Payoneer’s written policy banned transactions involving parties in sanctioned locations from as far back as June 2015. What OFAC’s release documents is a gap between that policy and what the screening system and the checks on it actually did.
What the notice says happened
Between 4 February 2013 and 20 February 2018, Payoneer, a New York-based online money transmitter and provider of prepaid access, processed 2,220 transactions totalling $793,950.70. Of these, 2,201 payments were for parties located in the Crimea region of Ukraine, Iran, Sudan and Syria, and 19 were for persons on the SDN List. The payments were made for Payoneer’s corporate customers and for card-issuing financial institutions.
Four control breakdowns
OFAC identifies four, each in the screening or review step rather than in any attempt to hide the payments:
- Weak matching. Algorithms were weak enough that close matches to SDN List entries were not flagged by the filter.
- No BIC screening. Payoneer did not screen for Business Identifier Codes, including where SDN List entries contained them.
- Backlog releases. In backlog periods, payments that had been flagged and pended were automatically released without review.
- No location focus. Payoneer was not monitoring IP addresses or flagging addresses in sanctioned locations, which OFAC singles out as a particular gap for Crimea.
Testing that did not catch it
The notice states that the testing and auditing conducted to verify that the policies were being implemented “failed to identify the compliance deficiencies” behind the violations. It does not say testing was absent. It says the tests that existed did not find these problems. OFAC’s compliance considerations point to what they should have covered: audits that look at sanctioned locations as well as listed persons, and algorithm testing “to be sure filters are flagging payments” as expected. The remedial measures include hiring compliance staff focused on testing. This is a variant of the untested screening controls pattern, in which the failure is a testing scope that missed the weak points. It is different from TradeStation, where a working control was never rechecked.
The penalty
OFAC set the statutory maximum at $654,357,316 and the base penalty at $3,849,726. It settled at $1,385,901.40.
Aggravating factors, as stated: Payoneer failed to exercise a minimal degree of caution or care by letting SDN-listed persons and persons in sanctioned locations open accounts and transact through processes that were deficient for years; it had reason to know user locations from billing, shipping or IP addresses, or identification copies in its possession; and the violations harmed six sanctions programs.
Mitigating factors: senior management acted quickly to self-disclose the blocked-person violations and cooperated substantially; no penalty notice or Finding of Violation in the prior five years; and remedial measures. These included replacing the Chief Compliance Officer, adding BIC and alias screening, screening names, addresses and IP data for sanctioned locations, pending flagged transactions during backlogs, and a daily review of uploaded identification documents.
What the record shows
- A written prohibition is not a control. The policy existed for years before the screening system could enforce it for locations and for close name matches.
- A test is only as good as its scope. Testing that checked implementation but did not find weak matching, missing BIC screening or unmonitored locations did not detect any of them.
- Information on file was enough. OFAC says Payoneer already held billing, shipping or IP addresses and identification copies that indicated user locations.