In the cryptocurrency/blockchain business and Web 3.0 ecosystem - understood as a “new” internet built, operated, and owned by a community of users -, this is not different. The regulatory agencies and governments expect the crypto firms and the operators in the Web 3.0 ecosystem to also comply with AML/CFT regulations2 and Sanctions regimes3, otherwise they will be subject to fines and other penalties.
In August 2022, OFAC sanctioned a cryptocurrency “mixer”4 – programmes used to increase the anonymity of crypto transactions – for its alleged use in money-laundering, and, on 11 October 2022, an agreement5 between OFAC and a crypto firm settled a fine of $24,280,829.20 due to violation of Sanctions Compliance.
Crypto firms need to ensure that the controls in place can appropriately identify and mitigate risks generated by the fast pace of the transactions and the elevated anonymity level in a global customer base, peculiar to its own business, while navigate the complex and intricate Sanctions regimes, altogether. Likewise, the community of users of Web 3.0 that advocates the benefits of a novel, more efficient and fair ways of coordinating activities across jurisdictions, need to focus on developing collective solutions to identify and inhibit bad actors from misusing the technology and enforcing penalties.
Whenever these controls are not sufficient, resulting in deficiencies, as observed in the latest OFAC’S enforcements, for instance, the crypto firm/Web 3.0 operator will be subject to a fine. Therefore, relevant to learn the valuable lessons presented by the enforcement actions on how to build a Sanctions Compliance Program and what regulators expect crypto firms to do to prevent Sanctions risk.
Along with the Compliance Program essentials predicated in the management commitment, risk assessment, internal controls, testing and auditing and training, the crypto firm is expected to6:
- have effective internal controls in place to proceed with complete screening on customers and transactions, also focusing on a nexus to sanctioned jurisdictions, in addition to formal demonstration of understanding of Sanctions regulations, through policies and procedures;
- have a tailored and risk-based Sanctions Compliance Program in place and additional independent audits of its Sanction’s Compliance functions;
- conduct additional Sanctions Compliance training for all relevant staff;
- ensure that its Sanctions Compliance service providers are aligned and compliant with the institution’s Sanctions Compliance risk; and
- timely implement remedial measures after becoming aware of a potential Sanctions issue.
