Kraken and Payward: Post-Onboarding Iran Access and the Separate SEC Dismissal

Kraken, operated by Payward, agreed to pay $362,159 in its OFAC Iran settlement over apparent sanctions violations, while the separate Securities and Exchange Commission registration case ended in a 2025 dismissal. The exchange checked where customers were when they opened accounts. According to the Office of Foreign Assets Control, it left a gap where those same customers could later transact from Iran. For someone inside an exchange, the revealing question is what happened after the customer passed the opening checks.

Payward, Inc. does business as Kraken, a centralized global virtual currency exchange incorporated in Delaware with operations in the United States and elsewhere. Customers can buy, sell and hold cryptocurrencies, trade conventional currency for crypto, or exchange one cryptocurrency for another. The Treasury Department’s Office of Foreign Assets Control described the Iran access problem in its November 28, 2022 enforcement release.

Kraken’s Onboarding Checks Left Later Iran Access Open

Kraken reviewed IP address information at account opening, but Treasury’s sanctions office said it did not apply IP address blocking to later transactional activity across the platform. Account holders who established accounts outside sanctioned jurisdictions appeared to have accessed those accounts and transacted from a sanctioned jurisdiction afterward.

Between approximately October 14, 2015 and June 29, 2019, the Office of Foreign Assets Control said Kraken processed 826 transactions totaling approximately $1,680,577 for people who appeared to be in Iran at the time.

Kraken already had an anti-money laundering and sanctions compliance program. It screened customers at onboarding and daily thereafter. The location check at account opening also had a defined purpose: preventing people in sanctioned jurisdictions from opening accounts.

According to Treasury’s sanctions office, the gap came after those checks. A customer could satisfy the opening controls, then use the account from a location those controls were intended to exclude. Daily customer screening and transaction-time location blocking did different jobs. The agency’s account shows how an exchange could have the former and still leave the latter undone.

The agency’s criticism was specific. Kraken knew it had customers worldwide, and available IP address information gave it reason to know that transactions appeared to have been conducted from Iran. By the agency’s account, the location information existed. The control stopped at account opening. That left services open to users who appeared to be in Iran, the very access the sanctions controls were meant to prevent.

What the OFAC Settlement Required

On top of the settlement, Kraken committed to invest $100,000 in additional sanctions compliance controls, including training and technical measures for screening.

The Office of Foreign Assets Control classified the apparent violations as non-egregious and voluntarily self-disclosed. In assessing the resolution, it credited Kraken’s cooperation and remedial measures. Its aggravating factor was the failure to apply location controls to subsequent transactions despite the available IP information.

After identifying the problem, Kraken implemented automated blocking for IP addresses linked to sanctioned jurisdictions. Treasury’s sanctions office also described geolocation blocking that prevented clients in prohibited locations from accessing their accounts on Kraken’s website, and multiple blockchain analytics tools to assist sanctions monitoring.

The changes reached staffing as well. Kraken added compliance training, including blockchain analytics, and hired a dedicated head of sanctions and additional sanctions staff.

The Exchange Holds More Than the Blockchain Shows

A centralized exchange’s internal records can connect a customer, a transaction and a location in ways a public blockchain cannot. Hosted exchanges can record transfers on internal ledgers without each transfer appearing individually on-chain. A public transaction hash can identify a transfer while leaving the exchange customer credited internally unidentified.

For an insider reviewing an access failure, that makes the account ledger and the location record useful together. Screening decisions and escalation histories can explain what the business did with the information. These are different parts of the same operational story.

The overlap between sanctions and anti-money laundering systems helps explain why the Kraken matter speaks to both teams. The Wharton Initiative on Financial Policy and Regulation’s 2024 paper Anti-Money Laundering: Opportunities for Improvement observes that financial institutions often use the same compliance infrastructure for both obligations. Here, Treasury’s sanctions office identified the particular failure in that infrastructure: location controls that did not follow the account into later transactions.

The same available-data problem appeared in Bittrex’s separate OFAC settlement. The Office of Foreign Assets Control described customer-address and IP data that were available but inadequately screened for sanctioned locations. The useful parallel is the distance between possessing location information and using it to control access. An insider who knows where that information went can explain a failure that a transaction total alone cannot.

The Separate SEC Registration Case Was Dismissed

The Kraken SEC dismissal concerned the registration action against Payward, Inc. and Payward Ventures, Inc., together operating as Kraken. The Securities and Exchange Commission announced on March 27, 2025 that it and the companies had jointly filed to end that action permanently.

The Securities and Exchange Commission explained that dismissal served its efforts to reform and renew its regulatory approach to the crypto industry. It expressly said the decision did not rest on an assessment of the merits of the claims.

The sanctions settlement addressed access from Iran. The securities action addressed registration. The later dismissal did not undo the earlier sanctions settlement with Payward.

What Proof Do You Need as a Whistleblower?

For an exchange sanctions-control case, useful evidence connects customer access, location information and the decisions that governed whether a transaction could proceed. We work with insiders to understand how those records fit together and what their own view of the system reveals.

An onboarding specialist may know which location checks the customer passed. An engineer may know which blocking rules actually operated during later transactions. A compliance investigator may know how a location signal was handled, and an auditor may know what testing showed. Together, those perspectives can connect the written policy to the system customers actually used.

The International Labour Organization’s 2019 paper Law and Practice on Protecting Whistle-Blowers in the Public and Financial Services Sectors explains why employees can be particularly well placed to expose misconduct: their work gives them access to information about operational practices, management and finances. In an exchange, that can mean understanding why a control worked at onboarding but left later access open.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. Exchange sanctions and securities matters involve separate whistleblower programs. We assess the program that fits your information as part of building the case with you.

You Know Where the Location Check Stopped

If you saw an exchange keep serving accounts after its own location data showed a sanctions problem, speak to one of our Whistleblower Experts about where the location check stopped. We shape your strongest sanctions whistleblower case with you and bring in sanctions whistleblower lawyers who understand exchange records and access controls. You bring the knowledge of how the platform worked, and we stay with you through the pursuit of the case.