MSTR Cat

Crypto Law/Level I · What crypto is in law/1.3 Who's who/Lesson 5

OFAC and sanctions

How US sanctions reach wallets, why a business can be liable without meaning to break them, and what the Tornado Cash litigation did and did not change.

Education, not legal, tax or investment advice. Crypto law differs between countries and states and changes often. Check the current rules where you live with a qualified lawyer or tax adviser before you act.

The lean path

The cheapest, lowest-tax, simplest and most private route the law allows, best first. Each step names the rule it rests on and the condition that keeps it lawful.

  1. Screening a counterparty in OFAC’s Sanctions List Search is free and takes a minute before any large peer-to-peer deal; a clean result is not a guarantee, because address lists are incomplete and whole countries such as Iran and North Korea are embargoed.
  2. If you discover a possible violation, a voluntary self-disclosure to OFAC is free and, under its Economic Sanctions Enforcement Guidelines, reduces the base penalty; it must come before OFAC learns of the matter elsewhere.
  3. If blocked crypto lands in your control, freezing it and reporting to OFAC within 10 business days, then annually, keeps a business compliant; applying for a specific licence to release funds is free, though decisions can be slow.
  4. Under Van Loon (5th Cir., 26 November 2024), immutable smart contracts are not blockable property, and Tornado Cash was delisted on 21 March 2025; the ruling binds only that circuit, and dealing with designated persons remains prohibited.

MaterialsOFAC’s Sanctions List Search tool (sanctionssearch.ofac.treas.gov)OFAC’s Sanctions Compliance Guidance for the Virtual Currency Industry (October 2021)The Fifth Circuit’s opinion in Van Loon v. Department of the Treasury, No. 23-50669 (26 November 2024)

Wonder

  1. Can a crypto wallet address be sanctioned?
  2. Can I break sanctions law without knowing who was on the other side?
  3. After the Tornado Cash case, can the US still sanction crypto tools?

Explore

  1. The Office of Foreign Assets Control (OFAC), part of the US Treasury, runs economic sanctions: legal measures that cut named countries, groups and people off from the US financial system. Its main list is the Specially Designated Nationals and Blocked Persons List (SDN list). US persons generally may not deal with anyone on it and must ‘block’, or freeze, property of listed persons that they hold. Much of this power comes from the International Emergency Economic Powers Act (IEEPA) of 1977, which lets the President act against foreign threats to national security.
  2. OFAC says sanctions obligations are the same whether a payment uses crypto or ordinary money. On 28 November 2018 it publicly attributed digital currency addresses to designated people for the first time: two Iran-based men tied to the SamSam ransomware scheme. Addresses now appear as identifiers in many SDN entries, but OFAC warns that the lists are not likely to be exhaustive. A business that finds it holds crypto belonging to a listed person must block it and report it to OFAC within 10 business days, then annually while it stays blocked.
  3. OFAC’s October 2021 guidance for the crypto industry explains that civil penalties are generally based on strict liability: a US person can be liable even without knowing, or having reason to know, that a transaction broke sanctions, although OFAC weighs all the circumstances when deciding a penalty. On 28 November 2022 the exchange Kraken settled for $362,158.70, plus $100,000 to invest in compliance, after users who appeared to be in Iran used its platform; OFAC noted it had not used IP-address blocking to stop them. Binance’s November 2023 settlement included $968 million to OFAC.
  4. On 8 August 2022 OFAC designated Tornado Cash, a ‘mixer’: software that pools many deposits so that the link between sender and recipient is hard to trace. Users of the service sued. In Van Loon v. Department of the Treasury, decided on 26 November 2024, the US Court of Appeals for the Fifth Circuit held that Tornado Cash’s immutable smart contracts, code that no one can change or control, are not ‘property’ under IEEPA, so OFAC could not block them. On 21 March 2025 Treasury removed Tornado Cash from the SDN list while saying it remained concerned about North Korean hacking.
  5. The Van Loon ruling is narrow. It binds federal courts in Texas, Louisiana and Mississippi, and it concerned code nobody controls; people and companies, including those who run mixers, can still be designated, and the country-wide sanctions on places such as Iran and North Korea still apply. Criminal cases are separate: the prosecution of Tornado Cash developer Roman Storm went ahead after the delisting (lesson 1.3.4). Other governments, including the UK, the EU and the United Nations, keep their own sanctions lists, which do not always match OFAC’s.
  6. For an ordinary holder, the main risk is receiving funds from, or sending them to, a sanctioned person or place. Platforms freeze accounts, block certain countries and screen addresses because the penalties fall on them even without intent, and a frozen deposit can take a long time to release. A practical check: before a large trade with a stranger, search the counterparty’s name in OFAC’s Sanctions List Search, and remember that a clean result is not a guarantee, because address lists are incomplete and sanctions also cover whole countries.

Key facts

  • On 28 November 2018 OFAC publicly attributed digital currency addresses to designated individuals for the first time.
  • OFAC may impose civil penalties for sanctions violations based on a strict liability standard.
  • Blocked virtual currency must be reported to OFAC within 10 business days and annually thereafter while it remains blocked.
  • On 28 November 2022 Kraken agreed to pay $362,158.70 to settle apparent violations of Iran-related sanctions.
  • On 26 November 2024 the Fifth Circuit held in Van Loon v. Department of the Treasury that Tornado Cash’s immutable smart contracts are not property under IEEPA.
  • Treasury removed Tornado Cash from the SDN list on 21 March 2025.

Exercise nine, six, three, one

9CollectList up to 9 ways crypto could reach or leave you, such as an exchange account, a peer-to-peer trade, a payment from a stranger, a bridge, a mixer or an overseas platform (some lists are shorter).
6ClusterSort them into 6 categories: regulated US platforms, overseas platforms, peer-to-peer trades, decentralised protocols, privacy tools, and routes you cannot trace.
3DistillReduce the 6 to 3 groups: routes where someone else screens for sanctions, routes where nobody screens, and routes where you cannot tell.
1CrystallizeWrite 1 sentence explaining, in your own words, what the Van Loon decision changed and what it left in place.

Fact check

Dates, figures and claims checked against the published sources listed below.

Open in the interactive academy →

PT ES ZH JA KO RU DE FR MS