The Office of Foreign Assets Control (OFAC) of the U.S. Department of the Treasury announced on Nov 28, that it has reached a settlement with the cryptocurrency exchange Kraken for alleged violations of the country’s economic sanctions against Iran.
Kraken as a Cryptocurrency Exchange and VASP
Kraken is a virtual currency exchange incorporated as Payward, Inc. It is based in Delaware and operates both in the United States and abroad. The company is a controlled international virtual currency exchange established in 2011 and made available for public trade in 2013. The Kraken platform allows users to trade fiat money for cryptocurrencies, buy, sell, and hold cryptocurrencies as well as exchange one cryptocurrency for another.
Kraken and it’s Anti Money Laundering and Sanctions Compliance Policy
In order to prevent users from creating accounts in sanctioned jurisdictions, Kraken maintained an anti-money laundering and sanctions compliance policy that included screening consumers at onboarding and every day following. It also reviewed the IP address information that was generated at that time.
What was Kraken’s Sanction Offense Against OFAC?
Since 1979, Iran has been subject to US sanctions that forbid the export of goods or services to organizations or people within the nation. Kraken, however, is accused of breaking these restrictions since 2019 by enabling over 1,500 people with addresses in Iran to open accounts there and use those accounts to buy and sell cryptocurrency.
Hence, despite putting up an AML and Sanctions Compliance Policy , Kraken conducted 826 transactions for a total of more than $1.6 million people in Iran between roughly October 14, 2015 and June 29, 2019. In order to prevent new users from opening accounts in sanctioned countries, OFAC claims that Kraken applied sanctions restrictions at the customer onboarding stage.
This includes using geolocation technologies to determine the whereabouts of new client sign-up attempts made using Internet Protocol (IP) addresses from authorized regions. However, according to OFAC’s findings, Kraken did not keep track of these data points on a regular basis. As a result, account holders who opened their accounts outside of Iran later used Kraken to conduct business there.
OfAC found the exchange’s self-identification and voluntary disclosure of these compliance shortcomings to be a mitigating factor for determining the magnitude of the civil monetary penalty Kraken paid.
How much did Kraken agree to pay as a settlement for OFAC’s Sanctions?
In order to resolve any potential civil liability for allegedly violating the sanctions against Iran, Kraken has agreed to pay $362,158.70. Additionally, Kraken has agreed to contribute an extra $100,000 to a number of sanctions compliance controls.
This implies that the $362,158.70 settlement amount reflects the General Factors under the Enforcement Guidelines taken into account by OFAC. Kraken and OFAC also agreed that Kraken will invest an extra $100,000 in training and technical steps to support sanctions screening as well as other enhanced sanctions compliance processes.
Kraken’s settlement sum is small in comparison to OFAC’s recent agreement with Bittrex, which agreed to pay a total of $29,280,829.20 to OFAC and the Financial Crimes Enforcement Network (“FinCEN”) to settle claims of sanctions and Bank Secrecy Act violations. As OFAC noted in its announcement, Kraken’s settlement sum “reflects OFAC’s assessment that Kraken’s apparent violations were non-egregious and voluntarily self-disclosed.”
Kraken’s Corrective Actions in Response to OFAC’s Sanctions Action
Kraken’s settlement agreement with OFAC emphasizes how crucial it is for crypto compliance teams at crypto businesses including Virtual Asset Service Providers (VASPS), to take initiative in addressing sanctions concerns by using a thorough risk management strategy. From Kraken’s case, we observed that while determining the penalty, OFAC also considered Kraken’s proactive and voluntary implementation of compliance controls to close identified holes as a mitigating factor.
OFAC has earlier on emphasized the need for these kinds of controls in its recommendations for the cryptocurrency industry. Hence, Kraken’s promptness in putting these controls in place when it discovered compliance holes contributed significantly to the scale of any potential fines.
Kraken’s chief legal officer, Marco Santori, said in a statement to Cointelegraph that the exchange had “voluntarily self-reported and rapidly remedied” its activities to OFAC: He further stated that “Before agreeing to this resolution, Kraken had already taken a number of actions to strengthen its compliance controls. This entails boosting training and accountability, extending our compliance staff, and further strengthening our control systems.”
Controls put in by Kraken to Comply with OFAC
Below are some of the Controls Kraken put in place to Comply with OFAC
- Implementing geolocation filtering to prevent users from accessing their accounts on the Kraken website from restricted areas.
- Putting in place a variety of blockchain analytic tools to help with monitoring sanctions.
- Investing in Crypto Compliance training which includes how to use blockchain analytics tools.
- Recruiting new sanctions compliance professionals as well as a designated head of sanctions to oversee Kraken’s sanctions compliance program
- Extending its agreement with its current screening provider to include additional screening capabilities.
- Including thorough reports on beneficial ownership, to guarantee compliance with OFAC’s “50 Percent Rule”
- Contracting with a KYC and Identity Verification provider that checks customers’ nationality by employing artificial intelligence algorithms to look for potential problems with the credentials they have provided as support.
- Utilizing an automatic control, to block accounts using locations in the so-called Donetsk and Luhansk People’s Republics of Ukraine, as well as the Crimea region.
6 Lessons Every VASP should learn from OFAC’s Action on Kraken
- Sanctions Monitoring is important for all your customers, both old and new.
- It is important to implement adequate wallet monitoring and transaction screening tools in your VASP or cryptocurrency business.
- A variety of Blockchain analytic tools can be put in place for screening and monitoring transactions. Some tools have more capabilities in specific tasks.
- Recruit competent and certified crypto compliance specialists that will ensure kyc/aml/sanctions compliance in your cryptocurrency business.
- Invest in training your staff on cryptocurrency compliance
- Ensure your compliance tools have geolocation capabilities to help prevent individuals from sanctioned entities getting onboard or assessing your platform.
How A&D Forensics Can Help with Your Compliance Systems
At A&D Forensics we take a look at your business systems, help you review your compliance level and make sure you are up-to-date through our Compliance as a Service Solution (CaaS).
The Compliance as a Service (CaaS) Offering from A&D Forensics is designed to assemble all the requirements needed for start-ups to have a simple-to-use, effective, affordable Compliance Program
CaaS by A&D Forensics allows financial institutions and cryptocurrency exchanges to check crypto wallets and transactions for signs of exposure to authorized parties. These include people and organizations that OFAC has sanctioned, as well as organizations that are based in countries like Iran and North Korea that have imposed sanctions. CaaS by A&D Forensics also allows you to conduct proper KYC and Identification processes on your clients.
A&D Forensics also offers industry-leading training on Crypto Compliance through the Certified Cryptocurrency Investigation Training (3CS). The 3CS credentials equip students to adopt effective policies and prevent financial crimes using cryptocurrencies by leveraging on cryptocurrency compliance tools.
Summary
From OFAC’s Sanction Action on Kraken, you can see the need to deploy geolocation technologies, including IP blocking and other location verification methods, to identify and prevent individuals based in sanctioned jurisdictions from engaging in unlawful virtual currency-related activities within your cryptocurrency exchange or money service business. In addition, these controls must be effective and prioritized in your business. Having compliance tools in place doesn’t mean that you are compliant. Hence, invest in training your crypto compliance officers on necessary actions to take while using those tools.
