Stablecoin issuer sanctions obligations under OFAC: a compliance guide

A stablecoin issuer onboards a new institutional counterparty through an automated screening tool. The name returns no match. Six months later, an ownership review surfaces a blocked person holding a majority stake through two intermediate entities. The issuer has been settling transactions for that counterparty – and under OFAC, settlement of funds in which a blocked person has an interest is a prohibited dealing, irrespective of intent. That is the exposure stablecoin issuers face when name screening is treated as a complete control.

Stablecoin issuers face stablecoin issuer sanctions obligations under OFAC that extend well beyond wallet-address screening. The core obligation is to block property – including digital-asset wallets and the stablecoin balances they hold – in which a designated person has an interest of 50 percent or more in the aggregate. Blocked property and rejected transactions must be reported to OFAC within 10 business days. Records must be kept for five years. Civil penalties are assessed on a strict-liability basis: knowledge of the violation is not required for liability to attach.

This guide walks through the compliance decision points a stablecoin issuer must work through, from initial classification of its obligations to the programme elements that hold up under regulatory scrutiny. As of January 2026, regulatory expectations for digital-asset issuers continue to develop across multiple regimes; the position described here reflects OFAC's published framework as currently in force.

Decision point 1: is your business a financial institution for OFAC purposes?

The first question any stablecoin issuer must answer is whether it falls within the category of persons subject to OFAC's jurisdiction – because the answer determines the baseline obligations and the enforcement risk profile. OFAC's jurisdiction extends to US persons and to transactions touching the US financial system, which captures virtually every issuer that settles in US dollars or holds dollar-denominated reserves.

A permitted payment stablecoin issuer – a category under active US legislative discussion as of early 2026 – is treated as a financial institution for anti-money-laundering purposes under a proposed rule that would require a full sanctions compliance programme. Even issuers that do not yet hold that formal designation are, as US persons or dollar-system participants, subject to OFAC's existing prohibitions. The practical implication: if your stablecoin is pegged to the US dollar, or if any element of your issuance, redemption, or reserve infrastructure is US-domiciled, you are within scope.

The compliance question is then not whether the rules apply, but how they apply to your specific operating model. Does your issuer sit on-chain only, with no direct counterparty relationship? Does it maintain a permissioned ledger with KYC at issuance and at redemption? Or does it operate in a hybrid model where secondary trading is beyond its direct control? Each architecture creates a different set of legal exposure points.

Decision point 2: does the 50 percent rule capture any wallet or counterparty?

The 50 percent rule is OFAC's rule that any entity owned 50 percent or more by one or more blocked persons in the aggregate – directly or indirectly – is itself treated as blocked, even if it does not appear by name on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons). In the stablecoin context, this means a wallet or institutional account held by a non-listed company can be subject to blocking obligations if its ultimate ownership chain leads to a designated person.

Aggregation is the mechanism firms most commonly miss. Two designated persons each holding a minority stake in the same counterparty may together reach or exceed the threshold. A screening tool that checks only the direct counterparty name – and does not trace the ownership chain – will not catch this pattern. We regularly advise issuers who discover the gap only after a transaction has been completed and a subsequent ownership review surfaces the problem.

The ownership analysis must be contemporaneous. Designation status changes; OFAC updates the SDN List on a rolling basis. An ownership structure that was clean at onboarding may be captured by a subsequent designation. This is why periodic re-screening of existing counterparties is an operational obligation, not a one-time exercise.

It is also worth asking: what happens to on-chain balances when the blocking obligation arises mid-transaction? OFAC's position on blocking (the obligation to freeze and segregate assets in which a blocked person has an interest, pending OFAC instruction or authorisation) requires the issuer to act at the moment it has knowledge or should have knowledge of the interest. Delay increases exposure.

Decision point 3: does your architecture create facilitation risk?

Facilitation by US persons of transactions that would be prohibited if conducted directly by them is itself a prohibited act under OFAC's rules. In a stablecoin context, this can arise in several ways that are not always obvious from the product design.

Consider a permissionless secondary market in which stablecoins issued by a US-nexus issuer trade freely between wallets. The issuer does not control secondary transfers. Nevertheless, if the issuer provides liquidity to, processes redemptions for, or settles accounts with an intermediary that is itself facilitating dealings with blocked persons, the issuer may be within the facilitation prohibition. The question is whether the issuer's product is a necessary element of the prohibited chain.

Blockchain analytics addresses part of this risk. Regulators use tracing tools to identify wallet clusters associated with designated persons; a designation can extend to addresses linked to a listed person. Issuers that incorporate on-chain analytics into their screening process – looking at transaction history, wallet cluster associations, and source-of-funds signals – are better positioned to identify facilitation risk before it crystallises. Name screening alone does not reach this layer.

In our experience, the facilitation question is also the point at which cross-border complexity enters the analysis. An issuer may be a US person or US-nexus entity for OFAC purposes, but its counterparties and their counterparties may sit in jurisdictions where separate, overlapping obligations apply. We address the cross-regime dimension at decision point 5.

Decision point 4: what does a defensible sanctions compliance programme look like for a stablecoin issuer?

