Matt Stankiewicz, Partner at The Volkov Law Group, joins us for a posting on sanctions compliance in the cryptocurrency industry.  He can be reached at [email protected].

On October 11, 2022, the Office of Foreign Assets Control (“OFAC”) and the Financial Crimes Enforcement Network (“FinCEN”) announced settlement agreements with Bittrex, Inc. (“Bittrex”), a cryptocurrency exchange based in Bellevue, WA. 

As part of its settlement with OFAC, Bittrex agreed to remit $24,280,829.20 to settle its civil liability.  Following its investigation, OFAC found 116,421 apparent sanctions violations in total– 13,245 violations of Crimean sanctions, 321 violations of Cuban sanctions, 94,634 violations of the Iranian sanctions program, 222 violations of the (since-repealed) Sudanese sanctions program, and 7,999 violations of Syrian sanctions.   According OFAC’s Enforcement Release, Bittrex maintained 1,730 accounts that processed those offending transactions between March 28, 2014 and December 31, 2017.  The transactions cumulatively totaled a staggering $263,451,600.13. 

OFAC’s investigation found that Bittrex had general policies and procedures that referenced sanctions as far back as August 2015.  These policies noted that U.S. Persons were generally prohibited from engaging with sanctioned parties and certain jurisdictions.  In terms of its controls to comply with these policies, however, Bittrex was found to be generally lacking.  The company began utilizing a vendor to screen customer names against the relevant sanctions lists in February 2016, however, the controls did not review individual transactions to identify potential connections to sanctioned jurisdictions.  This gap led to the numerous transactions that Bittrex failed to block.  OFAC even noted an example that Bittrex processed transactions for an Iranian citizen who self-identified as an Iranian national and even used an Iranian passport for onboarding.

Since the investigation began, Bittrex implemented a variety of controls, which earned them favor with OFAC who noted these controls comprised a mitigating factor in the enforcement action.  Among these controls, Bittrex

1. blocked all IP addresses associated with a sanctioned jurisdiction;
2. restricted the accounts of all account holders identified as being located in jurisdictions subject to OFAC sanctions;
3. began using a new software program for sanctions-related screening;
4. implemented blockchain tracing software to assist in identifying and blocking virtual currency addresses associated with persons potentially identified on OFAC’s SDN List;
5. hired a dedicated Chief Compliance Officer who reports directly to the Chief Executive Officer and the Board of Directors and otherwise substantially increased its compliance staff;
6. implemented a standalone Sanctions Compliance Policy and has undergone additional independent audits of its sanctions compliance functions; and
7. conducted additional sanctions compliance training for all relevant personnel.

For better or for worse, the cryptocurrency industry moves at staggering speed. Entire exchanges, projects, and/or protocols can rise and fall within a matter of months.  It can be hard to keep up to date with the changes and updates.  Meanwhile, this speed is in stark contrast to the speed at which these enforcement actions are issued.  This should be a a wake-up call for those in the industry.  Investigations take time to complete, regulators are very diligent in their work, and I would expect to see more enforcement actions in the coming years. Keep in mind, this enforcement action is focused on violations from more than five years ago.  The crypto industry saw an absolute whirlwind of activity in 2020 and 2021, so I would expect more than a few enforcement actions to stem from that period in the not-too-distant future. 

This enforcement action once again highlights an enhanced focus by regulators on the cryptocurrency industry.  As such, cryptocurrency programs of all shapes and sizes must take sanctions compliance seriously and implement needed policies, procedures, and controls to mitigate risks in this area.  While sanctions compliance can be difficult, cryptocurrency companies have unique tools available to them that can aid this endeavor.  The public nature of transactions on the blockchain allows for very robust transaction monitoring tools, for example. 

Finally, even if violations do occur, companies still have options to limit the damages.  Even outside of remediation, companies can work with counsel to self-disclose violations.  Here, OFAC noted that these violations were not self-disclosed by Bittrex and listed that as an aggravating factor.  Not only will self-disclosure possibly limit damages, but failure to disclose can ramp up violations once OFAC learns about a potential violation.