The U.S. Treasury Department on Thursday announced the following:<\/p>\n\n\n\n
BitPay, Inc. (\u201cBitPay\u201d), a private company based in Atlanta, Georgia, that offers a payment processing solution for merchants to accept digital currency as payment for goods and services, has agreed to remit $507,375 to settle its potential civil liability for 2,102 apparent violations of multiple sanctions programs. BitPay allowed persons who appear to have been located in the Crimea region of Ukraine, Cuba, North Korea, Iran, Sudan, and Syria to transact with merchants in the United States and elsewhere using digital currency on BitPay\u2019s platform even though BitPay had location information, including Internet Protocol (IP) addresses and other location data, about those persons prior to effecting the transactions. BitPay\u2019s sanctions compliance program deficiencies enabled persons in these sanctioned jurisdictions to engage in approximately $129,000 worth of digital currency-related transactions with BitPay\u2019s merchant customers. The settlement amount reflects OFAC\u2019s determination that BitPay\u2019s apparent violations were not voluntarily self-disclosed and were non-egregious.<\/p>\n\n\n\n
This action emphasizes that OFAC obligations apply to all U.S. persons, including those involved in providing digital currency services. As part of a risk-based approach, OFAC encourages companies that provide digital currency services to implement sanctions compliance controls commensurate with their risk profile.<\/p>\n\n\n\n
Description of the Conduct Leading to the Apparent Violations<\/strong><\/p>\n\n\n\n Between approximately June 10, 2013 and September 16, 2018, BitPay processed 2,102 transactions on behalf of individuals who, based on IP addresses and information available in invoices, were located in sanctioned jurisdictions (the \u201cApparent Violations\u201d). The Apparent Violations related to BitPay\u2019s payment processing service, which enables merchants to accept digital currency as payment for goods and services. Specifically, BitPay received digital currency payments on behalf of its merchant customers from those merchants\u2019 buyers who were located in sanctioned jurisdictions, converted the digital currency to fiat currency, and then relayed that currency to its merchants.<\/p>\n\n\n\n While BitPay screened its direct customers\u2014the merchants\u2014 against OFAC\u2019s List of Specially Designated Nationals and Blocked Persons (the \u201cSDN List\u201d) and conducted due diligence on them to ensure they were not located in sanctioned jurisdictions, BitPay failed to screen location data that it obtained about its merchants\u2019 buyers. Specifically, BitPay at times would receive information about those merchants\u2019 buyers at the time of the transaction, including a buyer\u2019s name, address, email address, and phone number. Beginning in November 2017, BitPay also obtained buyers\u2019 IP addresses. However, BitPay\u2019s transaction review process failed to analyze fully this identification and location data. As a result, buyers who, based on those information indicators, were located in Crimea, Cuba, North Korea, Iran, Sudan, and Syria were able to make purchases from merchants in the United States and elsewhere using digital currency on BitPay\u2019s platform.<\/p>\n\n\n\n This conduct resulted in Apparent Violations of Executive Order 13685 of December 19, 2014, \u201cBlocking Property of Certain Persons and Prohibiting Certain Transactions with Respect to the Crimea Region of Ukraine\u201d; the Cuban Assets Control Regulations, 31 C.F.R. \u00a7515.201; the North Korea Sanctions Regulations, 31 C.F.R. \u00a7510.206; the Iranian Transactions and Sanctions Regulations, 31 C.F.R. \u00a7560.204; the Sudanese Sanctions Regulations, 31 C.F.R. \u00a7538.205 (SSR)1<\/sup>; and the Syrian Sanctions Regulations, 31 C.F.R. \u00a7542.207.<\/p>\n\n\n\n Penalty Calculation and General Factors Analysis<\/strong><\/p>\n\n\n\n The statutory maximum civil monetary penalty applicable in this matter is$619,689,816. OFAC determined that BitPay did not voluntarily self-disclose the Apparent Violations and the Apparent Violations constitute a non-egregious case. Accordingly, under OFAC\u2019s Economic Sanctions Enforcement Guidelines (\u201cEnforcement Guidelines\u201d), the base civil monetary penalty amount applicable in this matter is $2,255,000. The settlement amount of $507,375 reflects OFAC\u2019s consideration of the General Factors under the Enforcement Guidelines.<\/p>\n\n\n\n OFAC determined the following to be aggravating factors<\/strong>:<\/p>\n\n\n\n (1)BitPay failed to exercise due caution or care for its sanctions compliance obligations when it allowed persons in sanctioned jurisdictions to transact with BitPay\u2019s merchants using digital currency for approximately five years, even though BitPay had sufficient information to screen those customers; and<\/p>\n\n\n\n (2)BitPay conveyed a total of $128,582.61 in economic benefit to individuals in several jurisdictions subject to OFAC sanctions, thereby harming the integrity of those sanctions programs.