What Happened
Exodus Movement, Inc. (“Exodus”), a U.S. company that makes software wallets for digital assets, has agreed to pay $3,103,360 to settle potential violations of U.S. sanctions against Iran.
Between October 2017 and January 2019, Exodus allowed users in Iran to use its software to manage and trade digital currency. While Exodus didn’t process the trades itself (it used third-party partners), it earned fees from the transactions.
The main issue was that Exodus staff knew some users were in Iran—a sanctioned country—but helped them anyway. When Exodus’s partners blocked these users to comply with the law, Exodus customer support told the users to use a VPN (Virtual Private Network) to hide their location and bypass the blocks. All of this happened even though Exodus’s own rules said people in sanctioned countries couldn’t use the app, but the company didn’t have a real system in place to check or stop them.
The Penalty
Exodus agreed to pay $3,103,360 to resolve the matter. The total maximum possible penalty was much higher, but the final amount was reduced because Exodus cooperated and fixed the problems.
Breakdown of Violations
There were 254 total violations, split into two types:
- 12 Egregious Violations: These were the most serious cases where staff actively helped users evade sanctions. The base penalty for these was calculated at the legal maximum, totaling $4,532,400.
- 242 Non-Egregious Violations: These were the standard transaction violations where users in Iran simply used the wallet without specific evasion advice.
Aggravating and Mitigating Factors
OFAC determined the final penalty by weighing “Aggravating Factors” (bad behavior that raises the fine) against “Mitigating Factors” (good behavior that lowers the fine).
Aggravating Factors
- Helping users trick the system
- General Factor A: Willful or Reckless Violation of Law
- Exodus staff knew their partners had blocked Iranian users for legal reasons but willfully advised those customers to use VPNs to get around the security controls.
- Management knew about the risks
- General Factor A: Awareness of Conduct
- Company leadership and staff were generally aware of U.S. sanctions and knew that their partners were restricting access to Iran, but they continued to support these users anyway.
- Undermining the purpose of sanctions
- General Factor D: Harm to Sanctions Objectives
- By helping people in a sanctioned country trade digital assets, Exodus defeated the purpose of the sanctions (which is to block access to the U.S. financial system) and sabotaged the compliance work of its partners.
Mitigating Factors
- Clean track record
- General Factor B: Administrative License; Prior Notice of Penalty or Penalty
- Exodus has not received a penalty notice or a finding of violation from OFAC in the five years preceding the earliest date of the transactions.
- Fixing the compliance program
- General Factor F: Remedial Response
- Exodus took serious steps to prevent this from happening again, including installing software to block users from sanctioned regions (geo-blocking) and training its staff on compliance rules.
- Cooperating with investigators
- General Factor G: Cooperation with OFAC
- Exodus worked closely with OFAC during the investigation, providing documents and information that helped resolve the case efficiently.
What are the Takeaways?
Compliance Considerations
- Start Early: Companies, especially startups in fintech and crypto, must build sanctions compliance into their business model from day one, not wait until they are large.
- Don’t Help Evasion: Customer support staff should never advise users on how to bypass security controls (like suggesting VPNs). This is considered a willful violation.
- Technology Matters: Simply having “Terms of Use” that ban sanctioned users is not enough; companies need technical controls (like IP blocking) to actually stop them.
- Check Your Partners: If you rely on other companies (like exchanges) to provide services, ensure your compliance standards match theirs so you don’t become a loophole.
Other resources
For more information on how to set up a proper compliance program, OFAC recommends reviewing:
- A Framework for OFAC Compliance Commitments: A guide on the five essential parts of a sanctions compliance program.
- Sanctions Compliance Guidance for the Virtual Currency Industry: Specific instructions for crypto companies on how to follow U.S. sanctions laws.
Mr. Sanctions’ Note: This settlement required some tweaking of the prompt I use to produce these summaries for the non-expert. This was for two reasons:
- The fact that there were both egregious and non-egregious violations caused the original prompt to treat everything as non-egregious. As revised, the summary now shows the effect on the base penalty of those egregious items.
- Probably at least partly due to the previous point, the aggravating factors list included two separate, but related, items: willful behavior in the case of the egregious violations, and reckless behavior with regard to the rest.
Even with this, Gemini missed the (admittedly minor) mitigating factor of not having a recent enforcement history. Luckily, when I told it that it had missed it and that it should be added back, it did so.
BTW, here are the Enforcement Release:
and the Settlement Agreement (which you get pretty rarely – generally only when there is egregious conduct):