March 25, 2015: 486 violations net PayPal a $7,658,300 fine

On March 25th, OFAC levied a Civil Monetary Penalty against PayPal for violations of the Iran, Cuba, Sudan, terrorism and Weapons of Mass Destructioin sanctions programs. These violations started in 2009 and occured as recently as September 2013, some of which included explicit references to sanctioned countries (e.g. “Tehran” or “Sudan”).

Here's the detail of one set of violations singled out by OFAC:

Separately, between October 20, 2009 and April 1, 2013, PayPal processed 136 transactions
totaling $7,091.77 to or from a PayPal account registered to Kursad Zafer Cire, an individual
designated by the U.S. State Department on January 12, 2009 pursuant to Executive Order 13382
of June 28, 2005, “Blocking Property of Weapons of Mass Destruction Proliferators and Their
Supporters,” in apparent violation of the WMDPSR. PayPal stated to OFAC that it failed to
identify its customer as a potential Specially Designated National (SDN) at the time of his
designation because the MSB’s automated interdiction filter was not “working properly.”
Starting approximately six months later, PayPal’s automated interdiction filter appropriately
flagged Cire’s account five times (on July 30, 2009, September 3, 2009, October 21, 2009,
October 24, 2009, and November 16, 2009) for potential matches to the SDN, and on each
occasion, separate PayPal Risk Operations Agents dismissed the alerts without requesting
additional information to clear the potential SDN name matches. PayPal stated that this conduct
did not comply with the MSB’s internal policies and procedures for handling SDN name
matches. On February 14, 2013, PayPal’s interdiction filter again flagged Cire’s account for a
sixth time due to a potential match to the SDN, and a PayPal Risk Operations Agent followed the
MSB’s procedures for handling an SDN name match by creating a “case” for the match,
restricting Cire’s account, and requesting additional information from the customer. Upon
receiving the requested information, which included a copy of Cire’s passport showing a date of
birth and place of birth that were identical to those of the SDN, PayPal’s Risk Operations Agent
dismissed the match due to an apparent misunderstanding of why the interdiction filter had
flagged Cire’s account for review. On April 3, 2013, PayPal’s interdiction filter flagged Cire’s
account for a seventh time, and the MSB appropriately blocked the account and reported it to
OFAC.

The total base penalty for all these violations was $17,018,443. Here are OFAC's list of aggravating factors:

1) PayPal’s
management demonstrated reckless disregard for U.S. economic sanctions requirements in
deciding to operate a payment system without implementing appropriate controls to prevent the
system from processing transactions in apparent violation of OFAC regulations;

2) PayPal
management and supervisors knew of the conduct giving rise to the apparent violations;

3)
PayPal’s conduct resulted in harm to U.S. sanctions program objectives, and the MSB provided
economic benefit to Cire and undermined the integrity of the WMDPSR by operating an account
and processing transactions on behalf of an SDN for approximately three-and-a-half years; and

4) PayPal’s OFAC compliance program was inadequate to prevent the apparent violations.

and mitigating factors:

1) PayPal hired new management within its Compliance Division, identified OFAC-related issues with regard to the MSB’s payment system in 2011, and undertook various measures to strengthen PayPal’s OFAC screening processes and measures, including steps to implement more effective controls;

2) PayPal has not received a penalty notice or Finding of Violation in the five years preceding the earliest date of the transactions giving rise to the apparent violations; and

3) PayPal substantially cooperated with OFAC’s investigation, including by submitting the relevant documents and information in a clear and organized fashion, answering numerous follow-up inquiries for information over the course of OFAC’s investigation, and by entering into a statute of limitations tolling agreement and an extension to the agreement.

Links:

OFAC Notice

OFAC Web Notice

OFAC Settlement Agreement