PayPal Gets Whacked by Treasury

On 3/25/15 the U.S. Treasury announced another "settlement agreement" from their Office of Foreign Asset Control, which in spite of its name, doesn't always look at foreign assets.  PayPal, an eBay subsidiary, agrees to pay to the U.S. Department of the Treasury the amount of $7,658,300.  In order to understand why a business would voluntarily give up that kind of money, we have to look at what they were cited for [ http://www.treasury.gov/resource-center/sanctions/OFAC-Enforcement/Pages/20150325_33.aspx ]

A settlement agreement allows a company to admit no wrongdoing, but pay a fine to avoid further action.  I've always found these agreements amusing because they are close to extortion, but good for both sides - especially here.  Either settle, or go to court, and we have the evidence to convict you.   In this case, we know what they are accused of:

"Separately, between October 20, 2009 and April 1, 2013, PayPal processed 136 transactions totaling $7,091.77 to or from a PayPal account registered to Kursad Zafer Cire, an individual designated by the U.S. State Department... on January 12, 2009 pursuant to Executive Order 13382 of June 28, 2005, "Blocking Property of Weapons of Mass Destruction Proliferators and Their Supporters." PayPal explained to OFAC that it failed to identify its customer as a potential Specially Designated National (SDN) at the time of his designation because the MSB's automated interdiction filter was not "working properly." Approximately six months later, PayPal's automated interdiction filter appropriately flagged Cire's account as a potential match to the SDN List. A PayPal Risk Operations Agent mistakenly believed that the system had generated the alert in order to confirm Cire's name and address, however, and the Risk Operations Agent dismissed the alert without requesting or obtaining any additional information.

On four separate occasions between September 3, 2009 and November 16, 2009, PayPal's automated interdiction flagged Cire's account for review due to a potential match to the SDN List. On each occasion, however, separate PayPal Risk Operations Agents dismissed the alerts because the previous alerts had been dismissed, which PayPal asserted made these alerts appear as though they were duplicates. PayPal stated that this conduct did not comply with the MSB's internal policies and procedures for handling SDN name matches.

On February I4, 2013, PayPal's interdiction filter again flagged Cire's account for a potential match to the SDN List, and a PayPal Risk Operations Agent followed the MSB's (a term applying to money service business providers) procedures for handling an SDN name match by creating a "case" for the match, restricting Cire's account, and requesting additional information from the customer. Upon receiving the requested information, which included a copy of Cire's passport showing a date o f birth and place of birth that were identical to those of the SON, PayPal's Risk Operations Agent dismissed the match due to an apparent misunderstanding of why the interdiction filter had flagged Cire's account for review. On April3, 2013, PayPal's interdiction filter flagged Cire's account for a seventh time, and the MSB appropriately blocked the account and reported it to OFAC."

Then there were additional reports about violating Cuban Assets Control, Iranian Transactions and Sanctions Regulations (125 counts in two cites), Sudanese Sanctions Regulations, Global Terrorism Sanctions Regulations, and the Weapons of Mass Destruction Proliferators Sanctions Regulations related to the Cire case. 

Imagine what kind of compliance program a company of this size has to run in order to find transactions from one person who is trying to avoid sanctions.  In 2014, PayPal was running about $62B a quarter in volume, on 1.06B transactions.  This is what drives compliance officers nuts, but keeps them employed. [http://www.statista.com/statistics/277841/paypals-total-payment-volume/]

"The apparent violations of theWMDPSR constitute an egregious case. In reaching its determination that the apparent violations of the WMDPSR were egregious, OFAC considered the following facts and circumstances: PayPal demonstrated reckless disregard for U.S. economic sanctions requirements when its interdiction software failed to identify Cire as a potential match to the SDN List for approximately six months after Cire's designation and when, after the software ultimately flagged the accountholder as a potential match to the SDN List, employees cleared name matches against Cire's account on six separate occasions prior to appropriately identifying and blocking the account. The conduct was particularly reckless with respect to those transactions on or after September 3, 2009-the date that a PayPal Risk Operation Agent dismissed the second alert. Further, PayPal agents engaged in a pattern of conduct by repeatedly ignoring certain warning signs about potential matches to the SDN List; in the course of this conduct, PayPal provided economic benefit to Cire and undermined the integrity of the WMDPSR and its policy objectives; and multiple PayPal Risk Operation Agents failed to adhere to the MSB's policies and procedures pertaining to SDN match escalation.

PayPal has taken remedial action by hiring new management within its Compliance Division, and undertaking various measures to strengthen PayPal's OFAC screening processes and measures, including steps to implement more effective controls. "

Somebody always gets blamed....

Dennis F. Poindexter books at Amazon