Judicial decisions finding that the U.S. Department of the Treasury (Treasury) Office of Foreign Assets Control (OFAC) exceeded its statutory authority in a sanctions action are rare. On November 26, 2024, however, the U.S. Court of Appeals for the Fifth Circuit issued such a finding. In Van Loon v. Department of the Treasury,1 the Fifth Circuit held that OFAC exceeded its statutory authority by designating an autonomous and immutable software program that facilitates anonymous cryptocurrency2 transactions. Van Loon is one of the first cases to review OFAC’s interpretation of its parent statutes since the Supreme Court ended deference to agency interpretations in Loper Bright Enterprises v. Raimondo.3 Although Van Loon’s formal legal effects are narrow, its reasoning suggests that OFAC rests on slightly shakier ground when regulating novel technologies. It is unclear whether the incoming Trump administration would seek additional congressional authority to address these issues.
Background
Legal framework. OFAC’s power to impose sanctions is broad but not unlimited. The International Emergency Economic Powers Act (IEEPA) gives the President, upon declaring a national emergency, the power to block “any property in which any foreign country or a national thereof has any interest.”4 IEEPA is OFAC’s principal statutory authority. Other statutes sometimes build on IEEPA: For example, the North Korea Sanctions and Policy Enhancement Act (NKSPEA) authorizes the President to invoke IEEPA’s authorities when the President determines that a person is involved in certain prohibited activities related to North Korea.5
In 2015 and 2016, President Barack Obama relied on IEEPA and NKSPEA to issue two executive orders directing Treasury to block the property and interests of foreign persons deemed to have provided support to North Korea or engaged in certain cyber-enabled activities.6 OFAC subsequently issued regulations implementing these orders, including by defining “person,” “entity,” “property,” and “interest.”7
The challenged OFAC action. In 2022, OFAC relied on these regulations to sanction a set of entities related to Tornado Cash, a software that facilitates anonymous cryptocurrency transactions, for allegedly being used to help North Korea launder stolen cryptocurrency and commit other cybercrimes.8 The action included sanctions on Tornado Cash smart contracts.9
The Van Loon litigation focused on whether OFAC had statutory authority to designate a specific subset of these entities: the portion of smart contracts that were “immutable” – and in particular, the set of “immutable pool smart contracts.” These smart contracts — often referred to as “mixers” — are software that facilitates transfers of cryptocurrency between human end users. A sender deposits cryptocurrency into a specific pool, and depositors then receive keys or a password enabling whoever holds that password to withdraw the same amount from the pool.10 Because a given pool may have several depositors and withdrawers, this “mixing” “severs any public link between the deposit and withdrawal address,” thereby obfuscating the identity of the transactors. The “pool smart contracts” are the software that facilitates this process automatically without human intervention.
Critically, however, the pool smart contracts at issue in Van Loon were “immutable”: In contrast to “mutable” smart contracts — which are managed by some party or group and may be changed — immutable smart contracts cannot be altered or deleted by anyone once they are created.11 Tornado Cash irreversibly converted its pool smart contracts to immutable status in 2020.12 After that point, the pool smart contracts “became self-executing and could no longer be altered, removed, or controlled.”13
Issues and Procedural History
Six Tornado Cash users sued Treasury in the Eastern District of Texas over OFAC’s decision to sanction the immutable pool smart contracts. The plaintiffs argued that OFAC’s designations exceeded its authority under IEEPA and NKSPEA because (1) Tornado Cash is not a foreign “national” or “person,” (2) immutable pool smart contracts are not “property,” and (3) Tornado Cash cannot have a property “interest” in the immutable smart contracts.14 The district court disagreed with the Tornado Cash users on each point and granted Treasury’s motion for summary judgement.15 The Fifth Circuit reversed. It held that OFAC lacked statutory authority to designate for sanctions the immutable pool smart contracts.
