In a long-awaited decision involving the cryptocurrency “mixer” Tornado Cash, a U.S. district court on August 17, 2023, upheld the broad authority of the Department of the Treasury’s (Treasury’s) Office of Foreign Assets Control (OFAC) to sanction non-U.S. associations operating in the cryptocurrency decentralized finance (DeFi) space.
The following week, the U.S. Attorney’s Office for the Southern District of New York announced indictments against two of the co-founders of Tornado Cash for violations of U.S. sanctions and anti-money laundering (AML) laws.
Federal Court in Texas Sides With US Department of the Treasury in Tornado Cash Suit
Key Points
- Decentral autonomous organizations (DAOs) can be sanctioned by OFAC and smart contracts can be sanctionable property, one federal district court has held.
- Courts likely will defer to OFAC’s authority to designate non-traditional entities such as DAOs, emphasizing the U.S. sanctions risks across the DeFi space.
Background
Tornado Cash is a DeFi cryptocurrency “mixing” protocol. Operating on the Ethereum blockchain, it allows users to send cryptocurrency to one or more wallet addresses owned by the service, where it is pooled with the assets of other users. As a result of this pooling, when a user later instructs Tornado Cash to send funds to an address, it becomes difficult, if not impossible, to trace the payment back to the user who initially placed the cryptocurrency into the mixing service. Tornado Cash’s operational and governance decisions are made by a DAO. (See our August 2022 article, “Treasury and New York Enforcement Actions Reveal Continued Focus on the Cryptocurrency Industry and Regulators’ Priorities.”)
On August 8, 2022, OFAC sanctioned Tornado Cash, naming it as a specially designated national (SDN), and added Tornado Cash along with numerous Ethereum and USD Coin wallet addresses associated with the service to the SDN List. On November 8, 2022, OFAC simultaneously delisted and redesignated Tornado Cash as an SDN under executive orders 13694 (“Blocking the Property of Certain Persons Engaging in Significant Malicious Cyber-Enabled Activities”), as amended, and 13722 (“Blocking Property of the Government of North Korea and the Workers’ Party of Korea, and Prohibiting Certain Transactions With Respect to North Korea”).
On September 8, 2022, six Ethereum blockchain users challenged OFAC’s designation of Tornado Cash in the Western District of Texas.1 The plaintiffs put forward three claims to dispute the designation of Tornado Cash: (1) OFAC exceeded its statutory authority in designating Tornado Cash as an SDN, (2) the designation violated the plaintiff’s First Amendment free speech rights, and (3) the designation constituted a taking under the Fifth Amendment.
On August 17, 2023, the court granted summary judgment for the Treasury on the first two claims. It dismissed the third as waived because the plaintiffs did not raise it on cross-motions for summary judgment, and therefore did not reach the merits of the claim. We summarize the court’s findings as to the first two claims below.
OFAC Did Not Exceed Its Statutory Authority in Designating Tornado Cash
The plaintiffs argued that OFAC exceeded its authority in designating Tornado Cash as an SDN because:
- Tornado Cash is neither a foreign “national” nor “person” under the International Emergency Economic Powers Act (IEEPA) or a “person” under the North Korea Sanctions and Policy Enhancement Act of 2016 (NKA), the statutory authorities under which OFAC designated Tornado Cash as an SDN.2
- The smart contracts subject to OFAC’s designation are not “property” that can be regulated by IEEPA or NKA.
- Tornado Cash cannot have an interest in the smart contracts.
The court dismissed these arguments and sided with the Treasury.
Tornado Cash Is a “Person”
In finding that Tornado Cash is a “person,” the court noted that a “person” is defined by the Treasury as a “individual or entity,” and that an “entity” includes an “association.”3 The court observed that the ordinary meaning of “association” is “[a] body of persons who have combined to execute [a] common purpose or advance a common cause.”4 The court found that Tornado Cash is an association within this ordinary definition composed of its founders, developers, and its DAO, who have combined to execute the common purpose of developing, promoting and governing Tornado Cash. The court rejected the plaintiff’s argument that Tornado Cash is simply autonomous software.
Smart Contracts Can Be “Property”
The court rejected the plaintiffs’ argument that Tornado Cash cannot have a property interest in the smart contracts involved in the Tornado Cash mixing service. The court observed that OFAC’s definition of property includes “contracts of any nature whatsoever.” The court stated that the Tornado Cash smart contracts operate like quintessential unilateral contracts in that Tornado Cash offers its cryptocurrency mixing services, and users accept this offer by sending funds to the Tornado Cash smart contracts. The court noted that, “[e]ven if not every smart contract can be considered a contract, the record shows that Tornado Cash promoted and advertised the contracts and its abilities and published the code with the intention of people using it — hallmarks of a unilateral offer to provide services.”
Tornado Cash Has an “Interest” in Smart Contract “Property”
As to whether Tornado Cash can have an interest in the smart contracts, the court noted that OFAC’s definition of “interest” is expansive and includes “an interest of any nature whatsoever, direct or indirect.”5 The court found that the phrase “any interest” should be construed broadly and includes even interests that are not legally enforceable. The court found that Tornado Cash has a beneficial interest in the smart contracts because they provide Tornado Cash with a means to control and use crypto assets, and the use of the smart contracts generates fees for Tornado Cash in the form of TORN, the native token of Tornado Cash, when users execute a relayer-facilitated transaction. The court noted that Tornado Cash receives a regular stream of revenue from the use of the smart contracts for the relayer-enabled transactions.
