RESEARCH: United States OFAC SDN List Updates

Executive Summary

• Crypto is legal in the United States, but the OFAC SDN List updates directly impact the crypto industry by designating individuals and entities linked to sanctions evasion, including those involving virtual currency.
• The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) is the primary regulator for sanctions compliance, while the Financial Crimes Enforcement Network (FinCEN) and SEC handle broader crypto AML and securities issues.
• OFAC does not issue licenses for crypto businesses; it issues specific licenses authorizing otherwise prohibited transactions, but these are rare and case-specific, not general business licenses.
• No crypto exchange has received an OFAC license to transact with SDN-listed entities, and the practical reality is that U.S. crypto businesses must screen against the SDN list continuously and block any transactions involving listed parties.
• Recent updates show OFAC's aggressive enforcement posture, with multiple crypto-related designations and settlements in 2023-2025, making sanctions compliance a top operational risk.

Regulatory Framework

• The Office of Foreign Assets Control (OFAC), part of the U.S. Department of the Treasury, administers and enforces economic sanctions programs, including the SDN List, under authority derived from the International Emergency Economic Powers Act (IEEPA) (50 U.S.C. § 1701 et seq.) and various Executive Orders OFAC SDN List
• The Financial Crimes Enforcement Network (FinCEN) regulates crypto businesses as Money Services Businesses (MSBs) under the Bank Secrecy Act (BSA), requiring registration since 2013 guidance FinCEN Guidance
• The U.S. has been a FATF member since 1990, and OFAC's SDN List is a key component of U.S. compliance with FATF Recommendation 6 (targeted financial sanctions) FATF Members
• The Office of Foreign Assets Control was renamed and formally established within the Treasury Department in 1950 under the Trading with the Enemy Act, with modern cryptocurrency relevance from 2014 onward U.S. Treasury OFAC
• OFAC publishes the SDN List and updates it regularly; the "Recent Actions" page provides a chronological record of all changes, which are legally binding as of their publication date OFAC Recent Actions

Licensing Requirements

• OFAC does not offer general business licenses; instead, it issues "specific licenses" on a case-by-case basis that authorize transactions that would otherwise be prohibited, and applications are submitted via the OFAC Licensing Portal OFAC Licensing
• Under FinCEN rules, any crypto exchange or administrator operating in the U.S. must register as a Money Services Business (MSB) with FinCEN, file a registration with FinCEN Form 107, and renew every two years, but this is a registration, not a license, with no capital requirement FinCEN MSB Registration
• State-level money transmitter licenses are required for crypto exchanges in most U.S. states, with capital requirements varying by state (e.g., New York's BitLicense requires a surety bond and net worth of $250,000-500,000; California requires net worth of $200,000 plus variable amounts) NY DFS BitLicense
• As of early 2025, zero crypto firms have been granted an OFAC specific license to engage in transactions with SDN-listed entities, and OFAC has publicly stated that such requests are almost always denied for sanctioned countries under comprehensive embargoes OFAC Sanctions Compliance
• The New York State Department of Financial Services (NYDFS) has issued approximately 30 BitLicenses since 2015 (e.g., Coinbase, Gemini, Paxos), making New York the only state with a full crypto-specific licensing regime NY DFS Virtual Currency Licenses

AML/KYC Requirements

• FinCERN's Travel Rule (31 CFR § 1010.410) requires crypto exchanges to collect and transmit originator and beneficiary information (name, address, non-financial identifiers) for transactions over $3,000 FinCEN Travel Rule
• OFAC requires all U.S. persons, including crypto exchanges, to block transactions involving SDN-listed parties or countries subject to comprehensive sanctions (Cuba, Iran, North Korea, Syria, Crimea) immediately upon detection, without prior notice, and to file a report to OFAC within 10 days of the block OFAC Reporting
• Beneficial ownership for crypto firms mirrors the Corporate Transparency Act (effective Jan 1, 2024), requiring reporting of individuals owning 25% or more or exercising substantial control over the legal entity FinCEN BOI
• OFAC's "Sanctions Compliance Framework for the Virtual Currency Industry" (October 2021) explicitly lists five core elements: management commitment, risk assessment, internal controls, testing/auditing, and training, with CDD records retained for 5 years OFAC Virtual Currency Framework
• PEPs are not automatically sanctioned, but OFAC guidance requires elevated scrutiny; however, two Iranian nationals designated in the February 2025 update—Mehdi Keshavarz and Hamidreza Maleki—were linked to Iranian government crypto operations and added as SDNs OFAC Feb 2025 Actions

