OFAC Guidance for Stablecoin Transactions

OFAC applies the same sanctions rules to stablecoin transactions as it does to other property. Before sending USDC or USDT, a company should confirm the parties are not sanctioned, check OFAC’s 50 Percent Rule, screen wallet addresses and assess relevant blockchain exposure. Potential matches should be paused for review. If property must be blocked or a transaction rejected, follow OFAC’s reporting and recordkeeping requirements.

How OFAC rules apply to stablecoin payments

The U.S. Treasury Department’s Office of Foreign Assets Control administers economic sanctions. Its rules are technology-neutral: using a public blockchain, self-hosted wallet or stablecoin does not remove a transaction from sanctions requirements.

U.S. persons generally must comply with OFAC sanctions. This includes U.S. citizens and permanent residents wherever located, people and entities in the United States, and U.S.-incorporated entities and their foreign branches. Some programs also create restrictions or secondary-sanctions exposure for non-U.S. persons. A stablecoin’s reference to the U.S. dollar does not, by itself, provide a complete jurisdictional analysis; teams should examine the parties, location, corporate structure and other U.S. touchpoints.

OFAC sanctions are not one uniform prohibition. The applicable rule depends on the sanctions program and the interests involved.

Screen the party, ownership and wallet before signing

A wallet address is an identifier, not a complete counterparty identity. A sound pre-transaction review therefore combines customer or vendor information with address screening and blockchain analysis.

1. Screen names and digital currency addresses

Check the counterparty, beneficial owners and relevant intermediaries against current OFAC sanctions data. OFAC includes digital currency addresses with some list entries, but published addresses are not exhaustive. A person does not become safe merely by switching to a new address.

Use OFAC’s current Sanctions List Search and downloadable sanctions data, or a screening provider that updates from official sources. Fuzzy name matches should be reviewed against identifiers such as date of birth, location, registration number and nationality. An internal “flag” is not itself an OFAC determination.

2. Apply the 50 Percent Rule

List screening alone can miss blocked entities. OFAC’s 50 Percent Rule covers entities owned 50% or more, directly or indirectly, by one or more blocked persons in aggregate. Control without 50% ownership does not automatically block an entity under this rule, although it remains a significant risk indicator and a designated officer may be unable to act on the entity’s behalf.

Finance teams should collect enough ownership information to identify beneficial owners, aggregate blocked ownership and preserve the evidence used for the conclusion.

3. Assess blockchain exposure proportionately

Blockchain analytics can identify direct or indirect links to addresses associated with sanctioned actors, illicit services or high-risk activity. It should support—not replace—the legal analysis. OFAC does not publish a universal number of hops, exposure percentage or risk score that automatically makes every wallet blocked.

Define review thresholds according to the company’s products, transaction sizes, counterparties and jurisdictions. When analytics identifies exposure, examine recency, value, direction, attribution confidence and whether the counterparty had control over or knowledge of the activity. Avoid treating every remote historical connection as conclusive “taint.”

What to do when screening finds a concern

The correct response depends on whether there is a true sanctions prohibition, a possible match or merely a risk signal. Stablecoin transfers should remain unsigned while that distinction is resolved because on-chain settlement is generally difficult to reverse.

Blocking is different from rejecting

Blocking freezes property in which a blocked person has an interest; title is not transferred to the U.S. government. Rejection means declining a prohibited transaction when there is no blockable interest. Teams should not use these terms interchangeably because custody, reporting and accounting treatment differ.

For blocked virtual currency, OFAC’s virtual-currency guidance describes controls such as placing the assets in a blocked wallet and preventing access or transfer. The precise process depends on who controls the keys and where the property is held. The availability of an issuer freeze function does not replace the holder’s own obligations.

OFAC reporting and recordkeeping

Under OFAC’s reporting regulations, an initial report of blocked property generally must be filed within 10 business days after the property becomes blocked. A reportable rejected transaction generally must also be reported within 10 business days. Holders of blocked property have an annual reporting obligation, generally due by September 30 for property held as of June 30.

Use OFAC’s current forms and OFAC Reporting System instructions because required fields and submission procedures can change. Reports commonly require the parties, amount, asset, transaction date, legal basis and available identifying information. A blockchain transaction hash, network, wallet addresses, screening evidence and custody location can help explain a stablecoin event.

Current OFAC rules generally require relevant records to be retained for 10 years. Records should show not only the final decision but how it was reached: sanctions data used, ownership evidence, analytics results, reviewer notes, approvals, communications and any report or license.

Build a risk-based stablecoin sanctions program

OFAC’s compliance framework identifies five core components: management commitment, risk assessment, internal controls, testing and auditing, and training. For a stablecoin treasury operation, those components should be connected to the signing workflow rather than maintained only in a written policy.

Controls should cover new payees, address changes, recurring payments, refunds, treasury rebalancing and transfers between company-controlled wallets. Re-screening may be appropriate before each payment because sanctions lists, address attribution and ownership can change after onboarding.

Approval rights should be separated from transaction preparation where practical. Higher-risk cases should require compliance review, and overrides should record who approved the decision and why. Stablerail can place sanctions and address screening before send, enforce approvals and signing quorum, and export audit evidence for USDC and USDT treasury activity.

Finance team implementation checklist

1. Map the flow: identify who initiates, reviews, signs, broadcasts, custodies and reconciles each stablecoin payment.
2. Define jurisdiction: document relevant U.S. persons, entities, locations and other sanctions touchpoints.
3. Verify counterparties: collect legal names, ownership, locations, payment purpose and wallet ownership evidence.
4. Screen before signing: check parties, beneficial owners and addresses using current sanctions data and risk-based blockchain analytics.
5. Pause exceptions: prevent flagged transfers from reaching the signing or broadcast stage until review is complete.
6. Separate outcomes: distinguish a false positive, internal risk decline, rejected transaction and blocked property.
7. Preserve evidence: retain list versions, timestamps, transaction hashes, review notes, approvals and regulatory filings.
8. Test the controls: periodically confirm that list updates, escalation routes, access permissions and blocked-wallet procedures work as designed.

Sanctions conclusions depend on the applicable program and facts. When a transaction may involve blocked property, a prohibited jurisdiction or an uncertain ownership chain, stop the payment and obtain qualified sanctions advice before signing.