What Sanctions Evasion Looks Like
Sanctions evasion is the act of keeping prohibited business running around the rules: hiding a counterparty's identity, routing through clean names, or parking value where screens do not look. For crypto teams the patterns arrive as customers, not headlines, which is why the working response is a control, not an opinion. The OFAC sanctions hub collects the related guides.
The shapes repeat. Identity laundering: a listed party transacts through relatives, fronts, or freshly formed companies whose names screen clean. Routing: payments hop through jurisdictions and assets that dilute the trail, dollar value sliding into tokens and back. Ownership concealment: the blocked stake hides behind nominee holders, exactly the gap the 50 percent rule exists to close. And timing: value moves just before a designation, or just after, betting that your re-screening lags.
Evasion is why strict liability feels harsh but stands: liability does not depend on intent or on whether your controls were reasonable. Controls affect the penalty amount, not whether a violation occurred. That is the thread running through this whole page, from how penalties are priced to what an examiner reads first.
One framing helps before the numbers. Evasion is the adversary's program; enforcement is the state's. Your screening sits between them, and every pattern above is a test of one specific input: names, ownership, addresses, or the re-check clock. The family guides cover each; this page covers what happens when they fail.
How OFAC Penalties Work
Civil penalties are the working end of enforcement: statutory maximums per violation, adjusted upward by the enforcement guidelines for willfulness and gaps, and downward for voluntary self-disclosure and fixes. The published year-by-year record shows the range, five-figure slips to nine-figure settlements, and the pattern behind it.
The mechanics are administrative, which is the surprise. A violation does not need a prosecutor: OFAC investigates, weighs the case under its published enforcement guidelines, and issues a penalty or settlement. The civil penalties and enforcement information page carries the full year-by-year record, and reading one year of it teaches more than any summary.
The 2026 record to date shows the spread. A settlement with an individual at over $1.4 million landed in September, and another individual settled at $3,777,000 in February. Adani Enterprises settled at $275 million in May, the year's outlier by nearly two orders of magnitude. FTI Consulting paid $1.05 million in June, and IMG Academy $1.72 million in February. Rice Lake Weighing Systems at $60,764 in August is proof that small companies still land on the same page. Seven settlements, roughly $284 million combined, and none of them crypto-native.
| Factor | Direction | Why it moves the number |
|---|---|---|
| Voluntary self-disclosure | Down sharply | Reporting yourself is credited |
| Willful blindness | Up | Knew the risk, skipped the control |
| Program gaps | Up | No screening, no records |
| Remediation | Down | Fixed before the order landed |
The name in that record closest to a crypto trading platform is TradeStation, a securities broker-dealer that settled at $1,110,661 in March 2026. It is not a crypto business: its products are stocks, options, and futures. What transfers to a crypto reader is why it was fined. A software update quietly broke the IP-based geoblocking on its mobile platform for roughly a year, and during that window 481 accounts in a sanctioned jurisdiction traded through the gap. The firm self-disclosed, and the case was treated as non-egregious. A seven-figure price followed anyway, for a control that failed silently in a business that otherwise tried.
A note on reading that record: the numbers are settlements, which means agreed endings, not courtroom verdicts. The settling party pays, the findings stand as written, and the case closes without a trial. For a compliance team the useful signal is not the amounts alone but the conduct descriptions, because those name the control gaps by name.
The cases and the penalty logic fill this page; the OFAC sanctions hub tracks the rest.
Recent Enforcement Patterns in Crypto
Crypto enforcement concentrates where the off-ramps are: exchanges that served listed jurisdictions or persons, screening that arrived after growth, and records that could not reconstruct decisions. The pattern is structural, not moral, and the same three gaps recur across the sector's public cases.
First gap: geography outrunning controls. Platforms added users in sanctioned jurisdictions faster than geofencing and screening could follow, and the enforcement record prices each month the mismatch ran. Second: screening as a project rather than a state, switched on once, not re-run as lists moved, so designations landed inside an unscreened book. Third: the record hole, alerts closed without owners, decisions without reasons, exactly what the OFAC compliance guide says an examiner reads first.
The virtual currency industry got its own written expectations in the sanctions compliance guidance OFAC published for the sector. That guidance folds crypto firms into the same five-part program frame, and it names geofencing, screening, and re-screening in terms a chain business can execute. The five parts are the same parts settlement documents quote when they are missing, which makes the framework the closest thing to a syllabus the exam offers. What the guidance does not do is grade effort: it names controls, settlements name absences, and the distance between those two sentences is where penalties come from.
Off-ramps deserve the last word in this section because they concentrate the exposure. Converting coins to fiat is where a crypto business touches banks, and where a listed party's trail becomes a compliance question with names attached. The crypto sanctions guide in this family takes that ground in full.
How Enforcement Reaches Crypto
Enforcement reaches crypto through the same doors crime does: the exchange onboarding desk, the withdrawal queue, and the bank that clears the off-ramp. The virtual currency guidance names the expectations, and parallel AML enforcement, FinCEN's side of the street, raises the stakes for the same records.
The reach is layered. Direct: your exchange served a listed person or a sanctioned jurisdiction, the classic case. Indirect: your customer's counterparty sat in a blocked ownership chain, the 50 percent problem wearing enforcement clothes. Structural: you cannot show what you screened, so every unanswered question becomes an assumed violation, which is how record holes turn into numbers.
Crypto's specific texture comes from addresses. A wallet has no passport, so the screen that matters compares addresses and clusters against labels, not just names at the door. That is the same machinery the sanctions screening guide covers, run at withdrawal speed, inside the pipeline. The FinCEN authorities that govern the AML side of a crypto business read the same records OFAC asks for.
The honest summary for a compliance team: enforcement is not a lightning strike, it is an audit with penalties attached. The programs that hold up are the ones whose screening writes its own record, whose re-checks track the list, and whose people close alerts with reasons. Phalcon Compliance runs that address-side record, with sanctioned entities among the risk categories it flags. Its PDF and CSV exports, on paid plans, turn a year of screening history into the exhibit an examiner asks for. The Phalcon Compliance page has the plans, and the OFAC sanctions hub holds the full family map.