OFAC Sanctions and Cryptocurrency

The Office of Foreign Assets Control (OFAC) is one of the most powerful financial enforcement agencies in the world, and its rules can apply to cryptocurrency activity. US persons and others whose activity is subject to OFAC rules — including relevant exchanges, payment processors, and individual holders — need to understand how sanctions apply to digital assets. OFAC may impose civil penalties without knowledge of a violation; criminal exposure depends on the governing law and generally involves willful conduct.

What Is OFAC?

OFAC is a division of the US Department of the Treasury responsible for administering and enforcing economic and trade sanctions based on US foreign policy and national security objectives. The agency maintains several sanctions lists, the most significant being the Specially Designated Nationals and Blocked Persons List (SDN List).

The SDN List identifies individuals, entities, and organizations that US persons are prohibited from transacting with. When a person or entity is designated, all of their property and interests in property within US jurisdiction are blocked (frozen), and US persons are generally prohibited from dealing with them. Civil and criminal penalties can be substantial, but the available penalty and legal standard depend on the sanctions program and governing statute.

OFAC's jurisdiction is broad. It covers all US persons — including citizens and lawful permanent residents wherever located, people and entities in the United States, and entities organized under US law, including their foreign branches. Depending on the sanctions program and the facts, non-US activity involving the United States, US persons, or US-exported goods or services can also be covered. For stablecoins, the actual US nexus matters; merely using a USD-pegged token does not decide jurisdiction.

The SDN List and Cryptocurrency Addresses

In November 2018, OFAC made regulatory history by adding cryptocurrency addresses to the SDN List for the first time. Two Bitcoin addresses associated with Iranian nationals were designated, marking the beginning of direct enforcement against blockchain-based assets. Since then, OFAC has designated hundreds of cryptocurrency addresses across multiple blockchains.

OFAC can list a digital-currency address as an identifier for a blocked person. US persons must not engage in prohibited transactions with blocked persons and must block property and interests in property when required by the applicable sanctions rules. An exchange or individual holder subject to those duties must apply them to virtual currency in its possession or control. A company behind a stablecoin may separately restrict its token under applicable obligations or company policy, but a designation does not itself execute an on-chain freeze.

Designations cover a wide range of illicit activities: North Korean state-sponsored hacking groups (notably the Lazarus Group), Russian ransomware operators, Iranian sanctions evaders, and criminal organizations worldwide. OFAC regularly updates the SDN List with new cryptocurrency addresses as investigations progress.

The Tornado Cash Case

The Treasury Department's August 8, 2022 designation of Tornado Cash stands as one of the most significant and controversial OFAC actions in cryptocurrency. Tornado Cash is an Ethereum-based mixing protocol that allows users to deposit assets and withdraw them to a different address, breaking the on-chain link between sender and receiver.

OFAC added Tornado Cash smart-contract addresses to the SDN List, with Treasury stating the protocol had been used to launder more than $7 billion since 2019, including funds linked to North Korea's Lazarus Group. The industry treated this as a major escalation. Circle blacklisted USDC held in Tornado Cash-related addresses, GitHub removed the project's repositories, and many DeFi front ends blocked associated addresses.

The legal picture then shifted. In November 2024, the Fifth Circuit ruled that OFAC had exceeded its statutory authority with respect to Tornado Cash's immutable smart contracts. On March 21, 2025, Treasury removed the Tornado Cash addresses from the SDN List.

The episode remains significant despite the delisting. It is a useful case study in separating a current official designation from historical issuer actions and in assessing mixer exposure with the transaction context and legal status that applied at the relevant time.

Compliance Obligations for US Persons

OFAC sanctions apply to all US persons, not just financial institutions. Individual cryptocurrency holders are subject to applicable prohibitions and blocking and reporting requirements, although the required action depends on the program and facts. Key points include:

Screening transactions. OFAC does not prescribe an identical workflow for every wallet user. In practice, businesses screen counterparties and monitor exposure to designated persons. Individual users reduce risk by checking destinations against current sanctions data before large or recurring transfers.

