Kraken to pay $362K over Iran sanctions screening lapses

Payward, doing business as Kraken, appeared to allow 826 transactions worth nearly $1.7 million on behalf of individuals located in Iran from 2015-19, according to OFAC’s enforcement release published Monday. Over that period, OFAC said Kraken failed to use appropriate geolocation tools that would prevent IP addresses from sanctioned jurisdictions from conducting transactions on its network.

As part of the settlement, Kraken agreed to spend $100,000 to implement certain sanctions compliance controls. Kraken voluntarily reported the apparent violations, and OFAC determined they were nonegregious.

Kraken’s customers use its platform to buy, sell, or hold cryptocurrencies, as well as trade fiat currency for cryptocurrencies or exchange one cryptocurrency for another.

Kraken employed software that prevented customers from opening accounts from sanctioned jurisdictions like Iran. However, it did not employ IP blocking software on transactional activity on its platform. As a result, “[A]ccount holders who established their accounts outside of sanctioned jurisdictions appear to have accessed their accounts and transacted on Kraken’s platform from a sanctioned jurisdiction,” namely Iran, OFAC said.

Kraken “failed to exercise due caution or care in its sanctions compliance obligations” when it knew it had users from around the world but did not take steps to prevent customers in sanctioned jurisdictions from completing transactions on its network, OFAC said. The company has taken remedial measures to prevent future violations.

“[T]his case highlights the importance of using geolocation tools, including IP blocking and other location verification tools, to identify and prevent users located in sanctioned jurisdictions from engaging in prohibited virtual currency-related transactions,” said OFAC. “In particular, limiting the use of such controls only to the time of account opening—and not throughout the lifetime of the account or with respect to subsequent transactions—could present sanctions risks to virtual currency-related companies.

“This case also demonstrates the value of a company implementing robust remedial measures after becoming aware of a potential sanctions issue, including the deployment of blockchain analysis tools and compliance-related training on blockchain analytics, as well as committing to future sanctions compliance investments.”

In addition to adding geolocation blocking to prevent customers located in prohibited jurisdictions from accessing Kraken’s network, the company hired a head of sanctions and compliance staff to direct its sanctions compliance program. Kraken expanded its contract with a vendor to add screening capabilities and contracted with a new vendor that conducts nationality verification using artificial intelligence tools. In addition, the company implemented blockchain analysis tools to assist with sanctions monitoring and invested in additional compliance training for its staff.

Kraken’s chief legal officer, Marco Santori, said in an emailed statement the company was pleased to resolve the matter.

“Even before entering into this resolution, Kraken had taken a series of steps to bolster our compliance measures,” he said. “This includes further strengthening control systems, expanding our compliance team, and enhancing training and accountability.”