CoinList Markets LLC is a currency exchange. When its customers open accounts, there is a Know-Your-Customer (KYC) process which requires individual applicants to provide, among other things, their country of residence and address. CoinList maintained several sanctions compliance measures, including screening new and existing customers against Office of Foreign Assets Control (OFAC) and other sanctions lists. By spring of 2021, CoinList’s onboarding protocols also included an automated process through which an application was meant to be immediately rejected if a user presented an identification card from, or provided a physical address in, a comprehensively sanctioned jurisdiction.
However, according to OFAC, CoinList’s screening procedures failed to capture users who represented themselves as resident of a non-embargoed country (Russia, in this instance) but who nevertheless provided an address within Crimea. There were 89 such accounts. CoinList’s screening protocols failed to recognize that “Crimea” or a city name in Crimea indicated likely residence in Crimea. Thus, there were 989 transactions, totaling $1,252,280, that appeared to violate the Ukraine-/Russia-Related Sanctions Regulations (URRSR).
The statutory maximum civil monetary penalty was more than $327 million. The parties settled for $1,207,830. OFAC identified the following aggravating factors: (i) CoinList failed to institute internal controls able to flag accounts whose owners described themselves as resident of Crimea; (ii) CoinList knew or had reason to know it was conducting transactions on behalf of persons who were likely to be ordinarily resident in Crimea; and, (iii) CoinList conferred economic benefits to Crimea by processing 989 transactions totaling $1,252,280 over two years, which harmed the integrity of the policy objectives of the URRSR. There were also the following mitigating factors: (i) CoinList had not been penalized within the five prior years; (ii) CoinList cooperated with OFAC’s investigation; (iii) the amount of the Crimea transactions was a very small percentage of the company’s annual total volume; and (iv) CoinList undertook a number of remedial measures, such as IP geo-blocking to detect IP addresses in sanctioned jurisdictions and preventing users from accessing their accounts from those IP addresses, and enhancing its training program and hiring additional experienced compliance personnel.
OFAC’s Statement about the settlement included the following comment under the heading “Compliance Considerations:”
This case, like previous OFAC settlement actions with firms operating in the virtual currency space, highlights the importance of integrating all available KYC and other relevant information into a company’s screening process and broader compliance function. As demonstrated in previous cases, certain firms providing virtual currency services have failed to ensure that their screening processes and broader compliance programs adequately incorporate customer information gathered from the onboarding process or through transactional information (such as IP location information). Ensuring that such data is gathered and employed using a risk-based approach is important to mitigate the risk of providing services to persons in sanctioned jurisdictions.
This enforcement action further emphasizes the importance for virtual currency companies and those involved in emerging technologies to incorporate risk-based sanctions compliance into their business functions, especially when the companies seek to offer financial services to a global customer base. OFAC’s Sanctions Compliance for the Virtual Currency Industry explains that OFAC strongly encourages a risk-based approach to sanctions compliance.
