Stablecoin issuer sanctions obligations under OFAC: compliance counsel

A stablecoin issuer operating across borders closes a transaction with a user whose wallet address links to a designated entity. The on-chain record is permanent. The exposure is immediate. Whether the issuer had a programme in place – and whether that programme was fit for the specific risks stablecoins create – determines how OFAC will treat the matter.

Stablecoin issuers face stablecoin issuer sanctions obligations under OFAC as financial institutions subject to IEEPA-based prohibitions: they must screen users and transactions against the SDN List (OFAC's list of Specially Designated Nationals and blocked persons), block or reject prohibited transfers, report blocked property and rejected transactions within 10 business days, and maintain records for five years. A screening gap that surfaces only after a breach is the defining risk for this sector, and in our experience the gap is usually structural, not incidental.

This page explains the outcomes we get stablecoin issuers to, the procedure and tests that govern obligations under OFAC, the cross-regime dimensions that compound exposure, and when specialist counsel materially changes the position.

What outcomes does effective OFAC compliance deliver for a stablecoin issuer?

Effective OFAC compliance delivers three concrete outcomes: a defensible position in any enforcement review, a programme that scales with transaction volume and user geography, and documented evidence of a reasonable compliance programme that OFAC treats as a genuine mitigating factor. These are not aspirational – they are the functional targets against which OFAC measures an issuer's conduct when it investigates a potential violation.

For a stablecoin issuer, the starting question is whether the programme addresses the distinctive features of the product. Stablecoins move at the speed of blockchain settlement, not the speed of a correspondent-banking wire. Users may be pseudonymous at onboarding. Wallet addresses – not just legal names – can themselves be designated. A programme designed for a traditional payment service will miss all three of these characteristics.

In our practice we focus first on whether the issuer has mapped its own product architecture against the obligations that actually attach to it. That mapping exercise consistently surfaces gaps that name-screening alone would never catch. Have you tested whether your screening logic reaches wallet-level designations, or only the legal-entity layer?

What is the legal basis for OFAC obligations, and how does it apply to stablecoin issuers?

OFAC's authority derives principally from IEEPA, under which it administers both list-based programmes (the SDN List) and, for certain country programmes, comprehensive territorial prohibitions. Stablecoin issuers sit within the category of financial institutions for the purpose of these programmes, as currently in force – verify the current position before relying on it – and are subject to the same prohibitions that apply to banks and payment firms: no dealing with blocked persons, no making funds or economic resources available, directly or indirectly, to listed parties, and no facilitation of transactions that a US person could not conduct directly.

The facilitation prohibition is significant for issuers with non-US affiliates or liquidity providers. A US-person stablecoin issuer that routes a transaction through a non-US entity to avoid a direct OFAC prohibition is itself in breach. The prohibition on facilitation catches the structure, not just the end-transaction.

OFAC operates on a strict-liability basis for civil penalties. This means knowledge or intent is not required to establish the violation itself. An issuer cannot rely on the argument that it did not know the wallet belonged to a designated person if the designation was publicly listed. The mental state of the issuer is relevant only to penalty severity, not to whether the violation occurred.

As of January 2026, a proposed rule treats permitted payment stablecoin issuers as financial institutions for AML purposes and requires a sanctions compliance programme as a formal obligation. The details of that rule are subject to the finalisation process – verify the current position before relying on it – but the direction of regulatory travel is clear: the compliance standard for stablecoin issuers is converging with that applied to licensed payment firms.

How does the OFAC compliance procedure work in practice for stablecoin issuers?

The compliance procedure for a stablecoin issuer follows five sequential stages, and the order matters because a failure at any stage can negate controls upstream of it.

Stage one: product and obligation mapping. Identify every point in the product lifecycle at which a sanctions obligation can attach: wallet creation, stablecoin minting, transfers between wallets, redemptions, and any off-chain settlement leg. Map the legal entities in the issuer's group that touch each stage. A non-US subsidiary that mints or redeems stablecoins on behalf of US-person users can itself be within OFAC's reach if the analysis is not done carefully at the outset.

