Cryptocurrencies have been making the headlines for all the wrong reasons. Their values have plummeted leaving investors out of pocket. Exchanges, lenders, and other entities in the crypto ecosystem have gone bust. Numerous fraud and money laundering cases involving cryptocurrencies have surfaced. Now, to add to all of this negativity, evidence is emerging about the wide-scale use of cryptocurrencies to evade economic sanctions imposed by western countries on foreign citizens, governments, and other entities.

One of the biggest cases was highlighted by Reuters last November. Under the headline “Crypto exchange Binance helped Iranian firms trade $8 billion despite sanctions,” the news agency alleged that the exchange had processed that amount of crypto transactions since 2018 in violation of U.S. sanctions designed to cut off Iran from the global financial system.

Almost all the funds potentially flowed between Binance and Iran’s largest crypto exchange, Nobitex, according to a review of data from U.S. blockchain researcher Chainalysis seen by Reuters; and three-quarters of the funds were in a low-profile cryptocurrency called Tron which allows users to conceal their identities.

Binance has denied any wrongdoing, as the Reuters article explains. Even so, it is clear that the use of cryptocurrencies to evade economic sanctions is a rapidly escalating problem. In a January preview of its 2023 Crypto Crime Report, Chainalysis said that despite the market downturn in 2022 “illicit transaction volume rose for the second consecutive year, hitting an all-time high of $20.1bn.” Incredibly, 44% of that came from “activity associated with sanctioned entities,” compared with a negligible amount in 2021. The remaining 56% was related to stolen funds, ransomware, fraud, terrorism financing, and other illegal activities.

Governments and their enforcement agencies have been working overtime to investigate who is using cryptoassets to evade sanctions and close the loopholes. They are having some success, but as the Chainalysis statistics show it is an uphill battle.

Offenders and How They Operate

Chainalysis calculates that crypto exchange Garantex accounted for most of the sanctions-related transaction volume last year, even though it was itself sanctioned in April 2022 by the U.S. Office of Financial Asset Control (OFAC), the financial intelligence and enforcement agency of the Treasury Department. However, “as a Russia-based business, Garantex has been able to continue operating with impunity,” says the report.

The Washington DC-based Center for Strategic and International Studies (CSIS) has also highlighted the nature and scale of the problem. “A current risk in today’s trade ecosystem is that countries leverage cryptocurrencies to circumvent U.S. sanctions,” writes the center’s William Reinsch and Andrea Palazzi in their article “Cryptocurrencies and US sanctions evasion.” “Due to their deregulated and decentralized nature, cryptocurrencies can be a useful tool to circumvent the global domain of the dollar.”

They go on to explain how Iran, North Korea, and Russia have circumvented U.S. sanctions in various ways. Iran, for instance, legalized cryptocurrency payments to pay for imports. North Korea has recovered some of its revenues lost due to sanctions by hacking into cryptowallets and laundering the stolen funds through crypto platforms. The North Korean state-sponsored hacking group Lazarus used Tornado Cash, a platform that mixes coins to disguise their origins, to launder the proceeds of its cyber crimes. “Since 2015, North Korea's cyberattacks have generated over $1 billion for the regime,” according to the CSIS article.

Although the crypto market is too small to fulfill Russia’s large import demands, newly developed hacking techniques and its leadership in crypto mining could allow it to use cryptocurrencies to make up for revenues lost to sanctions.

Countering the Threat

The response by the U.S. and other western governments has been swift and targeted. Agencies like OFAC, along with equivalent sanctions imposing and enforcing bodies in other countries, are taking action. According to Chainalysis’s 2023 Crypto Crime Report, they are helped by “cryptocurrency’s inherent transparency” and the “the willingness of compliant cryptocurrency services” – like exchanges that function as the link between crypto and fiat –  which “have demonstrated that sanctions enforcement is possible in the crypto world.”

