Sanctions screening for crypto wallets: OFAC rules and the Tornado Cash saga
OFAC's virtual currency guidance, SDN-listed addresses, what Tornado Cash's 2022 listing and 2025 removal changed, and what to do on a hit.
US sanctions apply to crypto exactly as they apply to dollars, and liability is generally strict, so a payment to a sanctioned address can be a violation even if you did not know. Finance teams that send or receive crypto need screening before payments, a plan for a hit, and a way to account for funds that must be frozen.
The basic rules
OFAC says sanctions obligations are the same whether a transaction is in fiat or virtual currency: US persons must block property of people on the Specially Designated Nationals (SDN) List and must not deal with them [2]. In October 2021 OFAC published a sanctions compliance guide for the virtual currency industry [1]. It explains that US persons include US citizens and permanent residents wherever they are, anyone in the United States, and US-organised entities including their foreign branches [3]. Some programmes also reach foreign entities owned or controlled by US persons, and a non-US person can violate sanctions by causing a US person to do so [3].
Civil penalties generally follow a strict liability standard, which means a company can be liable without knowing it was dealing with a sanctioned party [3]. OFAC does weigh the full facts, and a risk-based compliance programme and prompt remediation can count as mitigating factors [3]. Entities owned 50 percent or more by blocked persons are themselves blocked, even when they do not appear on the list [3].
Addresses on the SDN List
Since 2018 OFAC has added some crypto addresses to SDN entries as identifying information [3]. Each listing shows the address and the asset it belongs to, and the addresses can be searched using the ID field in OFAC's Sanctions List Search tool [2]. OFAC warns the address lists are not likely to be exhaustive [2]. Its guide adds that unlisted addresses sharing a wallet with a listed address, or that have transacted with one, may also carry risk, and suggests a lookback through past activity when a new address is listed [3].
What the guide recommends
OFAC frames a sanctions programme around five components: management commitment, risk assessment, internal controls, testing and auditing, and training [3]. For crypto businesses it highlights [3]:
- Geolocation and IP blocking to stop users in comprehensively sanctioned jurisdictions.
- Know-your-customer information at onboarding and over the relationship, including IP addresses tied to logins and transactions.
- Transaction monitoring and blockchain analytics to spot addresses linked to sanctioned persons.
- Screening customers and transactions against OFAC lists, with fuzzy matching for name variants, and re-screening when lists change.
- Fixing control weaknesses quickly once found.
These are written for exchanges and service providers, but the logic carries over to a treasury team that pays vendors, contributors or grant recipients in crypto: screen the payee address before you pay, and re-screen standing payees.
Tornado Cash: listed, challenged, removed
On 8 August 2022 Treasury sanctioned Tornado Cash, a mixer on Ethereum, saying it had laundered more than 7 billion dollars since 2019, including over 455 million dollars stolen by North Korea's Lazarus Group [4]. The listing included the protocol's smart contract addresses, which meant US persons could not interact with them.
Users challenged the listing. On 26 November 2024 the Fifth Circuit held that Tornado Cash's immutable smart contracts are not the property of a foreign national or entity, so they could not be blocked under the sanctions statute and OFAC had exceeded its authority [5]. On 21 March 2025 Treasury removed the sanctions, citing its review of the novel legal and policy issues involved, while restating concern about North Korean hacking and laundering [6]. OFAC deleted Tornado Cash, its website and 102 Ethereum addresses from the SDN List; co-founder Roman Semenov stays listed under a North Korea-related designation [7].
Two lessons follow. First, sanctions lists change in both directions, so screening must use the current list and keep a record of the list version used. Second, the delisting does not make every mixer interaction low-risk: Treasury told US persons to take care before transactions that could benefit malicious cyber actors or North Korea [6].
What to do on a hit
If you hold crypto that must be blocked, OFAC says you must deny everyone access to it [2][3]. You do not have to convert it to dollars or hold it in an interest-bearing account, and you may block each wallet separately or in a consolidated wallet [2]. Report blocked property to OFAC within 10 business days and then every year while it stays blocked; annual reports cover property held on 30 June and are due by 30 September [2][3]. If you reject a transaction for sanctions reasons, a rejected transaction report is also due within 10 business days [3]. Funds can be released only with OFAC authorisation or when the prohibition stops applying [2].
If you have already paid a sanctioned address, the payment cannot be reversed on-chain. Escalate to counsel; OFAC's guide describes voluntary self-disclosure and remediation as factors it considers [3].
On the books
The sanctions rules say nothing about accounting. Whether a blocked balance is still your asset, how to present it and what to disclose are judgement calls for you and your auditor. Many teams move blocked units into a separate restricted sub-account so they are not counted as available treasury and are easy to report.
| Account | Debit | Credit |
|---|---|---|
| Incoming USDC from a counterparty later matched to an SDN-listed address is blocked 5,000 USDC carried at 5,000.00; reclassified at carrying amount, no gain or loss | ||
| Digital assets — USDC (restricted: OFAC blocked) | 5,000.00 | |
| Digital assets — USDC | 5,000.00 | |
What to do
- Screen every outgoing payee address and every material incoming counterparty against the current SDN List before booking or paying.
- Record the screening date and list version with the payment evidence.
- Write a hit procedure: freeze, escalate to counsel, file the 10-business-day report, diary the annual report.
- Keep blocked units in a separate restricted sub-account and exclude them from available liquidity.
- Re-run a lookback when OFAC adds addresses that your wallets may have touched.
- This is general information, not legal advice.
Sources
- Publication of Sanctions Compliance Guidance for the Virtual Currency Industry and Updated Frequently Asked Questions (U.S. Department of the Treasury, OFAC)
- Questions on Virtual Currency (U.S. Department of the Treasury, OFAC)
- Sanctions Compliance Guidance for the Virtual Currency Industry (U.S. Department of the Treasury, OFAC)
- U.S. Treasury Sanctions Notorious Virtual Currency Mixer Tornado Cash (U.S. Department of the Treasury)
- Van Loon v. Department of the Treasury, No. 23-50669 (5th Cir. 2024) (U.S. Court of Appeals for the Fifth Circuit)
- Tornado Cash Delisting (U.S. Department of the Treasury)
- Cyber-related Designation Removal; North Korea Designation Update and Removal (U.S. Department of the Treasury, OFAC)
General information for finance teams, current as of publication. Not legal, tax or accounting advice.