OFAC treats virtual currency transactions the same as fiat for sanctions purposes. U.S. persons must block property belonging to Specially Designated Nationals, including crypto addresses, deny access to it, and report the blocked assets to the Treasury. The 2026 sectoral determination on Iran's digital assets sector has widened secondary-sanctions exposure, so counterparty due diligence needs tightening immediately.
Legal mandate: blocking and reporting virtual currency under OFAC sanctions
The Office of Foreign Assets Control confirms that virtual and fiat transactions carry identical obligations. If a wallet or address is owned or controlled by a party on the Specially Designated Nationals list, it counts as lockable property, regardless of the token type or blockchain involved.
Determining whether an address belongs to an SDN requires more than a name match. Compliance teams need to check OFAC's Sanctions List Search tool against the specific digital currency address, since OFAC does periodically list individual addresses tied to designated persons or entities. Once a match is confirmed, the obligation is immediate: deny the counterparty further access, freeze the asset in place, and stop processing related transactions.
Reporting follows a strict clock. Under OFAC FAQ 646, an initial report on blocked virtual currency is due within 10 business days of the blocking action, with annual follow-up reports required for as long as the asset stays frozen.
Practical steps for U.S. persons handling a block include:
- Identify the specific wallet address, transaction hash, and estimated value at the time of blocking.
- File the initial report with OFAC's Sanctions Compliance Division within the 10 business day window.
- Retain internal records: screenshots, blockchain explorer data, and the compliance officer's sign-off.
- Set a recurring annual reporting reminder for as long as the property stays blocked.
- Never process, convert, or transfer the asset without an OFAC licence.
Sanctions screening controls, transaction monitoring, and red flags
Name-based screening alone is not enough for cryptocurrency restrictions in 2026. OFAC's virtual currency guidance brochure sets a risk-based benchmark that expects address-level checks alongside customer name screening, because a sanctioned actor rarely transacts under a name that matches KYC records.
A workable screening and monitoring stack usually includes:
- Exact-match address screening against OFAC's SDN list and any published blockchain addresses, refreshed as new designations land.
- Geolocation and IP analysis to flag access from sanctioned jurisdictions, cross-checked against declared residency at onboarding.
- VPN and proxy detection, since obfuscated IPs are one of the clearest sanctions-nexus signals in OFAC's own guidance.
- Behavioural analytics that flag unusual transaction volume, rapid fund layering, or clustering with previously flagged wallets.
- Escalation workflows that route any hit, however weak, to a named compliance officer within a fixed time limit.
Exact-match screening has a real limitation: it only catches addresses OFAC has already published. A counterparty one hop away from a listed address will not trigger an automatic alert, which is why link analysis across on-chain flows matters as much as the SDN check itself.
Pro Tip: Do not rely on IP geolocation alone to gate access. Pair it with document-based residency checks at onboarding so a single VPN session cannot silently reclassify a sanctioned user as compliant.
Secondary sanctions and the 2026 sectoral determination on Iran's digital asset sector
The Federal Register recorded a sectoral determination in August 2026 covering Iran's digital assets sector, part of what Treasury has branded Operation Economic Outcast. A sectoral determination lets OFAC designate anyone who operates in or provides material support to that sector, not just named individuals, which pulls foreign exchanges, OTC desks, and infrastructure providers into scope even without a direct SDN listing.
That shift matters because a U.S. VASP's counterparty risk no longer stops at its own SDN screen. Treasury's August 2026 action against exchanges funding Iran's IRGC shows how quickly a foreign platform can move from unlisted to designated.
Triage exposure with a short checklist:
- Map every foreign VASP, OTC broker, and liquidity provider your platform touches, directly or through a payment rail.
- Flag any counterparty with disclosed or suspected ties to Iran's digital assets sector for enhanced due diligence.
- Escalate to legal counsel before onboarding any entity operating in a sector subject to a sectoral determination.
- Reassess existing relationships against each new Treasury designation, not just at onboarding.
Custody, consolidation, and unblocking of frozen crypto assets
Blocked virtual currency does not need converting to fiat. OFAC FAQ 646 permits holding it in the original wallet or moving it into a consolidated omnibus account, provided controls prevent access or transfer without OFAC authorisation.
Operational discipline around that custody choice determines whether an OFAC examiner treats the block as sound. Required elements include:
- Dual-control sign-off before any movement of a blocked wallet, even for internal consolidation.
