Binance Holdings, Ltd. OFAC Settlement: $968.6M (2023)

Binance's algorithmic matching engines ingested incoming buy/sell orders and matched them with pending orders on Binance's orderbook solely according to price and time, without regard to user location. Although Binance developed compliance policies and publicly issued Terms of Use stating that it prohibited business with sanctioned countries, senior management deliberately chose not to enforce these controls. Numerous internal communications demonstrate that the compliance program was intentionally maintained as a "paper program."

In September 2018, the then Deputy Head of Compliance noted that "[the CEO] keeps saying that compliance is here to make Binance APPEAR COMPLIANT." The then CCO explained that Terms of Use restrictions "has to be there to protect us, [it is] protective language. In biz, ceo doesn't want to enforce." In October 2018, the then CCO informed the CEO that Binance had users from sanctioned countries on Binance.com, warning of "downside risk" if FinCEN or OFAC obtained concrete evidence.

After launching Binance.US in September 2019 to nominally redirect U.S. users, Binance continued to retain high-volume and liquidity-providing U.S. users on Binance.com. The CEO directed that popup notices for U.S. users be worded carefully "so that we let people know what they need to do, including using a VPN, without explicitly stating it." As late as July 2020, the then CCO stated that high-volume U.S. users could trade on Binance.com "on an exceptional basis." Binance also continued to allow trades by users logged in from a sanctioned jurisdiction IP address so long as they had submitted KYC documents from a non-sanctioned jurisdiction.

Between approximately August 2017 and October 2022, Binance processed 1,667,153 virtual currency transactions totaling approximately $706,068,127 in apparent violation of § 560.204 of the Iranian Transactions and Sanctions Regulations, 31 C.F.R. part 560; § 542.207 of the Syrian Sanctions Regulations, 31 C.F.R. part 542; §§ 3(a) and 7(a) of E.O. 13722 and §§ 510.206 and 510.212 of the North Korea Sanctions Regulations, 31 C.F.R. part 510; §§ 1(a)(iii) and 3(a) of E.O. 13685 and §§ 589.207 and 589.213 of the Ukraine-/Russia-Related Sanctions Regulations, 31 C.F.R. part 589; § 515.201 of the Cuban Assets Control Regulations, 31 C.F.R. part 515; §§ 1(a)(iii) and 4(a) of E.O. 14065; and Section 206(a) of the International Emergency Economic Powers Act, 50 U.S.C. § 1701 et seq. Binance identified the sanctioned jurisdiction users as located in Iran, Syria, North Korea, the Crimea Region of Ukraine, Cuba, the so-called Donetsk People's Republic, and the so-called Luhansk People's Republic.

The maximum statutory penalty amount in this case is $592,133,829,398. OFAC determined that the Apparent Violations were not voluntarily self-disclosed and were egregious. Accordingly, under OFAC's Economic Sanctions Enforcement Guidelines, 31 C.F.R. part 501, app. A, the base penalty for the Apparent Violations equals the statutory maximum.

The settlement amount of $968,618,825 reflects OFAC's consideration of the General Factors under the Enforcement Guidelines, Binance's agreement to retain an Independent Compliance Monitor for a five-year term, and Binance's concurrent settlements with DOJ, FinCEN, and the CFTC. Of the total settlement amount, $898,618,825 shall be deemed satisfied by Binance's payment to DOJ for ITSR violations arising out of the same pattern of conduct during the same period of time. The Settlement Agreement also provides that if OFAC determines a material breach of, or misrepresentation in, the agreement has occurred, OFAC may seek to impose an additional penalty up to the statutory maximum.

OFAC took this action concurrently with the Department of Justice, FinCEN, and the Commodity Futures Trading Commission. As part of a global resolution, Binance entered into separate settlements with each agency. Binance's obligation to pay $898,618,825 of the $968,618,825 OFAC settlement amount shall be deemed satisfied by its payment to DOJ for ITSR violations arising out of the same pattern of conduct during the same period of time. Pursuant to the comprehensive settlement, Binance also undertook to pay substantial additional penalties to FinCEN and the CFTC and to undertake other significant remedial measures.

OFAC's Sanctions Compliance for the Virtual Currency Industry establishes management commitment as the first pillar of an effective, risk-based compliance program. This commitment should come from the top and begin on "Day One," even as a company may still be establishing itself and developing its technologies and offerings. Such a commitment should be backed by resources adequate to address a company's risks. Compliance personnel must be empowered and receive the backing and authority necessary to effectively fulfill their function. A culture of compliance, where senior management is invested in and supports an organization's program and allows it to operate effectively and without undue interference, is essential to avoid committing violations of OFAC sanctions.

Compliance controls should also be incorporated into a company's platforms and systems, through KYC protocols, transaction monitoring, sanctions screening, algorithmic configurations, and other controls as appropriate. It is no defense that an algorithm or other "autonomous" system or formula serves as the mechanism for the underlying transactions or activities that violate sanctions; companies are responsible for the operation and consequences of the technologies they employ and will be held accountable where their technologies result in violations.

Virtual currency exchanges based outside the United States that conduct business with U.S. persons or within the United States must take care that their activities do not cause U.S. persons to violate U.S. economic sanctions or result in the exportation, reexportation, sale, or supply, directly or indirectly, of goods, services, or technology from the United States to sanctioned jurisdictions or blocked persons. Foreign entities that conduct business in the United States or with U.S. persons should not avail themselves of U.S. customers, goods, technology, and services, without instituting controls to maintain adherence to U.S. economic sanctions and other U.S. laws.

This page summarizes an OFAC enforcement case based on the document archived below. SanctionsLookup assumes no liability for errors, omissions, or inaccuracies in the original documents, this summary, or any changes made to the source documents at any time.

Provided for informational purposes only and does not constitute legal or compliance advice. Always consult the source document directly rather than relying on this summary.