Matt Stankiewicz, Partner at The Volkov Law Group, continues his discussion of recent enforcement actions by OFAC and FinCEN.  He can be reached at [email protected].

In parallel with the Office of Foreign Assets Control (“OFAC”), the Financial Crimes Enforcement Network (“FinCEN”) settled with Bittrex, Inc. (“Bittrex”), a cryptocurrency exchange that allows users to trader virtual assets, for willful violations of the Bank Secrecy Act (“BSA”)’s anti-money laundering (“AML”) and suspicious activity report (“SAR”) reporting requirements.  Due to these violations, Bittrex has agreed to remit $29,280,829.20 in the settlement agreement, though will credit Bittrex’s nearly $24 million payment to OFAC in its settlement for the sanctions violations. 

Following an investigation, FinCEN found that Bittrex failed to maintain an effective AML program, as required.  Specifically, Bittrex maintained an “inadequate and ineffective” transaction monitoring system on its platform, which failed to identify suspicious transaction and exposed the platform to significant exposure to illicit finance.  Specific to the nature of its virtual asset offerings, Bittrex failed to address the risks associated with certain privacy-focused and anonymity-enhanced cryptocurrencies that were traded on the exchange. 

For years, Bittrex’s AML program and SAR reporting failures unnecessarily exposed the U.S. financial system to threat actors,” said FinCEN Acting Director Himamauli Das. “Bittrex’s failures created exposure to high-risk counterparties including sanctioned jurisdictions, darknet markets, and ransomware attackers. Virtual asset service providers are on notice that they must implement robust risk-based compliance programs and meet their BSA reporting requirements. FinCEN will not hesitate to act when it identifies willful violations of the BSA.

FinCEN determined these violations occurred between February 2014 through December 2018.  During the period of February 2014 to May 2017, Bittrex failed to file any SARs.  A significant number of these SARs included a sanctioned jurisdiction, while others included suspicious conduct “above and beyond” simply including a sanctioned jurisdiction.  For example, users of the exchange had direct transactions with various darknet marketplaces to buy and sell private data, illegal narcotics, and child pornography. 

While Bittrex has struggled more recently, during this time frame it was one of the most prominent exchanges within the United States.  As such, the company facilitated nearly 546,000,000 trades during this time period, averaging more than 20,000 transactions per day.  Bittrex offered more than 250 different cryptocurrencies for trade on its exchange, and traded over $17,000,000,000 in bitcoin transactions alone during this period. 

At a minimum, the BSA requires an effective AML program, which requires a company:

1. incorporates policies, procedures and internal controls reasonably designed to assure ongoing compliance with the BSA and its implementing regulations;
2. designates an individual responsible to assure day-to-day compliance with the MSB’s AML program and all BSA regulations;
3. provides education and/or training for appropriate personnel, including training in the detection of suspicious transactions; and
4. provides for independent review to monitor and maintain an adequate program.

Bittrex’s AML program fell well below any reasonable standard.  For example, during 2017 while the company was processing on average nearly $98 million in daily transactions, the company did not maintain a formal transaction monitoring system.  Instead, merely two employees were tasked with manually – manually!! – monitoring transactions, in addition to their other duties.  These employees also had very little AML training or experience.  Even upon hiring additional staff to continue the manual – manual!! – process, and even the expanded staff were overwhelmed with the task. The company had filed no more than a handful of SARs during much of the relevant time period here.  However, once the Internal Revenue Service (“IRS”) indicated it intended to examine the company’s BSA program, Bittrex suddenly filed 119 SARs with FinCEN within a month of that IRS notification.