acquisitions has made clear that acquiring companies must do ongoing, post-acquisition diligence to ensure continued compliance with U.S. sanctions. We expect OFAC to use enforcement actions to signal what it considers to be impermissible activity in the virtual asset space. Such activity may include products or services that are specifically structured to obfuscate the involvement of sanctioned parties.
3. For DeFi products and services, do not assume that OFAC's silence on a certain activity means such activity is permissible. As new products and services are evaluated, OFAC will continue to make determinations as to what constitutes potential sanctions violations. As a general rule, OFAC does not look favorably on any company that proceeds with potentially prohibited activities because it believes OFAC has not yet made a clear determination. Indeed, OFAC may be more inclined to pursue enforcement actions in such a scenario because such a company likely knew that there was at least a chance such activity was prohibited and proceeded anyway.
4. Understand the nuances of U.S. sanctions regulations and properly assess your institution's risks. U.S. sanctions regulations can be exceedingly complicated and prohibitions highly fact-specific. Companies in the virtual asset space should seek guidance from trusted third parties to better understand the scope of their potential exposure in certain situations.

As the virtual asset ecosystem continues to become more mainstream, it will likely garner additional regulatory and enforcement focus. Companies in this space should ensure that they have robust compliance programs in place, and the resources to continue fueling them, to ensure that they stay on the right side of sanctions and are not faced with an enforcement action.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Janie Eng
K2 Integrity
845 Third Avenue
New York
NY 10022
UNITED STATES
Tel: [phone]
E-mail: [e-mail]
URL: www.k2integrity.com

© Mondaq Ltd, 2021 - Tel. [phone] - http://www.mondaq.com, source Business Briefing