# OFAC and Van Loon

> OFAC and Van Loon (US Treasury · Office of Foreign Assets Control): Sanctions · where the law found a limit. Region: Americas. Privacy with disclosure: Confidentiality is workable so long as the regulated firm can identify parties and disclose on demand.

Part of the Soda Labs Privacy Hub regulation map, which reads the instruments
themselves rather than summarising the summaries: https://www.sodalabs.xyz/privacy-hub/regulation

## Key facts

- Entry type: Regulator or standard-setter
- Region: Americas
- Subject: Sanctions · where the law found a limit
- Authority: US Treasury · Office of Foreign Assets Control
- Stance on on-chain confidentiality: Privacy with disclosure. Confidentiality is workable so long as the regulated firm can identify parties and disclose on demand.
- Tags: Tornado Cash, Van Loon, IEEPA, strict liability
- Canonical page: https://www.sodalabs.xyz/privacy-hub/regulation/reg-ofac

## What it actually says

The most severe action ever taken by a government against privacy tooling, followed by the most significant legal retreat from one. Sanctioning Tornado Cash in 2022 meant that touching a set of immutable contracts became a strict-liability violation, with no intent requirement. The Fifth Circuit held that unlawful in November 2024 on a narrow but durable ground: property under the statute means something someone can own or control, and nobody can own an immutable contract. Treasury delisted in March 2025. Read the limits carefully before drawing comfort from it. The holding binds one circuit, it says nothing about mutable or upgradeable contracts, and OFAC's appetite for designating people and addresses is undiminished.

## The instruments that matter

- **Tornado Cash designation, 8 August 2022**: made interacting with a set of immutable Ethereum contracts a strict-liability sanctions violation
- **Van Loon v. Department of the Treasury (5th Cir., 26 November 2024)**: OFAC exceeded its statutory authority; immutable smart contracts are not property under IEEPA because nobody can own, control or alter them
- **Delisting, 21 March 2025**: Treasury removed the addresses from the SDN list; no re-designation has been reported
- **The limit is narrow**: binding in the Fifth Circuit only; OFAC may still designate people, mutable contracts and addresses, and has continued to do so

## Sources

- [Van Loon slip opinion](https://www.ca5.uscourts.gov/opinions/pub/23/23-50669-CV0.pdf)
- [CourtListener docket](https://www.courtlistener.com/opinion/10284289/van-loon-v-trea/)

## Related entries

- [FinCEN](https://www.sodalabs.xyz/privacy-hub/regulation/reg-fincen): Bank Secrecy Act · the deepest US constraint
- [GENIUS Act](https://www.sodalabs.xyz/privacy-hub/regulation/reg-genius-act): Stablecoins · censorability as a licensing precondition
- [IRS broker reporting](https://www.sodalabs.xyz/privacy-hub/regulation/reg-irs-broker-reporting): Tax · live at the custodial perimeter, dead beyond it
- [NYDFS](https://www.sodalabs.xyz/privacy-hub/regulation/reg-nydfs): The most privacy-restrictive US regulator, state or federal
- [The third-party doctrine](https://www.sodalabs.xyz/privacy-hub/regulation/reg-third-party-doctrine): Why chain analysis needs no warrant
- [United States](https://www.sodalabs.xyz/privacy-hub/regulation/jur-united-states): Split by perimeter, not by ideology