A case where the evasion tool was advice. Nothing in the release says Exodus held or moved anyone’s digital assets: its wallet software stores keys and connects users to third-party exchanges. The violations were the support it gave.
What happened
From October 2017 to January 2019, according to OFAC, Exodus answered 254 support requests from wallet users who identified themselves as in Iran. The help generally let them keep using the wallet or the exchanges it linked to. This was against Exodus’s own terms of use, which barred use in embargoed countries, but the release says staff were not trained on that rule and nothing stopped Iranian users from using the product for much of the period.
In April 2018 one exchange partner began blocking users in Iran by IP address. OFAC says Exodus knew by May 2018 that this was probably to comply with US sanctions. On 12 occasions, staff told the Iranian user the exchange had blocked Iran because of US sanctions, and recommended a VPN anyway. One message said the exchange “will not be able to detect you are from Iran if you use a VPN to change your IP address”. OFAC treated those 12 as egregious and as willful or reckless.
The penalty
Base penalty: the statutory maximum for each of the 12 egregious violations ($4,532,400) plus the schedule amount for the other 242 ($242,000), a total of $4,774,400. Not voluntarily disclosed. The settlement was $3,103,360. OFAC credited millions of dollars spent on a new compliance programme, with a standalone policy, more compliance staff, third-party screening and wallet-address monitoring tools, and mandatory training. See how penalties are decided.
What the record shows
- The control was a location check, and advice defeated it. The exchange’s block worked on IP addresses, so telling a user to change theirs undid it.
- A terms-of-use ban was not a control. The release stresses that the prohibition existed on paper but staff were neither trained on it nor stopped by any mechanism.
See crypto rails for the wider technique.