The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) and Financial Crimes Enforcement Network (FinCEN) announced settlements for over $24 million and $29 million, respectively, with Bittrex, a virtual currency exchange based in Bellevue, Washington.

This is OFAC’s largest virtual currency enforcement action to date. It also represents the first parallel enforcement actions by FinCEN and OFAC in this space.

Investigations by OFAC and FinCEN found apparent violations of multiple sanctions programs and willful violations of the Bank Secrecy Act’s (BSA’s) anti-money laundering (AML) and suspicious activity report (SAR) reporting requirements. These enforcement actions emphasize to the virtual currency industry the importance of implementing appropriate risk-based sanctions compliance controls and meeting obligations under the BSA. The failure to take action can result in violations of OFAC and FinCEN regulations and expose exchanges and others in the virtual currency industry to potential abuse by illicit actors.

OFAC Director Andrea Gacki said:

“When virtual currency firms fail to implement effective sanctions compliance controls, including screening customers located in sanctioned jurisdictions, they can become a vehicle for illicit actors that threaten U.S national security. Virtual currency exchanges operating worldwide should understand both who—and where—their customers are. OFAC will continue to hold accountable firms, in the virtual currency industry and elsewhere, whose failure to implement appropriate controls leads to sanctions violations.”

FinCEN Acting Director Himamauli Das added:

“For years, Bittrex’s AML program and SAR reporting failures unnecessarily exposed the U.S. financial system to threat actors. Bittrex’s failures created exposure to high-risk counterparties including sanctioned jurisdictions, darknet markets, and ransomware attackers. Virtual asset service providers are on notice that they must implement robust risk-based compliance programs and meet their BSA reporting requirements. FinCEN will not hesitate to act when it identifies willful violations of the BSA.”

Bittrex has agreed to remit $24,280,829.20 to OFAC to settle its potential civil liability for 116,421 apparent violations of multiple sanctions programs. As a result of deficiencies related to Bittrex’s sanctions compliance procedures, Bittrex failed to prevent persons apparently located in the Crimea region of Ukraine, Cuba, Iran, Sudan, and Syria from using its platform to engage in approximately $263,451,600.13 worth of virtual currency-related transactions between March 2014 and December 2017.

The applicable sanctions programs generally prohibited U.S. persons from engaging in transactions with these jurisdictions. Based on internet protocol (“IP”) address information and physical address information collected about each customer at onboarding, Bittrex had reason to know that these users were located in jurisdictions subject to sanctions. At the time of the transactions, however, Bittrex was not screening this customer information for terms associated with sanctioned jurisdictions. This information was not voluntarily self-disclosed.

In addition to the OFAC settlement, Bittrex has agreed to remit $29,280,829.20 for its willful violations of the BSA’s AML program and SAR requirements. FinCEN will credit the payment of $24,280,829.20 as part of Bittrex’s agreement to settle its potential liability with OFAC.

FinCEN’s investigation found that, from February 2014 through December 2018, Bittrex failed to maintain an effective AML program. This included deploying inadequate and ineffective transaction monitoring on its platform resulting in significant exposure to illicit finance. Further, Bittrex’s AML program failed to appropriately address the risks associated with the products and services it offered, including anonymity-enhanced cryptocurrencies. Bittrex failed to file any SARs between February 2014 and May 2017, a period of over three years. Bittrex also failed to file SARs on a significant number of transactions involving sanctioned jurisdictions, including transactions that were suspicious above and beyond the fact that they involved a sanctioned jurisdiction.