OFAC has articulated five elements that a well-designed sanctions compliance programme (SCP) should demonstrate: management commitment, risk assessment, internal controls, testing and auditing, and training. These are not sector-specific, but their application to a stablecoin issuer has particular features that a generic SCP template does not address.

First, risk assessment for an issuer must reflect the digital-asset-specific threat vectors: pseudonymous wallets, on-chain mixing, rapid peer-to-peer value transfer, and DeFi protocol interactions. A risk assessment modelled on a traditional correspondent-banking programme will miss these.

Second, internal controls must close the gap between name screening and ownership screening. Controls that are adequate for this business model typically include: automated SDN-list screening at wallet creation and at redemption; periodic re-screening of active wallets and institutional accounts; beneficial ownership collection at onboarding for institutional counterparties; on-chain transaction monitoring calibrated to geography, volume, and counterparty-cluster signals; and documented escalation procedures for potential matches.

Third, testing and auditing must include scenario testing for the 50 percent rule. Can your compliance team construct a hypothetical three-layer ownership chain and correctly determine whether the threshold is met in aggregate? Can your screening tool ingest the output of a corporate-ownership database and flag the result? If the honest answer to either question is no, the programme has a material gap.

Fourth, voluntary self-disclosure (VSD – the process of proactively reporting an apparent violation to OFAC before the regulator detects it) is a recognised mitigating factor in OFAC's published Enforcement Guidelines. An issuer that identifies a potential breach and discloses promptly, with a thorough remediation plan, is assessed differently to one that is detected. Engaging sanctions counsel early – before disclosure – allows the firm to scope the violation correctly, assess whether apparent violations are potentially egregious, and structure the submission in a way that accurately reflects the mitigating facts.

Decision point 5: how do other regimes interact with your OFAC obligations?

For a stablecoin issuer operating across jurisdictions, OFAC is rarely the only regime in play. The EU transfer-of-funds regime applies a zero-value threshold to transfers between crypto-asset service providers: originator and beneficiary information is required regardless of transaction value, as currently in force. This is stricter than most traditional-finance thresholds, and it applies to counterparties within the EU's regulatory reach.

UK rules administered by OFSI (the Office of Financial Sanctions Implementation) impose a reporting obligation on relevant firms that have knowledge or reasonable cause to suspect a dealing with a designated person. The UK ownership-and-control test differs from OFAC's mechanical 50 percent rule: it also looks at control, which means a non-listed entity effectively controlled by a designated person may be caught even where the ownership percentage falls below the threshold. Where an issuer has UK-nexus operations or counterparties, the UK position must be assessed separately.

Australia's autonomous sanctions regime, administered by DFAT, and Canada's measures under SEMA and JVCFOA, each apply independently. For an issuer with global distribution, compliance counsel should map which national regimes attach to which part of the operating model, because where two regimes both apply, the stricter prohibition governs the relevant conduct. Netting out the obligations is not permissible: each must be met on its own terms.

The travel rule obligations for virtual-asset businesses under Australian rules illustrate one dimension of this cross-regime analysis, and the BIS and EAR dimensions of travel rule obligations add the US export-control layer that can arise when technology is transferred across borders as part of an issuer's infrastructure. Issuers that treat sanctions and export controls as separate silos risk missing the intersection.

Decision point 6: what makes the position materially worse, and when should you call counsel?

Several patterns reliably escalate an OFAC matter from a manageable compliance issue to a serious enforcement exposure. Understanding them allows a compliance team to triage quickly when a potential issue surfaces.

Delay in blocking. When an issuer identifies a wallet or account in which a blocked person may have an interest, the obligation to block arises immediately. Continuing to process transactions while the issue is under internal review – without freezing the relevant assets and notifying OFAC within 10 business days – converts a potential technical violation into a course of conduct. The Enforcement Guidelines treat duration and pattern of violations as aggravating factors.

Inadequate records. OFAC requires records of blocked property and rejected transactions to be kept for five years. An issuer that cannot demonstrate, at the time of an OFAC inquiry, precisely what it blocked, when it blocked it, and what information it had at the time, faces an evidential problem independent of the substantive violation.

Prior notice. Where internal communications show that compliance officers raised the screening gap before the violation occurred, and management did not address it, OFAC's Enforcement Guidelines treat this as a factor that increases the seriousness of the matter. Document your gaps and document your remediation steps; undocumented verbal fixes do not help.

The myth that name screening alone is a complete control is, in our practice, the most common source of avoidable enforcement exposure for digital-asset issuers. Screening the wallet-holder's name at onboarding does not satisfy the obligation to assess and monitor the ownership chain, on-chain transaction history, or counterparty cluster risk. Compliance counsel should be involved when: the issuer is designing or redesigning its sanctions programme; an apparent match is identified; a transaction has been processed and a possible violation is under review; or the issuer is entering a new market or launching a new product line that changes its exposure profile.

For guidance on the related export-control dimensions of your compliance programme, the affiliate-level restrictions under BIS and the EAR can be material for issuers whose technology or infrastructure has US-origin components.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.