Bittrex to pay $29M for BSA violations in landmark FinCEN, OFAC case

The penalty, assessed Tuesday by the Financial Crimes Enforcement Network (FinCEN) and Office of Foreign Assets Control (OFAC), follows investigations by the Treasury Department agencies that uncovered “willful” violations of the BSA’s anti-money laundering (AML) rules and suspicious activity reporting (SAR) requirements. Bittrex admitted FinCEN’s findings in agreeing to a consent order.

“These enforcement actions emphasize to the virtual currency industry the importance of implementing appropriate risk-based sanctions compliance controls and meeting obligations under the BSA,” the Treasury said in a press release.

Bittrex, based in Washington, began offering virtual currency services in March 2014. The company had no sanctions compliance program in place until December 2015, OFAC stated in its enforcement release.

In February 2016, Bittrex hired a third party to screen transactions to ensure sanctioned nations and individuals were not involved. But the vendor worked off OFAC’s List of Specially Designated Nationals and Blocked Persons (SDN List) and did not “scrutinize customers or transactions for a nexus to sanctioned jurisdictions,” according to the regulator.

As a result, Bittrex, from February 2014 through December 2018, repeatedly failed to address the risks posed by its products and services, including anonymity-enhanced cryptocurrencies, FinCEN stated.

Bittrex didn’t adequately monitor transactions to prevent and halt money laundering, FinCEN said. The company sometimes had just two minimally trained employees watching 20,000 transactions a day for suspicious activity.

Bittrex conducted more than 116,000 transactions, valued at about $263 million, in nations and jurisdictions under OFAC sanctions. The company’s failings meant it risked transactions with illicit actors, like ransomware attackers, and trades that involved darknet marketplaces, FinCEN said.

Evidence showed the company knowingly allowed transactions with parties based in the U.S.-sanctioned jurisdictions of Cuba, Iran, Sudan, Syria, and the Crimea region of Ukraine, said OFAC.

The company didn’t file any SARs for three years, between February 2014 and May 2017, including 22 transactions of virtual assets worth $1 million or more each involving sanctioned jurisdictions.

The Treasury agencies said the case was their first joint enforcement action on virtual currency.

“Virtual asset service providers are on notice that they must implement robust risk-based compliance programs and meet their BSA reporting requirements,” said FinCEN Acting Director Himamauli Das in the agency’s press release.

OFAC assessed a penalty of $24.3 million against Bittrex that was credited as part of the company’s agreement with FinCEN. The case marks OFAC’s largest virtual currency enforcement action to date.

“Bittrex is pleased to have fully resolved this matter with OFAC and FinCEN on mutually agreeable terms,” the company said in an emailed statement. “None of the allegations relate to conduct after 2018.

“The settlement provides full resolution of both OFAC’s inquiry into transactions in sanctioned jurisdictions that occurred predominantly through 2017 and FinCEN’s assertion that Bittrex did not fully implement all of its [AML] program controls through 2018.”

OFAC acknowledged Bittrex’s cooperation in its investigation and the company’s remedial measures since implemented, including the appointment of a dedicated chief compliance officer, use of new sanctions screening tools and blockchain tracing software, and restriction of accounts located in sanctioned jurisdictions.

Editor’s note: An earlier version of this story incorrectly included a photo of the Bittrex Global logo.