Syed Rahman outlines OFSI’s recently-published guidance.
The guidance on sanctions compliance in the crypto asset sector published recently by the UK’s Office of Financial Sanctions Implementation (OFSI) has two main purposes.
It serves as an assessment of the threats to UK financial sanctions in the sector. But it can also help those in the sector adopt an appropriate, risk-based approach to meeting their compliance obligations.
OFSI’s report relates to all registered UK crypto asset firms that exchange and / or arrange the exchange of crypto assets for fiat currencies (or vice versa) or of one crypto asset for another. Crypto firms have been added to the list of relevant firms under the UK sanctions regime and so must report to OFSI when they know or have reasonable cause to suspect that either they have encountered a designated person or a breach of financial sanctions regulations has occurred.
It is worth noting that UK financial sanctions regulations do not differentiate between crypto assets and other forms of assets. So while it may sound obvious, it is also worth emphasising that using crypto assets to circumvent financial sanctions is a criminal offence.
Failing
OFSI’s report states that, since January 2022, just over 7% of all suspected breach reports submitted to it have related to crypto firms. The report adds that OFSI has pinpointed inconsistent and delayed reporting as a key failing when it comes to crypto firms’ compliance efforts.
This has to be seen as a serious issue, given that the OFSI report makes it clear that designated persons have increasingly been using crypto assets as a means of evading the restrictions imposed on them by sanctions. More than 90% of the reports of crypto-related suspected sanctions breaches relate to the UK’s Russia sanctions regime, with the remainder relating to Iran.
OFSI is encouraging crypto firms to make sure they are fully compliant with all UK sanctions regimes. Its guidance also highlights cross-border payments, centralised exchanges with links to designated persons, high-risk and non-KYC (know your customer) services, exchanges functioning on darknet marketplaces, nested exchanges, use of decentralised exchanges, over-the-counter trades, and use of layering, mixing and anonymity-enhancing techniques as reasons to be suspicious.
OFSI also warns about the threat of hackers linked to the Democratic People’s Republic of Korea targeting UK-based crypto firms. The guidance calls this “the most significant and persistent threat to the crypto assets sector at present’’ and blames those working for that state for a string of high-value crypto thefts globally in the past three years.
Factors
Given the sanctions challenges facing the crypto sector, OFSI has detailed a number of factors that may indicate situations where enhanced due diligence should be undertaken, as attempts could be being made to circumvent sanctions.
These include:
- Large or unusual transactions being made immediately after sanctions announcements.
- Repeated payments for very small amounts from individual addresses.
- Use of anonymity-enhancing crypto or technology, such as privacy coins or privacy wallets.
- Large amounts being built up from multiple small transfers (of less than £10,000 in value).
- Operations in jurisdictions that do not implement UK-aligned financial sanctions.
- Use of a virtual private network to disguise a party’s true location.
- A refusal to undergo standard compliance checks or a failure to provide transaction documentation.
OFSI asks crypto firms when making suspicious activity reports (SARs) to use the usual mechanism for reporting and:
- Include the reference OFSI – Cryptoassets Threat Assessment – 0725.
- Collect multiple small-value transactions involving the same actors or addresses into one report, as long as this does not create too great a delay.
- Include details such as the identity of the designated person and the relevant addresses and crypto quantities involved. Include the route in the case of indirect transactions, the measures put in place for any blocked transactions, and the reasons for any screening failure regarding transactions that have already occurred.
Such specific advice will be of use to both those in the crypto sector and legal professionals. The guidance’s more general recommendations for crypto firms regarding matters such as timely reporting as soon as any breach is identified, freezing assets linked to suspected sanction breaches, reporting breaches to OFSI and adopting a risk-based approach to compliance can also be of value to the sector.
It is worth emphasising the need to remain aware of developments regarding compliance requirements and emerging threats by regularly reviewing OFSI guidance, FAQ’s and advisories.
