The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) on February 18, 2021, announced an enforcement action against BitPay, Inc. for several apparent violations of U.S. economic sanctions. This is the second publicly-announced OFAC enforcement action focused on the cryptocurrency industry, following OFAC’s resolution with BitGo, Inc. at the end of 2020.
BitPay agreed to pay a $507,375 fine to resolve 2,102 apparent violations of multiple OFAC sanctions programs, including Crimea, Cuba, North Korea, Iran, Sudan, and Syria. BitPay allegedly allowed persons located in those sanctioned jurisdictions to transact with merchants in the U.S. on BitPay’s platform, engaging in approximately $129,000 worth of digital currency-related transactions with BitPay’s merchant customers.
The apparent violations are related to BitPay’s payment processing service, which enables merchants to accept digital currency as payment for goods and services. BitPay received digital currency payments from buyers of its merchants, thus the customers of its customers, who were located in sanctioned jurisdictions. BitPay then converted those digital currency payments into fiat currency and relayed those payments to its merchants.
Notably, OFAC found that while BitPay screened its direct customers (i.e., merchants), it failed to sufficiently screen its merchants’ buyers, including using location data as part of the screening process (which BitPay allegedly had access to but did not fully integrate as part of the diligence process).
This announcement represents OFAC’s second public enforcement action in the cryptocurrency industry and could signal a deeper regulatory focus. All U.S. persons are subject to OFAC sanctions, regardless of regulatory or licensing status (e.g., even if your company is not licensed or otherwise a “financial institution” subject to the Bank Secrecy Act, you will still be required to comply with U.S. sanctions). Additionally, OFAC sanctions are typically “strict liability,” meaning that even inadvertent or unintentional violations can still be penalized, which appears to have been the case in this enforcement action.