Yes, OFAC applies the same sanctions rules to digital assets as to fiat currency. If you’re a U.S. person and you control, hold, or process cryptocurrency tied to a Specially Designated National, you must block it and report it within 10 business days. There’s no crypto exemption. Enforcement is strict liability, meaning intent doesn’t matter, so a risk-based compliance program isn’t optional overhead. It’s the only real defense you have.
TL;DR:
- U.S. persons controlling or processing cryptocurrency tied to sanctioned addresses must block and report it within 10 business days, with no exemption for crypto assets.
- OFAC can list specific digital currency addresses directly, but screening must include behavior analysis and clustering, not just exact matches, to catch downstream exposure.
- Compliance programs should include management commitment, risk assessments, continuous monitoring, and documented procedures, all tailored to the business’s customer base and geography.
- Any blocked crypto, including NFTs and DeFi tokens, must be frozen immediately, with detailed custody records, and reported to OFAC to avoid penalties.
- Cross-border crypto transactions involving U.S. infrastructure or counterparties could trigger full OFAC sanctions obligations, demanding comprehensive screening of foreign partners and regulators.
Table of Contents
- What Are OFAC Crypto Sanctions and How Does OFAC Define Digital Currency?
- Who Has to Comply, and How Far Does OFAC’s Reach Extend?
- How Does OFAC List Crypto Addresses, and How Do You Screen for Them?
- What Does a Risk-Based Crypto Sanctions Compliance Program Look Like?
- What Do You Do If You’re Holding Sanctioned Crypto?
- What Enforcement Actions Reveal About OFAC’s Priorities
- Crypto Sanctions vs. NFTs and DeFi Tokens: Does OFAC Draw a Line?
- How Should DeFi Platforms Handle Sanctions Compliance?
- How Do OFAC Sanctions Affect Cross-Border Crypto Transactions?
- What Records Should You Keep for a Crypto Sanctions Program?
- Murphy’s Law’s Perspective on OFAC Crypto Risk
- How Murphy’s Law Supports Crypto Sanctions Compliance and Recovery
- Sources
- FAQ
What Are OFAC Crypto Sanctions and How Does OFAC Define Digital Currency?
The Office of Foreign Assets Control regulates virtual currency using definitions laid out in its FAQs on virtual currency. “Digital currency” covers value that functions as a medium of exchange, unit of account, or store of value, whether or not it runs on a blockchain. A “digital currency wallet” holds the private keys that control that value, and a “digital currency address” is the public identifier tied to a wallet on a distributed ledger.
Here’s the mechanic most people miss: OFAC can add a specific digital currency address to the Specially Designated Nationals List, the way it adds a bank account number. According to OFAC FAQ 562, these listings use exact strings, and the agency’s Sanctions List Search tool only catches identical matches. A wallet one hop removed from a listed address won’t trigger an automatic hit.
The core principle to internalize: OFAC treats a Bitcoin transaction and a wire transfer identically. If the underlying conduct or party is sanctioned, the payment rail doesn’t change your obligations under OFAC’s virtual currency guidance.
Who Has to Comply, and How Far Does OFAC’s Reach Extend?
“U.S. person” means U.S. citizens, permanent residents, entities organized under U.S. law (including foreign branches), and anyone physically located in the United States. If you’re a crypto exchange incorporated in Delaware, a DeFi front end run by a U.S. team, or an American investor holding tokens on a foreign platform, you have an OFAC touch.
The strict-liability standard is the part that catches businesses off guard. OFAC can impose civil penalties even when a firm had no knowledge the counterparty was sanctioned, and Elliptic’s overview of OFAC crypto sanctions reinforces that ignorance of a sanctioned address is not a defense.
Secondary exposure widens the circle further. Chainalysis has tracked OFAC’s growing use of sectoral designations tied to Iran’s digital-assets sector, which pulls in OTC brokers and exchanges with no direct U.S. presence but real ties to U.S. correspondent banking or dollar liquidity.
How Does OFAC List Crypto Addresses, and How Do You Screen for Them?