- A case file per blocked asset: address, blocking date, estimated value, and the report filed with OFAC.
- A tracked reporting calendar covering the initial 10 business day filing and every subsequent annual report.
- A documented rationale whenever the firm applies for a specific licence or requests OFAC guidance before acting.
Ten business days is the entire window between a block and the first report landing with OFAC. Firms that discover the requirement only after a hit occurs routinely miss it.
Designing a risk-based OFAC compliance programme for virtual asset businesses
OFAC's five-pillar sanctions compliance framework applies to virtual-asset businesses with only modest adaptation. The pillars are management commitment, risk assessment, internal controls, testing and training, and recordkeeping, and each needs a crypto-specific gloss.
- Management commitment: the board approves the sanctions policy and receives incident reporting on a fixed cadence, not just on request.
- Risk assessment: map exposure by product line (custody, exchange, OTC desk) and by jurisdiction, refreshed after every material Treasury designation.
- Internal controls: integrate address screening with existing AML/KYC systems so a sanctions hit and a suspicious activity flag are never handled by separate teams working from separate data.
- Testing and training: run periodic sanctions simulations that include address-level screening failures, not just name-matching drills.
- Recordkeeping: retain case files long enough to satisfy both OFAC's reporting rules and the firm's broader AML/CTF policy retention schedule.
Travel Rule data exchange creates a natural integration point. If originator and beneficiary information already flows between VASPs for AML purposes, that same data pipeline should feed the sanctions screen, rather than running a parallel, disconnected check.
Pro Tip: Test your sanctions programme against a scenario where the SDN hit comes from an address, not a name. Many firms discover during a real incident that their alert logic was built entirely around KYC name fields.
For platforms operating across jurisdictions, the governance patterns in regulatory compliance for virtual asset platform operators in the UAE offer a useful comparison point on how boards structure sanctions oversight outside the U.S. framework.
CRYPTOVERSE viewpoint: priority actions for the 2026 enforcement landscape
The gap we see most often is not a missing policy. It is a policy that exists on paper but was never wired into on-chain data. Firms run KYC screening and sanctions screening as separate exercises, so geolocation signals sit unused and address-level hits never reach the case manager who owns the OFAC report. Fix that link first. Confirm SDN address screening actually runs against live wallets, not just customer names, then build the medium-term programme upgrades around it.
— CRYPTOVERSE
How legal experts support OFAC sanctions readiness
Our legal team works directly with the OFAC frameworks that govern virtual currency, translating guidance like FAQ 646 into address-screening logic, case management procedures, and board reporting your firm can actually run.
Engagements typically start with a diagnostic review of existing screening controls and blocked-asset procedures, followed by a remediation roadmap and hands-on drafting of the compliance and AML/CTF policies that sit behind it. For firms managing exposure across the UAE's regulators as well as U.S. obligations, our regulatory and compliance advisory service covers both. If your current sanctions controls have never been pressure-tested against an address-level hit, get in touch through our services overview to scope a readiness review.
Sources
- OFAC: Publication of sanctions compliance guidance for the virtual currency industry and updated FAQs
- Federal Register: Sectoral determination for the Iranian digital assets sector (August 2026)
- Treasury sanctions crypto exchanges funding Iran’s IRGC and enabling illicit finance (7 August 2026)
FAQ
Does OFAC treat crypto differently from fiat currency?
No. OFAC's guidance confirms virtual currency carries the same blocking obligations as fiat, so a wallet linked to an SDN must be frozen exactly as a bank account would be.
How quickly must a blocked crypto asset be reported to OFAC?
An initial report is due within 10 business days of the blocking action, per OFAC FAQ 646, followed by annual reports for as long as the asset remains frozen.
What is the 2026 sectoral determination and why does it matter?
It is a Treasury mechanism allowing OFAC to designate anyone operating in or supporting Iran's digital assets sector, which extends secondary-sanctions risk to foreign exchanges and OTC desks that U.S. firms transact with indirectly.
Can a U.S. firm keep custody of blocked cryptocurrency, or must it convert to cash?
Firms can hold blocked virtual currency in its original form, including in a consolidated omnibus wallet, provided controls stop any transfer without OFAC authorisation; conversion to fiat is not required.
What happens if a crypto firm fails to comply with OFAC sanctions rules?
Non-compliance exposes a firm to civil penalties and potential criminal referral, and recent Treasury actions against exchanges tied to Iran's IRGC show enforcement extending beyond direct SDN dealings to sector-wide support.