OFAC Director Gacki: Crypto Sanctions Risks Are Real and Growing

The head of the US Treasury's sanctions enforcement office has given the crypto industry an unambiguous warning: sanctions compliance obligations apply in full to digital asset businesses, and OFAC is not waiting for the sector to catch up. In a conversation with Elliptic's David Carlisle, OFAC Director Andrea Gacki set out the agency's current thinking on privacy coins, unhosted wallets, ransomware, and mining, and the message is clear: document your risks, screen your counterparties, and be ready to demonstrate both.

Who Is Andrea Gacki and Why Does This Conversation Matter

Andrea Gacki leads the Office of Foreign Assets Control, the unit within the US Department of the Treasury responsible for administering and enforcing US economic and trade sanctions. OFAC sanctions touch virtually every financial institution and payments business that has any exposure to the United States, either through US-dollar settlement, US counterparties, or US-person employees. For crypto businesses, that reach is wider than many appreciate.

Director Gacki's remarks were made as part of Elliptic's Financial Regulator Crypto and Coffee Series, a public dialogue between regulators and the private sector. This was the first instalment, and the choice of OFAC as the opening participant signals how central sanctions enforcement has become to the crypto compliance agenda. A follow-up session was also announced featuring the Hong Kong Securities and Futures Commission's Director of Licensing and Head of Fintech, Clara Chiu, underscoring the global dimension of this regulatory push.

The Four Core Compliance Demands OFAC Is Making

Director Gacki's remarks distilled into four specific expectations for the crypto industry. Each carries practical consequences for compliance teams, CFOs, and the accounting firms that serve them.

1. Explain How You Handle Opaque Transactions

Crypto businesses must be able to show OFAC, clearly and concretely, how they manage sanctions risk when the identity or location of a counterparty cannot be determined. The two most common scenarios in this category are transactions involving unhosted wallets and transactions involving privacy coins. Where a user connects via an unhosted wallet, the business often has no direct KYC relationship with that wallet's controller. Where a privacy coin is involved, blockchain analytics may not be sufficient to trace fund flows to a known counterparty.

OFAC is not asking businesses to refuse all such transactions outright. It is asking them to have a documented, defensible policy for assessing the risk these transactions represent, and to apply that policy consistently.

2. Take Strict Liability Seriously

US sanctions law operates on a strict liability basis. That means OFAC can impose civil penalties even where a business did not know it was dealing with a sanctioned party. This is not unique to crypto, but it is particularly relevant in a space where pseudonymous addresses, privacy-enhancing tools, and cross-border flows make counterparty identification genuinely difficult.

Director Gacki highlighted that handling privacy coins or facilitating transactions with unhosted wallets raises the sanctions risk profile of a business, precisely because those features complicate counterparty identification. The elevated risk does not create a blanket prohibition, but it does demand a more rigorous control environment. A voluntary self-disclosure programme exists at OFAC, and a strong compliance culture is a mitigating factor in penalty decisions, but neither substitutes for the underlying controls.

3. Adapt Banking Sector Screening Practices

OFAC acknowledged that the crypto industry can and should draw on the established screening frameworks already used in traditional banking. Sanctions screening in banking typically involves real-time or near-real-time checks of transactions against OFAC's Specially Designated Nationals (SDN) list, plus checks on correspondent banking relationships, jurisdiction exposure, and transaction monitoring for typologies associated with sanctions evasion.

The point is not that crypto businesses should replicate bank processes wholesale; the technology and transaction structures differ materially. The point is that the underlying risk principles, identify counterparties, screen against designated lists, monitor for red flags, apply enhanced due diligence where risk is elevated, translate directly into a crypto context. Firms that have already invested in crypto bookkeeping software and digital asset accounting software with integrated compliance modules are better positioned to operationalise these controls at transaction level.

4. Document Risks Specific to Mining and Ransomware

OFAC expects crypto businesses to maintain a written risk assessment that addresses the specific sanctions risks associated with their particular activities. Two activities were called out explicitly: mining and ransomware. Mining operations can receive block rewards or transaction fees from addresses linked to sanctioned actors. Ransomware payments have historically been routed to wallets controlled by sanctioned groups or entities in sanctioned jurisdictions. A generic AML risk assessment is not sufficient; it needs to reflect the actual product and transaction mix of the business.

