Crypto Sanctions Compliance: An OFAC Playbook

A crypto business has to comply with OFAC sanctions exactly as any other U.S. financial company does — there is no digital-asset exception. That is the single most important sentence in this whole subject. OFAC said it plainly in its October 2021 Sanctions Compliance Guidance for the Virtual Currency Industry: technology companies, exchanges, miners, wallet providers, and users are all subject to the same sanctions rules as anyone transacting in dollars. This guide explains what that means in practice.

The Rule Is Strict Liability

OFAC sanctions are civil strict liability. You can violate them without knowing it and without intending to — there is no “we didn’t realize the counterparty was sanctioned” defense to liability itself. Good faith and a strong program affect the penalty, not whether a violation occurred. For a borderless, pseudonymous technology, that flips the usual startup instinct: you cannot wait to be told who your customers are, you have to find out before you transact.

Everything below is built on OFAC’s Framework for OFAC Compliance Commitments, which sets five expectations for any program: senior-management commitment, risk assessment, internal controls, testing and auditing, and training.

What Screening Actually Looks Like in Crypto

Sanctions screening in crypto has two layers that traditional finance does not worry about in the same way.

OFAC’s 50% Rule is the trap people miss: an entity owned 50 percent or more, in the aggregate, by one or more blocked persons is itself blocked, even though its own name never appears on the SDN List. Name-matching alone will not catch it. For the underlying screening discipline, see our guide on denied-party screening in export and what the sanctions-screening process involves.

Geolocation Blocking Is Not Optional

A recurring theme in crypto enforcement is exchanges that knew U.S.-based or sanctioned-jurisdiction users were on the platform and did nothing structural to stop them. The lesson: build IP-based and identity-based controls that actually block transactions tied to comprehensively sanctioned regions, and do not rely on a checkbox terms-of-service clause. OFAC expects controls that work, not controls that exist on paper.

What Binance and Tornado Cash Teach

Two events define the current landscape.

Binance (November 2023). OFAC reached a $968,618,825 settlement with Binance over roughly 1.67 million apparent violations across multiple sanctions programs — at the time the largest such settlement in OFAC history, and part of a much larger combined resolution with the Justice Department and FinCEN. Binance also accepted a five-year independent compliance monitor. The takeaway is scale: in crypto, a single configuration gap can produce violations by the million because the platform is automated and global. OFAC has also settled with other exchanges, including Bittrex, Kraken, and Poloniex.

Tornado Cash (2024–2025). OFAC sanctioned the Tornado Cash mixing service in 2022. In November 2024, the Fifth Circuit held in Van Loon v. Department of the Treasury that immutable smart contracts are not “property” of a foreign person and therefore could not be blocked under the International Emergency Economic Powers Act, and OFAC formally delisted Tornado Cash in March 2025. Read that narrowly. It does not mean mixers are safe to use, and it does not weaken OFAC’s authority over people and entities — it addressed the specific question of whether autonomous, un-ownable code can be designated. Sending funds to a sanctioned person through any tool is still a violation.

Blockchain Analytics Cuts Both Ways

The same transparency that makes blockchains traceable is a compliance asset. Blockchain-analytics tools let you trace the flow of funds, flag exposure to high-risk addresses, and screen wallet addresses before you transact. Use them — but treat them as one control among several, not a substitute for a real program. Technology that flags a problem is worthless if no one is assigned to act on the alert.

If Something Slips Through

When a violation has already happened, route the decision to counsel on a voluntary self-disclosure (VSD) to OFAC. A qualifying VSD can cut the base civil penalty by up to 50%, and since February 2026 OFAC accepts disclosures through an online portal. Keep your records for 10 years — OFAC extended the recordkeeping requirement from five to 10 years in March 2025. For penalty context, the maximum civil penalty under IEEPA runs to roughly $377,700 per violation (adjusted periodically for inflation) or twice the value of the transaction, whichever is greater — which is why million-violation counts get catastrophic fast.

Frequently Asked Questions

Does OFAC treat cryptocurrency differently from regular money? No. OFAC’s October 2021 guidance is explicit that virtual-currency businesses operating in U.S. jurisdiction must comply with sanctions the same way any company handling dollars does.

Can I be liable if I send crypto to a sanctioned wallet by accident? Yes. Sanctions are strict liability, so intent is not required for a violation to occur. A self-reported, well-documented mistake under a strong program is treated very differently at the penalty stage, but the violation still counts.

Did the Tornado Cash delisting make mixers legal again? No. The court ruled only that immutable smart contracts are not blockable “property.” Transacting with a sanctioned person — through a mixer or anything else — remains prohibited.

What is the most common crypto sanctions failure? Weak or absent geolocation and wallet-address controls that let sanctioned-jurisdiction users transact. Build controls that block, screen wallet addresses against the SDN List, and apply the 50% Rule.

Crypto moves fast; OFAC liability is strict and the violation counts compound at machine speed. Reidel Law Firm helps virtual-currency and blockchain businesses build sanctions screening and OFAC controls that hold up under scrutiny, delivered as a flat-fee compliance memo with direct attorney access. Get an export compliance memo →