Sanctions screening and the block

Graduate · enrolled learners

This lesson opens with Kraken and OFAC, November 2022.

What happened

Kraken, a US cryptocurrency exchange, checked a customer's location when the account was opened but did not apply geolocation controls afterward, so users who appeared to be in Iran, a comprehensively sanctioned jurisdiction, were able to keep transacting on the platform. Between October 2015 and June 2019 this produced 826 transactions worth about 1.68 million dollars for apparent users in Iran. In November 2022 the US Treasury's Office of Foreign Assets Control announced a settlement: Kraken agreed to pay about 362,000 dollars and to invest an additional 100,000 dollars in sanctions-compliance controls, for apparent violations of the Iran sanctions. OFAC treated the case as non-egregious and voluntarily self-disclosed, with no finding that Kraken set out to serve users in Iran, and the apparent violations stood anyway: OFAC may impose civil penalties on a strict liability standard, without knowledge or reason to know, and it counted against Kraken that its own IP address data gave it reason to know. The specific gap was narrow: Kraken screened its customers against the sanctions lists at onboarding and daily thereafter, but it applied its geolocation control, the check of where a user was connecting from, only at onboarding and not to the transactions that followed, while the obligation was continuous, and a customer's location can change after the account is open.

The decision point

Sanctions prohibit dealing with certain persons, entities and jurisdictions outright, and the liability for breaching them is strict: an apparent violation is a violation whether or not the institution meant to commit it, which makes sanctions unlike much of the rest of compliance where intent and reasonableness can decide whether there was a violation at all; under sanctions they count only as mitigating factors in the penalty. Meeting that obligation requires two things Kraken's case separates cleanly. First, screening has to be continuous rather than a one-time check at account opening, because the facts that determine whether a customer or transaction is prohibited, their location, their status on a sanctions list, can change after onboarding. Second, screening has to produce a block, an actual prevention of the prohibited transaction, not merely a record that risk was noted, because sanctions require that the dealing not happen, not that it be documented. Kraken checked location at onboarding and never again, so that control recorded a location once and never enforced it on a later transaction, and the transactions it was obliged to prevent went through. So the decision an institution makes is to run screening continuously and wire it to a block, because strict liability means a prohibited transaction that is merely observed, or observed once and then forgotten, is a violation the institution owns regardless of what it intended.

Recorded loss

$362,158

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.