The investigation and enforcement of potential sanctions violations by crypto exchanges is an area of focus in the US at present.  The US Department of the Treasury’s Office of Foreign Assets Control’s (OFAC) recent
settlement with Kraken, a global virtual currency exchange, is the most recent OFAC case demonstrating the risks for virtual currency platforms that process transactions without comprehensive sanctions controls.  Kraken agreed to pay USD 362,158.70 to settle its potential civil liability for alleged breaches of the Iranian Transactions and Sanctions Regulations and also agreed to invest USD 100,000 in the implementation and improvement of its sanctions compliance controls.  The indications are that this enforcement trend will develop across the UK and Europe in 2023, as regulators in both jurisdictions are looking to bring crypto exchanges generally more into the regulatory fold.

In the UK, since June 2022, the UK’s Office of Financial Sanctions Implementation (OFSI) has had the power to impose civil monetary penalties on a strict civil liability basis, bringing it into line with the US.  It also has the power to publicise details of financial sanctions breaches where a monetary penalty has not been imposed, particularly if the case involves important compliance messages for industry.  OFSI can impose civil penalties of GBP 1m or 50% of the value of the breach, whichever is higher.  They offer a 50% reduction in penalty for self-reporting in serious cases, reducing to 30% in very serious cases.  Individuals and companies can also be criminally prosecuted.  Whilst OFSI has not published any enforcement action against crypto exchanges to date, action has been taken against entities in the FinTech sector, which along with recent regulatory developments in the UK and EU, suggest that crypto exchanges are becoming a strategic priority for enforcement agencies.

The UK government’s scrutiny of cryptoasset exchanges has increased in recent months.  In July, enforcement agencies issued a red ALERT that included the risk that designated persons or their close associates will use cryptoasset exchanges to evade or circumvent sanctions.  This referred to UK intelligence and operational activity increasingly observing such activity by Russian money launderers, with the ability to move “significant sums”. OFSI and the Financial Conduct Authority (the FCA) have confirmed that the use of cryptoassets to circumvent economic sanctions is a criminal offence and that cryptoassets constitute “economic resources” that must be frozen if sanctions are imposed on an entity or individual.  This mirrors the position in the US and EU.  Cryptocurrency exchanges must report breaches to OFSI in specified circumstances.  These factors, together with the establishment of the UK’s Combating Kleptocracy Cell and close cooperation with the US and EU authorities, suggest that companies will see increased enforcement action, potentially civil and criminal, in this area.

In October, the EU strengthened existing prohibitions on cryptoassets and transactions for Russian residents and entities, banning the provision of cryptoasset wallets and custody account services regardless of the total value of the cryptoassets.  Penalties for breaches of sanctions are determined at Member State level. Sanctions enforcement has varied between Member States.  However, this year, the European Commission introduced the EU Sanctions Whistle-blower Tool which can be used to report past, ongoing or future EU sanctions violations to the European Commission.  They can share the report and provide assistance to the relevant Member State(s).  In November, the European Council unanimously adopted the decision to add sanctions violations the list of “EU crimes”.  On 2 December, the European Commission proposed a Directive establishing minimum standard rules for the definition of criminal offences and penalties for breaches of EU Sanctions, with a view to harmonizing sanctions penalties and aiding effective investigation and prosecution.  At the same time, with the European Council’s approval of the Markets in Crypto-Assets Regulation (MiCA), the EU is on the verge of delivering the most comprehensive regulation of cryptocurrency markets.  The EU is signaling a clear intention to strengthen and streamline sanctions enforcement by its members, and cryptocurrency platforms are an obvious target.

The recent OFAC cases highlight that virtual currency exchanges are an area of interest for US enforcement.  There is every indication that a similar approach will be adopted in the future in the UK and EU.  Companies operating in this area should undertake close reviews of their existing risk assessments to ensure that they are comprehensive with appropriate measures in place to mitigate risk.  At a minimum, sanctions compliance should be benchmarked against relevant regulations and guidelines, and needs to be kept up to date as sanctions regimes evolve and expand – the Russia sanctions in particular have developed rapidly through the year.  Companies must ensure that they have effective onboarding, due diligence, and screening processes in place.  This will include having a qualified and well-trained compliance team, using appropriate software, and having efficient processes in place for identifying and escalating sanctions red flags.