Bittrex: The Customer Locations Were Already on File

In the Bittrex FinCEN OFAC AML sanctions settlement, the Financial Crimes Enforcement Network imposed a $29,280,829 civil penalty for an ineffective anti-money laundering program and missed suspicious activity reports. The Office of Foreign Assets Control said Bittrex already held customer addresses and IP data that its sanctions screening failed to use. For an exchange insider, the story is familiar in its parts: information collected at account opening, a vendor checking only part of it, and transaction growth that left the people reviewing it behind.

The October 11, 2022 resolutions addressed different failures. In its civil consent order, Bittrex admitted the facts and willful Bank Secrecy Act violations. Bittrex also settled with the Office of Foreign Assets Control over its apparent sanctions violations.

An Exchange With Customer Files and Hosted Wallets

Bittrex operated a virtual currency exchange and a hosted wallet service from Bellevue, Washington. Customers could trade currencies on the platform and use its wallets to store and transfer them. The Financial Crimes Enforcement Network’s account covers conduct from February 2014 through December 2018, when the platform exchanged more than 250 virtual currencies.

The business combined customer information with the ability to move value. The agency treated Bittrex as a money services business subject to the Bank Secrecy Act’s anti-money laundering requirements.

That work reaches across an exchange. Bittrex’s orders show what happened when information the business possessed failed to become a working control.

Sanctions Screening Left the Location Out

Bittrex collected IP and physical address information but did not screen it for sanctioned locations. The OFAC notice gives examples that require no elaborate blockchain analysis: an Iranian passport and a customer who identified at account opening as being in Iran. The location was already in the customer file.

Bittrex hired a sanctions screening vendor in February 2016. Until October 2017, that vendor checked transactions against the Specially Designated Nationals List and other lists without checking customers or transactions for a connection to sanctioned jurisdictions.

The screening left the customer’s location unanswered, even when Bittrex had collected the answer. The sanctions agency emphasized that an exchange remained responsible for ensuring that its screening provider’s services matched its sanctions risks.

The Office of Foreign Assets Control identified 116,421 apparent violations involving approximately $263,451,600 in virtual currency transactions. The customers were apparently located in Crimea, Cuba, Iran, Sudan and Syria. Most of the activity fell between March 2014 and December 2017. The Sudanese restrictions involved were later removed.

The change came after the sanctions agency issued a subpoena in October 2017. According to the notice, Bittrex then realized the vendor was not checking sanctioned locations and began restricting accounts and screening IP and other addresses. New screening and blockchain tracing software, additional staff and training substantially curtailed the apparent violations.

What Are Violations of the Bank Secrecy Act?

In Bittrex’s civil consent order, the violations were an ineffective anti-money laundering program and failures to report suspicious transactions accurately and on time.

In 2016, Bittrex averaged 11,000 deposits and withdrawals a day. Two employees with minimal anti-money laundering training and experience manually reviewed the activity alongside their other duties. In April 2017 Bittrex hired more employees to help the two reviewers, but FinCEN found all of them overwhelmed. Later in 2017, the daily average reached 23,800 transactions, worth approximately $97.9 million, yet the consent order says the company still relied on the same two employees to manually review every transaction. Transaction volume grew.

The Financial Crimes Enforcement Network found that Bittrex grew its business without investing in the resources, tools and staff needed for effective anti-money laundering compliance. That gave it an unfair competitive advantage over businesses that made those investments.

Bittrex filed no suspicious activity report from its founding in 2014 until May 2017, then only one between May and November. The order describes missed transactions with darknet marketplaces including AlphaBay, Agora and Silk Road 2, and failures to detect, investigate and report transactions connected to ransomware attacks against U.S. individuals and small businesses.

The Internal Revenue Service notified Bittrex in October 2017 that it intended to examine the company’s compliance. A month later, Bittrex filed 119 suspicious activity reports. In December, it paused new accounts and hired a qualified anti-money laundering compliance officer. Until late 2017, Bittrex had assigned that job to its chief executive. The agency found that arrangement inadequate for the volume and scope of its business. Manual review nevertheless continued through December 2018, with the program still seriously short of resources.

