Loading…
Loading…
ShapeShift AG operated a peer-to-peer digital-asset exchange from 2014 to 2021 that allowed users to swap cryptocurrencies without account registration. During the period 10 December 2016 to 9 October 2018, ShapeShift's platform processed 17,183 transactions totaling USD 12,570,956 for users located in Cuba, Iran, Sudan, and Syria — all sanctioned jurisdictions under the four OFAC programs cited.
OFAC found that ShapeShift "failed to exercise a minimal degree of caution or care for its sanctions compliance obligations" by not implementing any internal controls — no IP-address geolocation screening, no SDN list screening, no jurisdiction-of-access monitoring — to prevent sanctioned-jurisdiction users from transacting on the platform. The control gap was endemic from inception: ShapeShift adopted a sanctions compliance program only after receiving an OFAC administrative subpoena compelling it to do so, an aggravating factor that weighed against the company in the enforcement guidelines analysis.
The base civil monetary penalty calculated under the OFAC Enforcement Guidelines was USD 39,515,000. The final USD 750,000 settlement (a 98.1% reduction from the base penalty) reflects OFAC's determination that mitigating factors significantly outweighed aggravating factors:
compliance infrastructure to support a large penalty;
enforcement campaign;
The four-program nature of the settlement (CACR + ITSR + SSR + SySR) is characteristic of OFAC enforcement against platforms that operated without any jurisdiction screening: because the platform had no controls, all sanctioned-jurisdiction users accessing the platform at any time generated cross-program apparent violations simultaneously.
The ShapeShift settlement is structurally novel because it establishes that OFAC will pursue civil liability against a dissolved / wound-down digital-asset exchange as a deterrent — even where the violating entity has zero ongoing operations and zero capacity to pay the base penalty. The 98% reduction is not a pass; it is OFAC explicitly pricing the compliance-deterrence function of enforcement against a defunct entity at USD 750,000 and signalling that corporate dissolution does not extinguish civil sanctions liability.
This is directly relevant to the wave of digital-asset exchange failures and voluntary wind-downs that occurred in 2022–2024 (FTX, Celsius, Voyager, Genesis, BlockFi) — administrators and estate fiduciaries managing these entities' liabilities must now account for potential OFAC civil enforcement exposure from historical transaction activity.
The ShapeShift settlement (2025-09-22) and the Exodus Movement ITSR settlement (2025-12-16) together define a coherent late-2025 OFAC fintech-and-crypto enforcement campaign, announced 19 days apart, targeting the structural compliance-program gap in the digital-asset exchange peer-set. Both settlements concern platforms that operated without sanctions screening controls during the 2016–2021 period. Together with the Binance Holdings settlement (2023-11-21) — the largest OFAC penalty in the digital-assets sector at USD ~968 million — they complete the major registered milestones in OFAC's progressive enforcement campaign across the crypto/fintech peer-set:
1. Binance (2023): USD 968M — largest-ever OFAC penalty; active global exchange 2. ShapeShift (2025-09): USD 750K — defunct exchange; establishes wind-down enforcement norm 3. Exodus Movement (2025-12): ITSR-specific; consumer crypto-wallet app
managing wind-down processes must account for OFAC civil-penalty exposure from historical transaction flows. The ShapeShift precedent caps the practical settlement range for small-to-mid defunct platforms at USD 500K–USD 2M (factoring in defunct-entity mitigants), but the base-penalty calculus remains USD 39M-class for a platform with ~17,000 apparent violations.
until after receiving a subpoena is the aggravating hook — platforms that proactively implement screening even at a basic IP-geolocation level will have a materially stronger mitigation posture.
crypto-exchange or digital-asset-transfer services without jurisdiction screening in the 2015–2021 period face analogous tail exposure, including against wind-down entities in their portfolios.
in their individual capacities?
guidelines analysis that explicitly cross-references ShapeShift as a contemporaneous enforcement action, further cementing the late-2025 fintech-crypto enforcement campaign framing?