Poloniex: New Checks, Old Accounts Still Trading

In the Poloniex OFAC sanctions settlement, the Boston-based exchange agreed to pay $7,591,630 to settle apparent sanctions violations involving digital-asset trades, deposits and withdrawals. The exchange had customer addresses and login data pointing to sanctioned locations. When Poloniex introduced checks for new customers, it left existing customers outside that review. Some had already told Poloniex where they lived.

The Treasury Department’s Office of Foreign Assets Control announced the settlement on May 1, 2023. Poloniex, LLC, formerly Poloniex Inc., was the company that agreed to pay.

The Transactions Behind the Poloniex Settlement

The Office of Foreign Assets Control identified 65,942 apparent violations involving 232 customers apparently located in Crimea, Cuba, Iran, Sudan and Syria. The transactions totaled approximately $15,335,349.

The transactions ran from approximately July 28, 2015 through September 2, 2019. Customers could fund their accounts, trade digital assets and withdraw them. The agency said Poloniex had reason to know where these customers were from both their customer information and their internet protocol addresses.

Crimea dominated the account, with 57,263 apparent violations. Its prominence matters because Crimea controls arrived later than the platform’s first sanctions program. The Sudan transactions fell under restrictions revoked on October 12, 2017. Treasury retained authority to enforce earlier violations.

New Customer Checks Left Existing Accounts Outside

Poloniex began operating in January 2014 and introduced its sanctions compliance program in May 2015. The new program reviewed Know Your Customer information for new customers in comprehensively sanctioned jurisdictions. According to the Office of Foreign Assets Control, it did not apply that review to existing customers.

That left customers who had supplied addresses in sanctioned jurisdictions before the program began generally able to keep using the platform. The location was already in the customer file. The decision to screen only new accounts left that information unused for the older population.

IP monitoring started in May 2015 as well. Poloniex reviewed logins from sanctioned locations, contacted account owners and closed some accounts. It began implementing an IP block in June 2017. Controls specific to Crimea followed in August 2017.

Those were different stages of the same control problem. The agency said Poloniex’s program did not operate consistently across sanctioned locations or pre-existing accounts.

Poloniex’s customer files and login records showed the location signals available to staff.

What Changed Under Circle

Circle Internet Financial Limited acquired Poloniex in February 2018 and introduced additional sanctions controls. Treasury’s sanctions office said controls introduced by late 2017 had already substantially reduced additional apparent violations, and Circle’s measures reduced the rate further.

The agency described changes that reached into account access itself: freezing accounts until customer verification was complete and preventing activation when profile information matched a sanctioned country. Circle’s measures and subsequent remediation also included closing accounts whose profiles listed Crimea, blocking relevant IP ranges, and screening account information against Crimea city and region keywords.

The Office of Foreign Assets Control credited Circle for beginning its measures before the agency’s investigation and both companies for substantial cooperation.

Some apparent violations continued in 2018 and 2019, primarily through a small number of accounts opened by people then located in Crimea. Poloniex operated the platform until its sale to a third party in November 2019.

Why Treasury Reduced the Penalty

Treasury’s sanctions office started with a base civil penalty of $99,237,000. The settlement was far below that starting point, reflecting the agency’s assessment of both the failures and the improvements.

On the aggravating side, the agency pointed to the initial absence of a sanctions program, inconsistent application afterward and location data Poloniex already possessed. It said the platform gave people in sanctioned jurisdictions economic benefits the sanctions were meant to deny.

The agency reduced the penalty for Poloniex’s small start-up size during most of the apparent violations, its improvements and its cooperation. It also explained that the platform’s processing of trade orders produced many small individual transactions, some below $1.

The SEC Action Concerned Exchange Registration

The Securities and Exchange Commission’s August 9, 2021 resolution settled charges of operating an unregistered digital-asset exchange, a separate matter from the OFAC sanctions settlement.

Why Crypto Exchanges Miss Sanctioned Customers

Poloniex’s account fits a recurring sanctions-control problem: an exchange can hold useful location information without applying it wherever customers gain access. In CoinList’s OFAC notice, country-of-residence screening missed Crimea addresses entered in other fields. At Kraken, onboarding checks did not prevent later access from sanctioned jurisdictions. The agency’s Bittrex account likewise described customer addresses and IP information that were available but inadequately screened for sanctioned locations.

Poloniex adds the history of the controls themselves. Its notice identifies when account checks began, which customers they reached, when IP blocks followed and what changed after an acquisition. The age of an account and the date a control took effect can explain why customers continued trading even after a company introduced a sanctions program.

The 2024 Wharton Initiative on Financial Policy and Regulation paper Anti-Money Laundering: Opportunities for Improvement explains why the systems overlap. It observes that financial institutions often use the same compliance infrastructure for anti-money-laundering and sanctions obligations, and connects that overlap to OFAC’s prominent role in cryptocurrency enforcement.

At Poloniex, that shared infrastructure had very concrete parts: identity documents, account profiles, IP data, account freezes and screening rules. The Office of Foreign Assets Control’s conclusion was equally concrete. Companies introducing new controls needed to apply them to existing customers too.

Whistleblower Rewards and the Conduct You Know

The Financial Crimes Enforcement Network’s whistleblower program covers qualifying sanctions information. Under its award law, qualifying whistleblowers can share 10% to 30% of the money collected in eligible sanctions actions. Those actions must impose more than $1 million in monetary sanctions.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. That is a separate program. We work through the evidence and the right whistleblower program for what you know.

You Know Which Accounts Kept Trading

If you saw location alerts, unfinished customer reviews or older accounts left outside new controls, you may know why those accounts kept trading. We build the case with you, connect the exchange’s transactions to its internal decisions, and bring in sanctions whistleblower lawyers who understand digital-asset businesses. Speak to our whistleblower experts about what kept those accounts open.