OFAC’s enforcement release states the failure in one sentence: based on the internet protocol address information and physical address information collected about each customer at onboarding, Bittrex had reason to know that these users were in jurisdictions subject to sanctions, but at the time of the transactions was not screening that customer information for terms associated with sanctioned jurisdictions.
The scale that produced was 116,421 apparent violations, covering approximately $263,451,600 of virtual-currency-related transactions by persons apparently located in Crimea, Cuba, Iran, Sudan and Syria.
Why this is the clearest crypto compliance case
There is no concealment technique in it at all. Nobody used a mixer, nobody hopped chains, nobody disguised anything. The users gave their real locations at signup.
That makes it the useful counterweight to the assumption that virtual currency sanctions exposure is principally an obfuscation problem. In the largest published cases it has been an implementation problem: the data required to prevent the transactions was already in the exchange’s own systems.
The outcome
OFAC determined the apparent violations were not voluntarily self-disclosed and not egregious, and the settlement formed part of a global resolution alongside FinCEN.