OFAC publishes sanctioned wallet addresses as identifiers attached to an SDN entry, the same way it lists a passport number or a known alias. The problem is scale: a sanctioned actor can generate thousands of fresh addresses, and OFAC’s list only ever reflects what investigators have already confirmed. Relying on exact-match screening alone leaves a business blind to anything one or two hops downstream.
That’s why Elliptic and other blockchain-analytics firms argue that published SDN addresses represent a floor, not a ceiling, on real exposure. Wallet clustering and behavioral heuristics can surface funds that trace back to a sanctioned entity even when the receiving address has never appeared on any government list.
A workable screening stack for a crypto business generally includes:
- Direct SDN list matching against every deposit and withdrawal address
- Blockchain analytics tools (Chainalysis or Elliptic, among others) to flag clustered wallets and known illicit typologies
- Continuous transaction monitoring rather than a one-time onboarding check
- Geolocation and IP screening to catch access attempts from sanctioned jurisdictions
- Periodic re-screening of dormant accounts, since sanctions lists change constantly
Pro Tip: Run screening against both the current SDN list and OFAC’s Consolidated Sanctions List. Sectoral and secondary designations sometimes land on the second list first.
What Does a Risk-Based Crypto Sanctions Compliance Program Look Like?
OFAC’s own Sanctions Compliance Guidance for the Virtual Currency Industry lays out five components the agency expects to see in any serious program, and it explicitly favors a risk-based approach over a rigid checklist. What that looks like in practice, tailored to a crypto business’s actual customer base and geography:
- Management commitment — a named compliance officer with real authority and a budget, not a part-time assignment tacked onto someone’s engineering role.
- Risk assessment — a documented review of your customer base, products, and geographic footprint, updated whenever you launch a new market or asset.
- Written policies and procedures — internal controls for onboarding, screening, and escalation that employees can actually follow under pressure.
- Screening and monitoring — KYC and KYB checks at onboarding, sanctions screening on every transaction, and ongoing monitoring rather than a single pass at signup.
- Testing and audit — periodic independent review of whether the program catches what it’s supposed to catch.
Layer operational red flags on top of the program itself: transactions structured to stay just underreporting thresholds, mixer usage immediately before a deposit, IP addresses masked through VPNs tied to sanctioned regions, or a sudden shift from small retail trades to large, rapid transfers. Build an incident response playbook before you need it, spelling out who freezes an account, who documents the decision, and who calls outside counsel. If your internal team lacks blockchain forensics capability, bring in a firm like Chainalysis or Elliptic before an incident forces the issue, and read our crypto compliance guide for businesses for how these pieces fit together operationally.
What Do You Do If You’re Holding Sanctioned Crypto?
Freeze it immediately. Deny the wallet owner any ability to trade, transfer, or withdraw the asset, and do it the moment you have a credible match, not after internal debate. Preserve the full chain of custody, including timestamps, wallet snapshots, and internal decision logs, because this record becomes your primary mitigation evidence if OFAC ever questions the response.
Under OFAC’s guidance, you must report the blocked property to OFAC within 10 business days, and you must continue filing an annual report for as long as the asset stays blocked. Decide early whether you’ll hold the asset in an omnibus blocked-funds account or isolate it in a dedicated wallet. That choice affects how cleanly you can later unblock and return it if a license is granted.
If you believe blocking was triggered in error, or you need to conduct an otherwise-prohibited transaction, you can apply for a specific license from OFAC, and general licenses sometimes cover narrow categories of activity. Given the stakes, most firms bring in regulatory counsel before submitting anything to OFAC directly.
What Enforcement Actions Reveal About OFAC’s Priorities
Treasury’s 2022 designation of Tornado Cash remains the clearest example of OFAC treating infrastructure, not just individuals, as a sanctionable target. The mixer’s smart contracts landed on the SDN List, blocking U.S. persons from interacting with them at all, and similar actions against Blender.io and Sinbad followed the same logic against mixing services tied to laundering activity.
The penalty framework is unforgiving on paper: strict liability means a violation exists regardless of intent, and OFAC can pursue civil penalties per transaction. In practice, the agency weighs mitigating factors heavily, including a documented compliance program, prompt voluntary self-disclosure, and swift remedial action after discovery.
