BitPay: Screening Merchants While Buyers Passed Through

In the BitPay OFAC buyer location sanctions case, the payment processor agreed to pay $507,375 over allegations that it screened merchants but failed to use location data about their buyers. The agency alleged that buyer information reached BitPay during payment but its transaction review failed to use it.

The Office of Foreign Assets Control announced the civil settlement on February 18, 2021, covering 2,102 apparent sanctions violations. The agency alleged that buyers apparently in Crimea, Cuba, North Korea, Iran, Sudan and Syria could buy from merchants in the United States and elsewhere through BitPay’s platform. The case turns on a distinction familiar to payment employees: the merchant receiving the money and the buyer sending it are different people to screen.

The Payment Processor Screened Merchants, Not Their Buyers

BitPay’s service let merchants accept digital currency for goods and services while receiving payment in ordinary currency. The Atlanta company received digital currency from a merchant’s buyer, converted it to fiat currency and passed that currency to the merchant. The agency’s description of the payment flow puts BitPay between the purchase and the merchant’s receipt of the money.

The Office of Foreign Assets Control said BitPay screened its direct customers, the merchants, against the agency’s List of Specially Designated Nationals and Blocked Persons. It also checked that those merchants were outside sanctioned jurisdictions. According to the agency, the gap was on the other side of the purchase: BitPay failed to screen location information it obtained about the merchants’ buyers.

Buyer Location Data Already in the Transaction

BitPay sometimes received the buyer’s name, address, email address and phone number when a transaction took place. Beginning in November 2017, it also obtained buyer IP addresses. The agency alleged that the transaction review process failed to fully analyze that identification and location data.

The Office of Foreign Assets Control used IP addresses and invoice information to identify the locations behind the payments. Its notice says BitPay held location information before completing the transactions. The alleged review failure occurred while the company still had the payment in front of it.

For a payment employee, that makes the connection between the invoice and the review decision central. A buyer address can sit in the purchase information while the sanctions review concentrates on the merchant. Our work with an insider is to connect what the company received to what its review actually considered. In BitPay’s case, the agency said the company had sufficient information to screen the buyers and still allowed the transactions through.

The Settlement and the Payments It Covered

The digital-currency transactions described by the agency totaled approximately $129,000, less than the amount BitPay agreed to pay in the settlement. The cost of the missed screening exceeded the payments that passed through it.

The agency placed the transactions between approximately June 10, 2013 and September 16, 2018. It said BitPay had allowed the conduct for approximately five years despite having sufficient screening information, and that the payments benefited people in sanctioned jurisdictions at the expense of the sanctions programs.

The agency also credited the controls BitPay already had. Merchant due diligence and sanctions screening dated to 2013, and the company formalized its sanctions compliance program in 2014.

That combination is the point. The company had a program, training and merchant restrictions. The agency’s allegation concerned the buyers those controls missed. A policy prohibiting a merchant from signing up did not answer where the merchant’s next payment came from.

What BitPay Said It Changed

BitPay told the Office of Foreign Assets Control it had ended the conduct and introduced controls aimed directly at buyer access and identification.

The company said it blocked IP addresses appearing to originate in Cuba, Iran, North Korea and Syria from connecting to its website or viewing payment instructions. It also said it checked buyers’ physical and email addresses when merchants supplied them, preventing invoice completion when it identified a sanctioned-jurisdiction address or email top-level domain.

The company also said it introduced BitPay ID, mandatory for buyers paying invoices of $3,000 or more. The tool required an email address, proof of identification or photo ID, and a selfie.

Each measure addressed a different part of the payment: reaching the website, completing the invoice and identifying the person paying it. The changes bring the buyer into a process whose earlier controls had concentrated on the merchant.

Why the Payment Records Matter Alongside the Blockchain

A blockchain transfer and a processor’s customer records answer different questions. A public transaction record can show value moving without supplying the customer’s identity, the company’s screening decision or what its staff knew. Those connections sit in the account, payment and review records.

The Hudson Institute’s 2021 report, Countering Global Kleptocracy: A New US Strategy for Fighting Authoritarian Corruption, explains why public transaction records can help investigators:

The report emphasizes the value of connecting a point of identification to the ledger. It also identifies convertibility into fiat currency as an important part of cryptocurrency’s value. BitPay’s service performed that conversion for merchants. Its own payment process also received information about the people buying from them.

That is where an insider’s account adds something a transaction trail alone cannot supply. The useful question is how information moved through the business: which buyer fields arrived, which reached the review, and which affected whether the payment went through. The agency’s notice makes the same operational point by emphasizing screening of all available customer and counterparty information, including location data.

Other Sanctions Cases Show Different Gaps

The Office of Foreign Assets Control alleged similar failures to use available information elsewhere, but at different points in the service. In BitGo’s OFAC settlement, the agency alleged that IP data collected for security were not adequately used to screen people using its wallet service. In Kraken’s sanctions case, the agency alleged that onboarding checks did not prevent later access from sanctioned jurisdictions, including transactions by people apparently in Iran.

At Bittrex, the agency alleged that customer addresses and IP data were available but inadequately screened for sanctioned locations. At CoinList, the agency alleged that country-of-residence screening missed Crimea addresses entered in other fields.

BitPay adds the payment intermediary’s version of the problem. The direct customer was the merchant, while the location information concerned the buyer. Across these cases, having the data and using it in the relevant decision were different things.

From Payment Operations to a Whistleblower Case

Anti-money laundering monitoring also depends on connecting customer information to transactions. In payment networks, the direct customer and the person behind a payment can be different. An insider who understands the invoice fields and transaction review can explain where a buyer’s location entered the system and what happened to it. We work with that knowledge to connect the payment, the available information and the company’s decisions. The strongest account explains how the controls operated on actual transactions.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. For information about sanctions violations or failures of anti-money laundering controls, our whistleblower experts assess the separate Financial Crimes Enforcement Network whistleblower program with you. We connect your information to the program and sanctions whistleblower lawyers suited to the conduct you know.

You Know What the Payment Review Missed

If you saw buyer location information reach a payment processor and disappear from its sanctions review, talk with our whistleblower experts. We build the case with you, bring in sanctions whistleblower lawyers who understand payment-processing controls, and stay alongside you as the case moves forward.