For accounting firms advising crypto-native clients, this is a direct signal that the board-level risk assessment is a regulated document, not an internal governance nicety. It should be reviewed at least annually, updated when OFAC adds new designations relevant to the client's business, and available for inspection.

Geopolitical Context: Why This Warning Is Timely

Director Gacki's remarks coincided with a development that illustrated exactly the kind of sanctions-evasion pressure OFAC is managing: Iran's government at the time permitted imports to be paid for using crypto, a measure aimed at circumventing sanctions restrictions. This is consistent with a broader pattern in which sanctioned states and non-state actors treat crypto rails as an alternative settlement mechanism when traditional channels are closed off.

For compliance teams, this context matters in two ways. First, it confirms that OFAC's focus on crypto is driven by real operational evasion attempts, not theoretical risk. Second, it reinforces that sanctions lists and the threat landscape evolve faster than annual review cycles. Businesses need near-continuous monitoring, not point-in-time snapshots.

The broader Southeast Asian dimension of this regulatory moment is also worth noting. Hong Kong and Thailand had an active cross-border CBDC pilot underway, while Cambodia's National Bank was running a pilot of its blockchain-based Bakong retail payment network. The growth of crypto-adjacent infrastructure across the region increases the surface area for sanctions risk, particularly where counterparties in those jurisdictions may route funds through privacy-preserving mechanisms.

Accounting and Operational Implications for B2B Firms

What This Means for Accounting Firms and CFOs

For accounting firms with crypto clients, Director Gacki's remarks translate into several concrete advisory responsibilities. Clients need documented, board-approved sanctions risk assessments that reflect their specific product mix. They need sanctions screening controls embedded at the transaction level, not just at onboarding. And they need a defensible record of how they handled transactions where counterparty identity was uncertain.

CFOs at crypto businesses should treat OFAC compliance as a financial reporting risk, not just a legal one. A sanctions violation can result in civil penalties, reputational damage, and in severe cases, the loss of banking relationships. Any of those outcomes has direct balance sheet consequences. The cost of the control environment is almost always lower than the cost of a penalty, and robust crypto accounting software that captures counterparty data and flags high-risk transaction patterns is a core part of that control environment.

It is also worth tracking the intersection of OFAC actions with stablecoin issuer behaviour. As background on Treasury's recent stablecoin freeze enforcement action demonstrates, stablecoin issuers are already cooperating with law enforcement to reverse and freeze transactions linked to illicit activity. That cooperation creates a paper trail that OFAC can use in its own investigations, meaning that exposure is not limited to the direct transacting party.

The Risk Assessment as a Living Document

OFAC's expectation of a documented risk assessment is not a one-time exercise. It needs to account for new designations, new product features (such as the addition of a privacy coin to an exchange's listing), changes in the business's geographic exposure, and emerging typologies such as the ransomware payment risks Director Gacki specifically flagged. Building a review cadence into the compliance calendar, with accountability assigned to a named individual or function, is the minimum expectation.

For firms advising clients through the lens of how US crypto rules are being tested for political durability, the OFAC dimension is an important counterweight: whatever the legislative outcome, OFAC's authority derives from the International Emergency Economic Powers Act and the Trading with the Enemy Act, both of which sit well outside the crypto-specific regulatory debates. OFAC sanctions enforcement is not going to be rolled back by a change in approach at any other US financial regulator.

Practical Next Steps for Compliance Teams

Director Gacki's remarks are not accompanied by new formal guidance, but they signal clearly where OFAC's examination focus sits. Teams should act on five priorities:

• Review and update the written sanctions risk assessment to cover privacy coin exposure, unhosted wallet transaction volumes, mining operations, and any ransomware-adjacent activity in the client base.
• Confirm that sanctions screening runs at transaction level, not only at customer onboarding, and that the SDN list and other OFAC lists are updated on a schedule that reflects how frequently OFAC issues new designations.
• Establish and document a decision protocol for transactions where counterparty identity or location cannot be determined, including criteria for rejection, enhanced due diligence, and escalation.
• Ensure that digital asset accounting software used to record transactions also captures the compliance metadata needed to reconstruct a sanctions screening record for any given transaction.
• Review the voluntary self-disclosure policy and make sure relevant staff know when and how to use it, since prompt disclosure is a recognised mitigating factor in OFAC's civil penalty framework.

None of these steps require waiting for new regulation. The legal framework is already in place. What OFAC is asking for is evidence that businesses are applying it.

Source: Elliptic