Bittrex FinCEN $29.3 Million Penalty: Crypto Exchange AML and Sanctions Lessons

Bittrex, Inc. was a US cryptocurrency exchange. On 11 October 2022 the US Financial Crimes Enforcement Network (FinCEN) and the Office of Foreign Assets Control (OFAC) announced coordinated settlements with it. FinCEN's civil money penalty was $29,280,829.20, of which $24,280,829.20 was credited against the amount Bittrex agreed to pay OFAC to resolve apparent sanctions violations, leaving $5,000,000 payable to FinCEN. FinCEN's order is a useful case for any crypto business because it describes, in plain terms, how an exchange grew faster than its controls: a late written programme, two people manually reviewing tens of thousands of transactions, and no suspicious activity reports (SARs) for years. To build your AML knowledge, see our CPD courses.

This guide is based on FinCEN consent order number 2022-03. We read it through a summarising tool, so check every figure against the order before you quote it.

The penalty and the legal basis

The order covers the period 13 February 2014 to 7 December 2018. FinCEN found that Bittrex willfully violated the Bank Secrecy Act (BSA), which in civil enforcement means reckless disregard or willful blindness. The order cites the AML programme rule for money services businesses (31 U.S.C. 5318(h)(1) and 31 C.F.R. 1022.210), the suspicious activity reporting rule (31 U.S.C. 5318(g)(1) and 31 C.F.R. 1022.320) and FinCEN's civil penalty authority (31 U.S.C. 5321(a)(1)). If Bittrex failed to pay the OFAC amount, the order says it would have to pay the full $29,280,829.20 to FinCEN within 30 days of default. The text we read does not give the date the order was signed; FinCEN's enforcement list shows 11 October 2022.

What FinCEN found

A programme written late and implemented later

Bittrex adopted a written AML programme in August 2015, about 18 months after it began operations, and did not fully implement it until December 2018. For most of the period the exchange operated without the controls the BSA requires of a money services business.

Manual monitoring that could not keep up

Two employees with minimal AML training reviewed all transactions by hand, alongside their other duties. Volume rose from about 11,000 transactions a day in 2016 to 23,800 a day in 2017. Automated monitoring tools were not installed until September 2018, and manual review continued at tens of thousands of transactions a day through December 2018. The practical lesson is simple: if your volumes double, your monitoring has to double with them.

SARs that were not filed

Bittrex filed no SARs from its founding through May 2017 and only one between May and November 2017. It then filed 119 SARs in November 2017, after receiving an IRS examination notice. Most SARs were filed long after the transactions. Our suspicious activity reporting guide explains why late filing reduces the value of a report to law enforcement.

Sanctions exposure

The order says more than 116,000 transactions worth over $260 million involved parties in comprehensively sanctioned jurisdictions: Iran, Cuba, Sudan, Syria and the Crimea region of Ukraine. OFAC-related screening did not cover customers' jurisdictional links until at least October 2017. Bittrex also failed to file SARs on sanctions-linked activity, including more than 200 transactions totalling $140,000 and 22 transactions of more than $1 million each. Our guide to sanctions screening and alert resolution explains how location and ownership checks fit into screening.

Darknet markets, anonymity-enhanced coins and ransomware

Direct transactions with three darknet marketplaces (AlphaBay, Agora and Silk Road 2) were not detected or reported. The order also describes a failure to detect ransomware-linked transactions affecting US individuals and small businesses, and says Bittrex did not fully address the risks of anonymity-enhanced cryptocurrencies until after the relevant period.

Cooperation, remediation and why the penalty was lower

Bittrex did not voluntarily disclose its violations to FinCEN and had no previous enforcement history. It responded to IRS and FinCEN requests, hired a qualified AML compliance officer and more staff in late 2017, paused new customer registrations for four months from December 2017 to improve its know-your-customer procedures, and added automated monitoring, customer surveillance, updated SAR and OFAC procedures, independent audits and training. FinCEN states the penalty was significantly lower because of cooperation and remediation, and is not requiring further remedial measures beyond those already taken.

Ongoing obligations

• Cooperate fully with FinCEN on matters related to the statement of facts.
• Keep records for six years.
• Make no public statements contradicting the admissions in the order.
• Any successor or buyer must agree in writing to comply.
• The penalty cannot be claimed as a tax deduction, and Bittrex waives limitation defences for the relevant period.

Practical lessons for crypto businesses

• Write the programme before you launch. An 18-month gap is difficult to defend.
• Scale monitoring with volume. Manual review by two people cannot cover tens of thousands of daily transactions.
• Screen locations as well as names. Customers in comprehensively sanctioned jurisdictions are a core risk.
• Know the typologies. Darknet marketplaces, ransomware and privacy coins should appear in your risk assessment and monitoring.
• File SARs as you go. A burst of filings after a regulator's notice is itself a signal.

For a later case with similar themes, read our Paxful penalty guide.

Frequently asked questions

How much was the Bittrex penalty?

FinCEN's penalty was $29,280,829.20, of which $24,280,829.20 was credited against Bittrex's OFAC settlement, so $5,000,000 was payable to FinCEN.

Did Bittrex have a compliance officer?

It hired a qualified AML compliance officer and additional staff in late 2017, well after it began operating in 2014.

Why did OFAC take part?

OFAC investigated apparent violations of its Cuba, Sudan, Syria, Iran and Crimea-related sanctions. The two agencies coordinated, and FinCEN credited the OFAC payment.

What we could not confirm

We read FinCEN's consent order through a summarising tool. The order's signing date is blank in the text we read, the total number of SARs over the full period is not stated, and we did not read OFAC's own enforcement release. Please check all figures against the original documents.