Chainalysis’s coverage of expanding sectoral actions against Iran’s digital-assets sector signals where enforcement is heading next: less about chasing individual bad actors and more about squeezing entire categories of counterparties out of dollar-linked liquidity.
Crypto Sanctions vs. NFTs and DeFi Tokens: Does OFAC Draw a Line?
OFAC doesn’t carve out exceptions by asset type. The FAQs on virtual currency apply the same blocking and reporting obligations whether the property in question is Bitcoin, an ERC-20 governance token, or a non-fungible token representing digital art. If a sanctioned person owns it, controls it, or benefits from its transfer, it’s blocked property.
Where things get genuinely harder is valuation and liquidity. A blocked stablecoin balance is straightforward to report and hold. A blocked NFT is a different problem entirely, since its value is illiquid and subjective, and a marketplace holding it has to decide how to document a blocked asset that might be worth $50 or $50,000 depending on market sentiment that week. DeFi governance tokens raise a related wrinkle: holding a token that grants voting rights over a protocol used by sanctioned actors can create exposure even if the platform itself has never been designated.
The safest posture treats every digital asset type the same way procedurally: same screening, same blocking obligation, same 10-day reporting clock. The complexity shows up downstream, in how you value, custody, and eventually dispose of the asset once a license permits it. NFT marketplaces and DeFi protocols that assume their asset class sits outside OFAC’s reach are working from a false premise, and it’s one that’s gotten several platforms into enforcement trouble already.
How Should DeFi Platforms Handle Sanctions Compliance?
Decentralized platforms face a structural tension: many are built to minimize gatekeeping, yet OFAC’s obligations attach to U.S. persons regardless of how decentralized the front end claims to be. If a U.S.-based team writes the smart contracts, controls a multisig, or runs the interface most users touch, that team carries sanctions obligations even without a traditional KYC funnel.
Practical compliance for a DeFi platform usually starts at the edges you can actually control. Front-end interfaces can screen wallet addresses against the SDN list before allowing a connection, the way several major protocols already do. Fiat on-ramps and off-ramps integrated into the platform are natural checkpoints for KYC and sanctions screening, since that’s where crypto meets the traditional banking system.
Governance is the harder question. If your protocol has a foundation, a development company, or a multisig with identifiable signers, that entity should run the same risk-based program OFAC expects from a centralized exchange, covering screening, monitoring, and documented escalation procedures. Fully autonomous protocols with no identifiable controlling party present a genuine gap in current guidance, and OFAC hasn’t issued DeFi-specific rules resolving it cleanly. Until that changes, the conservative approach is to build screening into whatever centralized touchpoint your protocol still has, and to document the reasoning behind every design decision that affects sanctions exposure. Our DeFi compliance roadmap walks through this in more operational detail.
How Do OFAC Sanctions Affect Cross-Border Crypto Transactions?
Crypto’s core selling point, moving value across borders without a bank intermediary, is exactly what makes cross-border transactions an OFAC focus area. A transfer that touches a U.S. exchange, a U.S.-incorporated custodian, or even a U.S.-based node operator can create jurisdiction where none seemed obvious at the outset.
Sectoral sanctions add another layer specific to cross-border activity. Chainalysis’s analysis of OFAC’s Iran-related crypto actions shows the agency targeting crypto-for-oil payment structures that route through OTC desks in third countries, meaning a U.S. exchange’s counterparty risk doesn’t stop at its own customer base. If your platform accepts deposits from an OTC broker who, in turn, services sanctioned oil buyers, that broker’s exposure can become yours.
For businesses processing international transactions, the practical rule is to treat every cross-border counterparty as a screening event, not just every customer. That includes correspondent relationships with foreign exchanges, liquidity providers, and payment processors. Broader compliance discussions about cross-border financial activity, including how U.S. trading compliance intersects with jurisdictional reach, underscore how quickly a foreign-facing business can find itself inside U.S. regulatory scope. When in doubt, the safer assumption is that a transaction touching any U.S. infrastructure, however briefly, brings full OFAC obligations with it.
What Records Should You Keep for a Crypto Sanctions Program?