Blocking property. If, as a US person, you determine that virtual currency in your possession or control is required to be blocked under applicable OFAC rules, you must deny access to it and report it to OFAC within 10 business days. An individual holder cannot move blocked funds; an exchange must prevent access to the blocked property it controls.

Reporting. A person holding blocked property must file an initial report within 10 business days and an annual report while the property remains blocked. A transaction rejected rather than blocked because OFAC rules prohibit processing it must also be reported within 10 business days.

Strict liability. OFAC may impose civil penalties on a strict liability basis. A person can therefore face civil liability for a prohibited transaction without knowing that the transaction violated sanctions. OFAC considers the full facts and circumstances when deciding its enforcement response, and it encourages a risk-based approach in its virtual currency industry guidance.

OFAC Compliance Guidance for Crypto Businesses

Cryptocurrency businesses that are subject to OFAC rules must comply with applicable prohibitions and blocking, reporting, and recordkeeping duties. OFAC encourages companies in the virtual-currency industry to develop, implement, and routinely update a tailored, risk-based sanctions compliance program. Its 2021 virtual currency guidance describes five essential components for such a program:

Management commitment. Senior leadership should support and resource a program that fits the business's sanctions risk.

Risk assessment. A tailored program should evaluate the business's customer base, geographic exposure, products, services, and other relevant risk factors.

Internal controls. These are the policies, procedures, and tools that operationalize the risk-based program. Depending on the business, they may include screening, transaction monitoring, and procedures for escalating and investigating alerts.

Testing and auditing. Risk-based testing or auditing helps determine whether the program works as designed and where it needs improvement.

Training. Relevant personnel should receive training appropriate to their role and the business's risk profile, updated when the program or risks change.

Beyond the SDN List: Secondary Sanctions and Emerging Risks

OFAC's reach extends beyond the SDN List. Some sanctions programs authorize secondary sanctions against non-US persons for specified conduct, which can include facilitating significant transactions for sanctioned persons. Non-US exchanges should assess the rules and facts that apply to them rather than assuming every transaction creates the same exposure.

Decentralized exchanges and cross-chain bridges can complicate sanctions analysis because assets can move through multiple protocols and networks. The Tornado Cash case — including the Fifth Circuit ruling and March 2025 delisting — also shows why a reviewer should distinguish current official status from historical designations and token actions.

For crypto businesses operating globally, the intersection of OFAC sanctions with EU, UK, and UN sanctions regimes adds complexity. Addresses sanctioned by one jurisdiction may not be sanctioned by another, requiring businesses to maintain compliance across multiple overlapping frameworks.

A risk-based program may call for ongoing monitoring beyond the SDN List when the business's exposure warrants it. Addresses associated with sanctioned persons can change as funds move. The appropriate screening, transaction-monitoring, and reassessment cadence depends on the business's products, customers, geography, and other risks.

Frequently Asked Questions

What is OFAC in cryptocurrency?
OFAC is the Office of Foreign Assets Control, a US Treasury division that enforces economic sanctions. It can list digital-currency addresses as identifiers for blocked persons. US persons must not engage in prohibited transactions with blocked persons and must block property and interests in property when required by applicable OFAC rules.

Can individuals be penalized for OFAC sanctions violations in crypto?
Individuals subject to applicable OFAC rules can face civil penalties even without knowing that their conduct violated sanctions. Criminal penalties may apply to willful violations; the available penalties depend on the governing sanctions authority.

Is Tornado Cash still sanctioned by OFAC?
No. The Fifth Circuit issued a ruling concerning immutable smart contracts in November 2024, and Treasury removed the Tornado Cash addresses from the SDN List on March 21, 2025. A historical interaction does not by itself establish a current sanctions match, purpose, or wrongdoing.

What should crypto businesses do to comply with OFAC sanctions?
Businesses must identify which OFAC rules apply to them and comply with applicable prohibitions and blocking, reporting, and recordkeeping duties. OFAC encourages virtual-currency firms to maintain tailored, risk-based programs. Its framework identifies five essential components: management commitment, risk assessment, internal controls, testing and auditing, and training. Screening and monitoring should match the business's risk profile rather than a universal workflow.