The Fifth Circuit’s Analysis
Immutable smart contracts are not “property.” The Fifth Circuit’s decision rested primarily on its finding that immutable smart contracts are not “property” that can be blocked under IEEPA and NKSPEA. Relying on plain-meaning analysis, dictionary definitions, precedent, and scholarship, the court reasoned that property must be “capable of being owned.” However, immutable smart contracts are by definition incapable of being owned.16 They irrevocably remove the option for anyone to update, remove, or control lines of code, and no party can control immutable smart contracts or exclude others from their use. As a result, immutable smart contracts are not “property” subject to regulation under IEEPA and NKSPEA.18
Immutable smart contracts are also not “contracts” or “services.” OFAC also argued that its longstanding definition of “property” includes “contracts of any nature” and “services of any nature” and that immutable smart contracts could fall into either of these categories.19 Without reviewing the legality of OFAC’s definition, the court held that the definition would not cover immutable smart contracts even if it applied.20
Immutable smart contracts were not “contracts” because contracts require an agreement between two or more parties. Immutable smart contracts only feature one party: The offeror makes an offer into the “pool,” but there is no “operator on the other side of the transaction to accept or make a counteroffer — just software code.”21 No one can control the immutable smart contract or the funds inside it. Accordingly, there is no counterparty with which to contract.22
Nor were the immutable smart contracts “services.” Relying on a dictionary definition, the court held that a service is an “intangible commodity in the form of human effort, such as labor, skill, or advice.”23 However, no human effort is expanded by immutable smart contracts.24 Immutable smart contracts are accordingly better understood as a tool for performing a service rather than a service themselves.25 Because immutable smart contracts did not fall within the categories of things IEEPA and NKSPEA empower the President to block, the Fifth Circuit held that OFAC’s decision to sanction them exceeded its statutory authority.
Key Takeaways
The formal effect of Van Loon is narrow. The ruling binds only the Fifth Circuit and provides only that OFAC cannot sanction immutable smart contracts. OFAC’s sanctions on Tornado Cash’s mutable smart contracts (those that can be owned and modified) were upheld.26 However, Van Loon’s reasoning and context suggest that a larger set of OFAC’s sanctions actions — especially as related to autonomous, immutable new technologies — rest on shakier ground.
OFAC under Loper Bright. Van Loon is one of the first appellate decisions to address OFAC’s regulatory authority after the Supreme Court revised the framework for reviewing agency interpretations of their parent statutes in Loper Bright,27 and it suggests that the Loper Bright era offers marginally more scope to challenge OFAC designations as unlawful interpretations of IEEPA. Under the previous standard, Chevron deference, reviewing courts would defer to any “reasonable” agency interpretation of their parent statute so long as Congress did not speak directly to the precise issue at question.28 OFAC interpretations of IEEPA were almost impossible to challenge under this paradigm. In June 2024, however, the Supreme Court eliminated Chevron deference in Loper Bright and instructed courts to exercise independent judgment in determining the meaning of statutory provisions. The Van Loon court accordingly conducted a robust de novo interpretation of IEEPA and applied its reading. Van Loon suggests that other creative OFAC interpretations of IEEPA will also be easier to contest under the Loper Bright framework than they were in past.
Regulation of novel technologies. Van Loon’s reasoning suggests that OFAC may be particularly vulnerable when trying to regulate novel autonomous and immutable technologies. First, Van Loon’s driving logic — that IEEPA authorizes OFAC to block only things that are “capable of being owned” — could extend to place other kinds of novel technologies over which no one has ownership or control rights beyond OFAC’s jurisdiction. For example, other aspects of a decentralized blockchain environment may feature elements that are immutable and not clearly subject to control.
Second, Van Loon’s textualist interpretation of IEEPA underscores challenges OFAC faces when relying on this statute to regulate new technologies. IEEPA was enacted in 1977. It was drafted before the modern internet was invented, and its enacting Congress may not have anticipated the malicious cyber-enabled activities OFAC sought to target in this action. However, the Van Loon court reasoned that interpreting IEEPA to cover immutable smart contracts — even if arguably consistent with IEEPA’s purpose — would amount to “judicial lawmaking.”29 The court acknowledged that its approach left gaps in OFAC’s ability to regulate new technology but insisted that only legislative amendment could solve this problem. This approach is increasingly representative of U.S. courts today, and it puts OFAC on weaker footing when attempting to regulate novel technologies.
