| |

OFAC adds cryptocurrency data to subject information

Nigel Morris-Cotterill

On 19th March, the USA's Office of Foreign Assets Control, a division of the US Treasury, which publishes lists of persons sanctioned under trade and economic policies, under policies that are political including but not limited to national security plus those under the USA PATRIOT Act announced that it was to include, where it has it, cryptocurrency data relating to subjects. Just what are they planning and what will it mean for crypto-currency holders and exchanges and businesses such as online auctions and advertising platforms?

OFAC confirms that compliance obligations are exactly the same as they are in relation to any other person or asset subject to control under its lists. Those subject to OFAC jurisdiction "must ensure that they block the property and interests in property of persons named on OFAC’s SDN List or any entity owned in the aggregate, directly or indirectly, 50 percent or more by one or more blocked persons, and that they do not engage in trade or other transactions with such persons." This clearly implies that risk management processes must be the same - which, because this is a new addition, actually means they increase, but only from a data management perspective (i.e. more data must be collected, analysed and reported or not and action taken or not).

But there is one major change, specifically in relation to the SDN (Specially Designated Nationals and BLocked Persons) list.

"Parties who identify digital currency identifiers or wallets that they believe are owned by, or otherwise associated with, an SDN and hold such property should take the necessary steps to block the relevant digital currency and file a report with OFAC that includes information about the wallet’s or address’s ownership, and any other relevant details."

This places an onus on persons (note, in particular, OFAC does not relate only to the financial sector - it applies to everyone in any form of commercial relationship with another person) to monitor for relevant data and make a report. Note, also, that the obligation relates to "belief" not "suspicion."

How does this relate to exchanges?

Exchanges that are subject to OFAC jurisdiction are already required to monitor for OFAC breaches. Cryptocurrencies are often held in false names which is not the same as saying they are anonymous. Therefore matching against the OFAC list is difficult. OFAC is now able to include account details because a government department has been able to connect a cryptocurrency account to a specific individual or entity. OFAC makes no comment as to how it comes by this information although publicly available documents suggest that the NSA has been working on this for a number of years. Therefore, what is now available to those subject to OFAC is data that will, in some cases, connect a false name to a person listed by OFAC.

That's the clever bit and it closes a gap that criminals and others have been able to exploit. But it is important to note that it closes the gap only in relation to those who are listed on OFAC or subject to publicised freezing orders in other jurisdictions.

Ripple Effect

OFAC has, depending on corporate structures, near-global influence. In relation to dealings in US currency, its influence is wherever inter-bank transactions are conducted in US dollars. Therefore any currency exchange that accepts US dollars in return for any cryptocurrency where payment is made through a banking transaction is subject to OFAC to some degree or other. In particular, if the OFAC listing arises out of a notice under the USA PATRIOT Act, the currency exchange could find itself listed, as have several real world banks, as being "of primary money laundering concern." That locks them out of the US Dollar system and in most cases has led to the banks failing. It almost always leads to a run on the bank.

Effect on cryptocurrencies

The first effect is that an OFAC listing is the first step towards confiscation of assets - and therefore the US Government will become, over time, a holder of cryptocurrencies and, ultimately, if it stores enough of them, could become a currency manipulator, causing increases or decreases in value at will. Perhaps an even greater risk is that the US Government fails to realise the effect it could have if it simply sells off its store of cryptocurrencies in the same way as it sells of other seized assets. What else is it to do with them - unless it formally recognises them and uses them for government purchases?

Impact on financial institutions

There is very limited impact on financial institutions either within or outside the USA. The addition of the account information is likely to be in a relatively small proportion of OFAC entries, primarily because obtaining the data is slow and complicated. Therefore in terms of quantum of additional analysis (which is computerised anyway) this is nothing to worry about. In terms of additional KYC data, financial institutions should add a data field for customers' information which includes any crypto-wallets they hold. But in reality the bad guys will lie so this is data without much value from a law enforcement perspective. However, when banks become de-facto crypto-currency exchanges, allowing payments to be made in and received by crypto-currencies, then this will become a vital source of data.