Documentation is what separates a defensible compliance program from a theoretical one. OFAC’s enforcement posture rewards firms that can show their work, and that means keeping records that reconstruct exactly what you knew and when you acted.
At minimum, retain screening logs showing every address checked against the SDN list and the date of each check, along with records of any hits, false positives, and how each was resolved. Keep wallet-level transaction histories tied to customer accounts, not just aggregate reports, since investigators will ask for specifics if a question ever arises. Store internal risk assessments and the policy updates that followed them, so you can show your program evolved as your business and OFAC’s guidance changed.
For any blocked asset, preserve a complete chain-of-custody record: the transaction that triggered the block, the wallet snapshot at the moment of freezing, the internal approval chain, and every subsequent report filed with OFAC. Set retention periods that match or exceed your state’s recordkeeping requirements, and store these records somewhere a regulator’s subpoena or a civil investigative demand can’t compromise their integrity. A compliance officer role with clear ownership over this documentation, as outlined in our guide to the compliance officer function, tends to produce cleaner audit trails than compliance handled as a shared responsibility across departments.
Murphy’s Law’s Perspective on OFAC Crypto Risk
Most sanctions incidents don’t start with a dramatic designation. They start with a routine screening hit that a junior compliance analyst isn’t sure how to handle, and the decisions made in that first hour often determine whether the incident stays a paperwork problem or becomes an enforcement action. Blocking, reporting, and license applications carry real legal weight, and getting the sequencing wrong can undo an otherwise strong mitigation argument.
Counsel can help you interpret an ambiguous match, structure a license application, and negotiate with OFAC if enforcement contact follows. Counsel cannot make a genuine violation disappear, and no legitimate firm will promise that. That distinction is exactly why businesses and investors should work with a licensed law firm with real litigation experience rather than an unregulated “recovery service” that overpromises outcomes it has no legal standing to deliver.
— Mark
How Murphy’s Law Supports Crypto Sanctions Compliance and Recovery
Specialized legal teams can provide expertise beyond generic compliance software, helping build programs before incidents occur and managing legal responses when they do, including designing screening protocols, filing required OFAC reports, and litigating recovery when sanctioned funds intersect with fraud cases.
The firm’s compliance consulting work covers governance structure, risk assessments, and screening design tailored to your specific customer base and jurisdictional exposure, not a boilerplate template. For businesses that have already had a blocking event or a regulatory inquiry, the firm’s crypto compliance consulting services pick up where internal teams reach their limits. And because Liam has litigated cases involving Celsius, Terraform Labs, and BitMEX, the firm brings actual courtroom experience to matters that go beyond a compliance memo. If your business needs a program built or a sanctions incident reviewed, start with a consultation on Murphy’s Law’s compliance services.
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
Sources
- OFAC FAQs on virtual currency
- OFAC Targets Crypto-for-Oil Payments in Latest Iran Sanctions (Chainalysis)
- What are OFAC crypto sanctions? | Elliptic
- Treasury press release: U.S. Treasury sanctions Tornado Cash
FAQ
What Happens If I Unknowingly Transact With a Sanctioned Wallet?
OFAC enforces on a strict-liability basis, so civil penalties are possible even without knowledge, though a documented compliance program and prompt self-disclosure can reduce the outcome.
How Long Do I Have to Report Blocked Crypto to OFAC?
You must report blocked property to OFAC within 10 business days, and you must file an annual report for as long as the asset remains blocked.
Does OFAC Treat NFTs Differently From Other Cryptocurrency?
No. Blocking and reporting obligations apply the same way regardless of asset type, though valuing and custodying an illiquid NFT once blocked is operationally harder than handling a fungible token.
Can a DeFi Protocol With No Company Behind It Still Face OFAC Risk?
Any identifiable U.S. person controlling a front end, multisig, or development entity carries sanctions obligations, even if the underlying protocol markets itself as fully decentralized.
When Should a Crypto Business Bring In Outside Legal Counsel?
Bring in counsel immediately after a confirmed SDN match, before submitting a license application, or as soon as OFAC or another regulator makes contact, since early legal input often preserves mitigation arguments that are hard to recover later.