Facts and Penalties
Interactive Brokers LLC (IB) has agreed to pay $11,832,136 to settle its potential civil liability for 12,367 apparent violations of multiple sanctions programs, including those targeting Iran, Russia, Syria, and China. Between 2016 and 2024, the firm improperly provided services to persons in sanctioned jurisdictions, processed payments to blocked Russian banks, and facilitated trading in securities of sanctioned issuers. These violations stemmed primarily from deficiencies in the firm’s screening technology, such as technical bugs in IP geo-blocking software and a failure to update blocking lists to include Crimea. Although the statutory maximum penalty exceeded $5 billion, the significantly reduced settlement amount reflects that IB voluntarily self-disclosed the matters and cooperated substantially with OFAC. However, OFAC identified several aggravating factors, noting that IB failed to exercise due caution for over eight years despite being a highly sophisticated, technology-driven financial institution. Additionally, the agency emphasized that IB's conduct harmed U.S. policy objectives by providing sanctioned persons and entities with access to the U.S. financial system.
Compliance recommendations and lessons to learn
Interactive Brokers LLC (IB) has agreed to pay $11,832,136 to settle its potential civil liability for 12,367 apparent violations of multiple sanctions programs, including those targeting Iran, Russia, Syria, and China. Between 2016 and 2024, the firm improperly provided services to persons in sanctioned jurisdictions, processed payments to blocked Russian banks, and facilitated trading in securities of sanctioned issuers. These violations stemmed primarily from deficiencies in the firm’s screening technology, such as technical bugs in IP geo-blocking software and a failure to update blocking lists to include Crimea. Although the statutory maximum penalty exceeded $5 billion, the significantly reduced settlement amount reflects that IB voluntarily self-disclosed the matters and cooperated substantially with OFAC. However, OFAC identified several aggravating factors, noting that IB failed to exercise due caution for over eight years despite being a highly sophisticated, technology-driven financial institution. Additionally, the agency emphasized that IB's conduct harmed U.S. policy objectives by providing sanctioned persons and entities with access to the U.S. financial system.
Compliance recommendations and lessons to learn
- This enforcement action serves as a critical reminder that firms must rigorously test and audit their automated compliance tools, such as IP geo-blocking and margin liquidation systems, to ensure they function as intended.
- Businesses cannot rely solely on customer-provided "Know Your Customer" (KYC) data; they must utilize all available location information, including IP addresses, to verify residency and screen against sanctioned jurisdictions.
- It is essential to modernize sanctions compliance infrastructure at the same pace as customer-facing technologies to prevent gaps where automated trading platforms might bypass screening filters.
- Companies should also exercise extreme caution when interpreting general licenses, as IB’s mistaken belief that "wind-down" licenses authorized certain payments to Russian banks led to significant violations.
- Furthermore, firms must ensure adequate resource allocation so that compliance teams can promptly review and escalate alerts without the delays that contributed to IB’s failures.
- Finally, conducting proactive, self-initiated internal reviews is highly recommended, as discovering and voluntarily disclosing issues can drastically reduce penalties compared to those discovered by regulators.
Due diligence checklist tailored for investment companies:
Based on the enforcement actions and guidance provided in the files, here is a due diligence checklist tailored for investment companies (broker-dealers, funds, investment advisers). This checklist focuses on mitigating sanctions risks by looking beyond just the direct customer.
Based on the enforcement actions and guidance provided in the files, here is a due diligence checklist tailored for investment companies (broker-dealers, funds, investment advisers). This checklist focuses on mitigating sanctions risks by looking beyond just the direct customer.
- Assess Geographic Risk: Identify if the firm or its customers operate in high-risk jurisdictions or offshore financial centers
- Review Product Risks: Evaluate if specific products (e.g., foreign exchange, penny stocks, margin lending) pose higher sanctions risks
- Map Intermediary Relationships: Determine who holds the ultimate customer relationship (e.g., are you a custodian for another bank's omnibus account?) and assess the risk of "blind spots" where the beneficial owner is unknown
- Identify Beneficial Owners: Do not stop at the entity name; identify the natural persons who own or control the structure. FinCEN guidance suggests a rigorous approach to identifying beneficial owners
- Screen All Parties: Screen not just the account holder, but also beneficial owners, fund advisors, and principals against the SDN List and other relevant lists
- Apply the "50% Rule": Verify if a corporate customer is 50% or more owned, directly or indirectly, by blocked persons. If so, the customer itself is blocked
- Verify Location Data: Cross-reference customer-provided addresses with objective data like IP addresses. Do not rely solely on the customer's stated residency
- Screen Underlying Securities: Before executing trades or holding assets, screen the issuer of the security. Holding shares of a company that is 50% owned by a sanctioned person can be a violation
- Check Foreign Funds: If investing in foreign funds, ensure the fund does not invest in sanctioned jurisdictions (e.g., Iran) or blocked entities
- Monitor Margin & Collateral: Ensure that margin loans are not extended to blocked persons or secured by blocked collateral
- Request Sub-Account Data: For omnibus accounts held for foreign financial institutions, consider requesting information on the underlying sub-account holders if the jurisdiction is high-risk
- Vet the Intermediary's Compliance: If relying on a third party (like an introducing broker) to perform KYC, assess the quality of their sanctions compliance program
- Implement IP Geo-Blocking: Use software to block access from comprehensively sanctioned jurisdictions (e.g., Cuba, Iran, North Korea, Syria). Ensure this software is regularly tested for bugs
- Test Screening Filters: Regularly audit screening tools to ensure they catch variations of names, misspellings, and updated sanctions lists (e.g., ensure new regions like Crimea or Donetsk are added)
- Automate Issuer Restrictions: Configure trading systems to automatically reject trades in securities of sanctioned issuers (e.g., Chinese Military-Industrial Complex companies)
- Monitor for "Status Changes": Re-screen customers regularly, as a legitimate customer today could be designated as an SDN tomorrow
- Watch for Evasion Red Flags: Customers using obscure ownership structures or shell companies. Incomplete or confusing information about beneficial owners. Transactions that seem inconsistent with the customer's known business or history
