What sanctioning SUEX changed for banks that serve crypto firms

The week

On September 21, 2021, the Treasury Department’s Office of Foreign Assets Control designated SUEX OTC, a virtual currency exchange, for facilitating transactions for ransomware actors. It acted under the executive order that authorizes sanctions for significant malicious cyber activity, and said the designation was carried out with assistance from the FBI.

The action came at the end of a year in which ransomware had moved from an IT problem to a national one. In May, an attack on Colonial Pipeline led the company to shut down the largest fuel pipeline on the US East Coast for several days. Weeks later, the meat processor JBS was hit, and in July an attack through the IT management software of Kaseya spread to many of its customers’ clients. In June, the Justice Department announced that it had recovered much of the bitcoin ransom Colonial had paid, by tracing it on the blockchain to an address it could seize. That recovery showed both that ransoms could be followed and that following them took real effort.

The Office of Foreign Assets Control, or OFAC, is the part of Treasury that runs US economic sanctions. When OFAC designates a person or company, it adds them to a list, and US persons and businesses are generally prohibited from dealing with them. A virtual currency exchange is a business that converts cryptocurrency, such as bitcoin, into ordinary money or other cryptocurrencies. “OTC” stands for over-the-counter: a desk that arranges trades directly between buyers and sellers rather than through a public order book, often for larger amounts. Ransomware is malicious software that locks up a victim’s files or systems until a ransom is paid, usually in cryptocurrency.

It was the first OFAC designation of a virtual currency exchange. Treasury said that more than 40 percent of SUEX’s known transaction history was associated with illicit actors and that it had handled proceeds from at least eight ransomware variants, meaning eight distinct strains of ransomware run by criminal groups. Treasury’s announcement also put the problem in numbers: ransomware payments in 2020 had exceeded $400 million, more than four times their level in 2019.

Treasury drew a distinction that mattered for everyone else in the industry. Some exchanges, it said, are exploited by criminals without their knowledge. Others, as in SUEX’s case, facilitate illicit activity for their own gain. The announcement also stressed that most virtual currency activity is lawful. The message was aimed at a particular kind of business rather than at the asset class.

The designation listed digital currency addresses linked to SUEX. A digital currency address is something like an account number on a blockchain, the public, shared ledger that records cryptocurrency transactions. Listing addresses meant that anyone could check whether funds were going to or coming from SUEX, as well as whether a customer’s name matched. OFAC had first included digital currency addresses in a designation in 2018, but this was the first time it had applied the practice to an exchange.

Blockchain analytics firms, companies that trace cryptocurrency flows across those public ledgers, described SUEX as a nested service, operating through accounts at larger exchanges rather than as a standalone platform. SUEX did not need its own trading platform; it used other exchanges’ infrastructure from the inside.

Analytics firms also reported that SUEX was registered in the Czech Republic but appeared to operate from Russia. That combination mattered. A company registered in one jurisdiction and run from another, holding accounts at exchanges in a third, is hard for any single bank or regulator to see whole.

The same day, OFAC updated its 2020 advisory on the sanctions risks of facilitating ransomware payments. It restated that the government strongly discourages paying, and named meaningful cybersecurity steps and prompt reporting to law enforcement as significant mitigating factors. Mitigating factors are things OFAC weighs in an organization’s favor when deciding how to respond to a possible violation.

Treasury framed the day’s actions as part of a whole-of-government effort against ransomware. Its announcement also pointed to FinCEN, the department’s financial crimes unit. FinCEN had issued an advisory on ransomware and the financial system in October 2020, and said it was taking further steps to collect information on ransomware payments. Within weeks, FinCEN published an analysis of suspicious activity reports showing that ransomware-related filings in the first half of 2021 already exceeded the total for all of 2020. In mid-October, OFAC issued sanctions compliance guidance written specifically for the virtual currency industry.

For banks, the action was a signal about where Washington’s attention was moving: from the victim paying a ransom to the businesses that help criminals turn that ransom into money they can spend.

Take the chief compliance officer of a mid-sized US bank on the morning of September 22, 2021. Her bank does not process ransom payments, and no sanctioned exchange holds an account with it. But over the past two years, her business development team has signed up a dozen crypto companies as customers: two exchanges, a payment processor, an operator of crypto ATMs and several fintech apps. They bring deposits and fees. Now she has to answer a question her board will soon ask: could any of SUEX’s money have passed through us, and how would we know?

