Increasingly Strengthened Cryptocurrency Regulation Under OFAC Sanctions

Original Title: “The Surge of Virtual Currency Regulation and Friction”

Author: Fu Zhuorui, Rhythm

Perhaps no one expected that the sanctions imposed by OFAC on the privacy trading application Tornado Cash a few weeks ago could trigger such a large-scale chain reaction, from blocking addresses on the front end of DeFi applications, to the arrest of developers, and then to the impact on the censorship resistance of Ethereum, the world's largest decentralized ecological network. The severity of the situation has far exceeded expectations.

You may wonder why cryptocurrency is facing regulation again, but this time it even affects the foundation of the network. What is different about this round of sanctions?

What is OFAC?

Established in 1950, the Office of Foreign Assets Control (OFAC) is an agency of the U.S. Department of the Treasury, primarily responsible for economic or trade sanctions against foreign individuals and organizations that oppose U.S. interests. It has significant power, relatively small notoriety, and its sanctions have clear effects; being placed on the OFAC list often brings profound impacts to the sanctioned targets.

The establishment of OFAC originated from a bill passed by Congress in 1977—the International Emergency Economic Powers Act (IEEPA). This act must first comply with the U.S. Constitution, so actions taken under the act must also conform to the Constitution. IEEPA grants the President (the national executive) the authority to declare a national emergency, thereby preventing individuals and organizations under U.S. jurisdiction from engaging in any activities involving foreign forces that harm U.S. interests. IEEPA grants OFAC the power to block property, with its core focus being "property." After 9/11, to better financially combat terrorist organizations, then-President Bush pushed Congress to pass another bill, the USA PATRIOT Act, which effectively expanded the administrative powers outlined in IEEPA and granted OFAC significant authority. This act allows OFAC to block property that is "under investigation" without needing to provide explanations or concrete evidence.

Before OFAC began wielding its sanctions against the cryptocurrency and blockchain industry, its traditional targets were generally individuals and organizations related to sovereign states that ideologically challenge the U.S. In October 2021, OFAC released a compliance guide for the virtual currency industry, reiterating the types of sanctions it imposes, which fall into four categories: i) broad trade sanctions and blockades, primarily targeting Iran, North Korea, Cuba, Syria, and the Crimea region; ii) sanctions against governments or regimes; iii) list-based sanctions (many sanctions in the virtual currency industry follow this model); iv) industry-specific sanctions targeting certain foreign industries.

The first category of sanctions is fundamental, but OFAC flexibly uses various sanctions to block all foreign trade and economic activities of certain sovereign states or regions. Readers who have traveled to places like Iran or North Korea may have felt that international banking transactions cannot be used in those countries, and all transfers involving citizens of those countries cannot go through SWIFT transactions. Since 1979, the U.S. has imposed comprehensive sanctions on Iran, prohibiting direct trade between the U.S. and Iran, banning the sale of aircraft parts to Iranian airlines, and prohibiting oil trade. OFAC has also directly frozen and confiscated the overseas assets of Iranian leaders, listing over 700 Iranian-related entities on the Specially Designated Nationals List (SDNs), among other actions. These sanctions have far-reaching effects, severely damaging Iran's economy and isolating it from the global economy. The temporary extradition of Meng Wanzhou was partly justified by investigating whether Huawei helped Iran evade sanctions. Currently, OFAC is investigating the largest cryptocurrency exchange, Kraken, a probe that began in 2019 due to allegations that Kraken was evading sanctions against Iran. Additionally, OFAC has sanctioned many individuals or entities attempting to circumvent sanctions. In March 2020, OFAC announced sanctions against two Chinese individuals for allegedly helping North Korea's Lazarus Group launder money through cryptocurrency. Most sanctions are related to the first category, with the rationale being that certain actions in a specific industry involve sanctioned countries, regardless of whether the actions were intentional or unintentional, whether they occurred within the U.S. or outside it, or whether there is evidence or not.

