New York hits Block with a $40 million fine and mandates independent oversight after major compliance failures in Cash Apps bitcoin and fiat transaction monitoring.
NY Regulator Unleashes Oversight Blitz on Block After Missed Red Flags and AML Gaps
New York State‘s Department of Financial Services (DFS) announced on April 10 that Block Inc. will pay a $40 million fine and hire an independent monitor, following findings of significant violations in the company’s anti-money laundering and virtual currency compliance systems related to its Cash App platform.
The DFS found that Block‘s rapid growth exceeded its capacity to establish adequate oversight, heightening the risk of illicit financial activity. The regulator said the company’s failures violated New York regulations for financial institutions and virtual currency firms. It cited weak internal controls over fiat and bitcoin transactions, including lapses in customer due diligence, sanctions screening, and monitoring for suspicious activity. By 2020, Block had accumulated a backlog of more than 169,000 unreviewed transaction alerts. Superintendent Adrienne A. Harris stressed:
All financial institutions, whether traditional financial services companies or emerging cryptocurrency platforms, must adhere to rigorous standards that protect consumers and the integrity of the financial system.
“Compliance functions must keep pace with company growth or expansion. The rapid growth of Blocks Cash App absent a robust compliance function created risk and vulnerabilities that violated the rules financial services companies operating in New York must adhere to. The Department is taking decisive steps to ensure accountability, including the appointment of an independent monitor to oversee corrective measures,” she continued.
In Block‘s consent order, DFS provided further violation details, including the company’s failure to screen transactions with potential links to terrorism until a recipient wallets exposure exceeded 10%, and its inadequate treatment of anonymizing services like mixers. The DFS claimed:
The AML program run by Block … failed to adequately consider the substantial risks posed to an entity of its new size and complexity.
The order also revealed that between 2018 and 2021: “Block had accumulated a transaction monitoring backlog of approximately 18,000 alerts, which grew to over 169,000 by 2020.” DFS added that “between February 2021 and September 2022 … SARs, for both bitcoin and fiat transactions, were at times filed over a year after the alerts were first generated.” Block‘s risk rating for transactions involving mixers was also cited, as DFS noted that despite guidance: “Block risk rated transactions identified as having exposure to mixers as ’medium‘ risk, rather than the ’high risk rating that is appropriate.”