OFAC settles with Bittrex, Inc., for $24+ million

OFAC has agreed to accept from Bittrex, Inc., a private company based in Bellevue, Washington, that provides an online virtual currency exchange and hosted wallet services, a payment of $20,280,829.20 to settle Bittrex's potential civil liability for 116,421 apparent violations of multiple sanctions programs. As a result of deficiencies related to Bittrex’s sanctions compliance procedures, Bittrex failed to prevent persons apparently located in the Crimea region of Ukraine, Cuba, Iran, Sudan, and Syria from using its platform to engage in approximately $263,451,600.13 worth of virtual currency-related transactions.

The applicable sanctions programs generally prohibited U.S. persons from engaging in transactions with these jurisdictions. Based on internet protocol (“IP”) address information and physical address information collected about each customer at onboarding, Bittrex had reason to know that these users were in jurisdictions subject to sanctions. At the time of the transactions, however, Bittrex was not screening this customer information for terms associated with sanctioned jurisdictions.

The settlement amount reflects OFAC’s determination that Bittrex’s apparent violations were not voluntarily self-disclosed and were not egregious.

Bittrex started offering its virtual currency services in March 2014, but it had no sanctions compliance program in place until December 2015, when it began verifying customer identity.
In February 2016, Bittrex went a step further and retained a third-party vendor for sanctions screening purposes, but the screening was incomplete. Until October 2017, the vendor screened transactions only for hits against OFAC’s List of Specially Designated Nationals and Blocked Persons (the “SDN List”) and other lists but did not scrutinize customers or transactions for a nexus to sanctioned jurisdictions.

Only after OFAC issued Bittrex a subpoena in October 2017 to investigate potential sanctions violations did Bittrex realize that the vendor was not scrutinizing whether customers were in a sanctioned jurisdiction and begin restricting accounts and screening IP and other addresses associated with sanctioned locations.

Bittrex subsequently implemented a number of other remedial measures, including implementing new sanctions screening and blockchain tracing software, conducting additional sanctions compliance training, and hiring additional compliance staff. Once implemented, these remedial measures substantially curtailed the number of Apparent Violations.
Bittrex’s compliance deficiencies resulted in 13,245 apparent violations of Section 1(a)(iii) of Executive Order 13685 of December 19, 2014, “Blocking Property of Certain Persons and Prohibiting Certain Transactions with Respect to the Crimea Region of Ukraine”; 321 apparent violations of the Cuban Assets Control Regulations, 31 C.F.R. §515.201; 94,634 apparent violations of the Iranian Transactions and Sanctions Regulations, 31 C.F.R. §560.204; 222 apparent violations of the now-repealed Sudanese Sanctions Regulations (SSR), 31 C.F.R. §538.205; and 7,999 apparent violations of the Syrian Sanctions Regulations, 31 C.F.R. §542.207.

The statutory maximum civil monetary penalty applicable in this matter is $35,773,364,108.57. OFAC determined that the Apparent Violations were not voluntarily self-disclosed and were non-egregious. Accordingly, under OFAC’s Economic Sanctions Enforcement Guidelines (“Enforcement Guidelines”), the base civil monetary penalty amount applicable in this matter equals the applicable schedule amount, which is $485,616,584.00. The settlement amount of $24,280,829.20 reflects OFAC’s consideration of the General Factors under the Enforcement Guidelines.

OFAC's action was part of a global settlement agreement with Bittrex that also involved FinCEN. Read about FinCEN's consent order for a civil money penalty HERE.