What went wrong at Kraken?

Relied on user self-certification of location. Did not block Iranian IP addresses. No sanctions screening during onboarding.

How was the penalty amount determined?

The statutory maximum was $216 million. OFAC considered Kraken's remedial measures and cooperation. The actual penalty was $362,158 reflecting the transaction volume and mitigating factors.

What is the compliance lesson?

Never rely on user self-declaration for location or identity. Verify independently through IP geolocation, document checks, and transaction monitoring.

Kraken OFAC settlement case study (2022)

In November 2022, Kraken (Payward, Inc.) agreed to a $362,158 settlement with OFAC for 826 apparent violations involving users in Iran.

Background

Kraken, a major US-based crypto exchange, allowed users in Iran to trade digital assets between June 2015 and December 2019. Iran is subject to comprehensive US sanctions under the ITSR.

What happened

Kraken processed 826 transactions worth approximately $269,000 for users who self-identified as being in Iran or used Iranian IP addresses. The exchange relied on self-certification of location without independent verification.

Root causes

Key lesson

Self-certification of location is not sufficient. Crypto exchanges must independently verify user location through IP geolocation, document verification, and transaction pattern analysis.

Root cause	Detail
Self-certification relied upon	Users self-declared location without verification
No IP geolocation	Iranian IPs were not blocked at the platform level
Inadequate onboarding controls	No sanctions screening during customer onboarding

Screen your agent's next payment

Check any wallet, name, or entity against OFAC, EU, UN sanctions lists in real time.

Free wallet checker

Frequently Asked Questions

What was the Kraken OFAC penalty?: $362,158 in November 2022 for 826 apparent violations involving users in Iran between 2015 and 2019.
What went wrong at Kraken?: Relied on user self-certification of location. Did not block Iranian IP addresses. No sanctions screening during onboarding.
How was the penalty amount determined?: The statutory maximum was $216 million. OFAC considered Kraken's remedial measures and cooperation. The actual penalty was $362,158 reflecting the transaction volume and mitigating factors.
What is the compliance lesson?: Never rely on user self-declaration for location or identity. Verify independently through IP geolocation, document checks, and transaction monitoring.