PayPal Coughs Up $7.6 Million After Processing Payments to WMD Suspects

Written by

PayPal has agreed to pay the US government $7.6m after processing multiple transactions in violation of American sanctions.

The payments giant is said to have not “implemented effective compliance procedures and processes to identify, interdict, and prevent” said transactions for “several years” prior to and including 2013.

The settlement was made with the Treasury department’s Office of Foreign Assets Control (OFAC).

This is an agency which enforces economic and trade sanctions on “targeted foreign countries and regimes, terrorists, international narcotics traffickers, those engaged in activities related to the proliferation of weapons of mass destruction, and other threats to the national security, foreign policy or economy of the United States.”

According to the settlement agreement (via The Register) PayPal is accused of failing to spot transactions made by entities covered by the sanctions.

Despite identifying “OFAC-related issues” with its payment systems as far back as 2006, the firm did nothing to “interdict in-process transactions that included references to OFAC-sanctioned countries or persons,” the settlement alleges.

In 2011 PayPal is said to have implemented a short-term fix allowing it to scan “sanctions-related keywords” for live transactions, but it was another two years before it implemented a long-term solution, allowing it to screen in-process transactions.

The settlement added:

“Upon implementation of the long term screening solution, PayPal began screening transactions in real time and began appropriately blocking and rejecting OFAC prohibited transactions before payment completion. Prior to the implementation of the "long ayPai, Inc. MUL-762365 term solution" PayPal processed hundreds of transactions in apparent violation of multiple U.S. economic sanctions programs.”

OFAC drew attention to one particular payee – Kursad Zafer Cire – who was granted payments totaling $7,091.77 between 2009 and 2013, despite having been on a sanctions list from 2009.

An executive order was put in place with the following: “Blocking Property of Weapons of Mass Destruction Proliferators and Their Supporters.”

PayPal apparently argued at the time that it failed to identify the individual as a “potential Specially Designated National (SDN)” because its automated interdiction filter was not “working properly.”

What’s hot on Infosecurity Magazine?