Recently the U.S. Department of Treasury’s Office of Foreign Assets Control (OFAC) added Tornado Cash to its Specially Designated National List. As part of enforcement efforts, the list contains individuals and companies that have been owned or transacted with targeted countries or organizations that may prove to be a threat to the United States. This action gives rise to questions regarding “secondary” sanctions/designated risk, and the effect this policy has on smart contracts and other protocols.
What is the decision based on?
The OFAC based its decision to forbid US persons from completing transactions with the cryptocurrency entity based on Executive Order 13694. Per a Bloomberg report, “The order permits sanctions against “persons” responsible for or complicit in cyber-enabled activities that harm the US, and provide material, financial or technological support for such persons or for targeted activities.” Section 6(a) of the EO includes entity, partnership, association, joint venture, and corporation in its definition of “individual.”
President Barack Obama, under the International Emergency Economic Powers act declared Executive Order 13694 to deal with the national emergency of significant malicious cyber-enabled acts.
Virtual currency mixers that assist criminals are a threat to U.S. national security. Virtual currency mixers mix identifiable cryptocurrency funds with other funds available. The U.S. Department of Treasury sanctioned the virtual currency mixer, Tornado Cash, for laundering more than $7 billion in virtual currency since its creation in 2019. Tornado cash failed to impose effective controls designed to stop the act of laundering funds for malicious cyber actors.
In the past, the Treasury’s Financial Crimes Enforcement Network (FinCEN) has assessed a $60 million civil penalty against the owners and operators of a virtual cryptocurrency mixer for violations against the Bank Security Act (BSA) and the entities lack of implementation of strict regulation. The BSA requires any U.S financial institution to voluntarily assist the U.S government agencies to detect and prevent money laundering.
Recently, the Treasury has worked to expose components of the virtual currency ecosystem, like Tornado Cash, to implicate for violation of Executive Order 13494 and the BSA. Due to the sanctions imposed, the cryptocurrency website of Tornado Cash is no longer able to be accessed through any platforms. The goal is to prevent illicit cyber activity and other crimes.
What do entities need to do to comply with regulation?
Due to the increase in target cyber-enabled threats and ransomware attacks, the OFAC has issued sanctions pursuant to Executive Order 13694. In October 2020, the Department of Justice (DOJ) added to its Cryptocurrency Enforcement Framework, a criminal liability that was enforced for services that were found to be linked to money laundering. In 2021, the Darknet-based service, Helix, was prosecuted by the DOJ for its involvement in narcotic sales and other transactions that were illicit. The enforcement of regulations like the BSA and Executive Order has resulted in sanctions and criminal penalties for many entities.
In order to comply with regulation, a recommendation for virtual currency businesses is to review and update their Anti-Money Laundering/ Countering the Financing Terrorism (AML/CFT) programs. If services are offering anonymizing programs for their clientele, it is crucial for cryptocurrency firms to be mindful that mixers such as Tornado Cash can still be capable of being subject to sanctions. The standard used against entities such as Tornado Cash is the “strict liability” standard, meaning there is no necessity for intent, knowledge, or reason to know that there is a deal being made with a sanctioned entity, in order to be subject to a violation.
Recently, the OFAC has issues a Sanctions Compliance Guidance for the Virtual Currency Industry regarding necessary virtual currency sanctions compliance. Cryptocurrency exchanges should be cautious of the continued scrutiny of the OFAC. The sanctions placed on Tornado Cash has caused an increase debate on the role of mixers, and privacy coins in the virtual currency ecosystem and what exactly qualifies as a legitimate use of the crypto technologies.
An organization should be cautious of the cryptocurrency mixers its associated with and keep a constant watch over the OFAC published list of sanctioned “individuals” to ensure that the company is not held liable for any violations of the Executive Order or BSA.