The process and cases of OFAC sanctions on cryptocurrency involve five elements of compliance (sanctions compliance program, SCP): i) management obligations; ii) risk assessment; iii) internal controls; iv) testing and auditing; and v) training. Overall, OFAC has high expectations; for companies to comply, there needs to be a top-down awareness of compliance and risk, with dedicated personnel and departments handling OFAC compliance matters internally, and they must be cautious not to inadvertently or unpreparedly cross OFAC's red lines. Entities on the SDN list can change their behavior, actively deploy compliance measures, and then apply to OFAC for removal from the list. OFAC has made it clear that the purpose of sanctions is not to eternally punish certain individuals or organizations but to urge them to change their behavior and increase compliance. Therefore, each year, OFAC also removes many individuals and organizations that have made changes from its website.

In recent years, with the rise of decentralized cryptocurrencies and trading platforms, OFAC's sanctions have increasingly entered this industry. Although the theoretical essence of cryptocurrency is decentralization, many important trading platforms are compliant companies based in the U.S., and their founders may have ties to U.S. interests. Even if a trading platform has no connection to the U.S., as long as transactions involve terms like "Iran" or "North Korea," which oppose OFAC's established sanctions, there is a high likelihood of being sanctioned by OFAC.

In September 2021, OFAC announced sanctions against a cryptocurrency trading platform operating in Russia, listing it as an SDN due to its alleged facilitation of money laundering for cyberattacks and its involvement with at least eight variants of ransomware. In April 2022, OFAC sanctioned the mining company Bitriver for helping the Russian government evade sanctions. In May 2022, OFAC announced sanctions against a cryptocurrency mixing platform, Blender.io, for helping the North Korean government launder money, specifically aiding the aforementioned Lazarus Group in laundering over $20.5 million. OFAC froze all of Blender's assets in the U.S. and prohibited U.S. individuals and entities from transacting with Blender.

Additionally, OFAC frequently updates its list of newly sanctioned individuals, including Iranians, Russians, and Chinese, as they use cryptocurrency to help sanctioned countries launder money. There are also cases of individuals using decentralized trading platforms to move criminal funds.

Before OFAC sanctioned Tornado Cash, the wallets and individuals listed by OFAC had a certain degree of "legitimacy," conforming to the logic of OFAC sanctions and primarily targeting centralized individuals and groups related to specific sanctioned countries like Iran, North Korea, and Russia. Although there were complaints within the cryptocurrency industry, no logical loopholes were found.

The Legitimacy and Illegitimacy of OFAC's Sanction on Tornado Cash

In August 2022, OFAC added the cryptocurrency mixing platform Tornado Cash to the SDN list, announcing sanctions against 44 related Ethereum and USDC wallet addresses, citing the mixer’s involvement in money laundering involving over $7 billion in virtual currency. This sanction stirred waves within the cryptocurrency community.

This sanction differs from the earlier sanction against Blender.io; sanctioning Tornado Cash does not equate to sanctioning an "entity." When sanctioning Blender, OFAC detailed several websites and dozens of Bitcoin wallet addresses related to Blender, and Blender is a centralized entity. However, Tornado Cash is not a centralized mixer, which raises questions about OFAC's authority to sanction "entities" and makes it very difficult to sanction decentralized smart contracts like Tornado Cash. After the sanctions, U.S. citizens will be unable to use Tornado Cash.

Due to the generally opaque nature of OFAC sanctions, it is unclear from their website exactly who is being sanctioned regarding "Tornado Cash." Is it an entity controlled by natural persons called Tornado Cash, or the entity that owns and operates the website, or the entity involved in fundraising? Because of Tornado Cash's decentralized nature, the virtual currency wallets listed in the sanctions do not necessarily indicate that there are entities, legal persons, or natural persons behind these sanctioned wallets that can be sanctioned. Wallets installed on Ethereum smart contracts can operate without human control, automatically mixing based on code. There is no evidence that the natural persons or legal teams that deployed Tornado Cash still control the program. In the logic of Tornado Cash, mixing users can come from all over the world, but there is no central review team or mechanism to identify these clients. This is not necessarily due to intentional negligence but rather because the system and algorithms automatically perform decentralized matching and processing. In this case, some lawyers question whether OFAC can list an automated protocol on the SDN and whether this situation is unconstitutional.

