What went wrong at BitPay?

Relied only on IP geolocation. Did not screen names or wallet addresses against the OFAC SDN list. Users bypassed IP checks with VPNs.

Why is IP-only geolocation insufficient?

VPNs allow users to mask their location. Sanctions screening requires name screening, wallet screening, and jurisdictional blocking in addition to IP checks.

What is the compliance lesson?

Use layered screening: IP geolocation + name screening + wallet screening. No single method is sufficient alone.

BitPay OFAC settlement case study (2021)

In February 2021, BitPay agreed to a $507,375 settlement with OFAC for 2,102 apparent violations involving users in sanctioned jurisdictions.

What happened

Between 2013 and 2018, BitPay, a crypto payment processor, processed 2,102 transactions totaling approximately $129,000 for users located in Cuba, Iran, North Korea, Syria, and Crimea. BitPay relied on IP address geolocation but did not screen against the OFAC SDN list or implement effective jurisdictional blocking.

Root causes

Lesson

IP-only geolocation is insufficient. A layered approach is needed: IP geolocation + name screening + wallet address screening. SanctionsAI provides all three via a single API.

Root cause	Impact
IP-only geolocation	Users bypassed with VPNs
No SDN name screening	Designated individuals transacted freely
No wallet address screening	Designated crypto addresses not flagged

Screen your agent's next payment

Check any wallet, name, or entity against OFAC, EU, UN sanctions lists in real time.

Free wallet checker

Frequently Asked Questions

What was the BitPay OFAC penalty?: $507,375 in February 2021 for 2,102 apparent violations involving users in sanctioned jurisdictions between 2013 and 2018.
What went wrong at BitPay?: Relied only on IP geolocation. Did not screen names or wallet addresses against the OFAC SDN list. Users bypassed IP checks with VPNs.
Why is IP-only geolocation insufficient?: VPNs allow users to mask their location. Sanctions screening requires name screening, wallet screening, and jurisdictional blocking in addition to IP checks.
What is the compliance lesson?: Use layered screening: IP geolocation + name screening + wallet screening. No single method is sufficient alone.