Sanctions Evasion Reference

TradeStation: two layers of geo-blocking, both down

A Florida brokerage paid OFAC $1.1 million in 2026 after a platform rebuild, an unreset setting and a discontinued test tool let its two-layer geo-blocking system fail for nearly a year without anyone noticing.

period

2018–2022

outcome

Settlement

parties

TradeStation Securities, Inc.

programmes

Islamic Republic of Iran, Syrian Arab Republic

reviewed

2026-09-23

Cite this page
APA 7 
Sanctions Evasion Reference. (2026, September 23). TradeStation: two layers of geo-blocking, both down. https://sanctionsevasion.org/cases/tradestation-securities-2026/
Chicago 
Sanctions Evasion Reference. “TradeStation: two layers of geo-blocking, both down.” Last reviewed September 23, 2026. https://sanctionsevasion.org/cases/tradestation-securities-2026/.
BibTeX 
@misc{ser-cases-tradestation-securities-2026,
  author = {{Sanctions Evasion Reference}},
  title  = {TradeStation: two layers of geo-blocking, both down},
  year   = {2026},
  note   = {Last reviewed 2026-09-23},
  url    = {https://sanctionsevasion.org/cases/tradestation-securities-2026/}
}

The date is when this page was last reviewed, not when it was first published.

Penalties imposed

AuthorityDate AmountNote
OFAC 2026-03-17 $1,110,661 481 apparent violations; voluntarily self-disclosed, non-egregious. Discovered by TradeStation in June 2022.

Every control in this case was real. What OFAC’s release documents is what happens when none of them is ever tested again after the day it was built.

What was built

TradeStation ran two independent layers of geo-blocking on its web and mobile platforms: a firewall denying access from IP addresses in sanctioned jurisdictions, and a second-tier tool that separately re-verified a user’s location at each login. A third-party service sent daily alerts listing blocked access attempts. TradeStation had also built its own automated tester that simulated logins from sanctioned-jurisdiction IP addresses specifically to confirm the first two layers still worked.

How all four failed

  • April 2018. A rebuild of the mobile platform’s software caused the second-tier geo-blocking to check the IP address of TradeStation’s own US-based server rather than the user’s, silently defeating it for every mobile user.
  • June 2021. An employee disabled the first-tier geo-blocking to install a cloud provider’s software update and never turned it back on. It stayed off until at least June 2022.
  • November 2021. TradeStation’s own third-party internet and cloud providers had begun blocking its automated test traffic, so the test could no longer verify anything. Rather than fix it, TradeStation discontinued the tool without replacing it.
  • September 2021. An employee received an email that the daily-alert subscription was about to expire and did not act on it before it lapsed.

With both geo-blocking layers down, the test tool blocked, and the alerts lapsed, nothing in the system could have surfaced the problem. Users in Iran, Syria and Crimea executed 481 trades on the mobile platform over the following months before a routine review caught it.

The penalty

Voluntarily self-disclosed and non-egregious. OFAC’s own compliance framework treats this pattern directly: testing and audit exist specifically to confirm a programme “is working as designed,” matched to its sophistication — the step TradeStation’s discontinued tester was built to perform and then stopped performing.

What the record shows

  • A working control and a tested control are different claims. Every one of TradeStation’s layers had worked when built. None had been confirmed to still work.
  • Redundant controls fail independently, not together. The first- and second-tier geo-blocking broke for unrelated reasons, three years apart, and neither failure exposed the other.

See untested screening controls and the Interactive Brokers case for the same pattern at a larger brokerage.

Techniques this case demonstrates

Programmes and jurisdictions in this case

  • Iran sanctions — A layered set of US, EU and UN measures dating from 1979 and substantially rebuilt after 2018, covering energy, finance, shipping, and proliferation-related procurement.
  • Syria sanctions — US, EU and UK measures restricting dealings with the Syrian government, its energy sector and designated parties, with substantial humanitarian carve-outs.

Enforcement documents and sources

  1. TradeStation Securities, Inc. Settles with OFAC for $1,110,661. U.S. Department of the Treasury, Office of Foreign Assets Control, 2026. Enforcement release, 2026-03-17, US$1,110,661.
  2. A Framework for OFAC Compliance Commitments. U.S. Department of the Treasury, Office of Foreign Assets Control, 2019. Risk Assessment, Mergers and Acquisitions (M&A); Root Causes, item III; General Aspects of an SCP, Testing and Auditing.

All enforcement cases