Get Ready for Crypto Sanctions Enforcement

[PRIBO247]

For the past year, the cryptocurrency industry’s attention has
focused on the Securities and Exchange Commission’s
deliberations over how to enforce U.S. securities laws. But the
past two months have seen important developments on a new
regulatory front: the application of U.S. sanctions laws by the
Treasury Department’s Office of Foreign Assets Control (OFAC).

Last week, OFAC sanctioned two Iranian individuals for
cyberattacks against U.S. networks. For the first time ever, OFAC
targeted both the individuals who committed the offense and their
associated bitcoin addresses.
OFAC is announcing a clear message to the industry: comply with
sanctions laws or pay the price.

Crypto industry, meet OFAC

Economic sanctions result from U.S. government policy decisions
that certain countries, governments, individuals, or companies
shouldn’t be allowed to transact with “U.S. persons.” The category
of “U.S. persons” is expansive: it includes U.S. citizens and
permanent residents anywhere in the world, non-U.S. nationals
within the United States, and entities incorporated under U.S. law
(as well as their foreign branches).

OFAC has broad authority to impose sanctions based on perceived
threats to U.S. national security. OFAC typically imposes “primary
sanctions” by prohibiting U.S. persons from directly or indirectly
transacting with a sanctioned party, in addition to “secondary
sanctions” based on a non-U.S. person’s transactions with other
sanctioned parties.

Some sanctions are nearly absolute, such as those prohibiting
almost all transactions with countries like Iran, while other
sanctions are nuanced, like those prohibiting certain transactions
with Venezuela related to certain debt transactions. Sanctions
violations are punishable as civil or criminal offenses and can
result in steep fines.

OFAC COMPLIANCE AND ENFORCEMENT   

Unlike many regulatory agencies, OFAC doesn’t impose formal
compliance obligations. Instead, it oversees a “strict liability”
regime: even unintentional sanctions violations are punishable
under the law, no matter the time or resources a company devotes
to compliance. That said, those with a strong compliance program
will have better odds of convincing OFAC to take a lenient
approach toward potential violations.

To help companies build out their sanctions compliance programs,
OFAC publishes a variety of policy statements, FAQs, brochures,
advisories, and press releases. OFAC also offers compliance
suggestions for stakeholders in specific industries.
For example, OFAC advises companies involved in online
commerce to “develop a tailored, risk-based compliance program”
including the use of sanctions list screening software. Similarly,

OFAC recommends that money transmitters block IP addresses
from sanctioned jurisdictions, gather detailed customer
identification information, and record a “purpose of payment” for
every transaction.
To fill the gaps left by its public statements, OFAC also engages in
“guidance by enforcement,” detailing specific violations and the
mitigating and aggravating factors that it considered in
determining an appropriate fine.

In 2015, for example, OFAC announced a settlement with PayPal
over approximately $44,000 in transactions that violated various
sanctions programs. The settlement described numerous
compliance missteps, including PayPal’s failure to screen
accountholders against the sanctions list. It required PayPal to
pay over $7 million and underscored to payment processors and
money transmitters the importance of compliance – even for
relatively low-value transactions.

OFAC ON CRYPTO

While other U.S. federal agencies have been commenting on the
rise of cryptocurrencies for years, OFAC long remained silent
despite requests from crypto industry stakeholders for clarity on
U.S. sanctions laws. This year, OFAC began to weigh in.
In March, OFAC responded to the Venezuelan government’s launch
of its own cryptocurrency–the Petro–by prohibiting U.S. persons
from engaging in transactions with that asset. OFAC also issued
FAQs noting that U.S. persons’ sanctions obligations are the same
“regardless of whether a transaction is denominated in a digital
currency or traditional fiat currency” and flagging that it may add
cryptocurrency addresses to the sanctions list in the future.

In October, in light of the U.S. government’s decision to withdraw
from the Iran nuclear deal and re-impose certain sanctions against
Iran, the Treasury Department issued an advisory warning
businesses about Iran’s efforts to fund illicit activities abroad. The
advisory described the Iranian regime’s practice of circumventing
financial restrictions by transacting in precious metals, misusing
exchange houses, counterfeiting currency, and transacting in
“virtual currencies.”

In warning about the risks of cryptocurrencies, the advisory
recommended specific compliance steps for crypto companies,
including “reviewing blockchain ledgers for activity that may
originate or terminate in Iran,” using software to “monitor open
blockchains,” and screening customers against the sanctions list.
Last week’s designation of two Iranians who executed
ransomware attacks on U.S. companies was OFAC’s first action in
direct relation to crypto. In a press release, OFAC trumpeted the
designation, highlighting that it had identified those individuals’
bitcoin addresses “for the first time” in order to “assist those in
the compliance and digital currency communities in identifying
transactions and funds that must be blocked and investigating any
connections to these addresses.”

OFAC also released additional FAQs addressing crypto companies’
obligations to block sanctioned persons and Treasury Under
Secretary Sigal Mandelker said the Department “will aggressively
pursue Iran and other rogue regimes attempting to exploit digital
currencies.”

GET READY FOR MORE   

OFAC’s recent actions illustrate the U.S. government’s renewed
focus on stopping authoritarian regimes–Venezuela, Iran, North
Korea, and others–from using cryptocurrencies to evade U.S.
sanctions. The crypto industry now finds itself caught in the
middle of several intense geopolitical conflicts.

SO, WHAT'S A CRYPTO COMPANY TO DO?   

* First, take compliance seriously. As OFAC has noted, all the
compliance obligations are the same regardless of whether a
transaction involves digital or fiat currency.

* Second, understand the risks. Because OFAC doesn’t require
specific compliance efforts, companies aren’t obligated to screen
customers against the sanctions list or restrict user access in
certain environments. But, companies should know that they
ignore these risks at their peril.

* Third, expect enforcement. OFAC, like many government agencies,
provides guidance in part by publicizing its enforcement actions.
It will be no surprise when OFAC begins to bring enforcement
actions in 2019 against those who transact in cryptocurrencies
without respecting U.S. sanctions.

Source : https://www.coindesk.com