Bittrex, Inc. OFAC Settlement: $24.3M (2022)

Between predominately March 28, 2014 and December 31, 2017, Bittrex operated 1,730 accounts that processed 116,421 virtual currency-related transactions totaling approximately $263,451,600.13 in apparent violation of multiple OFAC-administered sanctions programs. Bittrex's policies and procedures dating back as far as August 2015 demonstrated that the company had some understanding of OFAC sanctions regulations, including knowledge that OFAC generally prohibits U.S. persons from engaging in activity with sanctioned jurisdictions. However, Bittrex had no internal controls in place until October 2017 to screen customers or transactions for a nexus to sanctioned jurisdictions. Bittrex did not, for example, screen IP address information that indicated the customer was in a sanctioned location or physical address information provided by the customer, such as an Iranian passport or a customer who self-identified at account opening as being in Iran.

Bittrex started offering its virtual currency services in March 2014 but had no sanctions compliance program in place until December 2015, when it began verifying customer identity. In February 2016, Bittrex retained a third-party vendor for sanctions screening purposes, but the screening was incomplete. Until October 2017, the vendor screened transactions only for hits against OFAC's List of Specially Designated Nationals and Blocked Persons and other lists but did not scrutinize customers or transactions for a nexus to sanctioned jurisdictions. Only after OFAC issued Bittrex a subpoena in October 2017 to investigate potential sanctions violations did Bittrex realize that the vendor was not scrutinizing whether customers were in a sanctioned jurisdiction and begin restricting accounts and screening IP and other addresses associated with sanctioned locations.

Bittrex's compliance deficiencies resulted in 13,245 apparent violations of Section 1(a)(iii) of Executive Order 13685 of December 19, 2014; 321 apparent violations of the Cuban Assets Control Regulations, 31 C.F.R. §515.201; 94,634 apparent violations of the Iranian Transactions and Sanctions Regulations, 31 C.F.R. §560.204; 222 apparent violations of the now-repealed Sudanese Sanctions Regulations, 31 C.F.R. §538.205; and 7,999 apparent violations of the Syrian Sanctions Regulations, 31 C.F.R. §542.207.

The statutory maximum civil monetary penalty applicable in this matter is $35,773,364,108.57. OFAC determined that the apparent violations were not voluntarily self-disclosed and were non-egregious. Accordingly, under OFAC's Economic Sanctions Enforcement Guidelines, the base civil monetary penalty amount applicable in this matter equals the applicable schedule amount, which is $485,616,584.00. The settlement amount of $24,280,829.20 reflects OFAC's consideration of the general factors under the Enforcement Guidelines.

This action highlights that virtual currency companies, like all financial service providers, are responsible for ensuring that they do not engage in unauthorized transactions prohibited by OFAC sanctions, such as engaging in prohibited transactions with jurisdictions subject to sanctions. To mitigate such risks, virtual currency companies should develop a tailored, risk-based sanctions compliance program. An adequate compliance solution will depend on a variety of factors, including the type of business involved, its size and sophistication, products and services offered, customers and counterparties, and geographic locations served, but should incorporate at least five essential components of compliance: (1) management commitment; (2) risk assessment; (3) internal controls; (4) testing and auditing; and (5) training.

This enforcement action emphasizes the importance of new companies and those involved in emerging technologies incorporating sanctions compliance into their business functions at the outset, especially when the companies seek to offer financial services to a global customer base. Companies should ensure that their sanctions compliance service providers are providing services commensurate with the institution's sanctions compliance risk. When providing services globally, screening for location information, especially when available through IP addresses and information provided by customers (such as passports or when a customer self-identifies as being from a particular country), is particularly important in mitigating the risk of providing services to individuals in jurisdictions subject to sanctions. This case also highlights the value of a company quickly implementing remedial measures after becoming aware of a potential sanctions issue.

This page summarizes an OFAC enforcement case based on the document archived below. SanctionsLookup assumes no liability for errors, omissions, or inaccuracies in the original documents, this summary, or any changes made to the source documents at any time.

Provided for informational purposes only and does not constitute legal or compliance advice. Always consult the source document directly rather than relying on this summary.