On August 8, 2022, the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced the imposition of sanctions on the decentralized digital asset mixer Tornado Cash. The action marks the first time OFAC has targeted an on-chain decentralized protocol. To date, OFAC has not issued any guidance specific to decentralized finance (DeFi) as part of its broader sanctions guidance for the “virtual currency” industry, but the Tornado Cash action lays down an important marker and makes clear that OFAC will target projects or protocols engaged in illicit activity regardless of their centralized or decentralized status. (Our prior blog post on OFAC’s general virtual currency guidance is available here).

According to OFAC, Tornado Cash was “used to launder more than $7 billion worth of virtual currency since its creation in 2019,” including over $455 million stolen by the Lazarus Group, a North Korean-backed hacking group that was previously targeted by OFAC sanctions. In announcing the action, Under Secretary of the Treasury for Terrorism and Financial Intelligence Brian Nelson explained, “Despite public assurances otherwise, Tornado Cash has repeatedly failed to impose effective controls designed to stop it from laundering funds for malicious cyber actors on a regular basis and without basic measures to address its risks.”

What Happened

Tornado Cash was added to OFAC’s List of Specially Designated Nationals and Blocked Persons (SDN List) pursuant to Executive Order (EO) 13694, “Blocking the Property of Certain Persons Engaging in Significant Malicious Cyber-Enabled Activities.” The property and interests in property of an SDN must be blocked (i.e., frozen) when within the United States or within the possession or control of a US person, and US persons are generally prohibited from dealing with SDNs.

In addition, EO 13694 authorizes the SDN designation of any person determined to have “materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services in support of … any person whose property and interests in property are blocked pursuant to this order.” While use of so-called “secondary sanctions” of this nature is discretionary, this provision means that any person, including a non-US person acting outside the United States, is at potential risk if they continue to engage in dealings with Tornado Cash.

What it Means for Developers

The action has important implications for developers of decentralized platforms. In particular, it makes clear that decentralized projects that launch without considering sanctions compliance measures may risk designation by OFAC, threatening the project’s viability and creating legal risks for those interacting with it, including the developers. While a number of questions remain with respect to OFAC’s approach to DeFi, the Tornado Cash action sends a clear message that OFAC will target projects engaged in illicit activity regardless of their centralized or decentralized status.

Decentralized protocols have historically struggled to implement or enforce sanctions compliance measures. However, developers are increasingly looking for creative solutions, including building certain user screening mechanisms into the protocol code. That is a trend that may continue as developers look for ways to safeguard their projects from future OFAC action. Under Secretary Nelson’s comments on the Tornado Cash designation suggest that the Treasury Department believes certain basic compliance measures are achievable.

What it Means for Customers and Counterparties

The Tornado Cash designation highlights the importance of carefully considering the controls in place at digital asset platforms before using the platform or interacting with the platform in another manner (e.g., sending tokens to or receiving tokens from the platform on behalf of a customer). Sanctions compliance measures vary considerably across digital asset platforms and that variance is particularly pronounced in decentralized contexts where it can be more difficult for the platform to implement measures and more difficult for third parties to obtain information on the measures in place. Fortunately, there are an increasing number of tools, including blockchain analytics, available to assist industry in assessing the relative risks associated with a given platform, including decentralized platforms.

As noted above, OFAC has also issued guidance outlining its expectations with respect to sanctions compliance measures for the “virtual currency industry.” The guidance outlines a variety of measures that should be incorporated into a robust compliance program. Among other measures, companies dealing with digital assets should conduct a detailed risk assessment that takes into account the platforms with which they interact, implement measures to identify and mitigate risky relationships, utilize transaction monitoring and investigation tools, and implement procedures to identify and act on risk indicators and red flags, some of which are enumerated in the guidance. While OFAC’s guidance does not specifically address decentralized platforms, the Tornado Cash action highlights the importance of implementing a robust sanctions compliance program across all aspects of the digital asset ecosystem.

Companies seeking further information about economic sanctions compliance obligations in the digital asset space should contact a member of Steptoe’s Economic Sanctions Practice Group or Blockchain and Cryptocurrency Practice Group.

Photo of Evan Abrams Evan Abrams

Evan Abrams counsels multinational corporations, financial institutions, and individuals on various international regulatory and compliance matters. He assists foreign and domestic companies in navigating national security reviews by the Committee on Foreign Investment in the United States (CFIUS). He has represented companies in…

Evan Abrams counsels multinational corporations, financial institutions, and individuals on various international regulatory and compliance matters. He assists foreign and domestic companies in navigating national security reviews by the Committee on Foreign Investment in the United States (CFIUS). He has represented companies in industries including semiconductors, metals, and digital security. Evan’s anti-money laundering (AML) practice focuses on helping financial institutions comply with federal and state AML rules, particularly money transmitters and entities involved in creating, exchanging, or dealing in cryptocurrencies and tokens. Evan counsels clients in a variety of export controls and sanctions matters related to the Export Administration Regulations (EAR), International Traffic in Arms Regulations (ITAR), and various sanctions programs under US and international law. In addition, Evan routinely assists clients on anti-corruption investigations and enforcement actions.

Read Evan’s full bio.

Photo of Jason Weinstein Jason Weinstein

Jason Weinstein conducts internal investigations and represents companies and individuals in high-profile criminal matters. With 15 years of experience in senior positions at the US Department of Justice (DOJ), he helps corporations and boards successfully navigate challenging government enforcement matters and defends individuals…

Jason Weinstein conducts internal investigations and represents companies and individuals in high-profile criminal matters. With 15 years of experience in senior positions at the US Department of Justice (DOJ), he helps corporations and boards successfully navigate challenging government enforcement matters and defends individuals in criminal investigations and prosecutions. He is recognized across the United States as an authority on legal and regulatory issues involving digital currencies and blockchain technology. Jason serves as co-chair of Steptoe’s White-Collar and Securities Enforcement and the Blockchain and Cryptocurrency practices. Read Jason’s full bio.

Photo of Jack Hayes Jack Hayes

Jack Hayes has extensive experience providing clients with advice and assistance under ITAR and EAR, as well as US economic sanctions and anti-boycott regulations. Jack frequently handles complex export control matters, including voluntary disclosures, internal investigations of apparent export control violations, pre-closing and…

Jack Hayes has extensive experience providing clients with advice and assistance under ITAR and EAR, as well as US economic sanctions and anti-boycott regulations. Jack frequently handles complex export control matters, including voluntary disclosures, internal investigations of apparent export control violations, pre-closing and post-closing acquisition export compliance due diligence, export control audits, and assessments of compliance obligations and risks in accordance with relevant international trade regulations. He also provides guidance on brokering requirements and reporting obligations for certain fees, commissions, and political contributions related to sales of defense articles and defense services, prepares export and reexport license and agreement applications for submission, undertakes commodity jurisdiction and export classification analyses of items and services under the ITAR and EAR, drafts registration material change notifications, and develops compliance policies, programs, and training materials.

Read Jack’s full bio.