Payward, Inc. settles with OFAC

Payward, Inc., d/b/a "Kraken," a Delaware-incorporated virtual currency exchange with operations in the United States and elsewhere, has agreed to pay OFAC $362,158.70 to settle its potential civil liability for apparent violations of the Iranian Transactions and Sanctions Regulations. As part of its settlement with OFAC, Kraken also has agreed to invest an additional $100,000 in certain sanctions compliance controls.

Due to Kraken’s failure to timely implement appropriate geolocation tools, including an automated internet protocol (IP) address blocking system, Kraken exported services to users who appeared to be in Iran when they engaged in virtual currency transactions on Kraken’s platform. The settlement amount reflects OFAC’s determination that Kraken’s apparent violations were non-egregious and voluntarily self-disclosed.

Kraken maintained an anti-money laundering and sanctions compliance program, which included screening customers at onboarding and daily thereafter, as well as review of IP address information generated at the time of onboarding to prevent users in sanctioned jurisdictions from opening accounts. However, despite these controls, between approximately October 14, 2015 and June 29, 2019, Kraken processed 826 transactions, totaling approximately $1,680,577.10, on behalf of individuals who appeared to have been located in Iran at the time of the transactions.

Although Kraken maintained controls intended to prevent users from initially opening an account while in a jurisdiction subject to sanctions, at the time of the apparent violations, Kraken did not implement IP address blocking on transactional activity across its platform. According to IP address data, account holders who established their accounts outside of sanctioned jurisdictions appear to have accessed their accounts and transacted on Kraken’s platform from a sanctioned
jurisdiction.

As a result of the foregoing, Kraken engaged in 826 apparent violations of the Iranian Transactions and Sanctions Regulations, 31 C.F.R. § 560.204 (the “Apparent Violations”).

After identifying this problem, Kraken implemented automated blocking for IP addresses linked to sanctioned jurisdictions. Kraken also implemented multiple blockchain analytics tools to assist with its sanctions monitoring.

The statutory maximum civil monetary penalty applicable in this matter is $272,228,964. OFAC determined that Kraken self-disclosed the Apparent Violations and that the Apparent Violations constitute a non-egregious case. Accordingly, under OFAC’s Economic Sanctions Enforcement Guidelines (“Enforcement Guidelines”), 31 C.F.R. part 501, app. A, the base civil monetary penalty applicable in this matter equals the sum of one-half of the transaction value for each Apparent Violation, which is $840,288.55.

The settlement amount of $362,158.70 reflects OFAC’s consideration of the General Factors under the Enforcement Guidelines. Moreover, Kraken and OFAC have agreed that Kraken will spend an additional $100,000 to invest in certain additional sanctions compliance controls, including training and technical measures to assist in sanctions screening.