CoinList Markets: Crimea Was in the Address All Along

In the CoinList Markets OFAC Crimea settlement, CoinList Markets LLC agreed to pay $1,207,830 to resolve apparent sanctions violations involving services to users in Crimea. The Treasury’s Office of Foreign Assets Control said the exchange collected Crimean addresses at account opening, but its screening missed them when the country-of-residence field said Russia. In the agency’s account, the location information was already inside the business. The failure was in how the system used it.

The agency announced the civil settlement on December 13, 2023. It described CoinList as a San Francisco virtual-currency exchange and money services business, acting as an intermediary for users buying, selling and converting cryptocurrencies. The case turns on a familiar problem for people who build or operate account-opening systems: collecting a customer’s information and making the screening decision from that information are different jobs.

How Crimea Addresses Slipped Past Screening

According to the Office of Foreign Assets Control, CoinList’s screening failed to connect the country selected by a customer with the location given elsewhere in the same application. The agency said the exchange opened 89 accounts whose users all supplied addresses in Crimea. Nearly all selected Russia as their country of residence.

The enforcement release says opening an account and digital wallet required individuals to provide their country of residence, address, date of birth, phone number, selfie and a photograph of government-issued identification. Business applicants also supplied incorporation documents, their country of incorporation, company address, shareholders with 25 percent or more ownership, and signatory information.

The agency’s explanation identifies the precise break between collecting those answers and acting on them:

The Controls Already in Place

The Office of Foreign Assets Control described sanctions-list screening, transaction monitoring and blockchain analytics already in place at CoinList. CoinList screened new and existing customers against the agency’s sanctions lists and those of other authorities. Its blockchain tools looked for connections with high-risk jurisdictions and sanctioned wallet addresses. When a user placed a trade, CoinList held the requested amount in the user’s wallet and reviewed it for suspicious activity.

Beginning in February 2021, CoinList also added controls intended to deny access from IP addresses in sanctioned jurisdictions. By spring 2021, its automated onboarding process was supposed to reject applicants who supplied identification or a physical address from a comprehensively sanctioned jurisdiction.

The agency described an exchange with tools to trace blockchain activity that still missed Crimea in its own customers’ addresses.

What OFAC Counted

The Office of Foreign Assets Control identified 989 apparent violations involving financial services supplied between April 19, 2020 and May 7, 2022. The transactions totaled $1,252,280, close to the amount CoinList agreed to pay to settle the case.

In the agency’s account, the failure at account opening carried into the exchange’s ongoing business with those users.

The agency classified the apparent violations as non-egregious and said CoinList had not voluntarily disclosed them.

Why OFAC Said the Controls Failed

The Office of Foreign Assets Control said CoinList knew or had reason to know it was processing transactions for people likely resident in Crimea because the customers had identified their locations themselves. Every account in question supplied a Crimean city, the word Crimea, or both when it opened.

The agency pointed to customer information the exchange already possessed. It also faulted CoinList for failing to put in place controls able to flag accounts whose owners described themselves as Crimea residents. The agency said that processing those transactions conferred economic benefits on Crimea and undermined the sanctions program’s objectives.

The agency also credited CoinList’s cooperation, including responses to questions and the provision of transaction data. It noted the small share of the company’s annual transaction volume represented by the apparent violations and the remedial work the company undertook.

What CoinList Changed and What the Settlement Required

According to the enforcement release, CoinList changed its filters to reject applicants who supplied a Crimean city in their residential address, regardless of the country they selected. The new settings also covered addresses that named a Crimean city without using the word Crimea.

The agency also described IP geo-blocking, new vendors for identity-document verification and restricted-party screening, and tools to detect VPNs that can obscure a user’s location. CoinList enhanced its training and hired additional experienced compliance personnel. The agency’s broader lesson was to build sanctions compliance into development and beta testing.

The Office of Foreign Assets Control suspended $300,000 pending satisfactory completion of CoinList’s compliance commitments. It also agreed to count $300,000 in additional sanctions-control investment as partial satisfaction of the settlement, including enhanced screening and additional staff.

What Exchange Records Can Show

An exchange’s customer records can explain something a public transaction hash cannot: who held the account, what location they supplied and how the business handled that information.

For a failure like the one OFAC described at CoinList, we connect the onboarding answers with screening decisions, account activity and escalation history. An employee who knows which fields a screening rule actually reads may understand why an address was missed. Someone reviewing customer accounts may see the location information that the automated decision passed over.

The Wharton Initiative on Financial Policy and Regulation’s 2024 paper Anti-Money Laundering: Opportunities for Improvement finds that institutions often use the same compliance infrastructure for anti-money-laundering and sanctions obligations. A failure to use customer information can therefore matter to both functions. At CoinList, the Office of Foreign Assets Control’s specific concern was whether the screening process incorporated the information gathered at onboarding and through transactions, including IP location.

The Financial Crimes Enforcement Network’s Bittrex consent order supplies a useful parallel. That exchange and hosted-wallet business failed to maintain an effective anti-money-laundering program and report suspicious transactions. A separate sanctions resolution addressed overlapping activity.

Whistleblower Rewards for Sanctions Information

The Financial Crimes Enforcement Network’s whistleblower program covers qualifying sanctions enforcement. The law provides qualifying whistleblowers collectively 10% to 30% of qualifying collections from covered actions exceeding $1 million in monetary sanctions. For an exchange insider, we assess how evidence about a screening failure can support a case under that program.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. That is a separate program. For sanctions evidence, our work starts with the Treasury whistleblower route and the conduct you can show.

You Know Which Fields the System Used

If you saw customer addresses pass through sanctions screening that should have caught them, talk with our whistleblower experts about what happened inside the exchange. We build the case with you and bring in sanctions whistleblower lawyers who understand exchange controls, customer data and Treasury enforcement. We stay beside you as your knowledge of the system becomes evidence for the case.