OFAC Settles Sanctions Case Against Crypto Payments Processor BitPay
2 min read
BitPay enabled individuals in sanctioned jurisdictions to engage in approximately $129,000 worth of digital currency-related transactions with its merchant customers over five years.
BitPay, a US provider of cryptocurrency-based payment services, has agreed to settle 2,102 apparent sanctions violations with OFAC (Office of Foreign Assets Control) for USD 507,375.
According to OFAC’s enforcement notice, BitPay violated sanctions regulations by allowing individuals in sanctioned jurisdictions – Crimea, Cuba, North Korea, Iran, Sudan and Syria – to transact with merchants using digital currency despite having access to their location data prior to effecting the transactions.
Through its payments processing service, Bitpay enabled individuals in sanctioned jurisdictions to engage in approximately USD 129,000 worth of digital currency-related transactions with its merchant customers from June 2013 and September 2018.
OFAC said BitPay screened its direct customers, the merchants, against sanctions lists and conducted due diligence on them to ensure they were not located in sanctioned jurisdictions, but that it failed to screen buyers against identification and location data in the transaction review process. The data BitPay had available included buyers’ names, addresses, email addresses, phone numbers and IP addresses.
OFAC concluded that BitPay failed to exercise due caution or care for its sanctions compliance obligations and harmed the integrity of those sanctions programmes, though it noted that the company has since improved its processes.
BitPay implemented sanctions compliance controls since 2013 and formalised its sanctions compliance programme in 2014. The company has also provided training to all employees making clear that merchant sign-ups from sanctioned jurisdictions as well as transactions with sanctioned individuals and entities are prohibited.
OFAC said BitPay has also represented that it has terminated the conduct that led to the apparent sanctions violations and undertook several measures intended to minimise the risk of future recurrence.
These measures include blocking IP addresses that appear to originate in sanctioned jurisdictions, checking physical and email addresses of buyers when provided by merchants, and launching a new customer identification tool known as “BitPay ID” which requires customers to provide proof of identification and a selfie photo.
The enforcement notice is available here.
OFAC reached a similar settlement with digital wallet provider BitGo at the end of 2020 for USD 98,830.
As part of a risk-based approach, OFAC encourages companies that provide digital currency services to implement sanctions compliance controls commensurate with their risk profile.
