OFAC Fines Currency Exchange Kraken for Iranian Sanctions Violations

The Treasury Department fined U.S. crypto exchange Kraken $362,158.70 for violating U.S. sanctions against Iran, the agency said this week. Treasury’s Office of Foreign Assets Control said Kraken, also known as Payward, exported services to users who “appeared to be” in Iran and allows them to conduct virtual currency transactions on Kraken’s platform. The violations stemmed from Kraken’s "failure to timely implement appropriate geolocation tools, including an automated [internet protocol] address blocking system," OFAC said.

OFAC said Kraken had an anti-money laundering and sanctions compliance program, which included screening customers and reviews of IP address information during onboarding to prevent users in sanctioned jurisdictions from opening accounts. But the company didn’t “implement IP address blocking on transactional activity across its platform,” allowing account holders who established their accounts outside of sanctioned jurisdictions to access the platform from sanctioned jurisdictions at later dates.

Between October 2015 and June 2019, Kraken processed 826 transactions, totaling about $1,680,577.10, on behalf of people who appeared to have been located in Iran at the time of the transactions, OFAC said. After identifying this problem, Kraken implemented automated blocking for IP addresses linked to sanctioned jurisdictions. Kraken also implemented multiple blockchain analytics tools to assist with its sanctions monitoring, OFAC said.

OFAC said the maximum civil monetary penalty was more than $272 million, but the agency settled on a lower amount due to a range of mitigating factors, including that the violations were voluntarily self-disclosed. Other mitigating factors were that Kraken had not received a penalty notice from OFAC in the previous five years, the company cooperated with OFAC's investigation and it undertook "significant remedial measures," including agreeing to invest an additional $100,000 in more sanctions compliance controls.

Kraken also added geolocation blocking to “prevent clients in prohibited locations from accessing their accounts on Kraken’s website,” invested in more compliance training for its staff and hired a “dedicated head of sanctions” to lead its compliance program. The company also expanded its contract with its screening provider to make sure it complies with OFAC’s 50% rule, and hired another vendor to help with “identification and nationality verification.”

OFAC also pointed to an aggravating factor. It said Kraken failed to exercise "due caution or care for its sanctions compliance obligations" when, knowing it had customers worldwide, it applied its geolocation controls only at the time of onboarding. OFAC said Kraken did this “despite having reason to know based on available IP address information that transactions appear to have been conducted from Iran.”

The agency said the settlement highlights the importance of an “adequate sanctions compliance program” for companies in the virtual currency industry. The compliance program will depend on the “type of business involved, its size and sophistication, products and services offered, customers and counterparties, and geographic locations served,” OFAC said.

OFAC also stressed the importance of geolocation tools, including IP blocking and other location verification tools, to prevent users in sanctioned regions from using certain services. "In particular, limiting the use of such controls only to the time of account opening -- and not throughout the lifetime of the account or with respect to subsequent transactions -- could present sanctions risks to virtual currency-related companies,” OFAC said. Companies should also implement “robust remedial measures after becoming aware of a potential sanctions issue,” the agency said, “as well as committing to future sanctions compliance investments.”

Kraken is "pleased to have resolved this matter," said Marco Santori, the company's chief legal officer. Santori said the company had been improving its sanctions compliance procedures, including "further strengthening control systems, expanding our compliance team and enhancing training and accountability," before agreeing to the settlement. "With these enhanced systems in place," the company is in "a stronger position to continue our mission of accelerating the adoption of cryptocurrency," he said.