Crypto Exchange Clipped for Lax AML Screening

Poloniex, LLC has agreed to pay $7,591,630 to settle its potential civil liability for 65,942 apparent violations of multiple sanctions programs, according to the Department of Treasury's Office of Foreign Assets Control (OFAC). The Boston-based online trading and settlement platform allowed customers apparently located in sanctioned jurisdictions to engage in online digital asset-related transactions between January 2014 and November 2019, with a combined value of $15,335,349, despite having reason to know their location based on both Know Your Customer information and internet protocol address data.

The settlement reflects OFAC's determination that Poloniex's apparent violations were not voluntarily self-disclosed and were not egregious.

Poloniex launched its operations in January 2014, and 16 months later implemented a sanctions compliance program that provided for a review of Know Your Customer information for new customers in jurisdictions subject to comprehensive OFAC sanctions. However, existing customers were not retroactively screened. As a result, customers who had self-identified before May 2015 as residing in a sanctioned jurisdiction were generally able to continue using the platform.

Poloniex began monitoring IP address data in May 2015 to detect logins from sanctioned jurisdictions and conducted additional diligence on such logins, including contacting the account owner, and closing certain accounts based on that diligence. However, Poloniex did not begin implementing a block on such IP addresses until June 2017. It also implemented sanctions controls related to customers in the Crimea region of Ukraine only in August 2017.

Despite making efforts to identify and restrict accounts with a nexus to Iran, Cuba, Sudan, Crimea, and Syria pursuant to its compliance program, certain customers apparently located in these jurisdictions continued to use Poloniex's platform for online digital asset-related transactions.

The settlement amount of $7,591,630 reflects OFAC's consideration of the General Factors under the Enforcement Guidelines. The base civil monetary penalty amount applicable in this matter equals the applicable schedule amount, which in this case is $99,237,000. The statutory maximum civil monetary penalty applicable in this matter is $19,692,872,800. OFAC determined the apparent violations were not voluntarily self-disclosed and were non-egregious.

This action highlights that online digital asset companies, like all financial service providers, are responsible for ensuring that they do not engage in transactions prohibited by OFAC sanctions, such as providing services to persons in comprehensively sanctioned jurisdictions. To mitigate such risks, online digital asset companies should develop a tailored, risk-based sanctions compliance program.