The Office of Foreign Assets Control (OFAC) (which is part of the U.S. Department of the Treasury) recently published Sanctions Compliance Guidance for the Virtual Currency Industry. While many of our members may not consider themselves to be officially part of the virtual currency industry, the Guidance makes clear that all U.S. persons are responsible for ensuring they do not engage in unauthorized transactions or dealings with sanctioned person or jurisdictions. In addition, the Guidance also makes clear that the OFAC sanctions obligations “apply equally to transactions involving virtual currencies and those involving traditional fiat currencies.”
As we are all well aware, virtual currencies are playing an increasingly prominent role in the global economy. As a result of this growing prevalence as a payment method, there is greater exposure to sanctions risks (e.g., the risk that a sanctioned person or a person in a jurisdiction subject to sanctions might be involved in a virtual currency transaction). The goal of the Guidance is to help mitigate the risks that sanctioned people or entities exploit virtual currencies to evade sanctions, which can ultimately undermine U.S. foreign policy and national security interests.
When reviewing the Guidance, keep in mind that it is targeting a much broader audience than just financial institutions who are already well-versed in OFAC sanctions compliance. While much of the initial sections of the Guidance may be old news to our members, the latter parts of the Guidance contain valuable best practices for ensuring compliance in the virtual currency space. Key highlights from these sections are outlined briefly below, but it’s worth reviewing the Guidance in full for a complete understanding of regulatory expectations.
Management Commitment – Senior management’s support is critical, and it may consider the following steps to demonstrate its support for sanctions compliance: reviewing and endorsing sanctions compliance policies and procedures; ensuring adequate resources, including human capital, expertise, and information technology; and appointing a dedicated sanctions compliance officer with the requisite technical expertise.
Risk Assessment – While there is no “one-size-fits-all” risk assessment, it should include a complete review of the institution to assess touchpoints to foreign jurisdictions or persons. This will help identify areas of engagement with OFAC-sanctioned persons, countries, or regions, either directly or indirectly. The risk assessment process should be tailored to the types and locations of products and services offered.
Internal Controls – An effective sanctions compliance program should include controls to identify, escalate, report (as appropriate), and maintain records for transactions or activities prohibited by OFAC sanctions. An effective sanctions compliance program should enable sufficient due diligence on customers, business partners, and transactions, and identify red flags.
Testing and Auditing – Incorporating a comprehensive, independent, and objective testing or audit function will help ensure institutions are aware of how their programs are performing and what aspects need to be updated, enhanced, or recalibrated to account for a changing risk assessment or sanctions environment. Some best practices include sanctions list screening; keyword screening; IP blocking; and investigation and reporting.
Training – The scope of sanctions-specific training should be informed by an institution’s size, sophistication, and risk profile. Training should be provided to all appropriate employees, including compliance, management, and customer service personnel, and should be conducted on a periodic basis, and, at a minimum, annually. Effective training for the virtual currency industry should account for frequent changes and updates to sanctions programs, as well as new and emerging technologies in the virtual currency space.
The final sections of the Guidance outline a variety of resources to obtain further information on virtual currency compliance. As always, feel free to reach us on the Hotline with any additional questions.