Crypto sanctions are U.S. Treasury restrictions that prohibit anyone under U.S. jurisdiction from transacting with digital wallets, exchanges, tokens, or protocols tied to designated foreign governments, terrorist groups, cybercriminals, or narcotics traffickers. The Office of Foreign Assets Control (OFAC) enforces them, and it treats virtual currency the same as cash or securities: if a wallet or entity appears on the Specially Designated Nationals and Blocked Persons List, sending it crypto, receiving from it, or providing it services is a violation. Civil penalties reach $377,700 per transaction or twice the transaction’s value, and willful violations carry criminal fines up to $1,000,000 and prison sentences up to 20 years.
The Law Behind the Restrictions
The authority comes from the International Emergency Economic Powers Act (IEEPA), which lets the President regulate or block financial transactions when a foreign threat triggers a declared national emergency.1Office of the Law Revision Counsel. 50 USC Ch. 35 – International Emergency Economic Powers OFAC handles day-to-day enforcement.2Office of Foreign Assets Control. About the Office of Foreign Assets Control Its definition of digital currency sweeps in sovereign cryptocurrency, non-fiat virtual currency, and digital representations of fiat currency, which covers Bitcoin, Ethereum, stablecoins, and governance tokens.3Office of Foreign Assets Control. Frequently Asked Questions – Questions on Virtual Currency
The most important thing to internalize: primary sanctions are strict liability. You don’t need to know a wallet was sanctioned to violate the rule by sending crypto to it. Ignorance doesn’t automatically shield you from civil enforcement. That’s why screening isn’t optional.
What Violations Cost
Civil penalties under IEEPA reach $377,700 per violation or twice the value of the underlying transaction, whichever is greater.4U.S. Department of the Treasury. Notice – Inflation Adjustment to Maximum Civil Monetary Penalty The 2025 figure carries forward without a further increase. Each transaction can count as its own violation, so a pattern of noncompliant transfers stacks quickly.
Criminal prosecution is reserved for willful violations, meaning you knew or should have known the transaction was prohibited and did it anyway. Convictions carry fines up to $1,000,000 per violation and, for individuals, up to 20 years in prison.5Office of the Law Revision Counsel. 50 USC 1705 – Penalties
OFAC uses a tiered schedule to calculate base civil penalties. Prohibited transactions under $1,000 start from a much smaller base amount; transactions above $200,000 default to the statutory maximum.6Cornell Law Institute. 31 CFR Appendix A to Part 501 – Economic Sanctions Enforcement Guidelines Small transactions still carry real consequences.
Who and What Gets Sanctioned
OFAC designations in crypto typically target centralized exchanges that launder stolen funds or serve sanctioned governments, individual hackers and state-linked cyber units (North Korean groups appear often), and mixing or privacy services used to obscure illicit funds. The SDN List now includes blockchain wallet addresses alongside names and passport numbers, though OFAC acknowledges its listed addresses are unlikely to be exhaustive.7Office of Foreign Assets Control. Office of Foreign Assets Control FAQ 562 Once a wallet is listed, any property it holds is legally frozen, and anyone under U.S. jurisdiction is prohibited from transacting with it, providing services to it, or supplying it liquidity.
The 50 Percent Rule
A wallet doesn’t have to appear on the SDN List to be off-limits. Under OFAC’s 50 Percent Rule, any entity owned 50 percent or more in the aggregate by one or more blocked persons is itself blocked, even without formal designation.8Office of Foreign Assets Control. Entities Owned by Blocked Persons 50 Percent Rule Two sanctioned individuals each owning 25 percent of a project block it entirely. Ownership structures in digital asset ventures are often deliberately opaque, which makes this rule the hardest part of screening.
Foreign Persons and Secondary Exposure
Non-U.S. entities aren’t fully outside OFAC’s reach. Foreign persons are prohibited from causing U.S. persons to violate sanctions or engaging in evasion.9U.S. Department of the Treasury. OFAC Consolidated Frequently Asked Questions A foreign exchange that knowingly processes transactions for a listed wallet risks its own designation and loss of access to the U.S. financial system.
The Tornado Cash Carve-Out
OFAC designated the Ethereum mixing protocol Tornado Cash in August 2022 after determining it had been used to launder over $7 billion. The designation was unusual because the protocol runs on immutable smart contracts that no person or entity can alter. In Van Loon v. Department of the Treasury, the Fifth Circuit held that these immutable smart contracts are not “property” under IEEPA because nobody can own them, so OFAC had exceeded its statutory authority.10United States Court of Appeals for the Fifth Circuit. Van Loon v. Department of the Treasury On March 21, 2025, Treasury removed Tornado Cash from the SDN List.11U.S. Department of the Treasury. Tornado Cash Delisting
The ruling is narrow. It covers truly autonomous, immutable code with no controller. Smart contracts that are upgradeable or controlled by an identifiable entity remain within OFAC’s reach, and every DeFi compliance decision now turns on which side of that line the protocol sits.
