Crypto exchange Poloniex to pay $7.6M in OFAC sanctions case

Between July 2015 and September 2019, deficiencies in Poloniex’s compliance protocols played part in the company processing nearly 66,000 online digital asset-related transactions by customers in then-sanctioned jurisdictions, including the Crimea region of Ukraine, Cuba, Iran, Sudan, and Syria, said OFAC in its enforcement release published Monday. The combined value of the transactions surpassed $15 million, according to the regulator.

OFAC said Poloniex conducted this business despite having reason to know the locations of its customers. The relevant sanctions against Sudan have since been lifted.

The details: Poloniex began operating in January 2014 but didn’t implement a sanctions compliance program until May 2015. The program allowed review of know your customer (KYC) information for new customers but did not account for existing customers based in regions subject to U.S. sanctions.

“Poloniex failed to exercise due caution or care for its sanctions compliance obligations when it operated with no sanctions compliance program for more than a year,” OFAC noted.

Poloniex began monitoring IP addresses in May 2015 to identify customers accessing its platform from sanctioned areas, but it failed to begin blocking those customers until June 2017, OFAC said.

Customers based in Crimea, where more than 57,000 of the apparent violations occurred, were not blocked by Poloniex until August 2017, OFAC said. Despite efforts by the company to restrict accounts with a nexus to each of the sanctioned jurisdictions, certain customers in those nations remained unblocked and continued to use the platform.

Poloniex, which was based in Boston, was acquired by Circle Internet Financial Limited (CIFL) in February 2018. CIFL implemented further compliance controls, but some apparent violations, mainly involving users based in Crimea, continued until November 2019, when the platform was sold to a third party, OFAC explained.

Poloniex currently has no employees or business operations.

Compliance considerations: In determining a settlement amount, OFAC considered Poloniex harmed the integrity of multiple U.S. sanctions programs by conveying economic benefit to 232 customers in sanctioned regions.

The company did not voluntarily self-disclose the apparent violations. However, most of the questionable transactions involved small amounts of money.

OFAC noted CIFL implemented numerous compliance measures before the regulator began its investigation, including freezing users’ accounts until they were cleared by KYC verification, adding a tool that prevented users from activating an account if connected to a sanctioned jurisdiction, putting in place an automated review and verification tool for identity documents, and other measures.

“This action highlights that online digital asset companies—like all financial service providers— are responsible for ensuring that they do not engage in transactions prohibited by OFAC sanctions,” the regulator said. “… An appropriate compliance program for members of the online digital assets industry will depend on a variety of factors, including the type of business involved, its size and sophistication, products and services offered, customers and counterparties, and geographic locations served.”

Poloniex did not respond to a request for comment.