August.09.2022
The U.S. Treasury Department’s Office of Foreign Assets Control (“OFAC”) sanctioned the popular decentralized virtual currency mixer Tornado Cash on August 8, 2022, continuing the U.S. government’s efforts to target individuals and entities that use virtual currency in connection with malign activities.
According to OFAC, since the creation of Tornado Cash in 2019, the company has been used to launder over $7 billion worth of virtual currency for malicious cyber actors. Yesterday’s action follows OFAC’s first-ever designation of a virtual currency mixer – Blender.io – on May 6, 2022.
In the wake of these mixer designations, there has been widespread confusion in the market about the consequences of the actions, so our International Trade and Investments team put together five key takeaways to help provide some guidance on what this means for the crypto industry.
OFAC designated Tornado Cash as a Specially Designated National and Blocked Person (an “SDN”) pursuant to Executive Order 13694 of April 1, 2015, which targets persons engaging in significant malicious cyber-enabled activities. According to OFAC, Tornado Cash launders the proceeds of cybercrimes, including over $455 million stolen by the Lazarus Group (a North Korean state-sponsored hacking group that was previously designated as an SDN), more than $96 million of funds derived from the Harmony Bridge Heist, and at least $7.8 million from the August 2, 2022, Nomad Heist.
As a result of the designation of Tornado Cash, all property and interests in property of Tornado Cash, or of any entities that are owned, directly or indirectly, 50 percent or more by Tornado Cash, that are in the United States or within the possession or control of U.S. persons are blocked.
As of 10:30 am ET on August 8, 2022, which is the time OFAC publicly designated Tornado Cash as an SDN (the “Designation Time”), all U.S. persons are generally prohibited from engaging in transactions with Tornado Cash or that involve any property of Tornado Cash.
If funds were mixed or flowed through Tornado Cash prior to the Designation Time and Tornado Cash no longer has an interest in the funds, then U.S. persons are not required to block or “freeze” those funds as a result of the OFAC sanctions on Tornado Cash.[1]
If any funds were mixed or flowed through Tornado Cash after the Designation Time and were transferred directly from Tornado Cash to a U.S. person, the U.S. person would be required to block those funds.
If any funds were mixed or flowed through Tornado Cash after the Designation Time and were ultimately, but not directly, transferred to a U.S. recipient, that recipient should conduct additional diligence to try to determine, if possible, whether the funds initially passed directly from Tornado Cash to any U.S. person after the Designation Time before being sent to the recipient. If the funds did pass directly from Tornado Cash to a U.S. person after the Designation Time, that U.S. person would have been required to block those funds. And so, if the U.S. person forwarded the funds to any other person or entity, the U.S. person would have violated OFAC sanctions.
Holders of blocked virtual currency must file a report with OFAC within 10 business days from the date the virtual currency becomes blocked, and thereafter on an annual basis, so long as the virtual currency remains blocked.
OFAC has explained that “once a U.S. person determines that they hold virtual currency that is required to be blocked pursuant to OFAC’s regulations, the U.S. person must deny all parties access to that virtual currency, ensure that they comply with OFAC regulations related to the holding and reporting of blocked assets, and implement controls that align with a risk-based approach. U.S. persons are not obligated to convert the blocked virtual currency into traditional fiat currency (e.g., U.S. dollars) and are not required to hold such blocked property in an interest-bearing account.”[2]
In its Frequently Asked Question 646, OFAC explained that “[f]or example, a U.S. virtual currency company that maintains multiple virtual currency wallets in which a blocked person has an interest may choose to block each virtual currency wallet or opt to consolidate wallets that contain blocked virtual currency (similar to an omnibus account).” Accordingly, if a U.S. person determines that certain funds it has received into its wallet must be blocked, it could transfer such funds into a separate blocked account and report that account to OFAC pursuant to OFAC’s regulations.
In the Tornado Cash entry on the SDN List, OFAC has included associated virtual wallet addresses. While OFAC includes certain known virtual currency addresses as identifying information for persons listed on the SDN List, like Tornado Cash, the list of addresses is not necessarily comprehensive. U.S. persons should be watchful, therefore, for other addresses associated with Tornado Cash.
OFAC has previously noted in its Sanctions Compliance Guidance for the Virtual Currency Industry issued in October 2021 that the inclusion of virtual currency addresses on the SDN List may assist the industry in identifying other virtual currency addresses associated with blocked persons. (See also our prior alert regarding prior U.S. government actions relating to virtual currency.) OFAC advised that “unlisted virtual currency addresses that share a wallet with a listed virtual currency address may pose sanctions risk because the sharing of a wallet may indicate an association with a blocked person.” Moreover, in its press release, OFAC warned, “[M]ixers should in general be considered as high-risk by virtual currency firms, which should only process transactions if they have appropriate controls in place to prevent mixers from being used to launder illicit proceeds.”
OFAC further noted that companies in the virtual currency industry may consider deploying blockchain analytics tools that help identify and mitigate sanctions risks.
Because Tornado Cash is a smart contract-based mixer, its code can run autonomously and without maintenance from its developers. According to a January 2022 CoinDesk interview with its co-founder, Roman Semonov, the protocol was designed to be “unstoppable.” Because Tornado Cash can continue to function despite OFAC’s sanctions designation, virtual currency companies should stay especially vigilant, including through the use of blockchain analytics, to ensure they are not transacting directly or indirectly with Tornado Cash.
[1] A U.S. person would also be required to block any funds that passed directly from Tornado Cash to another blocked person and then directly to a U.S. person.
[2] See Sanctions Compliance for the Virtual Currency Industry, Office of Foreign Assets Control, October 2021, page 5.