BitGo: The Location Data Were Already There

BitGo agreed to a $98,830 civil settlement with the Treasury Department’s Office of Foreign Assets Control over noncustodial wallet IP screening failures. The agency alleged that the service let people in sanctioned jurisdictions make 183 digital-currency transactions worth about $9,128.

The company already collected their login IP addresses for security. The location information was there. According to the agency’s December 30, 2020 enforcement notice, BitGo failed to use it for sanctions compliance. An employee working on account security or screening could recognize that gap from inside the business.

The Noncustodial Hot Wallet at Issue

BitGo’s noncustodial hot-wallet service gave users access to an online wallet that stored keys online and could send digital currency to other wallets through a public blockchain. The Office of Foreign Assets Control described BitGo, based in Palo Alto, California, as a technology company providing security and scalability platforms for digital assets.

The notice drew a precise boundary around the service. Its apparent violations concerned hot-wallet services supplied by BitGo Inc. The enterprise and custodial services supplied by BitGo Trust Company, its affiliate, were outside that account.

The Financial Crimes Enforcement Network’s guidance on virtual-currency business models distinguishes a hosted provider’s control of customer value from an unhosted user’s control of their own transactions. BitGo’s sanctions issue concerned access: even with a noncustodial wallet, the company could use login information to identify where users were located.

Login Security Had the Data Sanctions Screening Needed

The Office of Foreign Assets Control traced the transactions to approximately March 10, 2015 through December 11, 2019. It said the users appeared to be in Crimea, Cuba, Iran, Sudan and Syria based on their IP addresses. They could open hot-wallet accounts and use BitGo’s platform to make transactions.

Before April 2018, an individual could open a BitGo wallet account with only a name and email address. BitGo then added a requirement for new accountholders to identify their country. The notice says the company generally relied on the user’s own attestation and did no additional location verification or diligence.

The company already held a separate source of location information in its login records, and the sanctions office said it had reason to know where some users were located from those records.

For an insider, this is the useful distinction between blockchain evidence and company evidence. A public transaction hash can show a transfer without identifying who owned the money or what staff knew. Account records and screening decisions can fill those gaps. Here, the location evidence the sanctions office emphasized sat in the company’s security data.

Why OFAC Focused on the Existing IP Data

The Office of Foreign Assets Control treated BitGo’s possession of the IP data as a factor that counted against the company. The agency said BitGo failed to exercise due care by allowing people apparently in sanctioned jurisdictions to open accounts and send digital currencies without appropriate sanctions controls.

The notice gives a statutory maximum civil penalty of $53,051,675 and a base civil penalty of $183,000 under the agency’s enforcement guidelines. Those figures show how far the possible penalty reached beyond the value transferred. The agency said BitGo had not voluntarily disclosed the apparent violations.

The sanctions office credited BitGo’s cooperation and the changes the company said it had made. But its central criticism was simple: BitGo already had location information that its sanctions controls failed to use.

What BitGo Changed

The notice says BitGo adopted a sanctions policy in January 2020 after learning of the apparent violations. BitGo told the agency it had hired a chief compliance officer and extended the policy across all its services.

The company said its changes included IP-address blocking for sanctioned jurisdictions and a retroactive screen of all users. It also described screening accounts against the blocked-persons list, including cryptocurrency wallet addresses identified by the Office of Foreign Assets Control. Those changes addressed both where users were connecting from and whether their accounts matched a sanctions listing.

The Office of Foreign Assets Control’s Sanctions Compliance Guidance for the Virtual Currency Industry develops the same point beyond this settlement. It recommends considering location information collected for business or security purposes, including customer addresses, email information and invoices, when screening for sanctions risks. Its testing guidance asks whether IP-blocking software actually prevents access from sanctioned jurisdictions.

The configuration, the account information and the access history can show whether a restriction described in a policy actually operated.

A Compliance Program Has to Use What the Business Knows

A Wharton Initiative on Financial Policy and Regulation white paper, Anti-Money Laundering: Opportunities for Improvement, published in 2024, argues that the effectiveness of the broader anti-money-laundering system is difficult to measure and that its design has to account for actual capabilities and information. One of its principles puts the practical constraint plainly:

Applied to BitGo, the information part is unusually concrete. The Office of Foreign Assets Control identified an existing source of location data and a compliance process that failed to use it. Someone who worked on both systems can explain where that connection broke.

Bittrex Shows Why the Service and the Failure Both Matter

The Financial Crimes Enforcement Network’s October 2022 consent order against Bittrex addressed an exchange and hosted-wallet business that failed to maintain an effective anti-money-laundering program and report suspicious transactions.

The Office of Foreign Assets Control’s BitGo notice concerned access to its noncustodial hot-wallet service and the unused IP information. The comparison puts different responsibilities inside the same digital-asset industry: controlling access from sanctioned jurisdictions, maintaining an effective anti-money-laundering program and reporting suspicious activity. The service someone worked on, and the control they saw fail, give a whistleblower account its substance.

The Whistleblower Route Depends on the Conduct

The Treasury whistleblower program provides for rewards for qualifying information about covered anti-money-laundering and sanctions violations. A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. For an insider with knowledge of ignored location data or screening failures, we assess the conduct and the appropriate reward program together.

You Know What the Login Records Show

If you saw location data collected while sanctions screening ignored it, speak to one of our Whistleblower Experts about where the screening failed. We work with you to build your strongest sanctions whistleblower case, bring in sanctions whistleblower lawyers who understand digital-asset services, and stay beside you through the pursuit of a recovery.