Crypto firms found to be involved in sanctions violations and other illicit transactions are themselves being sanctioned. The Chainalysis report looks at how OFAC’s crypto-related sanctions strategy has evolved and its impact. It imposed its first crypto sanction in 2018 when it added two Iranian individuals associated with a ransomware strain to the sanctions list – the Specially Designated Nationals and Blocked Persons List (SDN List). Significantly, it also included the Iranian’s Bitcoin addresses. For the next few years, only individuals’ cryptocurrency addresses were included as sanctions identifiers but in 2021 this was extended to include addresses linked to entities. The digital currency addresses on the SDN List include their unique alphanumeric identifier (up to 256 characters) and identify the digital currency to which the address corresponds – for example, bitcoin is XBT, Ethereum is ETH and ripple is XRP. The addresses can be found using OFAC’s SDN List search tool.

Most of OFAC’s crypto sanctions have been imposed for the use of cryptocurrencies in cybercrime, drug trafficking, and money laundering, says Chainalysis, but OFAC itself says more attention is now being paid to how digital currencies are being used to evade economic sanctions. “The growing prevalence of virtual currency as a payment method… brings greater exposure to sanctions risk – like the risk that a sanctioned person or a person in a jurisdiction subject to sanctions might be involved in a virtual currency transaction,” warns OFAC in its Sanctions compliance guidance for the virtual currency industry.

Accordingly, OFAC is putting pressure on everyone in the cryptocurrency industry – technology companies, exchanges, administrators, miners, wallet providers, and users – to play “an increasingly critical role in preventing sanctioned persons from exploiting virtual currencies to evade sanctions and undermine U.S. foreign policy and national security interests.” Hence the guidance, which makes it clear that sanctions apply equally to transactions conducted in cryptocurrencies as to those conducted in traditional currencies. Crypto firms should look to implement the OFAC sanctions framework, being, 1. Employing a compliance officer, 2. Developing internal policy, 3. Employee training, 4. Testing and sanctions screening, and 5. Customer due diligence.  

One of the most high-profile actions in this respect was OFAC’s sanctioning of the cryptocurrency mixer Tornado Cash in August last year, for allowing itself to be used to launder more than $7bn worth of cryptocurrency over several years. This included more than $455m stolen by the North Korean Lazarus Group that was sanctioned by the U.S. in 2019. “While most virtual currency is licit, it can be used for illicit activity, including sanctions evasion through mixers, peer-to-peer exchangers, darknet markets, and exchanges,” said OFAC.

The UK is also taking a tougher approach. The authorities issued a reminder last March that the use of cryptoassets to circumvent economic sanctions was a criminal offense under money laundering regulations, and in August introduced new reporting requirements for crypto firms. Mainstream financial institutions were already required to notify the Office of Financial Sanctions Implementation (OFSI) if they became aware of a breach of the UK financial sanctions regime, but this requirement was extended to include all cryptoasset exchanges and custodian wallet providers registered with the Financial Conduct Authority.

Potential Drawbacks of a Tougher Approach 

More regulation is necessary, but it also has its disadvantages. For example, the World Economic Forum (WEF) has highlighted the problems that could result from OFAC’s decision to sanction Tornado Cash’s software protocol as well as the entity. An article on WEF’s website says “it is the first time the OFAC has sanctioned a software protocol, rather than an individual or legal entity,” in a decision that “has implications for the development of Web3” and raises “questions about the proportionality of the measure.”

The move creates “an unclear precedent for open-source protocols that are in essence pieces of code/software or technological tools used to some end,” continues the article. It means that U.S. persons or entities – as well as non-U.S. persons or entities that have a connection with the U.S. – who interact with the sanctioned protocols and digital currency addresses would be liable under U.S. law.

The risk of inadvertently violating U.S. sanctions could hold back the development of Web3, the next version of the internet based on distributed ledger technology, unless those in the Web3 ecosystem develop solutions to prevent “bad actors” from misusing the technology and imposing penalties when they are identified. The problem is, this is easier said than done.

The use of sanctions evasion technology or methods is a serious offense. The preventive measures being put in place to stop it are necessary. Yes, the laws, regulations, and investigatory powers may be onerous, and the penalties eye-watering. But surely it is not beyond the ingenuity of the big brains working in the cryptoasset and Web3 industries to find legitimate ways of navigating around these obstacles.