On October 11, 2022, the U.S. Treasury Department's Financial Crimes Enforcement Network (FinCEN) and Office of Foreign Assets Control (OFAC) announced settlements for over $24 million and $29 million, respectively, with Bittrex, Inc., a U.S.-based cryptocurrency exchange, for Bank Secrecy Act (BSA) and sanctions violations.
FinCEN and OFAC have each targeted cryptocurrency platforms in the past, but this action marks the first time the two agencies have brought parallel enforcement actions relating to cryptocurrency activity. FinCEN and OFAC have distinct but conceptually overlapping missions: FinCEN is the primary regulator of money transmitters on the federal level, while OFAC administers and enforces U.S. economic sanctions.
According to FinCEN's order against Bittrex, the agency found that the cryptocurrency exchange willfully violated the BSA and FinCEN's implementing regulations. In particular, from February 2014 through December 2018, Bittrex failed to maintain an effective anti-money laundering (AML) program, including with respect to anonymity-enhanced cryptocurrencies (AECs).
The agency noted that while the exchange platform averaged over 11,000 transactions per day in 2016 (with a daily value of approximately $1.54 million), the company did not utilize widely available transaction-monitoring software tools, instead relying on as few as two employees with minimal AML training and experience to review the transactions for suspicious activity. In 2017, the exchange averaged 23,800 transactions per day (with a daily value of approximately $97.9 million), yet the company continued to rely on the same two employees to manually review all transactions.
FinCEN's investigation also found that Bittrex failed to file a single suspicious activity report (SAR) from 2014 through May 2017. Yet throughout this period, Bittrex opened hundreds of accounts on behalf of individuals located in jurisdictions subject to comprehensive OFAC sanctions programs and failed to implement adequate procedures, controls, and the staffing necessary to analyze its transaction activity, including traceable CVC activity on public blockchains.
These and other AML program deficiencies led FinCEN to conclude that the violations were willful and subject to civil monetary penalties.
OFAC determined that Bittrex repeatedly failed to prevent persons located in jurisdictions subject to comprehensive OFAC programs (including Iran, Sudan, Syria, Cuba, and the Crimea region of Ukraine) from using its platform. (The point here is that while individuals and entities in some of these jurisdictions may use a U.S. financial institution, such transactions are inherently suspicious, and the U.S. institution (here Bittrex) must demonstrate enhanced due diligence.) According to OFAC's order, persons located in sanctioned jurisdictions engaged in over 116,000 virtual currency-related transactions, valued at more than $263 million, between March 2014 and December 2017.
Bittrex has agreed to remit approximately $24 million to OFAC to settle its potential civil liability for its violations of the sanctions programs. Bittrex has also agreed to remit $29 million for its willful violations of the BSA's AML program and SAR requirements. However, FinCEN will credit Bittrex's $24 million payment to OFAC against its settlement liability.
This action represents the largest penalty levied by OFAC in this space. It is another signal to the cryptocurrency industry that serious, purposeful compliance with the economic sanctions laws is required. Beyond this, the Bittrex decisions are part of a comprehensive, aggressive push by federal agencies (DOJ, SEC, CFPB, CFTC, OCC, FRB, NCUA, IRS) to ensure cryptocurrency platforms are complying not just with their AML and sanctions obligations, but also with the full range of federal regulations governing the crypto industry. Cryptocurrency exchanges like Bittrex, and other money transmitters in the crypto industry, should view Bittrex as a cautionary tale and take immediate stock of their AML programs to avoid a similar fate.