Successful challenges to OFAC designations will remain rare. Nonetheless, Van Loon’s impact should not be overstated. Courts have often deferred to the executive branch in foreign affairs and national security cases for reasons different than those justifying Chevron deference, such as courts’ particular lack of competence to weigh in on sensitive foreign affairs issues and judge acceptable risks.30 OFAC will continue to receive deference in fact-based or discretionary applications of the statute — as opposed to its legal interpretation of it — such as determinations of whether funds were used in connection with a prohibited activity. Even where OFAC’s enforcement implicates an issue of statutory interpretation, Skidmore respect — a doctrine left intact by Loper Bright — provides that courts may still give persuasive weight to agency interpretations when the interpretation or its circumstances merit such respect.31 OFAC sanctions actions are at the heart of the foreign affairs and national security issues that have traditionally received deference for reasons outside the Chevron framework. The path to challenging OFAC sanctions designations as unlawful interpretations of IEEPA remains narrow.
The incoming Trump administration could seek additional authority. As the Fifth Circuit in Van Loon suggested, Congress can fill gaps in existing statutes or create new ones to provide the President clearer authority to regulate autonomous technology to address its impact on national security. Whether the incoming Trump administration will ask for such legislation is uncertain. The issue has not been the focus of pending cryptocurrency legislation, such as the Republican-sponsored Financial Innovation and Technology for the 21st Century Act, which passed the U.S. House of Representatives in May 2023.32 In his first term in office, then-President Donald Trump relied often on IEEPA and might do so again in his second term to impose additional tariffs on imported goods from various trading partners. He might be loath to put IEEPA “in play” in the Congress.
Van Loon is illustrative of increasing uncertainty in sanctions enforcement. OFAC enforcement actions are likely to increase in the incoming administration. At the same time, the end of Chevron deference and the continued rise of new technologies in contrast to IEEPA’s aging statutory authorities inject some uncertainty into the boundaries of OFAC’s regulatory authority. Careful sanctions diligence is essential to companies seeking to manage risk in the shifting legal and political landscape. Sidley lawyers are available to answer your questions.
1 No. 23-50669, (5th Cir., 2024).
2 The Fifth Circuit notes that whether certain cryptoassets are currency or securities is subject to ongoing litigation, and the opinion does not answer that question. The Fifth Circuit’s use of the term “cryptocurrency” “merely reflect[s] the language used in the briefing.” Accordingly, we use the same terminology.
3 144 S. Ct. 2244 (2024).
4 50 U.S.C. § 1702(a)(1)(B).
5 22 U.S.C. § 9214(a), (b).
6 Van Loon, slip op. at 14-15.
7 Id. at 15.
8 Id. at 13, 15.
9 Id. at 15-16.
10 Id. at 6-7.
11 Id. at 5-6.
12 Id. at 9.
13 Id.
14 Id. at 16.
15 Id. at 17.
16 Van Loon, slip op. at 22. The court’s focus on ownership was also consistent with OFAC’s illustrative list of blockable property, which consisted entirely of things capable of ownership. Id. at 24-26.
17 Id. at 24.
18 Id. at 22.
19 Id. at 23.
20 Id. at 22-23.
21 Id. at 28.
22 Id. at 28-29. The district court analogized to a vending machine to find that the immutable smart contracts were unilateral contracts. The Fifth Circuit rejected this analogy: While a vending machine has an owner who can update the machine’s inventory, unplug the machine, or move it, the Fifth Circuit stated that Tornado Cash has no control over immutable smart contracts. Id. at 29.
23 Id. at 31, citing Service, BLACK’S LAW DICTIONARY (12th ed.).
24 Van Loon, slip op. at 31-32.
25 Id.
26 Id. at 23.
27 Loper Bright, 144 S. Ct.
28 Chevron, 467 U.S. at 842.
29 Van Loon, slip op. at 33.
30 See Kristen Eichensehr, Foreign Affairs Deference After Chevron, JUST SECURITY (Jun. 28, 2024), https://www.justsecurity.org/97317/supreme-court-chevron-loper-bright/.
31 See Skidmore v. Swift & Co., 323 U.S. 134 (1944).
32 HR 4763, https://www.congress.gov/bill/118th-congress/house-bill/4763.
Thank you to Lloyd Lyall for his significant contributions to this Sidley Update.
Sidley Austin LLP provides this information as a service to clients and other friends for educational purposes only. It should not be construed or relied on as legal advice or to create a lawyer-client relationship.
Attorney Advertising - For purposes of compliance with New York State Bar rules, our headquarters are Sidley Austin LLP, 787 Seventh Avenue, New York, NY 10019, 212.839.5300; One South Dearborn, Chicago, IL 60603, 312.853.7000; and 1501 K Street, N.W., Washington, D.C. 20005, 202.736.8000.