OFAC’s October 2020 advisory had put sanctions exposure on ransomware victims and the firms that help them pay. SUEX moved the pressure to the other end of the chain. A ransom is only useful to criminals once it can be turned into spendable money, and that conversion runs through exchanges and over-the-counter desks. By designating one, Treasury targeted the off-ramp, not the payment. An off-ramp is simply the point where cryptocurrency leaves the crypto world and becomes dollars, rubles or euros in a bank account.

For banks, that shift landed in a different place from the 2020 advisory. Few banks process ransom payments directly. Many more, by 2021, served businesses in the virtual asset economy: exchanges, payment processors, crypto ATM operators, fintechs and over-the-counter desks that held accounts for fiat settlement, meaning accounts in ordinary government-issued currency, such as dollars, used to settle their customers’ trades.

The question SUEX raised for them was economic as much as legal. How far into a customer’s activity should the bank look for designated parties, and what is that worth paying for? The nested structure of SUEX made the answer harder, because exposure arrives through three layers, each costlier to see than the last: direct, where the bank’s customer or its immediate counterparty is designated; nested, where a designated service operates inside a customer’s platform; and indirect, where funds reach the customer after passing through designated addresses.

The answer depends on what kind of institution is asking. A bank that holds operating accounts for US-licensed exchanges faces a different version of the problem from one that provides accounts through fintech partners it barely sees. A credit union that lets members buy crypto through a third-party provider has a narrower exposure again, and its regulator addressed that model separately later in 2021. A broker-dealer or wealth manager whose clients hold crypto elsewhere mainly meets the issue when those clients move money in and out. The three layers apply to all of them, but the weight of each differs.

One feature of US sanctions law raises the stakes for all of them. OFAC’s civil liability is strict: an institution can violate sanctions without knowing it dealt with a designated party. What changes with knowledge and with the quality of the compliance program is how OFAC responds, from a cautionary letter to a large penalty. A bank cannot screen its way to zero risk, but it can show that its controls matched the risk it chose to take.

How a ransom becomes spendable money

Each step in a ransom’s typical journey is a place where a bank might, or might not, see something.

A hospital, a city or a manufacturer is hit by ransomware. The attackers demand payment in cryptocurrency, sent to an address they control. That payment is recorded on the blockchain, which anyone can inspect, but the address does not carry a name. The criminals now hold digital coins. To pay rent, staff or suppliers, they need ordinary money. So they move the coins, often through several intermediate addresses, to a service that will exchange them. That service, an exchange or OTC desk, gives them cash or a bank transfer in return, keeps a fee, and in turn needs its own access to the banking system to operate.

A stolen painting works the same way. Stealing it is only half the job; the thief also needs a dealer who will buy it without asking questions, and police who cannot find the thief can still make life hard for him by shutting down the dealers. SUEX, in Treasury’s account, was one of those dealers.

Why the off-ramp is the chokepoint

The off-ramp is where pressure works best for structural reasons. Coins on a blockchain can be moved endlessly between addresses at little cost, and each move is visible but anonymous. Conversion into ordinary money is different. It needs a counterparty with liquidity, a willingness to take the risk, and access to a bank somewhere. Only a limited number of services offered all three at the scale ransomware groups needed, especially for large sums handled through over-the-counter desks.

Removing one of those services raises costs for every criminal who relied on it. They must find another dealer, accept worse exchange rates and wait longer for their money. It does not end ransomware. It does make each attack less profitable, and that is the lever sanctions on off-ramps pull.

Nesting inside nesting

The structure could be deeper than one layer. When OFAC designated another exchange, Chatex, in November 2021, Treasury said Chatex had direct ties to SUEX and used SUEX as a nested exchange to conduct its transactions. SUEX itself was nested in larger exchanges. A criminal using Chatex was therefore two steps removed from the exchange whose infrastructure carried the trade, and three or more steps from any bank. Each layer of nesting thins the information that reaches the institutions at the edge of the system.

