Joe Ciccolo is the president of BitAML, Inc., a compliance service provider. Andrew Hinkes is an adjunct professor at the NYU Stern School of Business and NYU School of Law.
This article is not intended to provide, and should not be taken as, legal advice.
With just one paragraph, an agency of the U.S. government may have just radically altered the dynamics of the cryptocurrency ecosystem.
The Office of Foreign Asset Control (OFAC) announced on March 19 that it was considering including digital currency addresses associated with its list of persons and entities with whom U.S. persons and businesses are forbidden to transact business.
In a new section of its website, labeled “Questions about Virtual Currency,” OFAC noted that it “may add digital currency addresses to the SDN List to alert the public of specific digital currency identifiers associated with a blocked person.”
The list of Specially Designated Nationals (SDNs) includes individuals and entities associated with sanctioned governments, terrorism, trafficking in weapons of mass destruction, and illegal drug trafficking. This list includes varying types of records, including in some cases only names, but in other cases names, addresses, aliases, etc.
Financial institutions would be required to screen any virtual currency address provided for a transaction against a list to be provided by OFAC, and to either report, deny service to, or block transactions involving any listed addresses.
The agency’s FAQ also encourages reporting of addresses associated with listed individuals, which suggests that they intend to supplement the SDN list on an ongoing basis.
This brings up innumerable questions, a few of which we tackle below:
Who decides what addresses are added to the SDN list?
OFAC is operated by the Department of Treasury, which currently maintains and updates the SDN list. It appears that the existing SDN list will be updated to include addresses associated with individuals and entities already listed by OFAC, and that OFAC is encouraging others to provide additional data to associate addresses with listed individuals and entities.
What if a digital currency address is wrongfully associated with a blacklisted individual?
There is an appeal process available. By appealing you necessarily divulge your identity and contact information to OFAC, which will likely investigate your connection to the listed individual.
If you appeal, expect a long conversation with the regulator, and expect to provide evidence that you are not involved in whatever illicit activity is associated with that listed person or entity.
Taint by association
What happens if you receive a transaction from a listed digital currency address?
It is possible that the received coins would then be “tainted” as being linked back to a listed individual or entity, and that your identity and digital currency address may then be added to the OFAC list.
It is unclear as to whether OFAC intends to add new addresses that send or receive coins to or from listed public key addresses, but it is clear that any transaction with an illicit actor who is listed on the SDN list is prohibited and can result in penalties.
If OFAC uses blockchain tracing software to identify the counterparty to transactions with listed digital currency addresses, it may add the addresses of those counterparties to the SDN list.
This could quickly multiply the number of addresses on the SDN list and would likely include addresses for individuals and entities that are not currently there.
This may also kick off a cat-and-mouse game between OFAC and illicit actors. Can OFAC update its list as fast as illicit actors can move their funds to new digital currency addresses?
Suppose that OFAC wants to add to its SDN list any new addresses that interact with listed addresses. Does that mean that if a listed public address sends a transaction to someone else and receives change, both the recipient address and change address could be added to the OFAC list?
Probably, although it is unclear as to how much of its resources the Department of Treasury intends to devote to reading the blockchain and updating the SDN list. Arguably, it would require full-time staffing or dedicated software to track this, and the list of barred addresses would grow extremely quickly.
We will quickly know what OFAC intends to do, as it regularly updates its SDN list with new data, and rapid-fire updates to add new addresses will be obvious.
What if a digital currency address listed is an address used by a third-party custody provider, (i.e. a multisig wallet provider or a custodial exchange)?
It is unclear, but the addition of a multisig wallet provider’s digital currency address to the SDN list could affect all users of that custody provider’s service who transfer their funds to that service provider.
Customers of that multisig wallet may find that their funds may be blocked, and thus not able to be transacted through any financial institution….