Kraken under US investigation over allegedly violating Iran sanctions

Getting your Trinity Audio player ready...

U.S. authorities are reportedly investigating Kraken due to suspicions that the controversial cryptocurrency exchange has violated economic sanctions against Iran.

On Tuesday, the New York Times reported that the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) has been investigating Kraken since 2019 for allegedly allowing customers in Iran to buy and sell various ‘crypto’ tokens in defiance of U.S. sanctions prohibiting exports of goods and services to Iranian residents.

The Times reported that the OFAC probe began shortly after Nathan Runyon, a former staffer in Kraken’s finance department, filed a wrongful termination suit against the exchange in November 2019. Among the allegations made in Runyon’s suit was that Kraken was serving customers based in countries on the OFAC’s Specially Designated Nationals and Blocked Persons List.

Runyon claimed that he’d alerted Kraken’s compliance officer Steve Christie multiple times regarding this non-compliance starting in February 2019. Runyon claimed that he eventually quit making noise about this issue when he realized the exchange didn’t plan to take any action. Interestingly, a month before Runyon raised the issue with his superiors, Kraken CEO Jesse Powell tweeted that “evading sanctions” was “not necessarily illegal.”

While Runyon and Kraken settled the lawsuit last year—after Kraken’s countersuit against Runyon was dismissed—the Times reported viewing internal Slack conversations from June 2022 in which Powell posted a spreadsheet detailing 1,522 “verified accounts” of Kraken customers with residences in Iran. This spreadsheet—reportedly made private not long after its initial appearance—also cited Kraken accounts in other sanctioned countries, including 149 customers in Syria and 83 in Cuba.

Point / Counterpoint

Powell has made something of a name for himself through his reluctance to adhere to economic sanctions. This spring, when the U.S. imposed sanctions on certain Russian individuals and entities following that country’s invasion of Ukraine, Powell suggested that a blanket freeze on customers from “countries unjustly attacking and provoking violence around the world” would require Kraken to “freeze all US accounts.” 

A Reddit account believed to be Powell’s responded to the Times report on Tuesday, calling the article “light on quotes and heavy on conjecture.” The post went on to claim that there was “no perfect, 100% flawless way to eliminate sanctions violations short of shutting down the business.”

In response to Powell’s post, Ryan Mac, one of the Times reporters who wrote the article, tweeted that the paper had “confirmed the investigation thru 5 sources and gave him and Kraken a chance to comment,” an invitation that was declined. Mac added that Powell’s Reddit post “cycles through a few hypotheticals of how sanctioned people could potentially use Kraken. That’s interesting! But he doesn’t address why as of last month he was sharing a spreadsheet internally that showed “verified accounts” in sanctioned countries.”

Powell then replied to Mac via his Twitter account, claiming ignorance of the spreadsheet Mac was referring to. Powell further claimed that “nobody identified to be in Iran is able to trade crypto … the concern would be any potential unidentified accounts, not the identified ones.”

Rules for thee but not for me

This is the second report this month of digital currency exchanges allegedly ignoring sanctions on Iran. Reuters recently reported that Binance continued to permit residents of Iran to conduct trades despite publicly proclaiming that the exchange was complying with U.S. sanctions. Binance’s primary appeal for Iranian customers was based on the exchange’s notoriously inadequate ‘know your customer’ (KYC) controls and Binance boss Changpeng ‘CZ’ Zhao’s belief that rules apply to lesser mortals than himself.

Kraken’s Powell shares CZ’s sense of crypto exceptionalism, where code is law and actual law is to be disregarded on a case-by-case basis depending on whether a law fits within his personal worldview and/or might jeopardize company revenue.

The Times reported on a 2019 Slack discussion in which Powell suggested it might be “worth the risk to not follow the legal requirement” if the penalty proved less costly than the benefits the company could reap from non-compliance. Powell added that ignoring the law “would by default be ‘ill-advised,’ but it always has to be considered an option.”

