The U.S. Treasury Department’s Financial Crimes Enforcement Network (FinCEN) and Office of Foreign Assets Control (OFAC) announced yesterday that they had reached settlements for over $24 million and $29 million, respectively, with Bittrex, Inc., a U.S.-based cryptocurrency exchange, for Bank Secrecy Act (BSA) and sanctions violations.
FinCEN and OFAC have both targeted cryptocurrency platforms in the past, but this action marks the first time the two agencies have worked together in bringing parallel enforcement actions relating to cryptocurrency activity. FinCEN and OFAC have distinct but conceptually overlapping missions: FinCEN is the primary regulator of money transmitters on the federal level, while OFAC administers and enforces U.S. economic and trade sanctions.
According to FinCEN’s order against Bittrex, the agency found that the cryptocurrency exchange willfully violated the BSA and FinCEN’s implementing regulations. In particular, from February 2014 through December 2018, Bittrex failed to maintain an effective anti-money laundering (AML) program, including with respect to anonymity-enhanced cryptocurrencies (AECs).
The agency noted that while the exchange platform averaged over 11,000 transactions per day in 2016 (with a daily value of approximately $1.54 million), the company did not utilize widely available transaction-monitoring software tools, instead relying on as few as two employees with minimal AML training and experience to review the transactions for suspicious activity. In 2017, the exchange averaged 23,800 transactions per day (with a daily value of approximately $97.9 million), yet the company continued to rely on the same two employees to manually review all transactions. FinCEN’s investigation also found that Bittrex failed to file a single suspicious activity report (SAR), as required under the BSA, from 2014 through May 2017. These and other AML program deficiencies, including failing to detect thousands of transactions that were prohibited by OFAC and failing to fully address the risks associated with AECs for which it was impossible to disable privacy-enhancing features, led FinCEN to conclude the violations were willful and subject to civil monetary penalties.
Relatedly, OFAC determined that Bittrex had failed to prevent persons located in sanctioned jurisdictions (including Iran, Sudan, Syria, Cuba, and the Crimea region of Ukraine) from using its platform. According to OFAC’s order, persons located in sanctioned jurisdictions engaged in over 116,000 transactions, valued at more than $263 million, in virtual currency-related transactions between March 2014 and December 2017.
Bittrex has agreed to remit approximately $24 million to OFAC to settle its potential civil liability for its violations of the sanctions programs. Bittrex has also agreed to remit $29 million for its willful violations of the BSA’s AML program and SAR requirements. However, FinCEN will credit Bittrex’s $24 million payment to OFAC against its settlement liability.
This action represents the largest penalty levied by OFAC in this space, and signals a more aggressive push by federal agencies to ensure cryptocurrency platforms are complying with their AML and sanctions obligations. Cryptocurrency exchanges like Bittrex, and other money transmitters in the crypto industry, should view Bittrex as a cautionary tale and take immediate stock of its AML program to avoid a similar fate.
