MSTR Cat

Crypto Law/Level V · Builders and launchers/5.2 Money rules/Lesson 5

Sanctions screening and the SDN list

What a crypto business screens for, why a name check against the SDN list is only one layer, and how location data a business already holds can turn into sanctions liability.

Education, not legal, tax or investment advice. Crypto law differs between countries and states and changes often. Check the current rules where you live with a qualified lawyer or tax adviser before you act.

The lean path

The cheapest, lowest-tax, simplest and most private route the law allows, best first. Each step names the rule it rests on and the condition that keeps it lawful.

  1. OFAC’s Sanctions List Search tool and downloadable SDN list are free. Screen names and the listed digital currency addresses at signup, deposit and withdrawal, because US sanctions liability is strict.
  2. Act on the location data you already hold. Block IP addresses and physical addresses in comprehensively sanctioned regions; BitPay and Bittrex were penalised for ignoring data they had collected.
  3. Check ownership for the 50 Percent Rule, because entities owned 50% or more by blocked persons are blocked even if unlisted. A simple ownership question at onboarding handles this for business customers.
  4. Keep a short written programme with the five elements of OFAC’s 2019 framework. It can reduce penalties. Report blocked property and rejected transactions within 10 business days.
  5. Keep screening logs for ten years, the IEEPA limitation period since 24 April 2024. If you find a violation, voluntary self-disclosure halves the base penalty under OFAC’s enforcement guidelines.

MaterialsOFAC’s Sanctions List Search (sanctionssearch.ofac.treas.gov) and its ‘Digital Currency Address’ identifiersOFAC, ‘A Framework for OFAC Compliance Commitments’ (2 May 2019)OFAC’s revised guidance on entities owned by blocked persons, the ‘50 Percent Rule’ (13 August 2014)OFAC’s settlement notices with BitPay (18 February 2021) and Bittrex (11 October 2022)

Wonder

  1. If a customer’s name is not on the SDN list, is the business in the clear?
  2. Does a small project without a compliance team have to screen anyone?
  3. How far back can OFAC go when it finds a problem?

Explore

  1. US sanctions bind ‘US persons’: US citizens and permanent residents, entities organised under US law including their foreign branches, and anyone in the United States. OFAC’s basic rules, including strict civil liability and the duty to block and report listed persons’ property, are covered in lesson 1.3.5. This lesson is about building the screening that keeps a crypto business inside them. Screening means comparing customers, counterparties, wallet addresses and locations against sanctions lists and country restrictions, at onboarding and again as transactions happen, then stopping or escalating any match before value moves.
  2. Name matching against the Specially Designated Nationals and Blocked Persons List (SDN list) is necessary but not enough. Under OFAC’s ‘50 Percent Rule’, restated in guidance of 13 August 2014, any entity owned 50 percent or more in total by one or more blocked persons is itself blocked, even if it never appears on the list. Many SDN entries also carry ‘Digital Currency Address’ identifiers, so wallet screening is part of the job, though OFAC has warned that address lists are incomplete. Whole regions such as Iran, Cuba or North Korea are also under country-wide sanctions, which name screening alone cannot catch.
  3. Location data is where crypto firms have stumbled. On 18 February 2021 OFAC announced that the payment processor BitPay would pay $507,375 for 2,102 apparent violations: it let people apparently located in Crimea, Cuba, North Korea, Iran, Sudan and Syria pay merchants with crypto, although it held location information about those buyers, including internet addresses. On 11 October 2022 OFAC announced that the exchange Bittrex would pay $24,280,829.20; users apparently in sanctioned places had made over $263 million of transactions, and the internet and physical address data Bittrex collected at onboarding gave it reason to know where they were. Data collected but not acted on counts against a business.
  4. The stakes are set by statute. Under the International Emergency Economic Powers Act, 50 U.S.C. §1705, a civil penalty can reach the greater of $250,000, a figure adjusted each year for inflation, or twice the value of the transaction, per violation. Wilful violations are crimes punishable by fines of up to $1 million and, for individuals, up to 20 years in prison. On 24 April 2024 the 21st Century Peace through Strength Act extended the time limit for civil and criminal IEEPA actions from five to 10 years, so a business’s transaction records, and its screening logs, need to cover that longer window.
  5. There is generally no US statute requiring every business to run a sanctions compliance programme, but OFAC’s ‘Framework for OFAC Compliance Commitments’ of 2 May 2019 names five essential components: management commitment, risk assessment, internal controls, testing and auditing, and training. OFAC says an effective programme can reduce a penalty and can affect whether a violation is treated as egregious. For one group the programme is becoming mandatory: under the GENIUS Act, permitted payment stablecoin issuers must keep effective sanctions compliance programmes, and FinCEN and OFAC proposed the detailed rules on 10 April 2026 (lesson 5.2.3). That rule was still a proposal in October 2026.
  6. Other governments run their own lists. In the UK, the Office of Financial Sanctions Implementation (OFSI) can impose civil penalties on a strict liability basis for breaches committed after 15 June 2022, and the EU and the United Nations keep separate lists, so a product with users in several places must screen against each relevant regime. For non-custodial software, the Tornado Cash litigation set some limits (lesson 5.2.6), but people and companies running front-ends or services remain bound. A practical check: write down which lists you screen, at which moments (signup, deposit, withdrawal), what data you hold on location, and who decides what happens after a match.

Key facts

  • Under OFAC’s 50 Percent Rule, an entity owned 50 percent or more in the aggregate by blocked persons is itself blocked.
  • On 18 February 2021 BitPay agreed to pay $507,375 to settle 2,102 apparent sanctions violations.
  • On 11 October 2022 Bittrex agreed to pay $24,280,829.20 to settle apparent violations of multiple sanctions programmes.
  • Under 50 U.S.C. §1705, a civil penalty may reach the greater of $250,000 (as adjusted for inflation) or twice the transaction amount.
  • The 21st Century Peace through Strength Act, signed on 24 April 2024, extended the IEEPA statute of limitations from five to 10 years.
  • OFAC’s Framework for OFAC Compliance Commitments, published on 2 May 2019, sets out five essential components of a sanctions compliance programme.

Exercise nine, six, three, one

9CollectList up to 9 points in a crypto product where a sanctioned person or place could slip through, such as signup, a deposit address, a withdrawal, a referral payout, a merchant payment or a VPN user (some lists are shorter).
6ClusterSort them into 6 categories: name screening, ownership screening, wallet-address screening, location screening, ongoing transaction monitoring, and gaps nobody checks.
3DistillReduce the 6 to 3 groups: points the SDN name list covers, points that need other data such as ownership or location, and points that are not covered at all.
1CrystallizeWrite 1 sentence explaining, using the BitPay or Bittrex case, why collecting a customer’s location data creates a duty to act on it.

Fact check

Dates, figures and claims checked against the published sources listed below.

Open in the interactive academy →

PT ES ZH JA KO RU DE FR MS