Fifth Circuit Limits OFAC’s Sanctioning Authority Over Decentralized Cryptocurrency Trading Software

On November 26, 2024, the U.S. Court of Appeals for the Fifth Circuit held in Van Loon v. Department of the Treasury that the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) exceeded its statutory authority by designating Tornado Cash — a decentralized, open source software protocol that facilitates anonymous cryptocurrency transactions — on its Specially Designated Nationals and Blocked Persons List (SDN List). The Fifth Circuit determined that Tornado Cash “immutable smart contracts” are not “property” under the International Emergency Economic Powers Act (IEEPA) and OFAC therefore lacks the authority to block them.

The decision limits OFAC’s authority to regulate certain decentralized software and technologies.

Background

Tornado Cash is a “decentralized, open-source software project” that began in 2019 when several developers uploaded a set of “smart contracts” to the Ethereum blockchain. A smart contract is a software program that automatically performs a series of actions, such as executing cryptocurrency transfers. Certain smart contracts called “mixers” can be used to further anonymize cryptocurrency transactions by “collecting, pooling, and shuffling” deposits of hundreds of users before the funds are withdrawn. Tornado Cash offered both mutable and immutable smart contracts. Mutable smart contracts could be altered or removed from the blockchain by Tornado Cash, whereas immutable smart contracts could not be altered or controlled once initiated.

On August 8, 2022, OFAC sanctioned Tornado Cash after determining that a North Korean cybercriminal group used Tornado Cash “mixer” smart contracts to launder stolen cryptocurrency, pursuant to Executive Order (EO) 13694. EO 13694 was issued based on OFAC’s statutory authority under IEEPA to block “property” in which a foreign country, person, or entity holds an interest.

In September 2022, Six Tornado Cash users sued the Treasury Department, alleging that OFAC’s designation of Tornado Cash violated the Administrative Procedure Act (APA). The District Court for the Western District of Texas granted the Treasury Department’s summary judgment motion, finding that Tornado Cash is a foreign entity and that, through its decentralized autonomous organization (DAO) which acted as a governing body, Tornado Cash had a property interest in its immutable smart contracts. The Tornado Cash users appealed.

Reasoning

The Fifth Circuit held that Tornado Cash immutable smart contracts were not Tornado Cash’s “property” based on the plain meaning of “property” in IEEPA. Because IEEPA only allows OFAC to block “property,” the Fifth Circuit held that OFAC exceeded its authority when it blocked Tornado Cash immutable smart contracts. The Fifth Circuit therefore reversed the District Court’s decision. The court declined to decide whether the Tornado Cash DAO is an “entity” or whether it has an “interest” in immutable smart contracts under IEEPA.

The court found that the plain meaning of “property” under IEEPA is something “capable of being owned” and from which others can be excluded. In doing so, it noted that the Supreme Court determined the plain meaning of “property” from dictionary definitions contemporaneous with IEEPA’s passage in 1977 and Supreme Court scholarship on property. Using this definition, immutable smart contracts are not property because they are incapable of being owned and because Tornado Cash cannot alter or remove them from the blockchain or exclude any user — including the North Korean cybercriminal organization.

The court also reasoned that even if the Fifth Circuit were to defer to OFAC’s regulatory definition of “property,” the immutable smart contracts would remain beyond OFAC’s designation authority. OFAC’s “property” definition includes “contracts of any nature” and “services of any nature.” The court found that OFAC’s definition of property, however, still required ownership, and immutable smart contracts are incapable of being owned. The court found that despite their name, immutable smart contracts are not “contracts of any nature” because they involve a unilateral offer by a user to an autonomous computer code rather than an agreement between two or more parties. The court also concluded that immutable smart contracts are not “services of any nature” but rather a “tool” used in performing the service of mixing and pooling deposited cryptocurrency.

Implications

Van Loon confirms that OFAC’s authority to impose sanctions, while broad, is not unlimited. It limits OFAC’s ability to use its sanctions authority to block self-executing cryptocurrency trading programs, even if those programs are designed to obfuscate the source of laundered cryptocurrency and may be used by criminal or sanctioned organizations. However, the Treasury Department may seek discretionary Supreme Court review. In addition, given the decision’s focus on “immutable” smart contracts, the decision does not remove OFAC’s ability to impose sanctions on “mutable” smart contracts.

For questions about U.S. export controls or sanctions, contact the authors or any of their colleagues in Arnold & Porter’s Financial Services, White Collar Defense & Investigations, or Export Control and Sanctions practice groups.

*Daniel Elsen-Rooney contributed to this Advisory. Mr. Elsen-Rooney is a graduate of Brooklyn Law School and is employed at Arnold & Porter’s New York office. He is not admitted to the practice of law.

© Arnold & Porter Kaye Scholer LLP 2024 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.