Bybit OFAC compliance profile

How Bybit's non-US structure and global user base shape its sanctions exposure and why screening posture decides the risk.

TL;DR

TL;DR: No OFAC civil penalty against Bybit is documented in public records. Its exposure comes from serving a global user base while enforcement risk is decided by whether counterparties are screened before funds move.

What public records show

OFAC posts its enforcement actions publicly, and Bybit does not appear among published penalty actions as of this writing. That means no settlement has been made public, not that risk is zero. A non-US exchange can still face US jurisdiction when a transaction touches a US person, US-dollar rails, or a blocked party.

Why non-US exchanges face scrutiny

OFAC enforces under strict liability, so intent is not required, and civil penalties start at $356,000 per violation. The 50 Percent Rule extends blocking to entities 50% or more owned by a blocked person. A platform with users across many jurisdictions must screen names against the SDN List of 19,218 names and wallets against 947 OFAC-listed addresses, or it inherits the risk those lists describe. Syncing those lists hourly keeps every check current with each new designation.

The lesson

Structure does not remove exposure; screening does. Payment rails such as x402, AP2, ACP, and Coinbase AgentKit move money but do not screen. A one-call screening check that returns ALLOW or BLOCK under 100 ms, with a risk_score signal, gives a global exchange the documented control that enforcement reviews look for. A posture built on screening rather than structure is the one that holds up.