FAQ launched by OFAC into the Tornado Cash storm
On 8 August 2022, the US Office of Foreign Assets Control (OFAC) imposed sanctions relating to Tornado Cash in connection with alleged money laundering activity, including by US sanctioned entities such as North Korea's Lazarus Group. The sanctions raised significant debate over whether OFAC had overstepped its authority by imposing sanctions on autonomous smart contracts and the steps which DeFi protocols in particular would be required to take to comply with the sanctions. Following widespread calls for guidance, OFAC has issued four FAQs addressing the scope of the sanctions imposed on Tornado Cash.
The FAQs suggest that OFAC will take an expansive approach in requiring US persons and others who may be subject to US jurisdiction to block and report proceeds received from Tornado Cash. While the FAQs do not engage directly in the question of whether OFAC has the authority to sanction technology, OFAC has clarified that interacting with open-source code itself in a way that does not involve a prohibited transaction with Tornado Cash, is not prohibited. FAQ 1076 states:
For example, U.S. persons would not be prohibited by U.S. sanctions regulations from copying the open-source code and making it available online for others to view, as well as discussing, teaching about, or including open-source code in written publications, such as textbooks, absent additional facts. Similarly, U.S. persons would not be prohibited by U.S. sanctions regulations from visiting the Internet archives for the Tornado Cash historical website, nor would they be prohibited from visiting the Tornado Cash website if it again becomes active on the Internet.
That leaves the fundamental question of whether the US sanctions were intended to target an entity or entities called Tornado Cash or whether OFAC considers that it has sufficient authority to sanction technology in the form of autonomous smart contracts.
FAQ 1077 confirms that the US sanctions against Tornado Cash extend to any dealings by US persons with Tornado Cash and not just the wallet addresses which OFAC has identified in the SDN List.
OFAC's expansive approach is underlined by FAQ 1087 which confirms that it will also expect US persons whose addresses were "dusted" with proceeds from Tornado Cash following the imposition of sanctions to comply (absent a specific licence from OFAC). However, OFAC has stated that it will not prioritise enforcement action relating to delayed receipt of initial blocking and subsequent annual reports from those individuals.
FAQ 1079 addresses the issue of incomplete transactions initiated via Tornado Cash prior to the imposition of US sanctions and suggests that OFAC will view favourably licence applications which do not otherwise involve sanctionable conduct.
OFAC's latest guidance does little to address the unprecedented challenges posed by US sanctions relating to Tornado Cash which was also used by many crypto users for legitimate privacy preserving purposes. Given OFAC's expansive view of the sanctions' application, exchanges, decentralised projects and individuals will continue face difficult risk assessments and shoulder a considerable compliance burden in seeking to identify and block transactions which may be tainted by proceeds from Tornado Cash.
The latest guidance also leaves open the important question of whether OFAC in fact has authority to sanction autonomous smart contract addresses, something which may be tested in Court if US based Coin Centre pursues its mooted challenge to the sanctions.