OFAC violations are becoming more and more commonplace. But here’s a new one and it stands out for a few reasons. First, at $24.2 million, it’s the biggest settlement with a crypto company to date. While other crypto firms have experienced OFAC violations, this single settlement is more than the entire amount collected by OFAC annually for either 2021 or 2020. Second, Bittrex is one of the oldest crypto exchanges, having been around since early 2014. And third, it demonstrates the need to anticipate regulatory expectations and a rapidly changing environment.
Background
Bittrex, a cryptocurrency exchange based in Bellevue, WA, agreed to a $24,280,829 settlement with OFAC for 116,000 violations accounting for $263 million dollars of sanctioned transactions between 2014 and 2017. In particular, Bittrex failed to prevent persons located in sanctioned regions such as the Crimea region of Ukraine, Cuba, Iran, Sudan and Syria from using its platform.
Bittrex operated for nearly two years without any sanctions controls, which is a clear requirement for any US person or entity operating a global business. It then developed and began incrementally enhancing its sanction compliance program, but didn’t realize until 2017 – when subpoenaed by OFAC – that it was only screening customers against the SDN List and not for a nexus to a sanctioned location.
This is a classic case of what happens when an early-stage company under-invests in compliance. Which may be the point, as OFAC’s Enforcement Release sends a strong message to start-ups by stating “This enforcement action emphasizes the importance of new companies and those involved in emerging technologies incorporating sanctions compliance into their business functions at the outset…” Adding insult to injury, FinCEN piled on and added another $5 million fine on top of the OFAC settlement.
The takeaway. If you haven’t yet done so, check out OFAC’s Sanctions Compliance Guidance for the Virtual Currency Industry. And, as Bittrex learned a little too late, it’s not sufficient just to screen customer names against the SDN List, as OFAC controls at times impact some or all business types with anyone based in a particular country or other location. Lastly, remember that regulators examine your actions several years after the fact. The steps you take today may save your (and your investors’) reputations and pocketbooks in the years to come.