The Designation Did Not Violate the Plaintiffs’ First Amendment Rights
The plaintiffs argued that the designation of Tornado Cash prevented them from exercising their free speech rights of donating to charities of their choosing anonymously through the Tornado Cash services. While the court acknowledged that political contributions are protected speech, it disagreed that the First Amendment protected the plaintiffs’ right to do so through Tornado Cash where there are alternative means to make such contributions, even anonymously. The court also rejected the plaintiffs’ claim that the designation of Tornado Cash “chilled” the right of persons to publish source code.
The Tornado Cash ruling is the latest in a long line of cases in which federal courts have deferred significantly to OFAC in its imposition of sanctions. Among other things, the court emphasized the U.S. sanctions risks associated with DeFi, particularly where OFAC or other U.S. government agencies may perceive that the services provided by a DAO, such as mixing, may be used to facilitate illicit transactions or benefit sanctioned persons.
It is unclear whether the plaintiffs intend to appeal the ruling. A second lawsuit raising similar claims was filed in the Northern District of Florida on October 12, 2022, and is still pending.
DOJ Brings AML and Sanctions Charges Against Tornado Cash Founders
Key Points
- The DOJ indictment alleges that the Tornado Cash service and associated relayers were involved in money transmission in the U.S. and were therefore subject to money services business (MSB) registration and compliance obligations.
- Following the charges, DeFi services and platforms should assess whether they are engaged in money transmission and if they are required to implement and maintain appropriate AML and sanctions compliance programs consistent with their risk profiles.
- The DOJ, OFAC and the Treasury’s Financial Crimes Enforcement Network (FinCEN) will continue to focus on the AML and sanctions risks posed by DeFi platforms in general and cryptocurrency mixers in particular.
On August 23, 2023, U.S. federal prosecutors unsealed an indictment in the Southern District of New York against Roman Storm and Roman Semenov, two of three co-founders of Tornado Cash, for conspiracy to commit money laundering, conspiracy to commit sanctions violations, and conspiracy to operate an unlicensed MSB, all stemming from their role in creating, operating, and promoting Tornado Cash. These charges carry a maximum of 20 years in prison.6
Significantly, the indictment alleges that Storm and Semenov and others involved in the Tornado Cash service, including relayers, “engaged in the business of transferring funds on behalf of the public,” yet the Tornado Cash service and the Tornado Cash founders failed to register as a MSB with the FinCEN or establish effective know-your-customer (KYC) or AML programs, as required of MSBs by FinCEN regulations. The indictment alleges that these failures “facilitated the ability of customers of the Tornado Cash service to transfer criminal proceeds between addresses on the Ethereum blockchain without being traced, and to engage in transactions meant to conceal the nature, location, source, ownership, and control of criminal proceeds.”7
The indictment alleges that “at least over $1 billion in criminal proceeds were laundered through the Tornado Cash service between its launch and August 8, 2022.”8 Specifically, according to the indictment, the Lazarus Group, a sanctioned North Korean cybercrime organization used Tornado Cash to launder hundreds of millions of dollars of hacking proceeds. The indictment alleges that Storm and Semenov knew of these transactions, implemented sanctions controls in the Tornado Cash service that they knew to be ineffectual, and continued to operate the Tornado Cash service and facilitate hundreds of millions of dollars in transactions involving a sanctioned wallet address associated with the Lazarus Group.
In announcing these charges, Acting Assistant Attorney General Nicole M. Argentieri of the Justice Department’s Criminal Division described cryptocurrency mixers as the “go-to method for criminals to conceal their ill-gotten gains.”9 This prosecution, especially the allegation that Tornado Cash operated as an unregistered MSB, shows that the DOJ, FinCEN, and OFAC continue to focus on the AML and sanctions risks posed by DeFi platforms in general and cryptocurrency mixers in particular.
DeFi services and platforms should assess whether they are potentially engaged in money transmission or other services that require MSB registration with FinCEN (and possibly licensing with state authorities), which includes the requirement to implement and maintain an effective AML compliance program that is consistent with their risk profiles.
_______________
1 See our September 28, 2022, client alert, “Treasury and Justice Department Reports Signal Tougher Enforcement and Regulation in the Digital Assets Sector.”
2 50 U.S.C. § 1702(a)(1)(B) of IEEPA extends to “any property in which any foreign country or a national thereof has any interest by any person, or with respect to any property, subject to the jurisdiction of the United States.” The North Korea Sanctions and Policy Enhancement Act, 22 U.S.C. § 9214(c), authorizes the president to prohibit transactions only in “property and interests in property.”
3 31 C.F.R. §§ 510.305, 322 and 578.305, 393.
4 Association, 2. Oxford English Dictionary Online (3d ed. 2022).
5 31 C.F.R. §§ 510.323, 578.314.
6 Sealed Indictment, U.S. v. Roman Storm and Roman Semenov, No. 23 Crim 43 (S.D.N.Y., 2023). The indictment was unsealed on Aug. 23, 2023.
7 Id. at ¶34.
8 Id. at ¶45.
9 United States Attorney’s Office for the Southern District of New York press release, “Tornado Cash Founders Charged With Money Laundering And Sanctions Violations,” Aug. 23, 2023.