If the sanctioned Tornado Cash is an entity, that entity can argue against OFAC's sanctions through legal means and file a lawsuit in federal court. Since only entities can file lawsuits, only entities can petition for removal from the SDN list. Therefore, is it unfair to sanction an entity without a central organization? At the same time, sanctioning related wallets does not change the behavior of the automated algorithm conducting transactions. Does this mean that the sanctions violate OFAC's original intention of prompting an organization or individual to change their behavior?

The cryptocurrency think tank Coin Center believes that OFAC's sanctioning of Tornado Cash exceeds the organization's authority, as the sanctions do not effectively change behavior and do not target "entities." Ultimately, it does not fall within the scope of blocking "property" as defined by IEEPA and does not provide the procedural due process requirements mandated by the U.S. Constitution. Therefore, OFAC's actions exceed the administrative powers granted by IEEPA.

Kraken CEO Jesse Powell believes that OFAC's sanctioning of Tornado Cash may be "unconstitutional." After the Dutch government detained Tornado Cash founder Alex Pertsev, over 50 people protested in Amsterdam on August 20, demanding Pertsev's release. Currently, lawyers questioning OFAC's sanctions are organizing efforts to contact OFAC and attempt to legally promote protests and lawsuits.

The Future of Regulation and Ethereum Forks

Currently, Ethereum, which is in the spotlight due to the potential for a fork, may also confront OFAC. If one day OFAC wants to review or sanction Ethereum after it transitions to PoS (Proof of Stake), is that possible? OFAC can sanction "entities" that provide services to Ethereum, but sanctioning a decentralized protocol will face similar challenges. In response to this issue, Ethereum founder Vitalik Buterin stated on Twitter on August 16, 2022, that a censorship regime is an attack on the Ethereum protocol, and if such a situation arises, he would choose to burn his share through community consensus.

Some governments have recognized the logical issues and difficulties in regulating decentralized tools through centralized methods. In an interview with CoinDesk in August, EU Vice President Eva Kaili stated, "By design, DeFi lacks the characteristics of 'entities' in the way we are accustomed to. Therefore, in this decentralized environment, we need to reconsider our approach to what constitutes an 'entity' that would bear responsibility in cases of misconduct."

In June 2022, influenced by the collapse of UST, the EU accelerated its legislative efforts in the cryptocurrency industry, introducing the MiCA (Markets in Crypto-Assets) regulation, which requires stablecoin issuers operating within Europe to provide reasonable white papers and ensure logical feasibility. It mandates that cryptocurrency asset service providers in Europe obtain authorization to operate in the EU, with large service providers subject to oversight by the European Securities and Markets Authority. Stablecoin issuers must maintain certain reserves, among other requirements. This legislation marks a watershed moment for stablecoin regulation in Europe, with many provisions resembling regulations for traditional centralized financial service providers and banks. The EU's legislation aims to regulate decentralized content as much as possible through manageable nodes.

Despite the passage of MiCA and OFAC's actions, most activities in the decentralized market currently remain outside regulatory oversight. However, this does not mean that regulators are not paying attention to this industry. Federal Reserve Vice Chair Lael Brainard has consistently criticized the development of virtual currencies, arguing that effective regulation is needed before the industry grows larger. Federal Reserve Chairman Jerome Powell has also repeatedly stated in public that the U.S. may need a dedicated regulatory framework for virtual currencies.

In contrast, some smaller regions and countries have slightly relaxed laws. On February 28, 2022, the UAE passed a virtual asset law and established the Virtual Assets Regulatory Authority (VARA), which requires companies issuing virtual currencies to obtain a license from the UAE and states that all virtual asset companies within the UAE are regulated by VARA, without excessive provisions.

As regulatory scrutiny of the blockchain industry and cryptocurrencies intensifies, geopolitical factors and legal considerations have inevitably become more prominent in this theoretically decentralized industry. Given the increasing geopolitical factors and the rise in international activities involving money laundering through cryptocurrencies, regulators like OFAC will also enhance their regulatory measures to better achieve centralized political objectives within decentralized communities.