Sanctions and crypto payments: the OFAC basics a small merchant should know.

Do OFAC sanctions apply to crypto payments?

OFAC sanctions apply to crypto payments in the same way as to payments in dollars. The Treasury's Office of Foreign Assets Control answers the question in its virtual currency FAQs (FAQ 560, released 19 March 2018): "Yes, the obligations are the same." The same answer names who it has in mind, including "firms that facilitate or engage in online commerce or process transactions using digital currency".

Who must comply is set out in OFAC's Sanctions Compliance Guidance for the Virtual Currency Industry, published in October 2021: "All U.S. persons are required to comply with OFAC regulations." That covers US citizens and permanent residents wherever they are, everyone in the United States, and US-organised entities with their foreign branches. Some programmes reach further, and in most programmes a transaction that causes a violation, including one by a non-US person that causes a US person to violate sanctions, is also prohibited.

What does strict liability mean for a merchant taking crypto?

Strict liability means that, in many cases, a US person can be held civilly liable for a sanctions violation without knowing about it. The 2021 guidance says OFAC may impose civil penalties "generally based on a strict liability legal standard", and goes on: "This means that, in many cases, a U.S. person may be held civilly liable for sanctions violations even without having knowledge or reason to know it was engaging in such a violation."

The same paragraph says OFAC looks at "the totality of facts and circumstances" when it decides how to respond, and may treat a risk-based compliance programme and remedial steps as mitigating factors. FAQ 560 adds that technology companies, users of digital currencies and other payment processors "should develop a tailored, risk-based compliance program, which generally should include sanctions list screening and other appropriate measures", and that "There is no single compliance program or solution suitable for every circumstance."

For a small merchant, the practical reading is about evidence: what you knew about each payer, what you checked, and when. A wallet-to-wallet payment leaves a public record of the paying address, which makes the second and third questions easier to answer than the first.

Which wallet addresses are on the SDN list?

The SDN list, OFAC's list of Specially Designated Nationals and blocked persons, includes some digital currency addresses as identifiers of listed people and entities. FAQ 562 says OFAC "may add digital currency addresses to the SDN List to alert the public of specific digital currency identifiers associated with a blocked person", and that its "digital currency address listings are not likely to be exhaustive."

We counted the addresses in OFAC's enhanced SDN file with data as of 14 October 2026, counting an address once per label (some entries repeat across listed persons). Each one carries a label of the form "Digital Currency Address - XBT", as FAQ 563 describes:

Two limits follow from OFAC's own words. A list check only catches addresses OFAC chose to publish. And under OFAC's 50 Percent Rule, which the 2021 guidance describes, an entity owned 50 percent or more by blocked persons is itself blocked "even if that entity does not itself appear on the SDN List".

What happens if a sanctioned wallet pays you in USDC?

If a US person holds virtual currency that must be blocked, OFAC FAQ 646 says the holder "must deny all parties access to that virtual currency" and report it: "Blocked virtual currency must be reported to OFAC within 10 business days, and thereafter on an annual basis, so long as the virtual currency remains blocked." The 2021 guidance adds a separate report for a transaction rejected for sanctions reasons, also within 10 business days.

With Fianto, the USDC is in your wallet, not Fianto's. The customer's transaction sends the price straight to your receiving wallet and Fianto never holds it, so Fianto cannot hold, freeze or return a payment for you. Circle, which issues USDC, is a separate matter: whether and when an issuer can freeze tokens is covered in can USDC be frozen.

Sending the money back is a transaction too. FAQ 646 points to the OFAC Compliance Hotline for "Questions about whether a transaction should be blocked", and that is the place to ask before you move funds you think may be blocked.

What does Fianto check about the wallets that pay you?

Fianto checks no sanctions list automatically. What exists is a manual flag: a member of the Fianto team with the owner or compliance role can mark a payer wallet CLEAR, REVIEW or BLOCKED, with a written reason, and every change is recorded in an audit log. The flag is set across Fianto, so it applies to every merchant, and there is no merchant setting for it.

A payer with a blocked wallet sees this on a one-off checkout: "Fianto can't take payments from this wallet. Use another wallet, or contact [merchant name]." A subscription checkout says "Fianto can't take a subscription from this wallet" instead.

The flag has hard limits. It works only inside Fianto's checkout and renewals: anyone who knows your receiving address can send USDC to it directly, and nothing at Fianto stops that. It applies only to wallets someone at Fianto has reviewed. And it says nothing about who controls a wallet, since payers are never asked for identity details; what Fianto does and does not collect from payers is in do merchants need to KYC crypto payers.

How can a merchant check its own customers' wallets?

You can check the wallets that paid you against the SDN list with OFAC's free search tool and Fianto's own records. If you decide to, this is how the pieces fit:

1. Get the addresses. The Customers export in the dashboard has a wallet column, one row per paying wallet; the payments export has customer_wallet on every payment. With the API, the checkout.session.completed webhook carries customer.wallet. The exports guide shows how to pick the columns and date range.
2. Search each address in OFAC's Sanctions List Search, in the "ID #" field. FAQ 594 says that field "does not use fuzzy logic, so only exact matches will be returned", so paste the address whole. For many addresses, OFAC publishes the lists as downloadable files.
3. Check again when the list changes. The 2021 guidance says the SDN list "is frequently updated" and that you can sign up for email notifications of updates.
4. Stop future renewals if you decide not to serve a wallet. Cancel its subscription in the dashboard, or with POST /v1/subscriptions/{id}/cancel and at: now. A merchant cancel does not touch the chain and cannot be undone.

One limit applies whatever you do: a Fianto checkout gives you no step to approve a wallet before it pays, and the payment events reach you after the USDC is already in your wallet. Some providers screen paying wallets automatically; Request Network vs Fianto covers one that does.

Where do sanctions fit with licensing and stablecoin law?

Sanctions are one question among several for a business taking crypto, and the others have their own posts. Whether accepting USDC needs a licence is in do you need a licence to accept crypto payments, and the US stablecoin law is in the GENIUS Act explained for merchants, and US tax reporting on crypto sales in Form 1099-DA and crypto payments. For sanctions themselves, OFAC's FAQ page and its 2021 guidance are the primary texts to read before you talk to a lawyer.