The Treasury Department’s Office of Foreign Asset Control started off the new year with an interesting enforcement action against Airbnb Payments, Inc. (“Airbnb”), a money service business subsidiary of Airbnb, Inc. Airbnb agreed to pay $91,172.29 for violations of OFAC’s Cuban Sanctions Program. 

Airbnb discovered the violations as a result of a proactive forensic review that was approved by OFAC.  Given the number of records and the size of the data, Airbnb conducted statistically significant sampling of “Stays” (traveler lodging provided by Airbnb Hosts) and “Experiences” for transactions involving Cuba.  This sampling plan was approved by OFAC as a reasonable way to evaluate overall compliance with Cuba sanctions relating to Airbnb’s business.  Airbnb extrapolated the results of the sampling review to the total number of transactions processed by Airbnb between September 28, 2015, and March 1, 2020.

Airbnb voluntarily reported to OFAC the results of its review and lookback and implemented remedial measures to strengthen its sanctions compliance program. Airbnb fully cooperated with OFAC, including by responding to multiple requests for information and agreeing to toll the statute of limitations.

Based on this sampling process, Airbnb determined that it processed payments related to 3,464 Stays transactions in Cuba by Airbnb guests traveling for reasons outside the 12 authorized categories under OFAC regulations. The extrapolated average transaction amount for each Stay was $139.52.  Airbnb also processed payments related to 3,076 extrapolated Experiences transactions where Airbnb failed to keep records in accordance with OFAC’s regulations.  The extrapolated average transaction amount processed for each such Experience was $78.40.

Airbnb processed 44 confirmed transactions for Cuba travel transactions involving non-U.S. persons prior to OFAC issuing a license to cover such conduct.  The average transaction amount for those transactions was $111.09.

Airbnb launched its Cuba business in April 2015 without addressing the complexities of operating in Cuba and complying with the Cuba-related sanctions compliance program for internet-based travel services.  Airbnb failed to appreciate the risks of operating in Cuba in compliance with OFAC’s regulations and did not implement appropriate controls tailored to those risks.

When Airbnb initially launched its Cuba service, it used a manual process to screen Hosts and Guests for potential sanctions issues until it was able to implement an Internet Protocol blocking system that permitted Cubans from acting as Hosts but prohibited Cubans from transacting as Guests on the platform.  With respect to the Experiences transactions, Airbnb failed to implement functionality for Guests to attest to the reason for travel to Cuba.

Airbnb’s remedial measures included: (1) implementation of an IP blocking system; (2) collection of country of residence and payment instrument information to confirm whether users are residents or citizens of Cuba; (3) screening of Hosts in Cuba to ensure that no Hosts are Cuban government officials or communist party members, and also manual checks to ensure that no listings are associated with the Cuba Restricted List; and (4) requiring Guests and Hosts to implement appropriate compliance certifications. 

OFAC stated that this enforcement action underscored the risks associated with entering new commercial, high-risk markets, and the need to anticipate the legal and compliance risks and need for compliance controls.  OFAC noted that these risks are particularly high for internet-based businesses.