Loading…
Loading…
TradeStation Securities, Inc. is a U.S.-based online securities-trading platform and broker-dealer. Between 21 June 2021 and 15 June 2022, a software update to its mobile-platform inadvertently disabled the firm's second-tier geo-blocking control. Rather than evaluating the end-user's IP address at login to screen out customers in sanctioned jurisdictions, the updated system detected the IP address of a U.S.-located server intermediating the connection — causing the geo-block to pass through customers located in Iran, Syria, and Crimea as if they were U.S.-domiciled users. This allowed 481 prohibited securities-related transactions (equities, derivatives, and related investment services) to be executed for customers who should have been blocked.
The violation period lasted approximately 12 months before the failure was identified. OFAC noted that TradeStation voluntarily self-disclosed the apparent violations and implemented significant remedial compliance measures following discovery. OFAC classified the violations as non-egregious, which, combined with voluntary self-disclosure, resulted in a settlement amount substantially below the statutory maximum: $1,110,661 against a potential maximum considerably higher given 481 transactions across three sanctions programs.
The three programs implicated:
persons from providing investment services (including securities brokerage) to Iranian nationals or persons in Iran.
and investment services to Syria.
commercial transactions in the Crimea region of Ukraine.
This is the first OFAC enforcement settlement in the register specifically involving a mobile platform geo-blocking failure in an online securities-trading context. It establishes that OFAC treats IP-detection architecture as a material compliance control for retail trading platforms: using a server-intermediation IP instead of the end-user IP is not a technical defence but a compliance failure that the issuer is responsible for detecting and remediating.
The case joins a growing body of OFAC enforcement against fintech and online trading platforms — the parallel being the July 2025 Interactive Brokers $11.8M settlement (the largest OFAC enforcement action against a registered broker-dealer at that time, not yet filed in this register) — establishing that broker-dealers operating cross-border mobile apps must validate sanctions screening at the user's geographic location, not the intermediating infrastructure.
The voluntary self-disclosure discount is significant: the settlement amount ($1.1M across 481 violations) implies a per-transaction penalty of ~$2,300, far below the statutory maximum of $364,534 per transaction (2026 OFAC-adjusted ceiling). This reinforces OFAC's stated policy that self-disclosure, cooperation, and rapid remediation substantially reduce civil penalty exposure — a compliance calculus that shapes disclosure decisions across the securities and fintech sectors.
an enumerated OFAC compliance control, with testing requirements for both server-side and client-side IP resolution at login.
establishes a low-to-mid range data point ($1.1M, non-egregious, voluntary) in the broker-dealer enforcement spectrum that runs from TradeStation → Interactive Brokers (unfiled) → Binance ($968.6M) — pricing the compliance value of voluntary self-disclosure.
(Iran + Syria + Crimea/WBSR) do not necessarily compound linearly; OFAC aggregated them into a single settlement, suggesting multi-program scope is a severity aggravating factor rather than a per-program multiplier.
architecture requirements for mobile-platform securities trading apps (as it did for virtual-currency platforms following the Binance action).
register) sets a higher per-transaction precedent that repositions TradeStation as a "clean" voluntary-disclosure benchmark rather than a representative mid-range case.
Tokyo Stock Exchange under domestic securities reporting obligations, and whether this creates a cross-jurisdictional compliance-reporting signal.