Payoneer: The Filter Flagged the Payment, the Backlog Let It Through

Payoneer agreed to pay $1,385,901 in its sanctions settlement with the Office of Foreign Assets Control over alleged payment-screening failures, and later faced a separate order from the New York Department of Financial Services. The federal account describes more than a filter missing a name. The agency alleged that during backlogs, Payoneer automatically released payments its system had already flagged and put on hold, without review. For someone who worked on the screening software, the queue or the audit, that is the decision worth understanding.

What Payoneer Was Processing

Payoneer was a New York-based online money transmitter and provider of prepaid access. The transactions in the federal settlement were commercial payments it processed for corporate customers and card-issuing financial institutions. The Office of Foreign Assets Control’s July 2021 notice describes 2,220 apparent sanctions violations between 2013 and 2018.

Prepaid access allows a customer to retrieve or transfer value previously paid into an account or device. A payment business therefore has information about both the account and the movement of the money. In Payoneer’s case, the agency said the company possessed billing addresses, shipping addresses, IP addresses or identification documents that gave it reason to know where users were located.

In the agency’s account, the location information was already inside the business. The failure was in how the company used it when deciding whether a payment could go through.

How Payoneer’s Sanctions Screening Failed

The Office of Foreign Assets Control described two different payment populations: 2,201 payments for parties in sanctioned locations, including Crimea, Iran, Sudan and Syria, and 19 payments on behalf of people or entities on its sanctions list. Finding a listed name and finding a prohibited location required different checks. The agency alleged failures in both. Its notice also identifies Zimbabwe and weapons of mass destruction proliferator sanctions among the programs involved.

According to the agency, the name filter used weak algorithms that let close matches to the Specially Designated Nationals list pass without a flag. Payoneer also failed to screen Business Identifier Codes even when the agency’s list entries contained them. Those codes offered another way to identify a listed financial institution, but the screening omitted them.

Location screening had its own gaps. The notice says Payoneer was not monitoring IP addresses or flagging addresses in sanctioned locations, with a particular lack of attention to Crimea. A customer’s name could clear the list while the customer’s location still made the payment a sanctions problem.

The backlog failure came after detection. According to the Office of Foreign Assets Control, Payoneer allowed flagged and pending payments to be released automatically without review during backlog periods. The filter had done enough to stop a payment for examination. The queue then let it leave without that examination. Improving the name match alone would leave that release rule untouched.

The Policy Said Stop, but Testing Missed the Failure

The Office of Foreign Assets Control said Payoneer’s policies prohibited transactions involving sanctioned locations as far back as June 2015. It alleged that the testing and auditing intended to verify those policies failed to identify the deficiencies behind the apparent violations. In that account, Payoneer’s policy said stop, its filter said review, and its backlog process let the payment through anyway.

That makes the audit’s scope part of the story. The notice calls for testing whether algorithms flag payments as expected, examining location screening as well as listed-person screening, and holding flagged payments until review. A successful name match answers only part of the question. What happens to the payment afterward matters just as much.

The Wharton Initiative on Financial Policy and Regulation’s 2024 paper Anti-Money Laundering: Opportunities for Improvement describes the overlap between the infrastructure used for anti-money laundering and sanctions compliance, particularly as sanctions target individuals and affiliated entities. That observation helps explain why operations, monitoring and audit employees can recognize the same control problem from different desks. Here, the shared question is concrete: did the information inside the payment business actually affect whether the money moved?

What Payoneer Changed

Payoneer told the Office of Foreign Assets Control it had changed the backlog rule so flagged payments would stay pending until review. It also reported adding financial institution aliases and Business Identifier Codes to screening, alongside shipping, billing and IP addresses.

Payoneer’s OFAC and DFS Sanctions Settlements

The federal settlement covered approximately $793,951 in transactions that the Office of Foreign Assets Control said had passed through the deficient controls.

The New York Department of Financial Services announced its Payoneer consent order on November 2, 2023. That DFS resolution imposed a $1,250,000 civil penalty for sanctions-screening deficiencies.

Other Payment Businesses Had Information Their Controls Missed

The Office of Foreign Assets Control’s BitPay notice describes a payment processor that screened its merchant customers but failed to screen the location information it obtained about their buyers. It received digital currency from buyers, converted it to ordinary currency and passed it to merchants. Buyer addresses, email information, invoices and, later, IP addresses could expose the location behind the payment. Screening the merchant left the buyer outside the check.

At Kraken, the agency described a different gap. The exchange screened customers when they opened accounts and daily afterward, but checked IP information at account opening without blocking IP addresses on later transactions. Customers who opened accounts outside sanctioned jurisdictions appeared to transact later from Iran. The location at account opening answered a different question from the location when the money moved.

Bittrex’s civil consent order with the Financial Crimes Enforcement Network adds the staffing problem. Bittrex admitted relying on two employees with minimal anti-money laundering training and experience to review transactions manually alongside their other duties. The order describes an ineffective monitoring process and failures to file suspicious activity reports. The Office of Foreign Assets Control separately described Bittrex’s failure to use customer IP and physical-address information to screen for sanctioned locations.

These cases expose different places where a payment review can break down: the person screened, the moment the location is checked, the capacity to review, and the release decision. Payoneer’s alleged backlog failure belongs at the end of that chain, where a flagged payment was allowed through.

What an Insider Can Show About the Queue

The useful evidence connects a control to the payments it actually allowed. We examine how the screening rule was configured, what the location data showed, which payments entered the queue and what happened to them during a backlog. Testing results and audit findings can connect those events to what the business knew about the controls.

A monitoring engineer may understand the filter. An operations employee may know the release process. An auditor may know what was tested and what was left outside the review. We connect those accounts to show which control failed and how the payment cleared.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. For qualifying sanctions information, the Financial Crimes Enforcement Network’s whistleblower program offers a combined 10% to 30% of qualifying government collections to eligible whistleblowers. Our experts assess the sanctions reward route with you and bring the payment evidence into focus.

You Know Why the Payment Went Through

If you saw flagged payments released, location data ignored or audit tests miss the real process, tell our whistleblower experts what happened inside the payment business. We develop the matter with you, bring in sanctions whistleblower lawyers who understand payment systems, and stay beside you through the pursuit of a recovery.