Stage two: screening architecture. Name-screening of onboarding customers is necessary but not sufficient. The programme must also screen wallet addresses against OFAC's published designation lists, which include specific blockchain addresses. It must screen on an ongoing basis, not only at onboarding, because designations can occur after a user relationship begins. The screening logic must aggregate across accounts and wallets held by the same beneficial owner – OFAC's 50 percent rule (the rule treating entities owned 50 percent or more by blocked persons as themselves blocked) extends to wallet clusters controlled by designated persons.

Stage three: blocking and rejection. Where a match is identified, the issuer must take one of two actions: block the funds (freeze them and prevent further dealing) or reject the transaction (decline to process it). Which action applies depends on the type of programme in play. Blocked property must be reported to OFAC within 10 business days. This window is short; it requires a pre-built reporting workflow, not improvisation after the event.

Stage four: record-keeping. All relevant records – including the screening results, the blocking or rejection decision, and the underlying transaction data – must be retained for five years. In our experience, issuers frequently underestimate the granularity of record-keeping the OFAC standard requires. A log entry that says "screened – no match" is not the same as a record that shows what list was searched, at what date, against what identifier.

Stage five: voluntary self-disclosure. Where an issuer identifies a potential violation, voluntary self-disclosure (a VSD to OFAC, documenting the apparent breach and the remediation steps taken) is a recognised mitigating factor in OFAC's Enforcement Guidelines. Deciding whether and how to disclose is a legal judgment that depends on the facts of the apparent violation, the issuer's compliance history, and the severity of the potential penalty. This decision should not be made without specialist sanctions counsel.

Where does cross-regime exposure compound the OFAC position for stablecoin issuers?

A stablecoin issuer with users or infrastructure in the United Kingdom, the European Union, or both faces obligations that run in parallel with OFAC and that do not simply replicate it. Understanding the divergence is essential: the stricter prohibition governs the conduct of a person subject to both regimes, and the firm cannot net out the differences.

Under OFSI, the UK financial-sanctions authority, the obligations are structurally similar to OFAC's – asset-freeze, prohibition on making funds available, reporting duties – but the ownership-and-control test differs. Where OFAC's 50 percent rule is mechanical, the UK test can catch a non-listed entity that a designated person controls without owning 50 percent of it. For a stablecoin issuer with UK users, this means the scope of blocked counterparties may be wider under OFSI than under OFAC for the same ownership structure.

The EU position adds a further dimension. EU asset-freeze prohibitions extend to making funds or economic resources available, directly or indirectly, to or for the benefit of listed persons. The EU's transfer-of-funds regime applies a zero-value threshold to transfers between crypto-asset service providers: originator and beneficiary information is required regardless of transaction value. This zero-threshold rule has no direct OFAC equivalent. An issuer that calibrates its data-collection obligations to the OFAC standard will under-comply with the EU standard from day one.

Blockchain analytics amplifies all three regimes. Regulators use analytics tools to trace wallet clusters. A designation can extend to addresses associated with a designated person, meaning an issuer that has not updated its screening logic to include addresses – not just names – will miss a category of designation that OFAC, OFSI, and the EU all now use. In our cross-border practice, we see this gap arise most frequently in issuers that built their compliance programmes before address-level designations became routine. The architecture was correct for the moment it was built; it is not correct now.

Canada, Australia, and Singapore each implement obligations for virtual-asset service providers that affect issuers with users in those markets. The analysis for each jurisdiction is distinct. We regularly advise on the interaction between OFAC obligations and those of other regimes, and the starting point is always a map of where the issuer's users, entities, and counterparties sit – not an assumption that OFAC compliance transfers.

What are the risk flags that indicate a stablecoin issuer's programme is not fit for purpose?

The most consequential risk flag is a screening programme built entirely on name-matching. Name screening against the SDN List is the baseline of OFAC compliance. It is not the ceiling. An issuer that screens only at onboarding, only by name, and only against one list has not built a programme; it has built a single control that designated persons can circumvent with minimal effort – and that OFAC's own analytical capability will outpace.

A second risk flag is a failure to screen on an ongoing basis. Designations occur after user relationships begin. An issuer that screens at onboarding and then makes no further enquiry has a structural blind spot for every designation that post-dates account opening. The obligation to block or report is not conditional on having screened recently; it attaches when the designation exists.

A third flag is the absence of aggregation logic. Where a user controls multiple wallets or accounts, the 50 percent rule analysis must aggregate across the full cluster. Screening tools that operate wallet by wallet without a beneficial-owner aggregation layer will miss threshold-level exposure that is visible in aggregate. This is the same pattern that causes compliance failures at the bank-account level in traditional financial institutions, and it is at least as prevalent in digital-asset businesses.

