On November 28, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced a $362,158.70 settlement with Payward, Inc. d/b/a Kraken. The Delaware-incorporated virtual currency exchange allegedly processed 826 transactions amounting to approximately $1.7 million on behalf of individuals located in Iran. In addition to the fine, Kraken also has agreed to invest an additional $100,000 in certain sanctions compliance controls. The applicable statutory maximum penalty was $272 million, but because Kraken self-reported the sanctions violations along with mitigating factors, OFAC considered it a “non-egregious case.”

While OFAC determined that “Kraken failed to exercise due caution or care for its sanctions compliance obligations when, knowing it had customers worldwide, it applied its geolocation controls only at the time of onboarding and not with subsequent transactional activity, despite having reason to know based on available IP address information that transactions appear to have been conducted from Iran,” it determined the following to be mitigating factors:

• Kraken had not received a penalty notice or finding of violation from OFAC in the five years preceding the transactions at issue;
• Kraken voluntarily disclosed the apparent violations and cooperated with OFAC’s investigation;
• Kraken took significant remedial measures in response to the apparent violations, including;
  • Adding geolocation blocking to prevent clients in prohibited locations from accessing their accounts on Kraken’s website;
  • Implementing multiple blockchain analysis tools to assist with sanctions monitoring;
  • Investing in additional compliance-related training for its staff;
  • Hiring a dedicated head of sanctions to direct Kraken’s compliance program; and
  • Contracting with a vendor that assists with identification and nationality verification by using artificial intelligence tools to detect potential issues with supporting credentials provided by users.

OFAC’s Enforcement Release concluded by noting, “this case highlights the importance of using geolocation tools, including IP blocking and other location verification tools, to identify and prevent users located in sanctioned jurisdictions from engaging in prohibited virtual currency-related transactions. In particular, limiting the use of such controls only to the time of account opening — and not throughout the lifetime of the account or with respect to subsequent transactions — court present sanctions risks to virtual currency-related companies.”