Where banks meet the payment side

Banks also touch the other end of the chain, though less often. A bank can itself be a ransomware victim. It can also hold accounts for customers who pay ransoms, or for the incident response and negotiation firms that sometimes arrange payments on victims’ behalf. OFAC’s 2020 advisory addressed those cases, warning that facilitating a payment to a sanctioned party could itself be a violation. The SUEX action did not change that exposure. It added a second, larger one on the receiving end, where far more banks had customers.

Banks enter the picture because exchanges and OTC desks need bank accounts too. Somewhere along the chain, crypto turns into dollars, and dollars live in banks. A bank serving a crypto exchange is not dealing with ransomware gangs directly. But depending on how its customer runs its business, money that started as a ransom could reach the bank several steps later.

Direct exposure: cheap to screen, rarely the problem

The first layer is the familiar one. Banks screen customers and counterparties against the Specially Designated Nationals list, OFAC’s main list of sanctioned persons and companies, and a designated exchange that opened an account at a US bank would be caught at onboarding or on designation. Screening here means automatically comparing names, and now addresses, against the list, and flagging any match for review.

OFAC’s inclusion of digital currency addresses in the SUEX listing extended this layer slightly: a bank or its fintech customer can screen addresses as well as names. That matters because names are easy to change and addresses are what actually move money on a blockchain.

The mechanics of address screening

Address screening sounds simple but has its own moving parts. OFAC publishes addresses as identifiers on the entries in its list, labelled by the type of digital currency. A screening engine must import those fields, normalize them, and compare them with addresses in the bank’s or its partner’s transaction data. Unlike a name, an address either matches or it does not, so the fuzzy matching that generates false positives on names is not needed. The harder questions are coverage and speed: whether the engine captures every currency type the customer handles, and how quickly a new designation flows into the live screening list.

Banks rarely see blockchain addresses themselves. A bank holding an exchange’s dollar accounts sees wires and transfers, not the on-chain transactions that preceded them. Address screening therefore happens mostly at the customer or partner level, and the bank’s role is to require it, test it and see its results.

This layer is cheap because the tools already exist. It is also the least likely place to find a SUEX. Exchanges serving ransomware gangs did not bank in the United States, and their listed addresses were a snapshot: a service can create new addresses at will, so a list published on one day may not capture the addresses it uses the next. Banks that stopped at this layer were compliant with the obvious requirement and blind to how SUEX actually operated.

One extension matters for banks with fintech partners. Where a partner runs the customer-facing crypto product and the bank holds the accounts, the bank’s direct screening depends on the partner’s. The partnership agreement should require address screening against OFAC listings, set how quickly new designations are applied, and give the bank the results.

When a new designation lands

A designation like SUEX’s calls for more than updating the screening list. A well-run program also looks backward. It searches recent transaction history, its own and, through the contract, its partners’, for the newly listed names and addresses. Any hits go to the sanctions team for analysis, including whether the activity was blocked, rejected or completed. Where a completed transaction may have been an apparent violation, counsel can advise on whether a voluntary self-disclosure to OFAC is appropriate. OFAC treats such disclosures as a mitigating factor.

The look-back also tests the program. If the bank cannot search its partners’ historical address data within days, that is a finding in itself, and the contract or the data feed needs to change.

What OFAC weighs

In 2019 OFAC published a framework describing what it expects of a sanctions compliance program. It names five components: management commitment, a risk assessment, internal controls, testing and auditing, and training. When OFAC considers an apparent violation, the existence and quality of such a program is among the factors it weighs. For a bank serving crypto businesses, the risk assessment is the component the SUEX action tested most directly. A risk assessment written before the bank took on crypto customers, and not updated since, is unlikely to describe the exposure those customers bring.

Nested exposure: a sanctioned business inside a customer

The second layer reflects SUEX’s design. A nested service has no platform of its own. It holds accounts at larger exchanges and offers conversion to its own clients through them, so its flows look like ordinary customer activity on the host exchange. A bank whose customer is the host exchange is one step removed from the designated party, but the money is the same.

Banks have long worried about nested correspondent relationships: a foreign bank that holds an account with a US bank lets other, smaller banks route payments through that account. The US bank sees one customer but is in fact processing payments for many institutions it has never vetted. A nested crypto service is the same pattern in a new setting. The host exchange sees what looks like one busy customer. Behind that customer may be hundreds of the nested service’s own clients, some of them criminals.