Both agencies credited Bittrex’s cooperation and improvements. These included automated monitoring, more staff and training, and independent audits.

Privacy Features Needed Their Own Controls

Bittrex knew that anonymity-enhanced cryptocurrencies created particular monitoring problems, but failed to address those risks fully in its written program or in practice. The consent order names monero, zcash, pivx and dash among the currencies involved.

Disabling privacy features worked for some products. For currencies whose privacy features could not be disabled, the Financial Crimes Enforcement Network said Bittrex implemented no other risk controls until after the period covered by the order. Appropriate controls for especially challenging currencies such as monero came several years later. The order describes monero as concealing sender information and transaction amounts, making supervisory monitoring particularly difficult.

The SAR Failure Went Beyond the Sanctions Match

The Financial Crimes Enforcement Network found suspicious activity that went beyond a customer’s location in a sanctioned jurisdiction. Its order describes more than 200 transactions involving $140,000 worth of virtual currency, nearly 100 times the platform’s average deposit or withdrawal, and 22 transactions involving more than $1 million each. Bittrex failed to identify and report those transactions.

That distinction matters inside a business with separate sanctions and transaction monitoring functions. A sanctions match did not exhaust what the exchange knew about the transaction.

The order also describes how inadequate monitoring prevented Bittrex from combining available information, including traceable activity on public blockchains. Its failure reached beyond identifying a prohibited location. It affected the analysis of what an account was doing, how that activity compared with ordinary transactions, and what needed to reach investigators.

What Reporting Counts Miss

The Wharton Initiative on Financial Policy and Regulation’s 2024 paper, Anti-Money Laundering: Opportunities for Improvement, describes the overlap between the infrastructure used for anti-money laundering and sanctions compliance. It also finds that rising suspicious activity report volumes are difficult to interpret: more filings can reflect better detection, more crime or defensive reporting.

Bittrex shows what a filing count cannot: a written policy could recognize geographic risk while the vendor left location data unused. A product could carry known privacy risks while its controls remained incomplete. The people who worked with those systems can explain where the policy stopped and the business carried on.

The OFAC Payment Counted Toward FinCEN’s Penalty

Bittrex agreed to pay $24,280,829 to resolve OFAC’s apparent sanctions violations. The FinCEN order’s payment terms credited that payment against the civil assessment described above and required a further $5 million payment to Treasury. Adding the assessments together would count the credited amount twice.

The earlier BitMEX civil assessment illustrates the same need to read across agency orders. In that virtual currency derivatives matter, the agency addressed anti-money laundering, customer identification and suspicious activity reporting failures, with a credit for a payment to the Commodity Futures Trading Commission.

What Proof Do You Need as a Whistleblower?

For an exchange insider, proof may be in the work you already know: customer location fields, the scope of vendor screening, transaction records, staffing decisions and the response to regulatory scrutiny. Our whistleblower experts work with you to connect your view of those decisions to the conduct they reveal.

Someone who knows how the exchange reconciles its accounts may explain a gap that a public transaction trace leaves open.

Does FinCEN Have a Whistleblower Program?

Yes. The Financial Crimes Enforcement Network’s whistleblower program covers information about Bank Secrecy Act violations and specified sanctions violations. It offers potential awards for qualifying information that leads to successful Treasury or Justice Department enforcement. Our experts assess that route with exchange insiders who know how a control failed and who made the decisions behind it.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. That is a separate program from the Treasury enforcement described here. We work through the appropriate whistleblower program with you based on the conduct you know.

You Know Which Controls Reached the Transactions

If you saw an exchange collect customer information that its screening never used, or grow transaction volume while leaving reviewers overwhelmed, speak to one of our Whistleblower Experts about the controls that failed. We develop the case with you, find anti-money laundering and sanctions whistleblower lawyers who understand exchange operations, and stay beside you as we build your strongest whistleblower case.