Now-Dissolved Crypto Exchange ShapeShift AG Settles with OFAC over Transfers of Digital Assets to Sudan, Cuba, Iran and Syria
The cryptocurrency exchange ShapeShift AG (“ShapeShift”) has agreed to a settlement of $750,000 with the U.S. Office of Foreign Assets Control (“OFAC”) for apparent sanctions violations committed between 2016 and 2018. ShapeShift, which wound down its operations in 2021, was incorporated in Switzerland, but operated from Denver, Colorado. According to OFAC, ShapeShift AG exchanged digital currencies with users in violation of sanctions regimes applicable to Cuba, Sudan, Iran and Syria. The relatively modest settlement amount reflects the fact that the apparent violations were deemed “non-egregious,” although the entity did not voluntarily self-disclose its violations.
Facts
On September 22, 2025, OFAC announced a settlement with ShapeShift over its violations of U.S. sanctions targeting Sudan, Cuba, Iran and Syria. Between December 2016 and October 2018, ShapeShift’s platform made 17,183 exchanges of digital assets, valuing a total of $12,570,956, with users in the sanctioned countries.
From August 2014 to early 2021, ShapeShift operated a platform through which users could trade a wide range of digital assets directly with ShapeShift. Users would specify the assets to be exchanged, confirm beneficial ownership, and provide their digital wallets. Upon receiving a user’s digital asset, ShapeShift would transfer the corresponding value of the requested asset, with all transactions recorded publicly on the blockchain. ShapeShift would retain a premium, while offering prevailing market prices for exchange rates. At one point, ShapeShift became so popular that it facilitated up to 20,000 digital transactions per day. In 2021, ShapeShift ceased operating as a digital asset exchange, and is now a decentralized autonomous organization (“DAO”), governed by its members and users through token-based voting on the blockchain.
During the time of the apparent violations, ShapeShift’s U.S.-based operations failed to implement a sanctions compliance program that would screen for users or transactions connected to jurisdictions subject to U.S. sanctions. They either overlooked or ignored the existing sanctions regimes. ShapeShift implemented a sanctions compliance program only after it received an administrative subpoena from OFAC.
Penalty Calculation
OFAC determined that the violations were “non-egregious” under OFAC’s Economic Sanctions Enforcement Guidelines (the “Enforcement Guidelines”), but noted that ShapeShift did not voluntarily self-disclose. Based on the Enforcement Guidelines, the base civil monetary penalty for this matter would be $39,515,000. The final settlement amount of $750,000 indicates that OFAC considered the mitigating factors here to significantly outweigh any aggravating factors under the Enforcement Guidelines.
Mitigating Factors
Several factors reduced the severity of the penalty:
- ShapeShift was a relatively small company at the time of the violations and had since ceased operations, making further violations unlikely. Its financial condition was also highly constrained.
- ShapeShift cooperated with OFAC’s investigation, responding promptly to information requests and entering into tolling agreements.
- The apparent violations represented only a small fraction of the company’s total transaction volume.
- After discovering the violations, ShapeShift implemented multiple remedial measures, including mandatory screening of new customers, maintaining an internal blacklist of addresses linked to prohibited activity, daily rescreening against the SDN List, and sanctions-related training programs.
Aggravating Factors
OFAC identified several factors that tended to increase the severity of the apparent violations:
- ShapeShift failed to implement even minimal internal controls to prevent transactions by users in sanctioned jurisdictions. The company had the ability to know that some users were in such jurisdictions, including through IP address data, which could have been analyzed if the right programming had been implemented by ShapeShift’s coders.
- ShapeShift provided economic benefit to persons in multiple sanctioned jurisdictions, which OFAC considers as undermining the integrity of its sanctions programs.
Significance
This enforcement action serves as a reminder that digital asset companies are held to the same compliance standards as traditional financial service providers, and are responsible for ensuring they do not provide services to users in sanctioned jurisdictions. The case highlights that U.S. jurisdiction can extend to foreign-incorporated entities that maintain their principal place of business or overall operations within the United States, effectively classifying them as “U.S. persons” subject to OFAC regulations. It also shows the benefits of self-reporting, as well as OFAC’s wide latitude in fashioning monetary penalties. Here, the ultimate penalty of $750,000 was less than 2% of the calculated base penalty amount.
Companies and individuals should pay close attention to the sanctions regimes applicable to any jurisdictions in which they do business. This enforcement action further emphasizes the need for companies to integrate available user information, including onboarding data and transactional details like IP location, into their screening processes to avoid compliance gaps.
The foregoing is for informational purposes only. It is not intended as legal advice and no attorney-client relationship is formed by the provision of this information.