Citing Loper, Fifth Circuit Declines Agency Deference, Overturns Sanctions Against Cryptocurrency Software

On November 26, 2024, the Fifth Circuit issued an opinion in Van Loon v. Department of the Treasury that invalidated economic sanctions imposed by the U.S. Treasury Department’s Office of Foreign Assets Control (“OFAC”) on Tornado Cash, a software protocol that facilitates anonymous digital transactions.¹ The government alleged that Tornado Cash helped malicious foreign actors, including a North Korean hacking group, launder cryptocurrency, but the Fifth Circuit found that the “immutable smart contracts” used to anonymize transactions did not qualify as “property” under relevant law. As such, the contracts were not sanctionable. This opinion breaks new ground in applying the United States’ existing sanctions regime to the emerging cryptocurrency field. It may also suggest that refinements to the government’s sanctions authority could be on the horizon.

A primary source of authority for U.S. economic sanctions is the International Emergency Economic Powers Act (“IEEPA”).² IEEPA allows the President to exercise certain economic powers “to deal with any unusual and extraordinary threat, which has its source in whole or substantial part outside the United States” after declaring “a national emergency with respect to such threat.”³ OFAC administers these powers and oversees various economic sanctions programs. OFAC also maintains the Specially Designated Nationals and Blocked Persons (“SDN”) list, which publicly identifies individuals, groups, vessels, and other entities subject to U.S. sanctions. One power delegated by IEEPA is to prohibit transactions in, or otherwise block, “any property in which any foreign country or a national thereof has any interest” or “any property, subject to the jurisdiction of the United States . . . .”⁴ IEEPA does not define “property,” but OFAC has issued regulations defining the term to include “contracts of any nature” and “services of any nature.”⁵

Tornado Cash is a decentralized, open-source software project first developed by a group of contributors in 2019. Its software supports “immutable smart contracts,” which automatically perform tasks and cannot be altered, removed or controlled, even by their developers. Tornado Cash’s smart contracts, known as “mixers,” collect, pool, and shuffle cryptocurrency transactions deposited by many different users to obscure the path of funds. While mixers have legitimate privacy uses, OFAC alleged on August 8, 2022 that Tornado Cash had been used to launder more than $7 billion in cryptocurrency, including over $455 million stolen by the Lazarus Group, a North Korean state-sponsored hacking organization.⁶ OFAC designated Tornado Cash as an SDN and blocked all property interests in the entity, identifying the digital currency addresses of the smart contracts.⁷ Six Tornado Cash users then sued the Department of the Treasury, arguing that OFAC violated the Administrative Procedure Act (“APA”) because the “immutable smart contracts” were not “property” capable of being sanctioned under IEEPA.

The Fifth Circuit in Van Loon agreed with the plaintiffs, holding that the contracts were not “property” capable of being blocked and that OFAC had thus exceeded its authority under IEEPA. First, the court looked to the ordinary, contemporary, common meaning of “property.” The court explained that property encompasses all objects or rights which are susceptible of ownership. However, Tornado Cash’s “immutable smart contracts” were not property because they were “not capable of being owned.” Since they were unchangeable, and the code could not be updated, removed, or otherwise controlled, no one could exercise certain key traditional property rights over them, including changing them or excluding anyone from using them. The Fifth Circuit concluded that the inquiry could end there because the plain meaning of “property,” as used in IEEPA, did not encompass Tornado Cash’s “immutable smart contracts,” and therefore OFAC could not block the contracts. Interestingly, the Fifth Circuit went a step further and stated that not only were the smart contracts incapable of being blocked, but that the fact that the contracts were not property meant OFAC exceeded its authority under IEEPA in designating Tornado Cash as an SDN.

Second, the Fifth Circuit explained that, even if it were to consider OFAC’s longstanding regulatory definitions, including “contracts of any nature” or “services of any nature,” Tornado Cash’s “immutable smart contracts” were not sanctionable under such regulations. The court reasoned that OFAC’s regulations, despite their breadth, still require an asset or thing, whether physical or non-physical, to be ownable. The court distinguished the “immutable smart contracts” from patents and copyrights, because while each is intangible, persons can own the rights to patent and copyright protections and benefits. In addition, the “immutable smart contracts” were not “contracts” as defined by the regulations because they were not agreements between two or more parties. Moreover, the contracts themselves were not “services” because they did not require the expenditure of any human effort. The Fifth Circuit reversed and remanded with instructions to the district court to grant the plaintiffs’ motion for partial summary judgment based on the APA.

The Fifth Circuit’s decision could mark the start of changes to the scope of OFAC’s broad sanctions authority. In interpreting the definition of “property,” the court cited to the Supreme Court’s 2024 Loper Bright decision,⁸ which eliminated courts’ Chevron deference to agencies’ interpretations of ambiguous statutes. The Fifth Circuit explained that courts must be “sticklers” when interpreting legislation and must determine the “best” reading of a statute, not merely a “permissible” one. Accordingly, courts may have occasion to reinterpret other statutory provisions governing economic sanctions, especially as cryptocurrency, blockchain, and other digital technologies continue to rapidly evolve and pose novel legal questions. Moreover, gaps in OFAC’s ability to sanction malicious actors could motivate Congress to amend IEEPA, which became law in 1977, to account for the modern world. Businesses should closely monitor developments in U.S. sanctions laws, especially when evaluating transactions involving any foreign touchpoints. The combination of evolving technologies and legal precedent could reshape sanctions risks in ways that may be difficult to predict.

¹ Van Loon v. Dep’t of the Treasury, No. 23-50669, 2024 WL 4891474 (5th Cir. Nov. 26, 2024).

² 50 U.S.C. § 1701 et seq.

³ 50 U.S.C. § 1701(a).

⁴ 50 U.S.C. § 1702(a)(1)(B).

⁵ See, e.g., 31 C.F.R. §§ 510.323, 578.314.

⁶ Press Release, U.S. Department of the Treasury, U.S. Treasury Sanctions Notorious Virtual Currency Mixer Tornado Cash (Aug. 8, 2022), https://home.treasury.gov/news/press-releases/jy0916.

⁷ See 87 Fed. Reg. 49652 (Aug. 11, 2022) (designating Tornado Cash as an SDN); 87 Fed. Reg. 68581 (Nov. 15, 2022) (removing Tornado Cash from the SDN list); 87 Fed. Reg. 68578 (Nov. 15, 2022) (re-designating Tornado Cash as an SDN).

⁸ Loper Bright Enters. v. Raimondo, 144 S. Ct. 2244, 219 L. Ed. 2d 832 (2024).

This information is provided by Vinson & Elkins LLP for educational and informational purposes only and is not intended, nor should it be construed, as legal advice.