Sanctions screening and the block

Graduate · enrolled learners

This lesson opens with Kraken and OFAC, November 2022.

What happened

Kraken, a US cryptocurrency exchange, checked a customer's location when the account was opened but did not apply geolocation controls afterward, so users who were in Iran, a comprehensively sanctioned jurisdiction, were able to keep transacting on the platform. Over several years this produced hundreds of transactions worth more than a million dollars for apparent users in Iran. In November 2022 the US Treasury's Office of Foreign Assets Control announced a settlement: Kraken agreed to pay about 362,000 dollars and to invest further in sanctions-compliance controls, for apparent violations of the Iran sanctions. Kraken did not intend to serve sanctioned users, and it did not matter: sanctions liability is strict, so an apparent violation stands regardless of intent. The specific gap was that screening ran once, at onboarding, and then stopped, while the obligation was continuous, and a customer's location can change after the account is open.

The decision point

Sanctions prohibit dealing with certain persons, entities and jurisdictions outright, and the liability for breaching them is strict: an apparent violation is a violation whether or not the institution meant to commit it, which makes sanctions unlike much of the rest of compliance where intent and reasonableness matter. Meeting that obligation requires two things Kraken's case separates cleanly. First, screening has to be continuous rather than a one-time check at account opening, because the facts that determine whether a customer or transaction is prohibited, their location, their status on a sanctions list, can change after onboarding. Second, screening has to produce a block, an actual prevention of the prohibited transaction, not merely a record that risk was noted, because sanctions require that the dealing not happen, not that it be documented. Kraken screened at onboarding and stopped, so its screening recorded a location once and never enforced it again, and the transactions it was obliged to prevent went through. So the decision an institution makes is to run screening continuously and wire it to a block, because strict liability means a prohibited transaction that is merely observed, or observed once and then forgotten, is a violation the institution owns regardless of what it intended.

Recorded loss

$362,158

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.