Agency’s Focus on Cryptocurrency and Blockchain Continues

On September 21, 2021, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) released an updated advisory to “highlight the sanctions risks associated with ransomware payments”—almost one year after issuing the first such guidance—and simultaneously imposed sanctions on SUEX, a virtual currency exchange accused of facilitating illegal transactions related to ransomware attacks.  These developments highlight OFAC’s continuing focus on sanctions violations that broadly involve virtual currencies and digital assets.  We briefly describe the agency’s actions below.

Ransomware Advisory

OFAC’s updated ransomware advisory is thematically similar to its initial guidance on the topic from October 2020.  It emphasizes U.S. national security interests in preventing ransomware payments to persons, entities, or jurisdictions subject to trade or economic sanctions programs.  As in the original guidance, it also warns U.S. persons to be vigilant when considering such payments and encourages ransomware victims to consult with law enforcement agencies before taking any action.

The updated advisory goes further, however, explaining that OFAC will consider a company’s actions both before and after a ransomware attack in determining an appropriate response to sanctions violations that may occur.  Specifically, and as part of an effective sanctions compliance program, OFAC emphasizes the importance of:

• taking proactive steps to “reduce the risk of extortion by a sanctioned actor through adopting or improving cybersecurity practices”; and
• reporting ransomware attacks to “appropriate U.S. government agencies” and cooperating with them in responding to such attacks.

According to the updated advisory, OFAC will consider these actions as mitigating factors under its Economic Sanctions Enforcement Guidelines, giving “significant” weight to prompt reporting of a ransomware event to authorities as well as “ongoing cooperation” in any investigation or remediation that follows. This guidance highlights the importance of developing and implementing clear escalation procedures to ensure that reports regarding ransomware and other types of extortionate demands that may raise sanctions risks are timely reported internally and externally, as appropriate.

SUEX Designation

For the first time, OFAC designated virtual currency exchange SUEX as a specially designated national (SDN), meaning that U.S. persons and companies are broadly barred from direct or indirect transactions involving the exchange or any entity of which the exchange owns 50 percent or more, directly or indirectly, either alone or in the aggregate with other SDNs (e.g., its subsidiaries).  SUEX was sanctioned under Executive Order 13694, which authorizes sanctions against persons or entities engaged in “malicious cyber-related activities.”

In taking this first-ever action against a virtual currency exchange, OFAC acknowledged that “most virtual currency activity is [legal],” but that cybercrimes often involve use of cryptocurrencies.  To that end, the agency explained that more than 40% of SUEX’s transaction history involved “illicit actors.”  OFAC did not, however, detail the specific activity leading to SUEX’s designation, nor did it identify customers or counterparties of SUEX for sanctions.

Perhaps in a sign of additional scrutiny to come, OFAC made clear that participants in the “virtual currency industry play a critical role in implementing appropriate AML/CFT and sanctions controls” and affirmed its support for multinational efforts to “inhibit cybercriminals’ exploitation of virtual assets.”

Recommendations

With these two significant actions, companies should consider taking the following steps:

1. Improve Cybersecurity Practices to reduce the risk of a ransomware attack. This also will be considered a significant mitigation factor under OFAC’s Economic Sanctions Enforcement Guidelines.
2. Revise the Company’s existing Sanction Compliance Program to specifically address the steps that Company personnel should take in the event of a ransomware attack, including a.) implementing escalation procedures in the event of a ransomware demand that may raise sanctions risks; and b.) promptly reporting ransomware attacks to law enforcement and/or OFAC.
3. Digital currency trading platforms should review their user accounts to determine if SUEX has an account. They also should consider whether they have users who conduct multiple deposits and withdrawals with SUEX.

We will continue monitoring related developments and provide updates as warranted.  Please do not hesitate to contact us with questions.

Perkins Coie LLP is pleased to bring you this updated Digital Asset SEC Timeline.

The Digital Asset SEC Timeline serves as an interactive compilation of select SEC guidance, enforcement actions, and speeches relating to the application of the federal securities laws to digital assets. Beginning with the release of the DAO Investigative Report in July 2017, the Timeline includes relevant information for analyzing the offering, issuance, and trading of certain digital assets in the context of the federal securities laws.

This Timeline is meant to be a resource for those following SEC actions and guidance related to digital assets and to assist experienced securities counsel in assessing the applicability of the federal securities laws. The Timeline is for informational purposes only and does not constitute legal advice. If you are, or are planning to engage in transactions involving digital assets, you may want to contact experienced securities counsel.

Information in the Timeline is provided “as-is,” and may not reflect the latest guidance from the SEC and/or other federal or state regulatory authorities. The Timeline contains links to third-party websites. Such links are only for the convenience of the reader or user. Use of and access to the Timeline, including the links contained within the Timeline, do not create an attorney-client relationship with Perkins Coie LLP.