OFAC Compliance

OFAC Compliance

Turbine.cash integrates OFAC (Office of Foreign Assets Control) compliance checks to ensure the protocol cannot be used by sanctioned entities while maintaining user privacy.

What is OFAC?

OFAC is a U.S. government agency that maintains lists of sanctioned individuals, organizations, and countries. Financial services must not process transactions for sanctioned parties.

How Compliance Works

Before processing a withdrawal, the system verifies that the recipient address is not on the OFAC sanctions list:

The OFAC Signature

The compliance check works through a cryptographic signature:

1. Request Signature: Call /get_ofac_signature with your auth token
2. Compliance Check: The backend verifies your wallet against sanctions lists
3. Receive Signature: If compliant, you receive a signed attestation
4. Use in Withdrawal: Include the signature in your withdrawal transaction

Note

The OFAC signature proves your address passed compliance checks at a specific time. It does not reveal any personal information.

API Usage

Get OFAC Signature

const response = await fetch(
  `${API_BASE}/get_ofac_signature/${network}/${authToken}`,
  { method: 'POST' }
);

const signature = await response.json();

Include in Withdrawal

The OFAC signature is included in the withdrawal instruction and verified on-chain.

Privacy Considerations

What is Revealed	What is NOT Revealed
Your address was checked for compliance	Your identity
The check passed	Your location
Timestamp of check	Any personal data

The compliance check only verifies that an address is not on public sanctions lists. It does not require KYC or identity verification.

Compliance Provider

Turbine.cash uses CipherOwl for OFAC compliance checks:

• Real-time sanctions list updates
• Cryptographic attestations
• No personal data collection

[PLACEHOLDER: OFAC_SIGNATURE_EXPLANATION]

Sanctions List Coverage

The compliance check covers:

• OFAC SDN (Specially Designated Nationals) list
• Blocked addresses associated with sanctioned entities
• Addresses linked to known illicit activity

What Happens if Blocked?

If your address appears on a sanctions list:

1. The /get_ofac_signature endpoint will return an error
2. You cannot complete withdrawals through the relayer
3. Your deposited funds remain in the pool (not seized)

Caution

If you believe you were incorrectly flagged, contact compliance support. The protocol cannot help with false positives as it does not control the sanctions lists.

For Integrators

If you’re building on Turbine.cash:

1. Always check OFAC before initiating withdrawals
2. Handle errors gracefully - compliance failures should show appropriate messages
3. Don’t cache signatures - always get fresh signatures before withdrawals
4. Respect the result - never attempt to bypass compliance checks

Next Steps

• Continue to Getting Started
• Learn about the Authentication Flow