Sanctions, Export Controls, and Cross-Border Compliance
This domain tests how US sanctions and export controls reach virtual currency activity. The central idea is that digital assets do not escape controls that apply to money and services, and that OFAC jurisdiction follows US persons, US-nexus transactions, and property touching the United States.
OFAC fundamentals
- Sanctions are strict liability; intent is not required for a violation.
- US persons must block property of designated persons, reject prohibited transactions, and report blocked property to OFAC, generally within 10 business days.
- The 50 percent rule treats entities owned 50 percent or more, directly or indirectly, by one or more blocked persons as blocked themselves.
- OFAC has designated virtual currency exchanges and addresses, including SUEX in 2021 for facilitating ransomware payments, and requires screening of wallet addresses and counterparties.
Export controls
- The Export Administration Act and EAR regulate exports of items and technology, including certain encryption and mining hardware, and deemed exports to foreign nationals in the United States.
- Sanctioned destinations and persons remain off-limits for services as well as goods; a virtual currency payment does not make a prohibited service lawful.
Cross-border reality
A firm may face simultaneous US, EU, and UK obligations. Sanctions screening should cover onboarding, ongoing transactions, blockchain analytics alerts, and geolocation and IP indicators.
Worked example
An exchange finds that an incoming deposit originated from an address on the SDN list. The firm should block the funds, avoid returning them to the sender, file the required OFAC report, screen related accounts, and consider a SAR. Returning the funds would itself be a prohibited transfer to a blocked person.
Traps
- Assuming a non-US entity has no OFAC exposure because it is offshore.
- Relying on a customer's explanation instead of address screening.
- Treating sanctions screening as a one-time onboarding step.