On this page
Key facts (as of 29 October 2026)
- Strict liability: OFAC may impose civil penalties "based on a strict liability legal standard". A firm can be liable even if it did not know it was dealing with a sanctioned person.
- Addresses on the list: since 2018, OFAC has included certain virtual currency addresses as identifying information on the SDN List. They can be searched in the "ID #" field of OFAC's Sanctions List Search.
- 50 Percent Rule: entities owned 50% or more, directly or indirectly and individually or in aggregate, by blocked persons are also blocked, even if not named.
- Reporting: blocked virtual currency must be reported to OFAC within 10 business days, then annually while it stays blocked. Rejected transactions must be reported within 10 business days.
- Issuer freezes: Tether reported more than US$4.4bn blocked by 23 April 2026, including over US$2.1bn connected to US authorities (Tether, 23 April 2026).
OFAC's five components
OFAC's October 2021 guidance for the virtual currency industry sets out five essential components of a sanctions compliance programme:
| Component | What it means in practice |
|---|---|
| Management commitment | Senior support, resources and an empowered compliance function |
| Risk assessment | Products, customers, counterparties, supply chain and geographies, done before launching services |
| Internal controls | Screening, investigation, transaction monitoring, remediation |
| Testing and auditing | Independent checks that list screening, keyword screening and IP blocking work |
| Training | Role-specific and regular |
What to screen
| Element | Control |
|---|---|
| Customers and owners | Name screening against sanctions lists at onboarding, plus beneficial ownership under the 50 Percent Rule |
| Wallet addresses | Screening against listed addresses and blockchain-analytics exposure. See Wallet screening |
| Geography | Geolocation and IP blocking, and VPN detection |
| Counterparty VASPs | Licence, jurisdiction and ownership |
| Transactions | Ongoing monitoring for indirect exposure, and lookbacks after new listings |
| End users of merchants | Where a processor receives buyer data, screen it too |
Fuzzy matching
OFAC recommends fuzzy logic to catch name variations. Its examples include "Yalta, Krimea" as an alternative spelling, and "Krajinvestbank" or "Kray Invest Bank" for a listed "Krayinvestbank". Keyword lists of a sanctioned region's cities help screen KYC data.
OFAC's case studies
| Case | What went wrong | Lesson |
|---|---|---|
| 2020: digital asset custody and trading company | Tracked users' IP addresses for security but did not use them for sanctions screening. Users with IPs in Crimea, Cuba, Iran, Sudan and Syria used its non-custodial wallet service | Use all data you hold, even if collected for another reason |
| 2021: virtual currency payment processor | Screened its direct merchant customers but not the buyers paying them, despite receiving their names, addresses and sometimes IPs | Screen end users where you receive their data |
Screening flow for an outgoing stablecoin payment
flowchart TD
A[Payout request] --> B[Screen beneficiary name and owners]
B --> C[Screen destination address and its exposure]
C --> D[Check IP and location of the requester]
D --> E{Any match or red flag?}
E -- No --> F[Send]
E -- Possible match --> G[Investigate: false positive?]
G -- False positive --> F
G -- True match --> H[Block or reject]
H --> I[Report to OFAC within 10 business days]Red flags (OFAC)
- Inaccurate or incomplete KYC information at account opening.
- Access from an IP address or VPN connected to a sanctioned jurisdiction.
- Refusal to provide updated KYC or transaction information.
- Attempts to transact with an address linked to a blocked person or sanctioned jurisdiction.
Lists change
Sanctions designations are not permanent. On 21 March 2025 the US Treasury removed sanctions against Tornado Cash, a crypto mixing protocol. Screening tools must update both additions and removals, and internal risk policies may stay stricter than the legal minimum.
OFAC also suggests that addresses sharing a wallet with a listed address may pose risk, and that firms consider a historical lookback after an address is listed.
WarningA stablecoin transfer cannot be recalled once final. Screening has to happen before sending, and before crediting or releasing received funds.
NoteSanctions exposure is not only US-based. The EU, UK, UN and others keep their own lists. A business serving several markets must screen against each list that applies to it.
Jurisdiction breakdown
| Authority | List | Notes |
|---|---|---|
| OFAC (US) | SDN List and others | Strict liability; addresses listed as identifiers |
| OFSI (UK) | UK sanctions list | Applies to UK persons and UK-linked activity |
| EU | EU consolidated list | Applies to EU persons and activity in the EU |
| UN | Security Council consolidated list | Implemented through national law |
Illustrative example: a lookback
Illustrative example. The business and addresses are invented.
A PSP pays out USDT to 3,000 merchant and affiliate addresses a month. OFAC lists a new address linked to a sanctioned exchange. The PSP's analytics provider flags that one of its affiliates received funds from that address two months earlier, before listing. The PSP freezes payouts to the affiliate, investigates, takes legal advice, and documents the decision. It does not report the old transaction as blocked, because it was legal at the time, but files an internal record and raises the affiliate's risk rating.
Q/A
Does OFAC require specific software?
No. OFAC says it does not require any particular in-house or third-party software, but notes such tools "can be helpful".
What happens if we receive funds from a sanctioned address?
Under US rules the funds may have to be blocked and reported within 10 business days. Take legal advice at once.
Are non-US businesses affected by OFAC?
They can be, for example when using US dollars, US providers or US persons. Many stablecoin issuers and providers apply OFAC lists globally.
Is a VPN user from a sanctioned country our problem?
OFAC expects firms to detect VPN use and improbable logins where they can. Weak geolocation controls feature in its enforcement cases.
Does self-disclosure help?
OFAC says voluntary self-disclosure may be a mitigating factor in enforcement.
Can an issuer freeze our balance?
Yes. Major issuers can freeze addresses, often at the request of authorities.
Sources
- OFAC, Sanctions Compliance Guidance for the Virtual Currency Industry (October 2021): https://ofac.treasury.gov/media/913571/download?inline
- OFAC, civil penalties and enforcement information: https://home.treasury.gov/policy-issues/financial-sanctions/civil-penalties-and-enforcement-information
- US Treasury, Tornado Cash delisting (21 March 2025): https://home.treasury.gov/news/press-releases/sb0057
- private.law, Stablecoins: Types and Regulation: https://wiki.private.law/en/stablecoins
- Tether, freeze of more than US$344m (23 April 2026): https://tether.io/news/tether-supports-freeze-of-more-than-344-million-in-usdt-in-coordination-with-ofac-and-u-s-law-enforcement/
FiatDesk Wiki is educational. Not financial or legal advice.