What was the BitGo OFAC penalty?

$98,830 in December 2020 for 183 apparent violations involving users in sanctioned jurisdictions.

Why was BitGo significant?

It was one of the first OFAC enforcement actions against a digital asset custody company, signaling that all VASP types must comply with sanctions.

What was the root cause?

No sanctions screening at the platform level. No IP geolocation. Relied on user self-reporting.

What should custody companies do?

Implement sanctions screening of all users at onboarding and on an ongoing basis. Screen wallet addresses for crypto transactions. Block comprehensively sanctioned jurisdictions.

BitGo OFAC settlement case study (2020)

In December 2020, BitGo agreed to a $98,830 settlement with OFAC for 183 apparent violations of multiple sanctions programs.

What happened

Between March 2015 and December 2015, BitGo, a digital asset custody company, processed 183 transactions on behalf of persons apparently located in comprehensively sanctioned jurisdictions (Cuba, Iran, Syria, Crimea). BitGo did not screen users against the SDN list or sanctioned jurisdictions.

Root causes

Significance

This was one of the first OFAC enforcement actions specifically against a digital asset custody company. It signaled that OFAC considers all VASP business models subject to sanctions compliance requirements.

Key takeaway: Sanctions compliance applies to all VASP business models, including custody, exchange, and payment processing. No VASP category is exempt.

Screen your agent's next payment

Check any wallet, name, or entity against OFAC, EU, UN sanctions lists in real time.

Free wallet checker

Frequently Asked Questions

What was the BitGo OFAC penalty?: $98,830 in December 2020 for 183 apparent violations involving users in sanctioned jurisdictions.
Why was BitGo significant?: It was one of the first OFAC enforcement actions against a digital asset custody company, signaling that all VASP types must comply with sanctions.
What was the root cause?: No sanctions screening at the platform level. No IP geolocation. Relied on user self-reporting.
What should custody companies do?: Implement sanctions screening of all users at onboarding and on an ongoing basis. Screen wallet addresses for crypto transactions. Block comprehensively sanctioned jurisdictions.