BitGo Agreed to Pay $98,830 in Digital-Currency Sanctions Case

The U.S. Treasury Department’s Office of Foreign Assets Control announced on December 30, 2020 that BitGo had agreed to remit $98,830 to settle potential civil liability arising from 183 apparent violations of American sanctions programs.

OFAC said people apparently located in Crimea, Cuba, Iran, Sudan and Syria had used BitGo’s non-custodial secure wallet-management service. The enforcement action mattered beyond the relatively modest transaction value because it applied established sanctions obligations to the technical controls of a digital-asset company. Possessing location data for security purposes, OFAC’s account indicated, could create compliance consequences when a provider failed to use that information to restrict prohibited activity.

The settlement resolved potential civil liability. It was not a criminal conviction, and OFAC classified the matter as non-egregious.

What OFAC said happened

Between approximately March 10, 2015 and December 11, 2019, BitGo processed 183 digital-currency transactions totaling $9,127.79 for individuals whose Internet Protocol addresses indicated that they were in sanctioned jurisdictions. The transactions involved BitGo’s online “hot wallet” service, through which users could store keys online and send digital currency to other wallets over public blockchains.

OFAC expressly separated that service from the enterprise and custodial services offered by BitGo Trust Company, a BitGo affiliate. The public record therefore does not support treating the case as a finding about every BitGo business line.

Before April 2018, an individual could open one of the affected accounts by providing a name and email address. BitGo then began requiring new account holders to identify their country, but OFAC said the company generally relied on those attestations without additional location verification. At the same time, BitGo already collected IP-address information for login security and did not employ it for sanctions compliance.

OFAC identified that disconnect as an aggravating factor. The agency said BitGo had reason to know that some users were apparently in sanctioned jurisdictions and had failed to exercise due care by implementing appropriate risk-based controls.

The penalty and an inconsistency in the record

OFAC calculated a statutory maximum civil penalty of $53,051,675 and a base penalty of $183,000 after determining that BitGo had not voluntarily disclosed the apparent violations. The agency nevertheless treated the conduct as non-egregious and credited mitigating factors: BitGo was relatively small, had no OFAC penalty notice or finding of violation during the five years before the earliest relevant transaction, cooperated with the investigation and reported substantial remediation.

The official records contain a numerical inconsistency. OFAC’s dated notice, enforcement-release title, opening paragraph and 2020 penalties table identify the remittance as $98,830. A later paragraph inside the same release calls the settlement amount $93,830. This reconstruction uses $98,830—the amount repeated across the agency’s announcement and annual table—while preserving the unresolved discrepancy rather than silently correcting the primary record.

Why the controls mattered

BitGo told OFAC it had hired a chief compliance officer and adopted a sanctions policy in January 2020. The measures described by the agency included IP blocking, email restrictions for sanctioned jurisdictions, periodic screening, recordkeeping, employee training and screening accounts against OFAC’s blocked-person list and listed cryptocurrency addresses.

Those measures illustrate the institutional importance of the case as it stood on December 30. A non-custodial product did not, in OFAC’s view, remove the provider from sanctions responsibilities. Nor did the use of a public blockchain substitute for controls at the service layer where accounts were created and accessed.

The action did not establish that IP geolocation was infallible, identify the assets used in the 183 transactions or disclose individual transaction dates and amounts. It also supplied no evidence of a measurable cryptocurrency-price reaction. Its defensible event-day significance was regulatory: Treasury had connected digital-currency sanctions compliance to customer screening, location signals and the design of wallet-platform access controls.