On Wednesday, The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced a $7,658,300 settlement with PayPal, Inc. (PayPal) to settle potential civil liability for 486 apparent violations of the:
- Weapons of Mass Destruction Proliferators Sanctions Regulations, 31 C.F.R. part 544
- Iranian Transactions and Sanctions Regulations, 31 C.F.R. part 560
- Cuban Assets Control Regulations, 31 C.F.R. part 515
- Global Terrorism Sanctions Regulations, 31 C.F.R. part 594
- Sudanese Sanctions Regulations, 31 C.F.R. part 538
According to the settlement, PayPal failed to employ “adequate” screening technology and procedures to identify the potential involvement of U.S. sanctions targets in transactions that PayPal processed. Because of this, PayPal was unable to reject or block prohibited transactions pursuant to applicable U.S. economic sanctions program requirements.
In addition, PayPal processed 136 transactions totaling $7,091.77 to or from a PayPal account registered to an individual on OFAC’s List of Specially Designated Nationals and Blocked Persons. PayPal’s screening setup did not identify the account holder as a potential match to the SDN List, and even when it did, PayPal Risk Operations Agents dismissed alerts on six separate occasions after failing to obtain or review documentation corroborating the identity of the SDN.
Of particular note is that each of the transactions giving rise to the apparent violations either contained an explicit reference to a country subject to OFAC sanctions or another term linked to the country (i.e., “Tehran,” “Khartoum,” “Cuba,” “Iran,” “Sudan,”, “Iranian,” or “Cuban”), or involved a PayPal account in which the Specially Designated Global Terrorists Interpal or Kahane Chai had an interest.
The moral of the story here is to make sure your company:
- Has implemented screening software
- Has implemented procedures on how screening should occur and how to resolve all potential matches
- Considers adding an automatic block, hold, or escalation for review for all matches to obvious red flag terms such as “Iran”, “Iranian”, “Cuba”, etc.).