Venmo is probably just following what banks and other fintech companies are doing already. They don't even have to write anything themselves, there are commonly used third-party OFAC services like LexisNexis where you throw your transaction data over the wall, they come back with the verdict, you then just follow instructions and cross compliance off your list of things to worry about.