Loading…
Loading…
OFAC alleges that between October 17, 2017 and January 4, 2019, Exodus Movement, Inc. — a Delaware-incorporated developer of non-custodial / self-custody crypto wallet software headquartered in the United States — processed 254 customer-support interactions with users who self-identified as being located in Iran. The interactions consisted of technical and account-related support that enabled the Iranian users to continue using the Exodus Wallet and the services of Exodus's third-party exchange partners (which include centralised exchanges that geoblock Iranian IPs under their own sanctions-compliance policies). All 254 are charged as prohibited "exports of services" to Iran under § 560.204 of the ITSR.
For 12 of the 254 cases, OFAC further charged a separate violation of the facilitation prohibition (§ 560.203) and treated the conduct as "egregious." In those 12 instances, Exodus customer-support personnel specifically recommended that the Iranian users employ virtual private networks (VPNs) to defeat the geoblocking controls of Exodus's exchange-partner counterparties — i.e., the support channel itself was used as a workaround for the technical sanctions perimeter that other participants in the stack had implemented. OFAC noted that Exodus's written terms of use already prohibited Iran-located usage and that support staff were generally aware of U.S. sanctions, which is the factual basis for the willfulness finding.
The settlement amount ($3,103,360) reflects a substantial mitigation discount versus the statutory maximum, which would have been on the order of hundreds of millions of dollars for 254 violations under the IEEPA-CMRA penalty schedule. Exodus separately committed $630,000 in additional sanctions-compliance investment as part of the resolution.
software vendor.* Prior virtual-currency enforcements (Bittrex, Kraken, Bitpay, Bitfinex, Binance) were against custodial exchanges that hold user funds. Exodus does not custody assets — the wallet keys live on the user device — yet OFAC asserted that the company's support channel and partner-routing* were sufficient to create ITSR jurisdiction. This collapses the long-running "we don't custody, so we're not a money transmitter, so OFAC can't reach us" defense for the Web3-wallet-software segment.
Practitioner alerts (Akin, DLA Piper, K2 Integrity, Lexology, Mondaq, Paul Weiss-style memos) converge on reading Exodus as a sectoral warning that wallet vendors, DeFi front-ends, and on-chain analytics intermediaries must screen support tickets for sanctioned-jurisdiction IP / self-identification, and must train support staff to refuse geoblock-evasion guidance. Expect compliance-program build-out across the Web3-infrastructure segment to mirror the post-Binance-2023 build on the custodial side.
The egregious-conduct premium in this case (12 of 254 violations treated as VPN-coaching facilitation) materially drove the penalty multiple. Compliance-program economics for DeFi/Web3 vendors should now treat support-channel scripts and VPN-discussion prohibitions as first-order controls, not edge-case content moderation.
Exodus is the latest in a sequence (Bittrex 2022, Bitpay 2022, Kraken 2022, Binance 2023) of OFAC ITSR settlements priced against US-incorporated technology firms providing services to Iran-located users. The shift in this case is the move from custodial / exchange intermediaries to non-custodial / software-only intermediaries.
other Web3-infrastructure segments (DeFi front-end operators, on-chain analytics platforms, RPC/node providers, smart-contract audit firms, multisig-wallet SaaS vendors) on the same support-channel-as-facilitation theory.
customer-support staff or US-located cloud infrastructure will be treated as having sufficient US nexus for jurisdiction under the Exodus theory.
OFAC as a baseline benchmark for analogous Web3-vendor settlements.