Virtual Currency Transfers: Who Runs the Wallet?
OFAC defines wallets, addresses and hosted providers, and explains when digital currency activity can touch sanctions.
OFAC's virtual currency FAQ answers the wallet questions first. Digital currency covers sovereign cryptocurrency, virtual currency that is not fiat, and digital representations of fiat currency. A wallet is software or another mechanism to hold, store and transfer digital currency, and it keeps the user's addresses, private keys and balance.
The practical fork is who controls the wallet. A wallet provider supplies software that users download to create and manage wallets; a hosted wallet provider is a business that creates and stores a wallet on a customer's behalf. The source says most hosted wallets also offer exchange and payments services.
What each term covers
| Term | Definition in the source | Why it matters |
|---|---|---|
| Digital currency wallet | A software application or other mechanism for holding, storing and transferring digital currency | Holds addresses, private keys and the balance |
| Wallet provider | A person, individual or entity, that provides software to create and manage wallets that users download | Software-only relationship |
| Hosted wallet provider | A business that creates and stores a digital currency wallet on behalf of a customer | Business holds the wallet relationship |
| Digital currency address | An alphanumeric identifier representing a potential destination for a transfer, associated with a wallet | Receives, but does not itself hold funds |
The source distinguishes addresses from keys: addresses let a user receive digital currency, while private keys let a user transfer it. That split is why a wallet is more than an address list.
When sanctions enter
Persons and persons otherwise subject to OFAC jurisdiction must block the property and interests in property of persons named on the SDN List, or of any entity owned in the aggregate, directly or indirectly, 50 percent or more by one or more blocked persons. They must also not engage in trade or other transactions with such persons.
That duty is not limited to banks. Firms that facilitate or engage in online commerce or process transactions using digital currency are responsible for ensuring they do not engage in unauthorized transactions prohibited by sanctions, such as dealings with blocked persons or property. Prohibited transactions include those that evade or avoid, have the purpose of evading or avoiding, cause a violation of, or attempt to violate OFAC prohibitions.
The source also warns that persons providing financial, material or technological support for or to a designated person may themselves be designated under the relevant sanctions authority.
How the guidelines fit together
- Define the role. Decide whether you merely provide download software or create and store a wallet for a customer; the source treats those as different relationships.
- Know what the wallet contains. Addresses, private keys and balances are all part of the picture.
- Screen before acting. The source says compliance generally should include sanctions list screening and other appropriate measures.
- Match the program to the business. OFAC says factors include the type of business involved, and that no single compliance program suits every circumstance.
A worked example (Hypothetical)
Hypothetical: a small hosted wallet business creates and stores wallets for 500 customers and also offers exchange and payment services. Of those customers, 12 repeatedly receive transfers from addresses tied to a blocked person.
Calculation: 12 ÷ 500 = 2.4 percent of the customer base. That figure is not a risk score and says nothing about amounts, jurisdictions or whether those relationships are permitted. The point is procedural: because the business creates and stores wallets on behalf of customers, the source places it among firms that process digital currency transactions and must ensure they do not engage in unauthorized transactions. A smaller software-only provider faces the same screening question but a different set of data about who controls the wallet.
The source offers no revenue thresholds, customer limits or risk tolerances, so the business has to pick measures that fit its own product and customer base.
What the source does not say
- It does not state that every digital currency user must register with OFAC.
- It does not define a dollar threshold, transaction size or customer count that triggers specific duties.
- It does not say that holding a wallet is itself prohibited, or that address screening is mandatory for every transfer.
- It does not list approved screening vendors or tools, and it does not set out penalties for any particular violation.
- It does not address state-level money transmission licensing, tax treatment or exchange listing requirements.
- It does not settle whether a given token counts as virtual currency, a security or a commodity.
Those gaps matter for readers comparing U.S. service conditions. A wallet provider may be described in general terms in this FAQ, but the source does not tell users, state by state, whether a particular platform may serve them, what identity checks apply, or whether a specific address is safe to use.
A quick verification checklist
- Identify whether the service is a downloadable wallet or a hosted wallet that creates and stores the wallet for you.
- Check whether the provider also offers exchange or payment services, since the source says most hosted wallets do.
- Confirm what data the provider holds: addresses alone, or keys and balances as well.
- Ask what sanctions screening it runs and how it handles matches.
- Treat any statement that a transfer is clear as a claim about the provider's process, not a guarantee about the recipient.
The FAQ's closing point is about evolution: the strategies draw from a broad range of tools and authorities to respond to threats from malicious actors using new payment mechanisms. Read a provider's wallet terms against those definitions before assuming that a hosted and a self-managed wallet carry the same conditions.
Sources
Informational only. Not financial, legal or investment advice. Check the primary sources listed above before you act on anything here.