Something is Rotten in the State of Crypto: How Virtual Currency is Used for Sanctions Evasion
Crypto criminal at work
By: Viktoryia H. Bick: Staff Editor
Since the creation of Bitcoin in 2009, cryptocurrencies have exploded in popularity and grown to an over $1 trillion industry. Virtual currencies offer ease of transactions, increased speed and anonymity, and a lack of regulation, all of which make them a dangerous tool that can circumvent financial sanctions.
Economic sanctions are a pressure mechanism that compels a country’s government or ruling regime to change its policies. In recent years, the United States has increasingly relied on sanctions as an enforcement measure to accomplish its foreign policy and national security goals. Administered through the Office of Foreign Assets Control (“OFAC”), sanctions are a useful instrument to cut off terrorism financing, place an arms embargo to prevent illegal international trade, and generally restrict financial transactions that threaten the security of the United States. Particularly in the wake of the 2022 Russian invasion of Ukraine, sanctions have become a go-to tool aimed at cutting off hostile economies from the dollar.
Yet, the United States can only do so much to prevent illegal transactions in cryptocurrencies. Due to their decentralized and unregulated nature, they have become a useful tool to circumvent the U.S. sanctions regime. Indeed, in 2022, the volume of illicit crypto transactions surpassed $20 billion for the first time, with 44% of those funds originating from activity associated with sanctioned entities. As investors are still reeling from fallout of the crypto winter following the remarkable failures of FTX, Alameda, and Three Arrows Capital, we must not forget that virtual currency is not just an imprudent market speculation, but also a dangerous weapon in the hands of illicit actors.
Recent Instances of Sanctions Evasion
A Reuters investigation last year revealed that the crypto giant Binance has processed Iranian transactions valued at over $8 billion since 2018. The majority of the funds flowed from an Iranian exchange, Nobitex, which conveniently offered guidance on skirting sanctions right on its website. Significantly, Nobitex login was among the seven most popular Internet searches in Iran in 2021.
Binance is not a U.S.-based company and does not have to comply with the OFAC sanctions regime. Nonetheless, the exchange does follow Know-Your-Customer guidelines that require customer identification for registering on the platform. However, even after announcing it would cut off Iranian transactions voluntarily, the exchange still processed over $1 billion in trades from Nobitex. Part of the problem is the so-called “indirect” flows that insert a layer of intermediary transactions to obfuscate the funds’ origin. Indeed, Nobitex advises its customers to avoid direct transfer of crypto to “maintain security.”
Another notable actor is Garantex, a Russian-based exchange that was recently in the news for its role in helping finance Palestinian militants in the lead-up to the October 7 attacks on Israel. Garantex, which has accepted at least $7 billion in deposits since Russia invaded Ukraine in February 2022, remains operational despite being put on the OFAC blacklist. Yet another popular Russian crypto exchange, Hydra, was shut down in April 2022 by the German police in cooperation with the U.S. law enforcement. With over 80% of the Russian banking sector sanctioned, a crypto exchange provides a relatively fast and cheap method of moving rubles in and out of the country.
Challenges & Ways Forward
In the United States, there is still an ongoing debate over whether cryptocurrency is a security (subject to the SEC’s oversight) or a commodity (which should be regulated by the CFTC). Meanwhile, in the international arena, OFAC published guidance on virtual currency compliance that focuses on five key principles: (1) management commitment, (2) risk assessment, (3) internal controls, (4) testing and auditing, and (5) training. It is unclear, however, whether regulations can keep up with the field that is developing as quickly as crypto. In the absence of a single comprehensive regulatory authority, legal gaps are likely to continue being exploited by bad actors.
One regulatory challenge is how to shut down an exchange that does not operate on U.S. soil. Sanctioning Binance for its Iranian connection and Garantex in Russia is problematic precisely for this reason. Binance, founded in Shanghai, but now claiming to have no official headquarters, only operates a subsidiary called “binance.US” in the United States, which the company insists is completely independent. While the U.S. Department of Justice has been investigating Binance for violating anti-money laundering laws since 2018, it remains an open question whether primary or secondary sanctions will be imposed on the company for its dealings with Iran.
Similarly, while the Western authorities have been able to shut down Hydra, whose servers were located in Germany, taking Garantex offline is close to impossible without the cooperation of the Russian government. Treasury has designated several of Garantex’s digital wallet addresses in its sanctions notice, but customers can change up the wallets to evade tracking software used by authorities. Short of imposing secondary sanctions on every individual and entity who has ever done business with the offenders, which would be in the millions, it is unclear how the regulators are to proceed.
One possible solution would be to introduce personal criminal liability for the owners of the exchange platforms implicated in sanctions evasion. A recent district court decision, Van Loon v. Dep’t of Treasury, supports this proposition. Although the decision dealt with a crypto mixer, i.e., a software program that keeps crypto transactions private by mixing identifiable digital funds with vast sums of other money, it imposed criminal liability on the founders for knowingly facilitating money laundering and violating U.S. sanctions. This reasoning could be expanded to include all crypto executives who are aware of how their platforms are used. If we must rely on crypto companies themselves to conduct due diligence on the transactions’ origin, we must also appeal to their self-interest to induce compliance.
Viktoryia Bick is a second-year student at Columbia Law School and a Staff member of the Columbia Journal of Transnational Law. She graduated from Middle Tennessee State University in 2020 and interned at the New York State Attorney General’s Office Investor Protection Bureau in 2023.