In 2019, Powell publicly admitted that he’d essentially engaged in bank fraud years earlier in order to maintain his company payroll when banks froze Kraken’s accounts. Powell said he’d “cycled through multiple rented PayPal accounts and I started spreading deposits across several banks, cash in safety deposit boxes. Probably a compliance person’s worst nightmare but I basically had to employ the arts of a money launderer to survive.”

While the Times reported that the most likely outcome of the OFAC probe would be a monetary penalty—presumably larger than the $1.25 million penalty issued by the Commodities and Futures Trading Commission (CFTC) in 2021 for Kraken lacking a license to offer margined digital commodity products to unqualified investors—Powell’s constant ‘come at me, bro’ challenges of regulatory authority will eventually reach a tipping point.

The difference between Powell and Binance’s CZ is that the latter has the sense to avoid setting foot anywhere near the U.S. or any other jurisdiction that doesn’t view financial regulations on an opt-in basis. Then again, perhaps Kraken’s recent decision to shutter its San Francisco headquarters for a more freewheeling approach to residency means Powell has learned a lesson from CZ’s nomadic ways.

Ironically, Powell’s official statement on leaving San Francisco was that the local district attorney wasn’t applying the laws that Powell agreed with as rigorously as Powell would have preferred. Et tu, Jespow?

Someone must be a snowflake some of the time

Among the other eye-opening revelations in Runyon’s lawsuit against his former employer was that shortly after joining Kraken in March 2018, Runyon was asked to help with an audit. Runyon claimed that Kraken’s CFO Kaiser Ng told him to “come up with anything for the audit list that would satisfy the audit questions without regard to how accurate the info was. Ng wanted something to ‘check the box.’”

In March 2019, Runyon said he was asked to help reconcile the contents of Kraken’s bank accounts with the exchange’s customer account balances. Runyon subsequently discovered that the bank accounts were “short millions of dollars” when compared to the sum of customer deposits. But when Runyon alerted Ng as to the discrepancy, “Ng immediately removed Runyon from working on the project.” Kraken decided to “sever their relationship” with Runyon a few months later.

The not-at-all-batshit-insane ‘Kraken Culture Explained’ manifesto that Powell released last month was chock full of homages to employees who used language that irked other employees, based on the company ethos that “someone must be offended, some of the time.” Given that standard, it’s hard to fathom why Kraken and Powell acted like such snowflakes when an employee spoke hard truths about mixing customer deposits with operating capital.

Powell, along with other senior management at Kraken—and those working at other exchanges—would do well to remember that the Racketeer Influenced and Corrupt Organizations (RICO) Act gives the U.S. government broad authority to bring down entities they suspect are engaging in criminal activity—including fraud—undertaken as part of an enterprise.

Legal analysts have suggested that “a cryptocurrency network could serve as the ‘enterprise’ required by the statute.” The feds could prove a RICO violation by showing “the existence of an enterprise, the defendant’s derivation of income from a pattern of racketeering activity, and the use of any part of that income in acquiring an interest in or operating the enterprise.” Criminals could be prosecuted under RICO if they use an enterprise to conduct criminal activities, even as “the enterprise continues its legitimate operations.” 

As such, Kraken execs such as chief legal officer Marco Santori, chief operating officer David Ripley and new CFO Carrie Dolan would do wise to watch both their words and deeds. Dolan, in particular, given that she reached a settlement with the U.S. Securities and Exchange Commission in 2018 after being charged with violating the anti-fraud provisions of the Investment Advisers Act.

Jesse, we hear the weather in Iran is lovely this time of year…

Follow CoinGeek’s Crypto Crime Cartel series, which delves into the stream of groups from BitMEX to Binance, Bitcoin.com, Blockstream, ShapeShift, Coinbase, Ripple,
Ethereum, FTX and Tether—who have co-opted the digital asset revolution and turned the industry into a minefield for naïve (and even experienced) players in the market.