Partnered With:

OFAC Announces Sanction on Tornado Cash Industry Impact Interpretation and Risk Compliance Plan

Read this article in 13 Minutes

How Encryption Institutions Respond to OFAC’s Sanctions on Tornado Cash in Compliance

Original title: "Industry Impact Interpretation and Risk Compliance Plan—OFAC Announces Sanction on Tornado Cash"

Original Source: Shickey, AiYing Compliance

The U.S. Department of the Treasury announced on August 8 that the mixed currency agreement Tornado Cash was included in the SDN sanctions list. This is also the first Defi project to be sanctioned. Money laundered over $7 billion. According to data released yesterday by the Web3 blockchain security company Beosin, in the first half of 2022, approximately $1.1407 billion in stolen funds were transferred to Tornado Cash by hackers, accounting for 60% of the total Web3 losses. Following the sanction of Tornado Cash, Zcash (ZEC) and other privacy cryptocurrencies, and even related transaction parties may face a very large risk of being sanctioned. Therefore, it is very necessary for us to understand the working mechanism of OFCA to avoid corresponding risks.

In the first half of 2022, approximately $1,140.7 million in stolen funds were transferred by hackers to Tornado cash. Source: Beosin

1. OFAC

There are many functional departments in the United States involved in issuing and implementing sanctions policies , including, but not limited to, the President of the United States, the Director of National Intelligence, the Departments of State, Department of Justice, OFAC, and Bureau of Industry and Security of the Department of Commerce, among others. Among them, the department mainly responsible for who is on the SDN sanctions list is OFAC, the Office of Foreign Assets Control of the US Department of the Treasury. They are also responsible for the economic sanctions against Russia and the previous sanctions against Myanmar, Cuba, North Korea, Libya and other countries. In a nutshell, it is the responsible department for all terrorism, transnational drug and narcotics trade, proliferation of weapons of mass destruction and other money laundering, as well as financial sanctions imposed by countries that they dislike.

Second, what does it mean to be included in the SDN list?

The SDN List is used to sanction entities and individuals who violate OFAC's Sanctions Programs. According to the OFAC sanctions, the property of the SDN subject in the United States will be frozen, and any American (including US citizens, US green cards, institutions or legal persons registered and established in accordance with US laws, and people located in the US) will not be allowed to trade with them, which also means SDN entities will not be able to conduct USD clearing and transactions. Additionally, under OFAC's "50% Rule," any other entity in which one or more SDN entities own a 50% or greater interest should also be considered equally sanctioned. Of course, it also depends on whether there are secondary sanctions. If there are, the subjects and individuals of secondary related transactions will also be punished accordingly.

Let's first look at the level of sanctions and their consequences:

Although Tornado Cash is DeFi without a physical organization, it does not prevent OFAC from imposing sanctions on him. At present, it is a first-level sanction. So we can see that after the announcement of the OFAC sanctions information, the US organization Circle subsequently froze the USDC funds in the Tornado Cash wallet address, and we can also see that the corresponding "Americans" will be prohibited from having relationships with them, otherwise in addition to fines There may even be criminal liability.

So what will happen if it is a secondary sanction?

To use an image metaphor, the addresses included in the SDN list will be like the current asymptomatic new crown Virus-infected people, in the absence of prevention and control, they will infect the crowd at an extremely fast speed, and the way of infection is the interaction of various contracts between DeFi products and trading platforms, and the final result is everyone's Wallet addresses may all be recruited, and they are all on OFAC's penalty list.

Third, in case of wallet What to do if the address is infected?

It is the same as being red coded, you need to be isolated first and then do nucleic acid observation, and then wait Turn to green code. Similarly, your assets will be frozen, during which you need to apply to OFCA for removal from the SDN list. Specific removal method process:

Having said that, although it may be resolved in the end, it will take time and effort in the middle , it is best to prevent problems before they happen, prepare the compliance content in advance, and try to avoid pitfalls as much as possible.

Fourth, encryption business cooperation What is the regulation strategy?

1. Management Commitment

2. Risk Assessment

3. Internal Controls

In the virtual currency industry, the internal controls a company implements depend on the products and services it offers, where the company operates, the location of users, and the specific sanctions risks that the company identifies during its risk assessment process, among others. Generally speaking, internal controls include:

4. Testing and Auditing

For the virtual currency industry, best practices for testing and auditing procedures for sanctions compliance programs include:

5. Compliance Training

The scope of compliance training will be determined by the size, complexity and risk profile of the company. Effective OFAC compliance training for the virtual currency industry should take into account frequent changes and updates to sanctions, as well as new and emerging technologies in the virtual currency space. OFAC training should be provided to all appropriate employees, including compliance, management, and customer service personnel. Compliance training should be conducted on a regular basis, at least annually. A well-established OFAC compliance training program will provide each employee with specific job knowledge as needed, communicate sanctions compliance responsibilities, and assess employees to meet compliance training requirements.

In addition, establishing a sound compliance system is also a prerequisite for companies to be removed from the blacklist , Designing and implementing an effective compliance system can prevent compliance risks, and can also help companies mitigate or avoid penalties when violations or behaviors occur.

Summary

OFAC’s sanctions on Tornado Cash and its subsequent evolution are especially important to the encryption industry It has very high reference significance for the development of projects such as DeFi/anonymity and privacy. This is a problem of establishing the boundary line/principle of centralization and decentralization. We continue to pay attention and welcome to communicate!