BitPay Fined for Allowing Consumers to Pay Merchants from Sanctioned Jurisdictions


By Samuel Rubenfeld

Thursday, February 18, 2021

BitPay, Inc., a payment processor merchants use to accept digital currencies in sales transactions, agreed to a settlement with the U.S. Treasury Department after allowing users from multiple sanctioned jurisdictions to buy goods from merchants despite knowing their locations.

The Atlanta, Georgia-based company had screened merchants -- its direct customers -- against the U.S. sanctions list, but failed to investigate the location data it had obtained about the merchants’ consumers, according to a notice issued by the Treasury’s Office of Foreign Assets Control (OFAC). At times, BitPay received information about the merchants’ buyers when a transaction occurred, such as a name, address, phone number and IP address, but it failed to fully analyze the location data, the notice said.

“This action highlights that companies involved in providing digital currency services -- like all financial service providers -- should understand the sanctions risks associated with providing digital currency services and should take steps necessary to mitigate those risks,” OFAC said.

Between June 2013 and September 2018, BitPay processed about 2,100 transactions on behalf of individual consumers who, based on IP addresses and information available on invoices, were located in the Crimea region of Ukraine, Cuba, North Korea, Iran, Sudan or Syria, the OFAC notice said. Users in those jurisdictions engaged in about USD 129,000 worth of digital currency-related transactions with BitPay’s merchant customers, according to OFAC.  

The company, which did not self-disclose the violations, agreed to pay about USD 507,000 to resolve the case, OFAC said, deeming the case as non-egregious. BitPay didn’t have a public response to the sanctions penalty posted on its website, but a representative told CoinDesk, a cryptocurrency-focused trade publication, that the company was “pleased to have resolved this matter,” and that the average transaction was less than USD 100 in value.

BitPay works with consumer-facing companies in a wide range of sectors, ranging from electronics and hardware to precious metals, gaming and travel, according to its website. 

A consumer purchasing goods or services via BitPay receives an invoice and makes a payment to the merchant at a locked-in exchange rate, converted to the local currency, according to the company’s page geared toward businesses. BitPay then initiates a settlement for the payment the next business day, the site says. Personal consumers can use the BitPay app or a prepaid debit card to shop online or in person, and the company offers non-custodial wallet services. The company applied in December to the U.S. Office of the Comptroller of the Currency to form a national trust bank, according to media reports and a post on its social media page.

(Source: BitPay social media)

BitPay faced a penalty in the case as high as nearly USD 620 million, but OFAC credited the company for a number of mitigating factors, including that it had certain sanctions controls in place since 2013 and formalized a compliance program a year later. 

The company also terminated the conduct that led to the penalty and took several remedial measures, such as blocking IP addresses that appear to originate in sanctioned jurisdictions. BitPay now checks the physical and email addresses of buyers when merchants provide the information, and it launched a customer identification tool, called “BitPay ID,” that is mandatory for buyers paying invoices of USD 3,000 or more, OFAC said in the notice.

The settlement with BitPay comes amid an increased focus on cryptocurrencies at the Treasury, as bitcoin’s value rises to record levels during a rapid increase in mainstream acceptance. 

In late December, OFAC fined BitGo Inc. about USD 98,000 after the company tracked the IP addresses of users for security purposes, but not for sanctions compliance. Treasury Secretary Janet Yellen delivered remarks at a financial sector innovation policy roundtable held earlier this month, saying that though misuse of cryptocurrency is “a growing problem,” new technologies also hold promise.

The recent OFAC cases show that the compliance obligations are the same regardless of the currency in which a transaction occurs, said Katherine Kirkpatrick, a partner in the special matters and government investigations practice at the law firm King & Spalding LLP.

“Companies need to do everything they can to increase their visibility into these transactions,” said Kirkpatrick, who is also a member of the firm’s fintech and cryptocurrency working groups.

If a payment processor obtains certain information about a merchant’s consumer, such as physical location in a sanctioned jurisdiction, OFAC will hold them accountable for how it is handled, said Judith Alison Lee, a partner at Gibson, Dunn & Crutcher LLP who co-chairs the firm’s international trade practice group. “It is clear from this settlement that OFAC expects companies to screen IP location,” she said. “If you don’t, you can expect a penalty.”