Sanctions Screening for Crypto

Sanctions compliance is among the most serious legal obligations facing crypto exchanges, custodians, and other virtual asset service providers. Unlike many regulatory requirements — which have grace periods, transition regimes, and safe harbours — sanctions violations carry strict liability: a VASP that processes a transaction involving a sanctioned party violates the law regardless of intent, and criminal penalties can be severe. The application of US sanctions to crypto has been tested in landmark litigation involving the Tornado Cash mixer, generating important legal clarity about what can and cannot be sanctioned in a decentralised environment.

OFAC and the SDN List

The US Office of Foreign Assets Control (OFAC) administers and enforces economic and trade sanctions programs against targeted foreign countries, entities, and individuals. The Specially Designated Nationals and Blocked Persons List (SDN list) is OFAC’s primary published list of sanctioned parties. US persons — which, for sanctions purposes, includes entities organised under US law and their foreign branches — are generally prohibited from conducting transactions with SDN-listed parties, regardless of where those transactions occur.

OFAC began designating crypto addresses to the SDN list in 2018, adding Bitcoin and Ether addresses associated with Iranian nationals, North Korean actors, ransomware operators, and other sanctioned parties. VASPs are required to screen incoming transactions against known sanctioned addresses and to block or reject transactions involving those addresses. This requires real-time screening against an up-to-date list of sanctioned addresses, which is technically feasible using blockchain analytics tools.

The Tornado Cash Sanctions

The August 2022 designation of Tornado Cash — an Ethereum-based mixing protocol — by OFAC was the first-ever sanctioning of an autonomous smart contract rather than a person or organisation. Tornado Cash is a smart contract protocol that accepts deposits of Ether and other tokens and allows withdrawal of equivalent amounts from a common pool, obscuring the on-chain link between deposit and withdrawal. OFAC alleged that Tornado Cash had been used to launder more than $7 billion in crypto, including funds stolen by the North Korean Lazarus Group.

The legal question the designation raised was novel: can immutable smart contract code — software that no individual controls or can modify — be sanctioned under a framework designed to prohibit transactions with foreign persons and entities? OFAC’s designation listed specific Tornado Cash smart contract addresses, effectively prohibiting US persons from interacting with the code itself.

The 5th Circuit Ruling

In November 2024, the US Court of Appeals for the Fifth Circuit, in Van Loon v. Department of the Treasury, issued a partial ruling on the Tornado Cash sanctions. The court held that immutable smart contracts — code that cannot be altered or controlled by any person after deployment — cannot be “property” of a foreign national for purposes of OFAC’s sanctions authority under IEEPA, because there is no person with a property interest in the code. The court therefore held that OFAC had exceeded its statutory authority in sanctioning the Tornado Cash immutable pool contracts, and vacated those specific designations.

The court explicitly distinguished the immutable pool contracts from mutable components of Tornado Cash (such as the protocol’s governance structure and multisig wallet, which remained sanctioned) and from natural persons associated with Tornado Cash (several of whom had been criminally charged separately). The ruling did not create a general immunity for DeFi from OFAC sanctions; it addressed only the specific legal question of whether immutable code can constitute sanctionable “property.”

Compliance Obligations for VASPs

For VASPs, the practical sanctions compliance obligation involves screening transactions against OFAC’s published crypto address list and against additional addresses identified by blockchain analytics tools as associated with sanctioned entities (including addresses not yet on the formal SDN list but identified as belonging to sanctioned parties by analytics). VASPs must maintain compliance programmes that include: sanctions screening at onboarding and for each transaction; procedures for blocking or rejecting transactions that match sanctioned parties; filing of blocked transaction reports with OFAC within 10 business days; and record-keeping of blocked and rejected transactions.

The DeFi Problem

The Tornado Cash case illustrates the fundamental challenge of applying jurisdiction-based sanctions to decentralised protocols. Where there is no intermediary — where the smart contract itself is the service — it is unclear who bears the sanctions compliance obligation. OFAC’s position that users of Tornado Cash (US persons who deposited into the protocol) were potentially in violation prompted significant concern, since many users may have had legitimate privacy reasons for using the mixer. The legal landscape for DeFi sanctions compliance remains unresolved following the 5th Circuit ruling.