In a closely watched and complicated case, Van Loon et al. v. Dep’t of the Treasury et al., the U.S. Court of Appeals for the Fifth Circuit ruled that the Office of Foreign Assets Control (“OFAC”) cannot sanction Tornado Cash, “an open-source, crypto-transactions software protocol that facilitates anonymous transactions by obfuscating the origins and destinations of digital asset transfers.” The opinion, which reversed the ruling of the District Court, is here. A recording of the oral argument is here. The opinion is complex but written in a very clear style.
We previously blogged on OFAC’s designation of Tornado Cash (here) and the resulting civil suit (here). We also covered the indictment returned against the alleged developers of Tornado Cash, Roman Storm and Roman Semenov, who were charged with conspiring to commit money laundering, operating an unlicensed money transmitting business, and violating sanctions under the International Emergency Economic Powers Act, or IEEPA (here). The DOJ subsequently obtained a superseding indictment against Storm only (here); Storm’s trial currently is scheduled for April 2025). When the initial indictment was unsealed, Treasury simultaneously sanctioned Semenov, who remains outside the U.S., by adding him to OFAC’s Specially Designated Nationals and Blocked Persons (“SDN”) List.
These actions are a reminder that, putting aside the complex issues presented by the Fifth Circuit decision regarding OFAC’s (in)ability to sanction a technology, law enforcement and regulators still can pursue people for related alleged conduct. And, invariably, people are involved in a technology.
The second paragraph of the opinion nicely summarizes the decision, so we quote it here:
The six plaintiffs-appellants are users of Tornado Cash. They argue that Tornado Cash’s inclusion on the SDN list exceeded OFAC’s statutory authority. The district court disagreed, granting summary judgment to the Department and finding Tornado Cash subject to OFAC’s sanctioning authority. Van Loon and the other plaintiffs appealed, making the same principal argument here—that Tornado Cash’s open-source, self-executing software is not sanctionable under the Act (as opposed to the rogue persons and entities who abuse it). OFAC’s concerns with illicit foreign actors laundering funds are undeniably legitimate. Perhaps Congress will update IEEPA, enacted during the Carter Administration, to target modern technologies like crypto-mixing software. Until then, we hold that Tornado Cash’s immutable smart contracts (the lines of privacy-enabling software code) are not the “property” of a foreign national or entity, meaning (1) they cannot be blocked under IEEPA, and (2) OFAC overstepped its congressionally defined authority.
The Court’s Primer on Cryptocurrency, Blockchain and Mixers
The Court begins its opinion with a clearly-written primer on cryptocurrency and blockchain. Most pertinent to the analysis here is its description of smart contracts, which the opinion describes as coming in two forms: “mutable” – a contract “managed by some party or group and may be changed” – and “immutable” – which “cannot be altered or removed from the blockchain.” The opinion continues: “Importantly, a mutable contract may be altered to become immutable. But that is an irreversible step; once a smart contract becomes immutable, no one can reclaim control over it.” This distinction is important, because the Fifth Circuit’s opinion pertains to immutable smart contracts. The opinion leaves the door open to a different result if mutable smart contracts are at issue.
Tornado Cash uses smart contracts, which increase anonymity by “mixing” – i.e., collecting, pooling and shuffling the cryptocurrencies deposited by multiple users. The opinion contains this helpful graphic, which illustrates how a mixer makes the tracing of cryptocurrency very difficult, and invites the reader to “imagine this complexity amplified with thousands of users. The result: a highly obfuscated blockchain that is much hard to trace and consequently renders the transactors far more anonymized.”
Although the withdrawing account must pay a “gas fee” to the Ethereum network, which could create a link between the user’s deposit and withdrawal accounts, this link is itself obscured by the optional use of relayers. These are mutable smart contracts operated by third parties, who pay the gas fees from their own accounts and deduct the cost of those fees, and their own fees, from the withdrawal accounts.
The Court noted that the developers of Tornado Cash eliminated their control over the pool smart contracts in 2020 by making them irreversibly immutable. “Consequently, the pool smart contracts became self-executing and could no longer be altered, removed or controlled.” The developers then created a decentralized autonomous organization (“DAO”) which can vote to implement new projects and change certain optional Tornado Cash features, but which cannot vote on or make any changes to the immutable smart contracts.
Finally, the Court observed that although there are lawful uses of mixers (such as maintaining anonymity concerning net worth, spending habits and donations to charitable causes, or thwarting criminals who might use blockchain information to commit a phishing scheme), mixers “are also ‘go-to’ tool[s] for cybercriminals[,]’” including North Korean hackers.
The Analysis
The Court explained that OFAC’s “designations identified Tornado Cash as an entity organized by and under its DAO, and in doing so blocked ‘all real, personal, and other property and interests in property’ of the designated Tornado Cash entity subject to U.S. jurisdiction.” The plaintiffs, all individual users of Tornado Cash, claimed “that OFAC lacked the authority to designate Tornado Cash as an SDN because (1) Tornado Cash is not a foreign ‘national’ or ‘person,’ (2) the immutable pool smart contracts are not ‘property,’ and (3) Tornado Cash cannot have a property ‘interest’ in the immutable smart contracts.” The Court indicated that it was considering the matter without the deference afforded previously to agencies under the Chevron doctrine, in light of the Supreme Court’s recent decision in Loper Bright rejecting that doctrine, but that its ruling would be the same under any standard. Ultimately, the Court sought to determine the “best” reading of the statute at issue.
The heart of the Court’s analysis was that the immutable smart contracts at issue did not constitute “property,” subject to OFAC designation, because they are not capable of being owned. The Court reasoned that, even under OFAC’s own definition of “property,” which includes “contracts of any nature,” and “services of any nature,” the immutable smart contracts still did not qualify as property. In part, this is because they are different than patents and copyrights because Tornado Cash does not profit from them. “Second, patents and copyrights are ownable, just like everything else in OFAC’s regulatory definition.” Although OFAC’s definition of property includes “contracts of any nature whatsoever,” the immutable smart contracts are not, actually, contracts. This is because, according to the Fifth Circuit, contracts require an agreement between two or more parties. In contrast, immutable smart contracts involve only one party, because one “side” involves only “just software code.” Mutable smart contracts, however, could facilitate a contract between the operator and a third party. Referencing “blockchain case law relied upon by the district court,” the Court stated that it was “not to the contrary,” because those cases did not involve clearly immutable smart cases.
Briefly, the Court also rejected the government’s argument that the immutable smart contracts qualify as “services,” because although they provide services, they are not “services” themselves. Further, Tornado Cash does not actually own the services provided by the immutable smart contracts. “Similarly, Tornado Cash as an ‘entity’ does not own the immutable smart contracts, separate and apart from any rights or benefits of the services performed by the immutable smart contracts.”
Ultimately, the Fifth Circuit focused on the explicit text of the IEEPA and the limited role of the judiciary: “We readily recognize the real-world downsides of certain uncontrollable technology falling outside of OFAC’s sanctioning authority. . . . . Mending a statute’s blind spots or smoothing its disruptive effects falls outside our lane.”
If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. Please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.