TRM Labs says Tornado Cash action is a ‘new challenge for sanctions compliance’

Blockchain analytics firm TRM Labs says that the Tornado Cash sanctions present new problems for crypto firms trying to comply with US regulations.

TRM Labs provides information to crypto entities such as Uniswap, Aave and Circle which helps them comply with various regulations and track criminal activity. It monitors crypto addresses and categorizes them by their level of risk, enabling crypto entities to avoid dealing with laundered funds or bad actors. It also assesses whether addresses are compliant with US sanctions.

The firm issued a statement on August 15 that broke down how it works with DeFi protocols to help them try to stay compliant. Yet the firm highlighted that these sanctions are different from previous rules in a way that makes it more ambiguous in how to adhere to them.

TRM Labs noted that this is the first time the Office of Foreign Assets Control (OFAC) has sanctioned a set of smart contracts instead of normal blockchain wallets. With wallets, it’s generally easy to identify if someone has interacted with the wallet either by sending or receiving funds from them. But smart contracts are more complicated.

“What makes the Tornado Cash designation challenging from a compliance and enforcement perspective is that any person who deposits funds into Tornado Cash can trigger the Tornado Cash smart contracts to send funds to any other Ethereum address(es),” said TRM Labs. “Theoretically, someone could send funds to Tornado Cash and then specify that those funds be deposited into a totally unrelated cryptocurrency address belonging to a random, unsuspecting, or even unwilling person.”

As TRM Labs noted, this has already happened. One user sent small amounts of ETH from the sanctioned Tornado Cash smart contract to a range of well-known crypto and mainstream individuals (including Coinbase CEO Brian Armstrong, talk show host Jimmy Fallon and former basketball player Shaquille O’Neal).

Due to the uncertainty, TRM Labs explained that it provides three levels of risk data. When a crypto firm pings it with an address (to check whether the address is compliant), TRM Labs provides data on whether the address is a sanctioned address, and whether it has direct or indirect exposure to sanctioned addresses. 

Yet TRM Labs highlighted that so-called dusting attacks are a particular problem. Since they are technically an interaction with a sanctioned entity, the firm is unable to dismiss them — especially without any guidance from regulators.

The result is that this pushes the onus onto crypto entities, which will be forced to individually decide whether to allow wallets that have been hit by dusting attacks. 

© 2022 The Block Crypto, Inc. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.