A fourth flag is an unreviewed or inherited programme. Issuers that have grown through acquisition, rebrand, or product extension frequently operate compliance programmes built for a different product or a different regulatory moment. The acquired entity's programme may have been adequate for its original scope; it will not automatically be adequate for the acquirer's. We have acted for issuers that identified this gap only when a transaction failed to process – at which point the disclosure and remediation clock was already running.

Finally, the absence of a VSD protocol is itself a risk flag. An issuer that has never considered what it would do in the first 72 hours after identifying a potential breach is one that will be improvising at the worst possible moment. The decision about whether to disclose, and on what terms, requires a prepared position, not a reactive one.

Is name screening alone enough to meet OFAC obligations?

Name screening alone is not enough, and the belief that it is represents the most common misconception we encounter in this sector. OFAC's own guidance is explicit: a sanctions compliance programme is a multi-element control, of which name screening is one component. The elements that name screening does not address include wallet-address designations, ongoing post-onboarding screening, aggregation of holdings across related wallets, and the record-keeping standard that OFAC applies when it investigates a potential violation.

The misconception persists for understandable reasons. Name screening is visible, auditable, and produces a clear yes/no output. It maps naturally onto existing AML/KYC processes. It satisfies the question "did we check the list?" without addressing the question "did we check the right things, in the right way, at the right time?" These are different questions, and OFAC's Enforcement Guidelines treat them differently. An issuer with a comprehensive name-screening programme but no address-level screening, no ongoing monitoring, and no aggregation logic does not have a reasonable compliance programme by OFAC's standard.

In our experience, the gap between what an issuer believes its programme covers and what it actually covers is almost always widest in the digital-asset space, precisely because the product moves faster than the compliance architecture. A programme review – structured around OFAC's five-element compliance framework – is the most efficient way to map and close that gap before it becomes an enforcement matter.

When should a stablecoin issuer involve specialist OFAC compliance counsel?

A stablecoin issuer needs specialist ofac sanctions risk specialist counsel at four points, and the cost of late engagement at any of them significantly exceeds the cost of timely engagement.

The first point is product or market launch. Before an issuer makes its stablecoin available in a new jurisdiction, a legal assessment of the sanctions obligations that attach in that market – both under OFAC and under the local regime – is the foundation on which the compliance programme is built. A programme designed retrospectively around a live product is always more expensive and more constrained than one designed prospectively.

The second point is a material change to the product architecture or the user base. A new liquidity provider, a new distribution arrangement, or a significant growth in users from a particular region all change the obligations analysis. Issuers that treat their programme as a one-time exercise rather than a living document create the conditions for a gap that opens gradually and becomes apparent abruptly.

The third point is the identification of a potential breach. When screening produces a hit, or when an internal review surfaces a transaction that should have been blocked, the clock on reporting obligations may already be running. The 10 business day window for reporting blocked property or rejected transactions is short. It does not accommodate a lengthy internal investigation before a decision on disclosure is made. Early involvement of counsel who can scope the apparent violation, advise on whether a VSD is warranted, and prepare the necessary filings preserves options that close with time.

The fourth point is a regulatory enquiry or enforcement action. OFAC has the authority to investigate, to request information, and to impose significant civil penalties. An issuer that responds to an OFAC enquiry without experienced counsel is navigating one of the most consequential legal processes in US financial-services regulation without the institutional knowledge of how those processes actually run.

We act for multinationals, financial institutions, and exporters on sanctions and export-control matters across the major regimes. For a confidential assessment of your stablecoin issuer sanctions obligations under OFAC, or to stress-test your screening and compliance programme, contact Calder & Vance at info@caldervance.com.

Related practices

• Affiliate-level restrictions under the BIS/EAR – how US export-control affiliate restrictions interact with sanctions obligations for digital-asset businesses
• Virtual-asset travel rule obligations under the BIS/EAR – travel-rule compliance for virtual-asset service providers operating across US and non-US regimes
• Affiliate-level restrictions: BIS/EAR versus EU – comparative analysis – a side-by-side comparison of how the US and EU approach affiliate-level controls for technology and digital-asset businesses

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.