CoinList Markets LLC OFAC Settlement: $1.2M (2023)

CLM allows users to buy, sell, and otherwise trade in crypto tokens and other crypto assets, acting primarily as an intermediary. During onboarding, individuals must provide their country of residence, address, date of birth, phone number, selfie picture, and a photo of government-issued identification. Entities must provide incorporation documents, country of incorporation, company address, shareholder information, and signatory details.

During the relevant period, CLM maintained several sanctions compliance measures, including screening customers against OFAC and other sanctions lists, transactional monitoring, and blockchain analytics tools to identify touchpoints with high-risk jurisdictions and sanctioned wallet addresses. Beginning in February 2021, CLM instituted controls to deny access to users with IP addresses in sanctioned jurisdictions. By spring 2021, CLM's onboarding protocols also included an automated process to immediately reject applications from users presenting identification from, or providing a physical address in, a comprehensively sanctioned jurisdiction.

CLM's screening procedures nonetheless failed to capture users who represented themselves as resident of a non-embargoed country but provided an address within Crimea. CLM opened 89 accounts for customers who specified "Russia" as their country of residence while providing addresses in Crimea — identifying a city in Crimea or the term "Crimea" in a separate data field. Because "Russia" appeared in the country-of-residence field, CLM's screening protocols did not recognize the Crimean references in the address field as indicating likely Crimea residence.

In providing financial services to these users between April 19, 2020 and May 7, 2022, CLM engaged in 989 apparent violations of the Ukraine-/Russia-Related Sanctions Regulations (URRSR), 31 C.F.R. § 589.207, totaling $1,252,280.

The statutory maximum civil monetary penalty applicable in this matter is $327,306,583. OFAC determined that the apparent violations were not voluntarily self-disclosed and were non-egregious. Accordingly, under OFAC's Economic Sanctions Enforcement Guidelines, the base civil monetary penalty amount equals the applicable schedule amount of $3,097,000. The settlement amount of $1,207,830 reflects OFAC's consideration of the General Factors under the Enforcement Guidelines.

In view of the individual facts of this case, including CLM's financial circumstances, $300,000 of the settlement amount will be suspended pending satisfactory completion of CLM's compliance commitments as agreed to by CLM as part of this settlement. As partial satisfaction of the settlement amount, CLM has also agreed to invest $300,000 in additional sanctions compliance controls, including enhanced screening controls and additional compliance staff.

This case highlights the importance of integrating all available KYC and other relevant information into a company's screening process and broader compliance function. Certain firms providing virtual currency services have failed to ensure that their screening processes and broader compliance programs adequately incorporate customer information gathered from the onboarding process or through transactional information (such as IP location information). Ensuring that such data is gathered and employed using a risk-based approach is important to mitigate the risk of providing services to persons in sanctioned jurisdictions.

This enforcement action further emphasizes the importance for virtual currency companies and those involved in emerging technologies to incorporate risk-based sanctions compliance into their business functions, especially when the companies seek to offer financial services to a global customer base. An appropriate compliance program for members of the virtual currency industry will depend on a variety of factors, including the type of business involved, its size and sophistication, products and services offered, customers and counterparties, and geographic locations served. It should be predicated on and incorporate five essential components of compliance: (1) management commitment; (2) risk assessment; (3) internal controls; (4) testing and auditing; and (5) training. Members of the virtual currency and emerging technologies industries should incorporate sanctions compliance considerations at the development and beta testing stages. Delaying development and implementation of a sanctions compliance program can expose companies to a wide variety of potential sanctions risks.

This page summarizes an OFAC enforcement case based on the document archived below. SanctionsLookup assumes no liability for errors, omissions, or inaccuracies in the original documents, this summary, or any changes made to the source documents at any time.

Provided for informational purposes only and does not constitute legal or compliance advice. Always consult the source document directly rather than relying on this summary.