Screening Wallets Before You Transact
Before completing any meaningful transaction or onboarding a user, check the wallet addresses involved against the SDN List. OFAC’s free Sanctions List Search accepts names, aliases, and digital currency addresses.12U.S. Department of the Treasury. Sanctions List Search It’s a starting point, not the whole of due diligence.13Office of Foreign Assets Control. Office of Foreign Assets Control – Frequently Asked Questions Downloadable list files are available in formats that can plug into automated compliance systems.
Listed addresses don’t capture every risk. Blockchain analytics firms use clustering — grouping addresses likely controlled by the same entity based on transaction patterns and shared inputs — to identify wallets tied to sanctioned actors even when the specific address hasn’t been listed. Each cluster carries a confidence score, and for an attribution to hold up in enforcement or litigation, the methodology from raw address to attributed entity must be documented. Relying only on the published SDN List without supplementary screening is a gap OFAC’s own compliance guidance discourages.
Compliance Programs for Crypto Businesses
OFAC has published sanctions compliance guidance specifically for the virtual currency industry, built around five components.14Office of Foreign Assets Control. Sanctions Compliance Guidance for the Virtual Currency Industry
- Senior leadership approves the program, gives the compliance team real authority and resources, and appoints a dedicated sanctions compliance officer.
- Risk is assessed routinely across products, customers, and jurisdictions, and updated as new tokens, chains, and DeFi protocols change the picture.
- Internal controls identify, intercept, escalate, and report prohibited transactions. For crypto platforms, that includes geolocation and IP blocking for comprehensively sanctioned jurisdictions.
- Independent testing and auditing check whether the program actually works.
- Employees receive regular sanctions training, updated as rules change.
Separately, crypto platforms that qualify as money service businesses must register with FinCEN within 180 days of establishment and renew every two years.15FinCEN.gov. Money Services Business (MSB) Registration Registration is done on FinCEN Form 107 through the BSA E-Filing System, and copies plus supporting documents must be retained for five years at a U.S. location. The owner or controlling person is responsible, and failure to register carries civil and criminal penalties.
Blocking, Rejecting, and Reporting
Not every prohibited transaction gets handled the same way. A transaction is blocked when it involves property in which an SDN or other blocked person has an interest. The funds are frozen into an interest-bearing account from which only OFAC-authorized debits can be made, and they stay there until OFAC issues further instructions.16U.S. Department of the Treasury. Blocking and Rejecting Transactions For crypto, that means isolating the assets so the sanctioned party can’t reach them, and doing it immediately.
A transaction is rejected when it’s prohibited but no blockable property interest exists, such as a transfer between two non-sanctioned parties that would route through a sanctioned jurisdiction. The transaction isn’t processed and the funds go back to the originator. Both blocked and rejected transactions must be reported to OFAC within 10 business days.17Office of Foreign Assets Control. Frequently Asked Questions – Filing Reports with OFAC
Reports are filed through the OFAC Reporting System and must include the property owner, the value and nature of the blocked assets, and the circumstances of discovery, with supporting documentation attached.18U.S. Department of the Treasury. OFAC Reporting System Anyone still holding blocked property as of June 30 must also file an Annual Report of Blocked Property by September 30.17Office of Foreign Assets Control. Frequently Asked Questions – Filing Reports with OFAC Filing does not cure the underlying violation; the report documents it.
Accidentally Receiving Sanctioned Crypto
Blockchain transactions are permissionless, so anyone can send tokens to your wallet without your consent. Strict liability still applies once the funds land — you’re now holding property in which a blocked person has an interest. Treat the assets as blocked: don’t move, spend, or return them. On a custodial platform, the platform freezes the assets and files the report. In self-custody, segregate the assets and file with OFAC yourself within 10 business days.7Office of Foreign Assets Control. Office of Foreign Assets Control FAQ 562
The fact you didn’t initiate the transfer matters for how OFAC weighs the conduct, even though it doesn’t erase the technical violation. An unsolicited receipt followed by prompt blocking and reporting looks nothing like active engagement with a sanctioned counterparty. Do not try to “return” the funds by sending them back to the sanctioned address; that creates a second prohibited transaction.
Licenses and Voluntary Disclosure
OFAC issues two kinds of authorizations. General licenses are published broadly and apply automatically to anyone meeting their conditions, so check for one before doing anything else — OFAC will not grant a specific license when a general one already covers the situation.19U.S. Department of the Treasury. OFAC Specific Licenses and Interpretive Guidance When no general license fits, you can apply for a specific license through the OFAC Application Portal, describing the transaction in detail and identifying every party. Reviews are case-by-case with no guaranteed timeline. For blocked digital assets, a specific license is usually the only path to release.
If you discover a possible violation on your own — a retrospective screen catches a past transfer to a later-listed wallet, or an audit surfaces a gap — voluntary self-disclosure to OFAC is a significant mitigating factor and reduces the base penalty under enforcement guidelines.20Office of Foreign Assets Control. FAQ 13 – How Can I Report a Possible Violation of U.S. Sanctions to OFAC The disclosure must contain enough detail for OFAC to understand the circumstances, and if the initial notification isn’t complete, OFAC generally expects the full report within 180 days. Sitting on a known problem is almost always worse: the penalty reduction is substantial, and concealment becomes an aggravating factor when the violation surfaces some other way.