OFAC Cyber-Related Sanctions Regulations — Full Reissuance (31 CFR Part 578)

Mechanism

The US Cyber-Related Sanctions program was established by Executive Order 13694 (1 April 2015), which declared a national emergency with respect to the threat of significant malicious cyber-enabled activities originating from, or directed by, persons abroad. The EO authorised OFAC to block the property of any foreign person determined to have engaged in or materially assisted, sponsored, or provided support for:

• Significant malicious cyber-enabled activities that harm or compromise critical

infrastructure, financial systems, or computer networks;

• Theft of trade secrets, financial data, or personal information for commercial advantage;
• Disruption of computer systems in the financial sector, energy sector, or critical

government networks.

Executive Order 13757 (28 December 2016) expanded EO 13694 to include tampering with, altering, or causing a misappropriation of information for the purpose of interfering with or undermining election processes or institutions — codifying the basis for the 2016 election-interference sanctions designations (including Russian GRU and FSB units).

The original regulations (31 CFR Part 578) were published in abbreviated form on 31 December 2015 — a placeholder framework without full interpretive text. The 2022 final rule replaces that placeholder with complete regulatory text across nine subparts, adding:

• Definitions (Subpart C) — clarifying "cybersecurity firm," "malicious cyber-enabled

activity," "critical infrastructure," and related terms for US-person compliance.

• General licences (Subpart E) — covering personal communications, humanitarian

assistance, official government business, and NGO activities, mirroring the standard OFAC licence architecture used in other program reissuances.

• Interpretive guidance (Subpart D) — on the "50-percent rule" for entities owned by

blocked persons, evasion provisions, and the scope of "materially assisted."

• Civil penalties framework (Subpart G) — incorporating the standard OFAC penalty

ceiling (up to USD 1.4 million per violation or twice the transaction value as adjusted by the inflation adjustment rules).

The reissuance also triggered an administrative renumbering of Specially Designated Nationals (SDN) entries under the CYBER program, with OFAC publishing updated unique identifier numbers (UIDs) for affected designees.

Context: Scope of the CYBER SDN list

At the time of this reissuance, the CYBER program's SDN list included individuals and entities linked to:

• Russian GRU / FSB cyber operations (EO 13757 designations, 2016–2018): Main

Intelligence Directorate units 26165 and 74455 (Fancy Bear / Sandworm), responsible for the DNC hack and NotPetya.

• North Korean Lazarus Group affiliates designated under the parallel EO 13722 DPRK

cyber nexus.

• Iranian APT actors (Mabna Institute / Rana Intelligence Computing Company)

designated under the IRAN program's cyber overlay.

• Chinese PLA Unit 61398 — not designated under the CYBER program itself (handled

via DOJ indictment rather than OFAC designation), but the regulatory perimeter covers equivalent actors.

Downstream implications

• US financial institutions and technology companies must apply OFAC's standard

SDN-screening procedures to CYBER-designated entities; the 2022 definitions clarify which services constitute "material support" for sanctioned threat actors.

• Cybersecurity vendors, incident-response firms, and intelligence companies operating

in or near jurisdictions hosting designated cyber actors face compliance friction; the new general licences (particularly for defensive cybersecurity research and vulnerability disclosure) reduce uncertainty for the security-research community.

• The codified "50-percent rule" guidance captures corporate structures where a

sanctioned threat actor holds ≥50% ownership interest — relevant for state-linked technology firms in sanctioned jurisdictions.

• The regulatory reissuance provides the infrastructure for OFAC to expand CYBER

designations; subsequent actions targeting ransomware groups (e.g., Evil Corp, Conti affiliates) and cryptocurrency mixers used by cyber actors (Blender.io, Tornado Cash) draw on the definitional framework codified here.

Open questions

• Whether OFAC will extend the CYBER program to cover ransomware-as-a-service

operators based in jurisdictions without extradition treaties, using financial nexus as the jurisdictional hook.

• Whether EO 13694/13757 authority will be layered with the ICTS supply-chain

review regulations (Commerce/BIS) or the cyber incident reporting rules (CISA/DHS) to create a broader cyber-threat response architecture.