top of page
Search

USA/IRAN: LESSON LEARNED ON SANCTIONS ENFORCEMENT IN THE KRAKEN CASE

On November 28, 2022, Kraken settled a case with OFAC for potential civil violations resulting from inadequate systems and controls to prevent clients' operations in jurisdictions subject to economic sanctions.

OFAC released an enforcement decision pertaining to a potential violation of a sanction regime, based on the internet address of the recipient. OFAC is confirming its efforts aimed at making sanctions efficient within the area of e-commerce and virtual currency operations.



Kraken is a centralized global virtual currency exchange that was founded in 2011 and opened for public trading in 2013. Users of the Kraken platform can buy, sell, or hold cryptocurrencies, as well as trade fiat currency for cryptocurrencies, or exchange one cryptocurrency for another. Kraken maintained an anti-money laundering and sanctions compliance program, which included screening customers' onboarding and management, as well as a review of IP address information generated at the time of onboarding to prevent users in sanctioned jurisdictions from opening accounts.


In 4 years, as stated by the US Treasury Department "despite these controls, between approximately October 14, 2015, and June 29, 2019, Kraken processed 826 transactions, totaling approximately $1,680,577.10, on behalf of individuals who appeared to have been located in Iran at the time of the transactions."


According to IP address data, account holders who established their accounts within jurisdictions that were not subject to economic sanctions appear to have accessed their accounts and transacted on Kraken’s platform from a jurisdiction subject to economic sanctions.


After identifying this problem, Kraken implemented automated blocking for IP addresses linked to sanctioned jurisdictions. Kraken also implemented multiple blockchain analytics tools to assist with its sanctions monitoring. Kraken has agreed to pay $362,158.70 to settle its potential civil liability for apparent violations of the Iranian Transactions and Sanctions Regulations. As part of its settlement with OFAC, Kraken also has agreed to invest an additional $100,000 in certain sanctions compliance controls.


What can the industry learn from this case?

  1. The implementation of geolocation instruments aimed at preventing clients' financial operations in prohibited jurisdictions is mandatory;

  2. Geolocation controls should operate all along the transactional process, and not only at the onboarding of the customer;

  3. Appropriate tools must be adopted in an integrated way following international business best practices;

  4. Having a Head of Compliance Programs specialized in economic sanctions is considered a valuable asset;

  5. Additional screening tools capable of informing about Ultimate Beneficial Owners (UBOs) should be made available;

  6. OFAC Guidelines for the Virtual Currency Industry have to be taken into adequate consideration.

As OFAC has clarified: "An adequate sanctions compliance program for members of the virtual currency industry will depend on a variety of factors, including the type of business involved, its size and sophistication, products and services offered, customers and counterparties, and geographic locations served. It also should be predicated on and incorporate at least five essential components: (1) management commitment; (2) risk assessment; (3) internal controls; (4) testing and auditing; and (5) training."


Download the OFAC's Enforcement Release relating to the Kraken case

OFAC Enforcement Release - Kraken Case Nov. 28 2022
.pdf
Download PDF • 194KB



Tags:

bottom of page