ShapeShift Settles OFAC Sanctions Violations for $750,000 After Processing $12.5 Million in Prohibited Transactions

Executive Summary

ShapeShift AG, a former prominent cryptocurrency exchange, reached a settlement with the U.S. Treasury Department's Office of Foreign Assets Control (OFAC) on September 20, 2025, agreeing to pay $750,000 for alleged sanctions violations. The settlement addresses charges that ShapeShift permitted users in sanctioned countries, including Cuba, Iran, Sudan, and Syria, to conduct over $12.5 million in cryptocurrency transactions between December 2016 and October 2018. During this period, the exchange reportedly lacked an adequate sanctions compliance program. This OFAC resolution follows a separate action by the Securities and Exchange Commission (SEC) on March 5, 2024, which charged ShapeShift with operating as an unregistered dealer, resulting in a $275,000 penalty.

The Event in Detail

ShapeShift AG, incorporated in Switzerland but with its headquarters and substantial operations in Denver, Colorado, functioned as a market maker for digital assets. At its peak, the platform facilitated up to 20,000 transactions daily, supporting exchanges for approximately 79 different cryptocurrencies. OFAC's investigation revealed that ShapeShift processed 17,183 prohibited transactions, totaling $12,570,956, with users in sanctioned jurisdictions. These included 39 violations of Cuban Assets Control Regulations, 16,839 violations of Iranian Transactions and Sanctions Regulations, 33 violations of Sudanese Sanctions Regulations, and 272 violations of Syrian Sanctions Regulations.

OFAC identified several aggravating factors, including ShapeShift's failure to maintain even minimal sanctions compliance controls, its possession of IP address data indicating users in sanctioned regions, and the economic benefit conveyed to persons in those areas. Mitigating factors considered by OFAC included ShapeShift's relatively small size during the violation period, its cessation of operations in 2021, and its constrained financial position. The agency also noted ShapeShift's cooperation with the investigation and lack of prior OFAC violations. While the base civil monetary penalty for these violations was calculated at $39,515,000, the final settlement amount of $750,000 reflects these mitigating circumstances and the company's defunct status.

Separately, the SEC found that ShapeShift operated ShapeShift.io as an online platform that bought and sold crypto assets from and to users, acting as the counterparty for every transaction. The SEC alleged that some of these crypto assets were offered and sold as securities, leading to charges that ShapeShift acted as an unregistered dealer in violation of Section 15(a) of the Securities Exchange Act of 1934. ShapeShift consented to a cease-and-desist order and paid a $275,000 penalty without admitting or denying the findings.

Market Implications

This settlement reinforces the U.S. government's stringent approach to sanctions compliance within the cryptocurrency sector. It signals that regulatory obligations extend to digital asset platforms, regardless of their operational status or incorporation jurisdiction, particularly if they have substantial U.S. ties. The enforcement action underscores the critical need for all crypto entities to implement and maintain robust, risk-based sanctions compliance programs, including comprehensive Know Your Customer (KYC), Anti-Money Laundering (AML), and sanctions screening protocols. Failure to do so can result in significant penalties, even for defunct organizations. The case highlights the trend of applying traditional financial compliance frameworks to the evolving landscape of decentralized and cross-border digital asset platforms, drawing parallels to large-scale penalties such as Binance's $4.3 billion settlement for similar breaches in 2023.

Broader Context

The ShapeShift settlement occurs within a dynamic regulatory environment for cryptocurrencies. While this action demonstrates continued enforcement against non-compliance, recent developments in early 2025 suggest a potentially shifting stance from the U.S. administration toward regulatory clarity and reduced enforcement. For instance, the SEC has reportedly closed investigations into entities like Opensea and Robinhood and dismissed claims against Coinbase. Furthermore, the SEC announced that memecoins would no longer be considered securities subject to its oversight. However, this potential relaxation is not universal, as evidenced by OKX's guilty plea on February 24, 2025, for operating an unlicensed money business, resulting in over $500 million in forfeitures and fines. This mixed landscape suggests that while federal enforcement trends may evolve, stringent compliance requirements for core financial regulations, such as sanctions and money laundering, remain paramount. Additionally, private litigation continues to serve as an ongoing check on the industry, independent of federal regulatory actions.