A Request to Pay in Cryptocurrency? Add It to Your Third-Party Red Flags

“Wait, they want to be paid in Bitcoin?”

“Not Bitcoin. Tether. It’s a stablecoin, so it’s designed to hold its value against the U.S. dollar. Can you approve this?”

What the heck do you do? If this hasn’t happened to you yet, it probably will in the next few years.

At the Society of Corporate Compliance and Ethics conference in Orlando this September, I attended a fascinating session on cryptocurrency and its intersection with money laundering and sanctions violations. The presenters were experts working in the cryptocurrency industry, a world that I rarely encounter in my own practice.

One of their recommendations struck me as particularly practical: a third party requesting to pay, or be paid, in cryptocurrency should trigger a red flag in your third-party due diligence process.

Here’s why, and what you should do about it.

There are perfectly legitimate reasons to use cryptocurrency to move money. Currency volatility and difficulties moving funds across borders can make traditional payment arrangements challenging, especially in certain jurisdictions.

The presenters used Venezuela as an example. OFAC has issued general licenses and may issue specific licenses authorizing certain transactions that would otherwise be prohibited under U.S. sanctions. For companies operating within the scope of those authorizations, getting paid in a usable, relatively stable currency can still be difficult.

One potential solution is a stablecoin, a type of cryptocurrency designed to maintain its value against another asset, often the U.S. dollar. That can provide a more predictable means of payment than a highly volatile local currency. Of course, using a stablecoin does not itself authorize a transaction or remove applicable sanctions obligations.

The important distinction is that a cryptocurrency payment request is not proof of misconduct. There may be a legitimate business reason for it. But there are also reasons that compliance should want to know more.

Cryptocurrency transactions can create real difficulties in understanding who is on the other side of a payment. Blockchain transactions may be traceable, but connecting a wallet address to the person or entity that ultimately controls it can be challenging. Some services are specifically designed to obscure the source, destination, or movement of funds.

There have also been significant enforcement actions against cryptocurrency businesses that failed to apply appropriate sanctions controls despite having information indicating that customers were in sanctioned jurisdictions. In its 2022 Bittrex action, for example, OFAC identified failures to use location information the company already possessed. The issue is not theoretical.

There are two straightforward approaches and either could work depending on how your third-party risk assessment is designed.

The first is to add a cryptocurrency payment request to your risk-ranking criteria. Most organizations already consider factors such as whether the third party interacts with government officials, government ownership or control, geographic corruption risk, and contract value. You could add a question: Has the third party requested to pay, or be paid, in cryptocurrency? A yes answer would elevate the risk rating and trigger a higher level of due diligence.

The second is to keep your existing risk matrix and use the question as an automatic escalation trigger. In that model, a yes answer requires compliance review, regardless of the third party’s overall risk score.

Either approach accomplishes the key objective: the business cannot treat this as merely a decision about payment mechanics. Compliance gets an opportunity to understand the proposed transaction before the company proceeds.

The starting point is to understand why cryptocurrency is being requested. What problem is the proposed payment method solving? Why would ordinary banking channels not work? Which cryptocurrency or stablecoin will be used, and through what exchange or wallet?

Compliance should also review the structure of the deal and the parties involved, including ultimate beneficial ownership. Understand who controls the receiving or sending wallet, whether a third-party payment processor or intermediary is involved, and whether any party or wallet presents a sanctions concern. Where appropriate, use specialist wallet-screening or blockchain-analysis capabilities rather than assuming ordinary name screening will answer those questions.

For higher-risk arrangements, it may make sense to go further. Boots-on-the-ground due diligence through a provider such as Diligent or one of its competitors can help establish whether the third party is operating as represented, who is actually behind it, and whether its business explanation makes sense. And, of course, counsel should confirm that the transaction and payment route fall within any applicable sanctions authorization.

The goal is not to prohibit every cryptocurrency transaction. It is to ensure that an unusual payment method does not bypass the scrutiny that the underlying risk deserves.

Cryptocurrency is still relatively new in many corporate payment environments, but it is not going away. As banks expand tokenization and payment methods continue to evolve beyond traditional correspondent banking and SWIFT messaging, compliance teams will encounter more arrangements that do not look like the payments they have historically reviewed.

We do not need to become cryptocurrency experts. We do need to recognize when a payment request introduces a different risk profile, ask the right questions, and ensure that our due diligence process requires an appropriate response.

OFAC, Sanctions Compliance Guidance for the Virtual Currency Industry

OFAC, Venezuela-Related Sanctions and General Licenses