Seeing this layer means diligence on the customer’s controls as well as on the customer: whether the exchange identifies nested services among its users, whether it screens deposit and withdrawal addresses against designations and analytics-based risk scores, and what it did with SUEX-linked accounts on September 21.

A bank serving virtual asset businesses needs those answers in its onboarding file and its periodic reviews. Gathering them costs analyst time and, often, specialist expertise the bank must hire or contract. Most bank compliance staff in 2021 had deep experience with wire transfers and cash, and much less with blockchains, so the knowledge to ask sharp follow-up questions often had to come from outside.

What belongs in the diligence file

The questions a bank asks a crypto exchange customer can be specific without requiring the bank to become an exchange itself:

• Licensing. The customer’s registration with FinCEN as a money services business and its state licenses, and who supervises it.
• Account-level checks. How the exchange identifies business accounts that are themselves offering services to others, including other exchanges and over-the-counter desks.
• Behavioral signs. Which patterns trigger review, such as very high volumes, many unrelated deposit sources feeding one account, or rapid in-and-out movement.
• Screening. Whether the exchange screens deposit and withdrawal addresses against OFAC listings and analytics risk scores, and how fast new listings take effect.
• Geography. Whether it uses IP address and other location data to block users in sanctioned jurisdictions, a practice OFAC’s October 2021 guidance recommended.
• Response. What it did, with dates, when SUEX and later designations were announced.
• Assurance. Independent testing of its sanctions and anti-money laundering program, and the most recent findings.

How the nested risk differs by customer type

The nested layer looks different for each kind of crypto customer. A US-licensed exchange with mature controls is the easiest case: it is supervised, it can answer the questions above, and the bank can test its answers. An offshore exchange with US banking for its dollar flows is much harder, because its users and controls sit largely outside US supervision. A payment processor that converts crypto for merchants may itself be the nesting point, offering conversion to businesses it vets less carefully than an exchange would. A crypto ATM operator turns cash into coins at kiosks, which makes its customer identification at the kiosk the main control.

Fintech partnerships add a layer of their own. A bank providing accounts through a partner that runs a crypto feature may have thousands of end users it never onboarded directly. Its exposure depends on the partner’s controls, so the partnership contract, the bank’s oversight of it and the data it receives are the bank’s real defenses.

Indirect exposure: funds that passed through designated hands

The third layer is the most expensive. Blockchains are public, so a bank or its customer can trace whether funds arriving from a wallet had passed through designated addresses one, two or more transactions earlier. Each of those steps is often called a hop. Blockchain analytics firms sell that tracing as a service, with risk scores for addresses and alerts on exposure.

With cash, tracing every hand a banknote has passed through is impossible. With a blockchain it is often possible, but the trail branches quickly. Funds get mixed with other funds, split and recombined, and after a few hops nearly every coin has some distant connection to something unsavory. The further back the bank looks, the more it finds, and the less each finding means.

Indirect exposure is not itself a sanctions violation in most cases, and a policy that treated every trace of contact as prohibited would block large volumes of legitimate activity. It is, however, a signal for suspicious activity monitoring, the ongoing review banks perform to spot and report possible money laundering, and a large or repeated pattern can point to a customer that is functioning as an off-ramp.

Deciding how many hops to examine, what risk score triggers review, and who adjudicates alerts is a policy choice with direct cost: licences, analysts, and the friction imposed on customers. Set the thresholds too tight and analysts drown in alerts that lead nowhere, while legitimate customers find their transfers delayed. Set them too loose and the bank misses the patterns that matter.

Mixers and other obfuscation

Some funds reach a customer after passing through a mixing service, which pools coins from many users to break the trail. Analytics tools generally score exposure to mixers as high risk, because legitimate users rarely need them and criminals often do. A bank’s threshold policy should state how mixer exposure is treated, separately from exposure to designated parties. Mixer exposure is a reason to look more closely at a customer’s flows. It is not by itself evidence of a sanctions violation, and the policy should say what additional facts would move a case from monitoring to escalation.

