OFAC Settles with Digital Currency Payment Processor BitPay for Violations of Sanctions Programs | Practical Law

OFAC Settles with Digital Currency Payment Processor BitPay for Violations of Sanctions Programs | Practical Law

OFAC announced a settlement with BitPay, Inc., for apparent violations of multiple US Office of Foreign Assets Control (OFAC) sanctions programs related to BitPay transactions in digital currency.

OFAC Settles with Digital Currency Payment Processor BitPay for Violations of Sanctions Programs

by Practical Law Finance
Published on 24 Feb 2021 • USA (National/Federal)
OFAC announced a settlement with BitPay, Inc., for apparent violations of multiple US Office of Foreign Assets Control (OFAC) sanctions programs related to BitPay transactions in digital currency.
On February 18, 2021, the US Office of Foreign Assets Control (OFAC) announced a settlement with BitPay, Inc., a private company based in Atlanta, GA, for violation of multiple OFAC sanctions programs by:
  • Receiving digital currency payments on behalf of its customers from buyers who were located in sanctioned jurisdictions.
  • Converting the digital currency into fiat currency.
  • Relaying that currency to merchants.
BitPay offers payment processing solutions for merchants to accept digital currency as payment for goods and services. OFAC alleged that between June 2013 and September 2018, BitPay processed 2,102 transactions on behalf of individuals who, based on IP addresses and information available in invoices, were located in sanctioned jurisdictions.
Although BitPay screened its direct customers and conducted due diligence to ensure they were not located in sanctioned jurisdictions, BitPay failed to screen location data that it obtained about its merchants' buyers. Therefore, OFAC alleged that BitPay conveyed a total of $128,582.61 in economic benefit to individuals in the sanctioned jurisdictions of the Crimea region of Ukraine (Crimea), Cuba, North Korea, Iran, Sudan, and Syria. BitPay agreed to remit $507,375 to settle its potential civil liability.
OFAC cited the following mitigating factors and credited BitPay for:
  • Implementing certain sanctions compliance controls as early as 2013, including conducting due diligence and sanctions screening on its merchant customers, and formalizing its sanctions compliance program in 2014.
  • Clearly indicating to all employees, including senior management, that BitPay prohibited merchant sign-ups from Cuba, Iran, Syria, Sudan, North Korea, and Crimea, as well as trade with sanctioned individuals and entities.
  • Not receiving any penalty notice or finding of violation from OFAC in the five years preceding the date of the current violation.
  • Cooperating with the OFAC investigation.
  • Terminating the conduct that led to the violations and undertaking the following measures intended to minimize the risk of recurrence of similar conduct in the future:
    • blocking IP addresses that appear to originate in Cuba, Iran, North Korea, and Syria from connecting to the BitPay website or from viewing instructions on how to make payment;
    • checking physical and email addresses of merchants' buyers when provided by the merchant to prevent completion of an invoice if it identifies a sanctioned jurisdiction address; and
    • launching a new customer identification tool.
  • Planning to continue implementation of all compliance commitments.
This enforcement action serves as a reminder that companies involved in providing digital currency services must understand the sanctions risks associated with providing digital currency services and should take necessary steps to mitigate this risk. In May 2019 OFAC published a Framework for OFAC Compliance Commitments (see Legal Update, US Treasury Department Releases A Framework for OFAC Compliance Commitments), which notes that each risk-based sanctions compliance program varies based on individual factors, but should include the following five essential components of compliance:
  • Management commitment.
  • Risk assessment.
  • Internal controls.
  • Testing and auditing.
  • Training.
This settlement represents the second recent OFAC enforcement action against a digital asset platform. OFAC settled an enforcement action with a California company for violations of multiple US sanctions in December 2020 (see Legal Update, Current Developments in Digital Assets: January 12, 2021: OFAC Settles with BitGo in First Ever Digital Asset Enforcement Action).