ShapeShift: Location Data Without Sanctions Screening

ShapeShift AG agreed to pay $750,000 in its 2025 OFAC sanctions settlement with the Office of Foreign Assets Control to resolve allegations that its exchange served users in sanctioned jurisdictions without a sanctions screening program. The agency said the company already held IP address information that gave it reason to know where those users were. For an exchange insider, the revealing gap is between the information a platform collects and the information it uses to stop a transaction.

The Office of Foreign Assets Control announced the civil settlement on September 22, 2025. The alleged conduct concerned transactions with users in Cuba, Iran, Sudan and Syria from December 10, 2016 through October 9, 2018. The agency said these transactions benefited people in sanctioned jurisdictions and undermined the sanctions programs.

How ShapeShift’s Exchange Worked

ShapeShift traded directly with its users, supplying the requested digital assets from its own inventory. A customer specified the asset offered and the asset wanted, certified beneficial ownership and supplied a wallet address. Once the customer’s asset reached a ShapeShift wallet, the company sent the equivalent value of the requested asset to the customer’s wallet.

ShapeShift was the sole counterparty to each exchange. It earned a premium over the market exchange rate. At its peak, the platform handled as many as 20,000 transactions daily and offered at least 79 digital assets. The business depended on software that could receive one asset, price the exchange and deliver another.

Every exchange occurred on chain and became publicly visible immediately after completion. That visibility still left an important part of the business inside the company. A transaction hash can show a transfer while customer identity, wallet control, screening decisions and staff knowledge sit in other records. Connecting those records is how an insider’s account can explain what the public transaction trail leaves unanswered.

Swiss Incorporation, Denver Operations

ShapeShift incorporated in Switzerland, but the Office of Foreign Assets Control described a business headquartered and run from Denver. Most of its officers and staff ran the business from the United States. Its senior leadership worked from the Denver office, an arrangement reflected in its Swiss incorporation filings.

U.S.-based engineers created and maintained the platform’s code, including the algorithms that executed transactions. The company also registered as a foreign corporation with Colorado’s Secretary of State.

The agency based its authority over the company on the physical headquarters and overall business operations. The office, management and engineers showed where the exchange actually ran. For someone who knows who maintained the transaction system and where decisions were made, those operational details matter.

The Location Data Went Unused

The Office of Foreign Assets Control alleged that ShapeShift exchanged $12,570,956 in digital assets with users in the four jurisdictions across 17,183 instances. Iran accounted for 16,839 of the alleged violations.

During the relevant period, the agency said, ShapeShift had no sanctions compliance program to screen users or transactions for connections to sanctioned jurisdictions. It possessed at least some IP address information throughout the period and conceded that IP addresses were its only available indicator of a party’s location.

The agency said ShapeShift had reason to know users were in sanctioned jurisdictions, including from their IP addresses, and had failed to exercise even minimal care by omitting controls to prevent those transactions.

The Subpoena Came Before the Controls

According to the Office of Foreign Assets Control, ShapeShift adopted a sanctions compliance program only after receiving the agency’s subpoena. The program introduced mandatory screening of new customers against the agency’s Specially Designated Nationals and Blocked Persons List, along with procedures to identify and deny access to users whose IP addresses were associated with sanctioned jurisdictions.

The agency also credited an internal blacklist of digital asset addresses associated with malign activity, including addresses designated by the agency. The revised program screened new and current customers against that blacklist, rescreened customers daily against updated versions of the SDN List and added sanctions training.

Those changes show where the earlier system fell short. Location information became a basis for denying access. Wallet addresses became something to screen. Screening continued after a customer first arrived. For staff working on onboarding, engineering or compliance, each change concerns a concrete part of the service they operated.

Why Limited Assets Mattered to the Settlement

The Office of Foreign Assets Control said the settlement reflected ShapeShift’s limited assets and cessation of operations. The agency’s penalty formula started at $39,515,000. By the time the company settled, the agency described it as defunct and in a highly constrained financial condition.

The release describes the historical exchange as operating from August 2014 until early 2021, when it stopped operating as a digital asset exchange. Alongside its limited finances, the agency credited ShapeShift’s relatively small size, timely responses to information requests and remedial measures.

The Same Information Gap at Another Crypto Service

BitGo’s OFAC settlement, announced December 30, 2020, involved a similar information gap in a different service. The agency alleged that BitGo’s non-custodial hot-wallet services reached users apparently in sanctioned jurisdictions while IP data collected for security were not adequately used for sanctions screening.

That comparison makes the operational point sharper. A business can possess useful customer information in one function while another function fails to use it. ShapeShift’s case concerned an exchange supplying assets from its own inventory. BitGo’s concerned wallet services. Available location data mattered in both.

The Wharton Initiative on Financial Policy and Regulation’s 2024 paper, Anti-Money Laundering: Opportunities for Improvement, describes the wider gap between crypto rules and practice. It notes that the Financial Crimes Enforcement Network clarified the application of existing anti-money laundering obligations to convertible virtual currencies in 2013, then observes:

The paper also explains that anti-money laundering and sanctions compliance often use overlapping infrastructure. In ShapeShift’s sanctions action, the Office of Foreign Assets Control identified the practical consequence: companies should integrate available user information into screening and build sanctions controls into development and beta testing. In the agency’s account of this exchange, the program came after the subpoena.

Sanctions Whistleblower Rewards

The Office of Foreign Assets Control’s release identifies the Financial Crimes Enforcement Network’s whistleblower incentive program as covering information about sanctions and Bank Secrecy Act violations. We assess your information about an exchange’s sanctions or anti-money laundering failures and the potential for a whistleblower award.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. ShapeShift’s resolution was an OFAC civil sanctions settlement, and our work with exchange insiders starts with the program that fits the conduct they can explain.

You Know Where the Screening Stopped

If you worked with exchange location data, wallet screening or access decisions, speak with our whistleblower experts about the gap you saw. We connect your knowledge of the system to the transactions and decisions behind a sanctions case, bring in sanctions and crypto whistleblower lawyers who understand exchange controls, and stay beside you throughout the case.