Running the alert queue

Analytics alerts need the same operational discipline as any other monitoring queue. Each alert should become a case with an owner, a due date and a recorded outcome. A sample of closed cases should be reviewed by a second analyst to check quality and consistency. And the thresholds should be tuned on a schedule, using the record of which alerts led to escalations and which did not.

Tuning cuts both ways. Raising a threshold to reduce noise must be tested against the alerts it would have suppressed, to confirm that none of them mattered. That evidence, kept on file, is what lets a bank defend a threshold to an examiner who asks why it is set where it is.

How the risk scores are built

Analytics vendors build their scores in broadly similar ways. They group addresses that appear to be controlled by the same entity, using patterns in how transactions are constructed. They attribute those groups to known services, such as exchanges, mixers or darknet markets, using public information, their own investigations and law enforcement actions. They then measure what share of the funds reaching an address came from each category, directly or through intermediate hops.

Each step involves judgment. Groupings can be wrong. Attributions can be out of date. Vendors weigh hops and categories differently, so two tools can score the same address differently. A bank that relies on a vendor’s score for decisions is relying on a model, and supervisory expectations for model risk management apply. That means understanding how the tool works, testing its outputs against known cases and documenting its limits.

Writing the threshold policy

A workable policy typically ties actions to the strength of the link. Direct contact with a designated address calls for blocking or rejecting where possible, immediate escalation and a sanctions analysis. A close indirect link that carries a meaningful share of funds calls for a case review and a decision about whether to file a suspicious activity report. Distant or minor links feed aggregate monitoring of the customer rather than individual alerts. The exact numbers are the bank’s to choose, but they must be written down, approved and revisited when the tool or the threat changes.

Suspicious activity reporting has its own clock. A bank generally must file within 30 calendar days of initially detecting facts that may warrant a report, with limited extra time where no suspect has been identified. An alert queue that grows faster than analysts can clear it therefore creates regulatory exposure of its own, separate from any sanctions question.

What each layer costs, and who pays

Taken together, each layer adds cost, and the bank has to recover it from the relationship. Some banks concluded that virtual asset customers could not be served profitably at the level of diligence the layers required, and closed accounts. That avoids the cost but carries its own: lost deposits and fees, customers moving to less scrutinized providers, and supervisory questions about whether exits were risk-based.

Closing a whole category of customers at once is often called de-risking. Supervisors generally expect banks to assess risk customer by customer, rather than drop entire sectors without looking. A blanket exit can push legitimate businesses toward providers with weaker controls, which does not reduce the overall risk in the system; it simply moves it.

Others built a specialized program, priced accounts to cover analytics and staff, and accepted the work. Either path is defensible if it is chosen deliberately. Drifting into this business, with direct-layer screening only, is the expensive option, because it bears the risk without paying for the means to see it. Which sanctions and anti-money laundering duties attach to each relationship is something to settle with the bank’s lawyers.

Suppose a regional bank holds accounts for three crypto exchanges, which together bring in meaningful deposits and fee income. To serve them properly, it would need a blockchain analytics subscription, at least two analysts who understand crypto flows, periodic reviews of each exchange’s controls, and time from its sanctions and legal teams. If the income from those three relationships cannot cover those costs with a reasonable margin, the bank has three honest options: raise prices, narrow the relationship to customers whose controls are strong enough to need less oversight, or exit carefully and on documented grounds. Keeping the accounts without paying for the analytics, staff and reviews they require is not one of those options.

The deposit side of the economics

The income side of the relationship also deserves a hard look. Deposits from crypto businesses tend to be large and concentrated, and they can move quickly when markets turn or when a customer loses confidence. Those characteristics affect how much value the deposits really bring, because a bank cannot safely lend against funds that may leave in days. A full view of the economics weighs the diligence costs against deposits valued for their stability rather than their size alone.

The strongest case against this view

A fair counter-argument holds that the three-layer approach asks too much of banks. Illicit activity is a small share of crypto activity by most estimates, and cash and trade remain far larger channels for laundering. Banks are not law enforcement, and the on-chain layers belong to the exchanges and their regulators. On this view, a bank that screens names and addresses and monitors its own customers’ fiat flows has done its part, and further diligence is a cost the system does not need.

