How stablecoin addresses are blacklisted, explained

Last month, The Block discovered that an Ethereum address holding USDC stablecoins had been “blacklisted” for the first time ever. According to Centre, the consortium behind USDC, all $100,000 worth that was held in the blacklisted address was frozen.

The discovery sent shockwaves through the crypto world. But the truth is that stablecoin blacklisting has been happening for years: Tether, which as of April accounted for more than 75% of the stablecoin market, has blacklisted at least 39 Ethereum addresses since 2017, including one that it blocked in April that held $4.56 million.

If the practice is becoming commonplace, it’s worth asking: What exactly does it take to get a stablecoin holder blacklisted? The Block reached out to four major stablecoin projects on Ethereum — Paxos (Pax stablecoin), Centre (USDC); TrustToken (TUSD), Tether (USDT) — and asked about their blacklisting policies. Each one has the power to step in and prevent any address deemed to be associated with illegal behavior from redeeming or transferring its stablecoins on-chain.

Who determines that an address is associated with illegal behavior? In the U.S.,the most important player is the Treasury Department’s Financial Crimes Enforcement Network (FinCEN). FinCEN enforces a law called the Bank Secrecy Act (BSA), which requires financial institutions to report and maintain records of any suspicious activity, via so-called Suspicious Activity Reports (SARs).

The BSA also requires that financial institutions — including “convertible virtual currency exchangers” — register as so-called money services businesses (MSBs), which FinCEN defines as any company that transmits or converts money — including issuers and redeemers of money orders or traveler’s checks, check cashers, and currency converters in addition to virtual currency exchangers. MSBs must create and operate an effective written anti-money-laundering (AML) program and comply with AML-related regulations, such as the requirement that financial institutions run know your customer (KYC) checks on all their customers.

Besides the federal requirements, every state except Montana also requires money transmitters to be licensed before they can operate there.

All four projects that The Block reached out to emphasized that law enforcement is the most important determining factor in stablecoin blacklisting. But each one had a slightly different way of explaining their internal policies — and they all implied that at least sometimes the decision is based on the company’s own judgment.

Centre

USDC is a dollar-backed stablecoin that was launched in 2018 by Centre, a consortium created by Circle and Coinbase. It is an ERC-20 token on the Ethereum blockchain and is the second-largest stablecoin behind Tether with over 7% global market share.

Centre maintains that it is not itself a financial institution. It does not issue the stablecoin, guard the stablecoin or monitor its end-user transactional activity. Centre is solely responsible for facilitating the governance, policy and technology divisions in its role as “a standards settings and policy governance body” for stablecoins, according to Josh Hawkins, senior vice president of corporate communications for Circle.

“The entities that issue and custody USDC are required, in accordance with Centre policy, to be regulated financial institutions, including as MSBs under FinCEN's authority if they fall into its jurisdiction,” Hawkins said.

Still, Centre has the sole ability to blacklist USDC holders. According to it’s blacklisting policy, it will only do so if compelled by a court order or government regulation — or in an event where failure to blacklist an address would pose “a threat to the security, integrity, or reliability of the USDC Network.”

The policy also states that a blacklisted address may be eligible for a reversal if a court order against it is lifted or if a court confirms that the address is no longer a security threat to the network. Ultimately, for the Centre to either blacklist an address or reverse a blacklisting, it has to get a majority vote from its three-person board of managers, which includes Centre CEO Jeremy Allaire, Impossible Foods chief legal officer Dana Wagner, and Coinbase’s CFO Alesia Haas.

As for the address it blocked in July, Circle confirmed that Centre made the decision “in response to a request from law enforcement” but declined to offer any more specifics.

Tether

Tether, which dominates the global stablecoin market, is unique relative to its peers — at least in the context of U.S. law. Its primary legal entity, called Tether International Unlimited, is based in the British Virgin Islands. Though a separate entity called Tether Limited is regulated by FinCEN, U.S. persons are technically prohibited from using the stablecoin unless Tether makes an exception, the grounds for which are not clear.

Nonetheless, Tether general counsel Stuart Hoegner said that as part of the firm’s duties under the BSA, it works with law enforcement to determine and report any illegal activity on their platform. “If we notice a suspicious transaction there, we file a suspicious activity report to FinCEN. These reports are then available for use in follow up investigations,” he said.

Like Centre, Tether has the power to blacklist an address and freeze all its associated tokens, and the company says it will do so if law enforcement agencies require it.

“We must receive a request from law enforcement that constitutes a valid legal process. It may be a case of stolen property or contraband, often through a user’s security breach, said Hoegner. “Or a law enforcement agency may come to us through the appropriate process and require that we freeze the tokens as part of a more general investigation.”

Still, according to Hoegner, Tether might blacklist a coin for other reasons as well — especially if it determines that it is not completely secure or might pose a threat to the Tether community.

Paxos

Paxos began issuing its own dollar-backed stablecoin, called Pax Standard (Pax), in September 2018. As of April, Pax made up around 5% of the stablecoin market.

The company monitors the use of its stablecoins both within its ecosystem of products and services, which includes an exchange, and “in the wild,” according to Paxos’s Chief Compliance Officer Dan Burstein.

“We may freeze, temporarily or permanently, your use of, and access to PAX and/or BUSD or the U.S. dollars backing your PAX and/or BUSD, with or without advance notice, if we are required to do so by law, including by court order or other legal process,” the company states on its website. The company may also blacklist addresses as a result of its own investigations.

Technically, Paxos has the ability to take two different actions to blacklist users of its stablecoin. Besides freezing in which tokens in a blockchain wallet cannot be accessed by the user, it can also “seize” the coins. “The freeze allows us to put a hold on and make sure that the tokens don’t leave whatever wallet it’s in while we investigate further,” said Burstein.

A seizure, on the other hand, requires that Paxos destroy the coins associated with an address to free the underlying dollars. In that case, Paxos determines how to handle the freed-up assets based on guidance from law enforcement agencies.

“We don't want to be the judge or executioner here,” Burstein said. “We report things to the law enforcement when there is suspicious activity, but we are not going to take someone's assets unless we are directed to do so,” Burstein said.

TrueUSD

TrustToken, which issues the fourth-most-popular Ethereum-based stablecoin TrueUSD (TUSD), says its guarantees that it won’t “freeze out” a user either unless a regulator specifically makes a request for that.

“We are a licensed and regulated money services business (MSB) financial institution in the U.S. and maintain an independently audited BSA/AML program. That program utilizes OFAC’s sanctions lists, Treasury’s SDN lists, among others,” said a spokesperson for the company. (OFAC is the Treasury Department’s Office of Foreign Asset Control, which maintains a list of “specially designated nationals and blocked person’s list” of foreign nationals on whom the U.S. has imposed sanctions.)

“TrustToken does look at aggregate usage trends, but does not monitor for deposits into any particular address unless subject to a legal order,” the spokesperson said, adding: “If discovered, we report suspicious activity as required by our BSA/AML policy.”