<\/p>\n\n\n\n OFAC determined the following to be mitigating factors<\/strong>:<\/p>\n\n\n\n (1)BitPay had implemented certain sanctions compliance controls as early as2013, including conducting due diligence and sanctions screening on its merchant customers, and formalized its sanctions compliance program in 2014;<\/p>\n\n\n\n (2)BitPay made clear in its training to all employees, including senior management, that BitPay prohibited merchant sign-ups from Cuba, Iran, Syria, Sudan, North Korea, and Crimea, as well as trade with sanctioned individuals and entities;<\/p>\n\n\n\n (3)BitPay is a small business that has not received a penalty notice or Finding of Violation from OFAC in the five years preceding the date of the earliest Apparent Violation;<\/p>\n\n\n\n (4)BitPay cooperated with OFAC\u2019s investigation into these Apparent Violations;and<\/p>\n\n\n\n (5)BitPay has represented that it has terminated the conduct that led to the Apparent Violations and undertook the following measures intended to minimize the risk of recurrence of similar conduct in the future:<\/p>\n\n\n\n \u2022 Blocking IP addresses that appear to originate in Cuba, Iran, North Korea, and Syria from connecting to the BitPay website or from viewing any instructions on how to make payment;<\/p>\n\n\n\n \u2022 Checking physical and email addresses of merchants\u2019 buyers when provided by the merchants to prevent completion of an invoice from the merchant if BitPay identifies a sanctioned jurisdiction address or email top-level domain; and<\/p>\n\n\n\n \u2022 Launching \u201cBitPay ID,\u201d a new customer identification tool that is mandatory for merchants\u2019 buyers who wish to pay a BitPay invoice equal to or above $3,000. As part of BitPay ID, the merchant\u2019s customer must provide an email address, proof of identification\/photo ID, and a selfie photo.<\/p>\n\n\n\n (6) As part of its agreement with OFAC, BitPay has undertaken to continue its implementation of these and other compliance commitments.<\/p>\n\n\n\n Compliance Considerations<\/strong><\/p>\n\n\n\n This action highlights that companies involved in providing digital currency services\u2014like all financial service providers\u2014should understand the sanctions risks associated with providing digital currency services and should take steps necessary to mitigate those risks. Companies that facilitate or engage in online commerce or process transactions using digital currency are responsible for ensuring that they do not engage in unauthorized transactions prohibited by OFAC sanctions, such as dealings with blocked persons or property, or engaging in prohibited trade or investment-related transactions.<\/p>\n\n\n\n To mitigate such risks, administrators, exchangers, and other companies involved in using digital currencies should develop a tailored, risk-based sanctions compliance program. OFAC\u2019s Framework for OFAC Compliance Commitments <\/em>notes that each risk-based sanctions compliance program will vary depending on a variety of factors, including the company\u2019s size and sophistication, products and services, customers and counterparties, and geographic locations, but should be predicated on and incorporate at least five essential components of compliance: (1) management commitment; (2) risk assessment; (3) internal controls; (4) testing and auditing; and (5) training. Within that framework, this enforcement action emphasizes the importance of screening all available information, including IP addresses and other location data of customers and counterparties, to mitigate sanctions risks in connection with digital currency services.<\/p>\n\n\n\n Additional guidance from OFAC related to the provision of digital currency services can be found here: https:\/\/home.treasury.gov\/policy-issues\/financial-sanctions\/faqs\/topic\/1626.<\/p>\n\n\n\n OFAC Enforcement and Compliance Resources<\/strong><\/p>\n\n\n\n On May 2, 2019, OFAC published A Framework for OFAC Compliance Commitments <\/em>in order to provide organizations subject to U.S. jurisdiction, as well as foreign entities that conduct business in or with the United States or U.S. persons, or that use U.S.-origin goods or services, with OFAC\u2019s perspective on the essential components of a sanctions compliance program. The Framework <\/em>also outlines how OFAC may incorporate these components into its evaluation of apparent violations and resolution of investigations resulting in settlements. The Framework <\/em>includes an appendix that offers a brief analysis of some of the root causes of apparent violations of U.S. economic and trade sanctions programs OFAC has identified during its investigative process.<\/p>\n\n\n\n Information concerning the civil penalties process is discussed in OFAC regulations governing the various sanctions programs and in 31 C.F.R. Part 501. On November 9, 2009, OFAC published Appendix A to Part 501, the Economic Sanctions Enforcement Guidelines. See <\/em>74 Fed. Reg. 57,593 (Nov. 9, 2009). The Economic Sanctions Enforcement Guidelines, as well as recent final civil penalties and enforcement information, can be found on OFAC\u2019s website at http:\/\/www.treasury.gov\/ofac\/enforcement.<\/p>\n\n\n\n For more information regarding OFAC regulations, please visit: http:\/\/www.treasury.gov\/ofac.<\/p>\n\n\n\n 1\u00a0<\/sup>Effective October 12, 2017, pursuant to Executive Order 13761 (as amended by Executive Order 13804), U.S. persons are no longer prohibited from engaging in transactions that were previously prohibited solely under the SSR. Consistent with the revocation of these sanctions, OFAC removed the SSR from the Code of Federal Regulations on June 29, 2018. However, the revocation of these sanctions does not affect past, present, or future OFAC enforcement investigations or actions related to any apparent violations of the SSR arising from activities that occurred prior to October 12, 2017.<\/p>\n\n\n\n Source : Cuban Money project<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"