Much of that is right about proportion. A bank should not try to trace every coin, and the deepest layer should be monitored in aggregate rather than case by case. But the argument underrates the nested layer. SUEX’s whole business model depended on looking like an ordinary customer of a larger exchange. A bank that never asks how its exchange customers detect nested services has no basis for saying its customers do the job, and its regulators will reasonably expect that question to have been asked.

Who owns the decision inside the bank

One reason banks drifted into crypto relationships without the matching controls is that the decision was spread across several teams, none of which saw the whole picture.

Business development teams brought in the customers, often because a fintech partner wanted to add a crypto feature or an exchange needed a home for its dollar balances. The onboarding team applied the bank’s standard checks, which were built for ordinary businesses. The sanctions team ran its usual name screening. The anti-money laundering team monitored transactions with rules written for wires and cash. Each team did its job. Nobody was asked whether the combination was enough for a customer whose own customers might include a nested service.

A more deliberate approach treats virtual asset businesses as a distinct line of business with a named executive owner. That owner works with compliance to set the bank’s risk appetite, meaning how much and what kind of exposure the bank is willing to accept, and then with finance to make sure the pricing covers the controls that appetite requires. The decision, and the reasoning behind it, goes to senior management and the board, who can then hold the owner to it.

Technology plays a supporting role rather than a leading one. Blockchain analytics tools are powerful, but they answer questions; they do not decide which questions to ask. The bank still needs people who can look at a risk score, understand why a particular address is flagged and decide whether the pattern points to a customer acting as an off-ramp or simply to the ordinary messiness of shared blockchains.

Supervisors, for their part, tend to ask the same few questions in an examination: whether the bank understood the risk before taking it on, whether its controls are proportionate to that risk, and whether it can show its reasoning. A bank with a written decision, a named owner, documented diligence on each customer and pricing that reflects the work can answer all three. A bank that drifted in usually cannot answer any of them with confidence, regardless of whether anything has actually gone wrong.

Onboarding as a deliberate gate

A bank that has decided to serve virtual asset businesses should still treat each new customer as a separate decision. A small approval committee, with the business owner, compliance and a crypto specialist, can review each proposed relationship against written criteria. The criteria cover the customer’s licensing, the quality of its controls, its expected volumes, the products it offers and its geographic reach. Approval records the conditions attached, such as reporting the bank will receive or limits on certain activity. Declines are recorded too, which helps show later that the bank applied its criteria evenly rather than taking every customer that came along.

Three lines of defense, applied

Banks commonly organize risk in three lines. Here, the first line is the business owner of the crypto line, who is responsible for knowing the customers and paying for the controls. The second line is compliance, which sets the sanctions and anti-money laundering standards, approves thresholds and challenges the first line’s decisions. The third line is internal audit, which tests whether the program works as described. A crypto program that cannot name a person in each line is likely to show gaps at examination.

What the board should see

The board does not need hop counts. It needs a short regular report. That report shows the number of virtual asset customers and the deposits they hold, the alerts generated and how many were escalated, and any sanctions matches and how they were handled. It also covers exits and their reasons, and the cost of the program against the income from the line. That report lets directors judge whether the line still fits the bank’s appetite.

The marks of a deliberate crypto program

A bank that handles this well usually has a written decision, approved by senior management, on whether it serves virtual asset businesses and at what level of diligence. It knows which of its customers touch crypto, including through fintech partners. It screens addresses as well as names. Its onboarding file for each crypto customer explains how that customer detects nested services. It has written thresholds for hops and risk scores, and named people who review alerts. Its pricing reflects the cost of all this. And when it exits a customer, it records why.

When an examiner arrives, that bank can produce a coherent set of evidence. It has the board-approved decision and the risk assessment behind it. It has a diligence file for each crypto customer with answers to the nested-service questions. It has the threshold policy with its tuning record, a sample of reviewed alerts, and a memo for each exit. The evidence tells the same story as the policy.