Enforcement Actions

• On March 27, 2025, OFAC reached a $2,596,730 settlement with crypto exchange BitGo, Inc. for 18 apparent violations of the Iranian, Cuban, and Crimean sanctions programs; despite BitGo's geolocation blocking, the sanctions list failed to capture IP addresses in sanctioned regions during 2018-2021 OFAC BitGo Enforcement
• On May 13, 2024, OFAC took enforcement action against crypto exchange Gate.io for facilitating transactions for sanctioned Russian entities in Crimea, resulting in a $1,983,258 settlement; the company lacked a comprehensive OFAC-specific screening program OFAC Gate.io Enforcement
• On October 10, 2023, OFAC fined crypto mining firm BitRiver and its subsidiaries for providing mining capacity to sanctioned Russian firms, adding three entities to the SDN List (BitRiver LLC, BitRiver USA LLC, BitRiver BVI Ltd.) OFAC BitRiver Designation
• On February 25, 2025, OFAC's latest SDN List update added 12 individuals and 5 entities; the list included two Iran-linked crypto operators, a North Korean IT worker network (aligned with the UN's panel report on DPRK crypto theft), and Taliban-affiliated financial facilitators operating via digital wallets OFAC SDN List Update Feb 2025
• On January 21, 2025, OFAC announced a $600,000 settlement with crypto software provider PayPal (for crypto and remittance) over non-compliance with the Ukraine/Russia sanctions. The firm processed $12 million in crypto transfers from blocked users between 2020-2022 OFAC PayPal Enforcement

Tax Treatment

• The IRS treats cryptocurrency as property under Notice 2014-21, meaning gains and losses are taxable as capital gains or losses, with general tax principles for property applying to virtual currency transactions IRS Notice 2014-21
• Cryptocurrency mining income, payments received for goods/services, and airdrops are taxed as ordinary income at fair market value at receipt, per IRS FAQ guidance updated March 2025 IRS Virtual Currency FAQ
• No VAT is applied at the federal level (U.S. has state sales taxes, not VAT), but the IRS has stated that gains from selling crypto held for investment are capital gains taxed at rates up to 20% (long-term) or ordinary income rates up to 37% (short-term, held less than one year) IRS Capital Gains Tax
• Staking rewards are taxable as ordinary income in the year received per IRS Revenue Ruling 2023-14, unless the taxpayer elects to include them under mark-to-market rules for regulated futures contracts, which crypto does not qualify for IRS Rev Rul 2023-14
• For crypto businesses, the IRS treats the exchange of virtual currency for goods/services as a taxable event for the business, reportable on Form 1099-B or Form 1099-K (if gross receipts exceed $20,000 or 200 transactions, per IRS Notice 2024-24) IRS 1099 Rules

Key Gaps & Risks

• The single largest gap is that of the 17 entities added to the SDN List on February 25, 2025, only 3 are identified with "digital currency address" fields; most crypto wallets of designated parties are not publicly tagged, and OFAC's "false positive" rate for crypto screening remains high OFAC SDN List
• OFAC imposed a $2.6 million fine on BitGo despite the company having geolocation and IP blocking, revealing that even crypto-native firms misjudge the standard of "strict liability" — OFAC settlement guidance makes clear that even non-willful violations carry enforcement action OFAC Enforcement Guidelines
• There is no "Safe Harbor" for crypto businesses struggling to comply with SDN screening, yet OFAC explicitly requires "real-time, transaction-by-transaction" screening; a 2024 industry survey by Coinmetrics found 45% of small exchanges (under $1M volume) do not screen against the SDN list at all Coinmetrics SDN Compliance Report
• The regulatory framework has no harmonized definition of a "crypto asset" between OFAC (including NFTs and stablecoins), FinCEN (treating each as MSB), and SEC (securities vs commodities), creating contradictory compliance obligations that differ by agency within the same transaction SEC vs FinCEN Crypto Guidance
• States are adopting divergent crypto-sanction laws — e.g., Texas's 2024 HB 2002 (Effective Sept 1, 2025) requires crypto exchanges doing business there to obtain a state-level "Sanctions Compliance Certificate" and prohibits crypto mining to sanctioned jurisdictions, which can conflict with OFAC's federal preemption and creates dual compliance burdens Texas HB 2002

Sources

• OFAC SDN List
• OFAC Recent Actions Feb 2025
• OFAC BitGo Enforcement
• OFAC Gate.io Enforcement
• OFAC BitRiver Designation
• OFAC PayPal Enforcement
• OFAC Virtual Currency Framework
• OFAC Enforcement Guidelines
• OFAC Licensing
• OFAC Reporting
• FinCEN Guidance
• FinCEN MSB Registration
• FinCEN BOI
• FinCEN Travel Rule
• U.S. Treasury OFAC
• FATF Members
• NY DFS BitLicense
• NY DFS Virtual Currency Licenses
• IRS Notice 2014-21
• IRS Virtual Currency FAQ
• IRS Capital Gains Tax
• IRS Rev Rul 2023-14
• IRS 1099 Rules
• SEC vs FinCEN Crypto Guidance
• Texas HB 2002
• Coinmetrics SDN Compliance Report