BitGo Inc., a digital asset security and cryptocurrency company based in Palo Alto, California, failed to prevent users in Crimea, Cuba, Iran, Syria, and Sudan from accessing its services despite having a record of their locations, according to a notice posted Wednesday by the U.S. Treasury Department’s Office Foreign Assets Control (OFAC).
From March 2015 and December 2019, BitGo processed 183 digital currency transactions amounting for $9,130 USD on their behalf, according to the OFAC notice. The company was tracking IP addresses for security purposes at the time, but did not use the information for sanctions compliance.
“This action highlights that companies involved in providing digital currency services—like all financial service providers—should understand the sanctions risks associated with providing digital currency services and should take steps necessary to mitigate those risks,” OFAC said.
BitGo did not self-disclose the sanctions violations, agreeing to pay USD $98,830 to resolve the matter, OFAC said, deeming the case as non-egregious. Users in the sanctioned jurisdictions signed up for the company’s “hot wallet” secure digital wallet management service. They created and used digital currency wallets on BitGo’s online platform to conduct their transactions, OFAC stated.
BitGo, which offers the use of both hot and cold wallets, as well as a variety of other digital services, allowed users prior to April 2018 to open accounts using only a name and email address. The company later required new account holders to verify their location. The company implemented an OFAC sanctions compliance program after learning of the violations via their platform. The company blocked IP addresses and email-related restrictions for sanctioned jurisdictions.
In May 2019, OFAC introduced a framework to aid organizations with sanctions compliance. BitGo screens each account, including its hot wallet accounts, against U.S. sanctions lists, including cryptocurrency wallet addresses identified by OFAC as blocked property.
The company back-screened its users and documented all of its sanctions compliance efforts under its new sanctions compliance program. “Companies that facilitate or engage in online commerce or process transactions using digital currency are responsible for ensuring that they do not engage in transactions prohibited by OFAC sanctions, such as dealings with blocked persons or property, or engaging in prohibited trade or investment-related transactions,” OFAC said in the notice.