Banks that struggle tend to make the same errors:

• Stopping at name screening. It satisfies the obvious rule and misses how services like SUEX operate.
• Treating the host exchange as the whole story. The customer’s own customers may include nested services.
• Buying analytics without a policy. A tool with no thresholds or owners produces noise, not insight.
• Relying on a fintech partner’s word. If the partner screens, the bank should see the results.
• Exiting a sector without documentation. It invites supervisory questions and may simply shift the risk elsewhere.
• Underpricing the relationship. Crypto customers that look profitable before diligence costs may not be afterward.

Where to probe the crypto book

1. Which of our customers are virtual asset businesses, including those we serve through fintech partners?
2. For each crypto exchange customer, do we know how it detects nested services among its own users?
3. Do we use blockchain analytics? If so, how many hops do we examine, and what risk score triggers a review?
4. Do our prices for crypto customers cover the cost of the diligence we actually need?
5. Have we made a deliberate, documented decision about whether to serve this sector, or did we drift into it?

With hindsight

SUEX opened a long campaign against crypto off-ramps: the first of a series of actions aimed at the services that convert criminal proceeds into usable money.

OFAC designated the Chatex exchange in November 2021, noting that it had used SUEX as a nested exchange, and the Russia-based Garantex in April 2022, alongside the darknet market Hydra. In January 2023, FinCEN, Treasury’s financial crimes unit, named the Bitzlato exchange a primary money laundering concern, a designation that lets Treasury restrict US financial institutions’ dealings with it.

Regulators also tightened their expectations for banks during 2021 and 2022. In November 2021 the OCC told national banks to obtain supervisory non-objection before engaging in certain crypto activities. The FDIC and the Federal Reserve set similar notice expectations in 2022. In December 2021 the NCUA issued a letter to credit unions on relationships with third parties offering digital asset services. In January 2023 the federal banking agencies jointly warned about crypto-related risks to banking organizations.

Then the deposit risk described above materialized. In March 2023 Silvergate Bank, heavily concentrated in crypto customers, announced it would wind down, and New York regulators closed Signature Bank, which also served many crypto firms. Both cases showed that the economics of serving this sector depended as much on deposit stability as on diligence costs.

Enforcement against the largest exchange followed. In November 2023 Binance agreed to pay about $4.3 billion to resolve US anti-money laundering and sanctions charges, the largest such resolution with a crypto company. Its failings included weak controls over who used the platform, the same weakness that lets nested services operate unseen.

In May 2022 OFAC sanctioned Blender.io, the first virtual currency mixer it designated, which extended the off-ramp campaign to the services criminals used to obscure funds before cashing out.

In 2022 OFAC sanctioned the Tornado Cash mixing service, a designation lifted in March 2025, months after a federal appeals court ruled that its immutable smart contracts could not be sanctioned as property. A mixing service pools and shuffles cryptocurrency from many users to obscure where any particular coin came from. Its smart contracts are self-executing programs on a blockchain that, once deployed, cannot be changed. The episode showed that the legal reach of sanctions has limits when the “service” is code rather than a company.

Law enforcement seized Garantex’s domains in March 2025, and OFAC later designated its apparent successor. The pattern there, a sanctioned service resurfacing under a new identity, is a reminder that a list of names and addresses is always a snapshot.

Ransomware did not go away. Blockchain analytics firms reported that payments reached a record of more than $1 billion in 2023. They then reported that payments fell by about a third in 2024, attributing part of the fall to enforcement pressure. That suggests pressure on the off-ramp can have a measurable effect, though not a permanent one.

For banks, address screening and blockchain analytics have become standard in virtual asset programs. In 2025 the banking agencies withdrew the earlier notice and non-objection requirements and the 2023 joint statements, signaling a more open stance toward bank crypto activity. The GENIUS Act, signed in July 2025, set a federal framework for stablecoins, which are cryptocurrencies designed to hold a steady value against a currency such as the dollar. It requires issuers to maintain anti-money laundering and sanctions programs. Together these changes have made the decision whether to serve such businesses, and at what level of diligence, more pressing for more institutions. A more permissive supervisory stance removes a barrier to entry, not the sanctions exposure. With fewer prior approvals required, each bank’s own written decision, diligence files and pricing became the main evidence that it understood what it had taken on. The three-layer view still applies. Serving virtual asset businesses is a deliberate business line with real operating costs, and the decision to enter it, price it and staff it belongs with senior management and the board, not with a sales team acting alone.