Settlement Agreement with Bittrex, Inc.

Today, on October 11, 2022, the Office of Foreign Assets Control (OFAC) announced a $24,280,829.20 settlement agreement with Bittrex, Inc., an online virtual currency exchange and hosted wallet service provider, in connection with 116,421 apparent violations of multiple sanctions programs. This enforcement action highlights the OFAC compliance risks for virtual currency platforms. So, assess your risks and take steps to make sure you’re addressing them with smart compliance and screening measures.

Background

Bittrex began offering its virtual currency services in March 2014, but had no sanctions compliance program in place until December 2015. On February 2016, Bittrex retained a third-party vendor for sanctions screening purposes but the screening was apparently incomplete. The screening only looked for hits against OFAC’s List of Specially Designated Nationals and Blocked Persons (the “SDN List”) and other lists but did not scrutinize customers or transactions for a nexus to sanctioned jurisdictions. After receiving a subpoena, Bittrex realized that the vendor was not appropriately identifying whether customers were located in sanctioned jurisdictions. Bittrex began restricting accounts and screening IP and other addresses associated with sanctioned locations. The company also added new sanctions screening and blockchain tracing software, conducted additional sanctions compliance training, and hired additional compliance staff. (We have discussed related OFAC guidance and compliance recommendations here!)

The Bittrex settlement also comes on the heels of published guidance for instant payment systems, which OFAC issued on September 30, 2022. It is clear that OFAC is focused on emerging payment technologies and raising awareness about the spectrum of related risks.

Key Takeaways

• Compliance, Compliance, Compliance: Sanctions compliance should be top of mind for the virtual currency industry. Bittrex operated with no sanctions compliance program for nearly two years (from March 2014 until February 2016) after beginning to offer virtual currency services, which OFAC determined to be an aggravating factor. Companies should integrate sanctions compliance into their overall compliance infrastructure as soon as practicable, and the good news is that there are a lot of smart tools that can support your compliance team. We expect OFAC to continue its enforcement of the virtual currency industry.

• The Importance of Smart Screening Tools: As we have noted, companies should screen for IP addresses that originate in sanctioned jurisdictions and block any users there. More importantly, in addition to geolocation tools, there are other technologies that can help in the screening process. Technology companies are often looking for technological solutions that support their compliance efforts. There are a number of options out there that serve as a piece of the compliance-best-practices puzzle.
• When Discovering an Issue, Quickly Remediate: Whenever there are potential violations, it is critical for companies to quickly identify and take appropriate corrective actions. After identifying compliance issues, Bittrex blocked all IP addresses associated with sanctioned jurisdictions, restricted the accounts of all account holders identified as being located in jurisdictions subject to OFAC sanctions, used a new software screening program, implemented blockchain tracing software to assist in identifying and blocking virtual currency addresses associated with persons potentially identified on OFAC’s SDN List. OFAC deemed the corrective actions as a mitigating factor in its penalty calculation.