MUL~762365
DEPARTMENT
OF
THE
TREASURY
WASHINGTON,
D.C.
20220
SETTLEMENT AGREEMENT
This
Settlement Agreement
(the
"Agreement")
is
made
by
and between
the
U.S.
Department ofthe Treasury's Office
of
Foreign
Assets
Control (OFAC)
and
PayPal,
Inc.
(PayPal).
I.
PARTIES
1.
OFAC
administers
and
enforces
economic
sanctions against targeted
foreign
countries,
regimes,
terrorists, international
narcotics
traffickers,
and
persons
engaged
in
activities
related
to
the proliferation
of
weapons
of
mass
destruction, among others.
OFAC
acts under
Presidential
national
emergency authorities,
as
well
as
authority granted
by
specific legislation,
to
impose
controls
on
transactions
and
freeze
assets
under
U.S.
jurisdiction.
2.
PayPal
is
a
licensed
money
services
business
(MSB)
headquartered
in
San
Jose,
California
and
organized
under
the
laws
of
the
United
States.
II.
FACTUAL STATEMENT
3.
For several
years
up
to
and
including
2013,
despite processing a
high
volume
of
transactions
and
maintaining
an
international
presence,
PayPal
does
not appear
to
have
implemented effective compliance procedures
and
processes
to
identify, interdict,
and
prevent
transactions
in
apparent violation of the sanctions
programs
administered
by
OFAC.
In
particular,
Pay
Pal
failed
to
employ adequate
screening
technology
and
procedures
to
identify the
potential involvement
of
U.S.
sanctions targets
in
transactions that PayPal processed.
As
a result
of
this
failure,
Pay
Pal
did
not screen in-process transactions
in
order
to
reject or block
transactions pursuant
to
U.S.
sanctions
program
requirements.
4.
Beginning
in
or
around
March
2006,
Pay
Pal
identified a series of OFAC-related
issues
with
its
payment
systems
and
began taking
steps
to
strengthen
and
enhance
its
OFAC
compliance processes
and
procedures. For several
years,
up
to
and
including
2011,
Pay
Pal
did
not
interdict in-process transactions that included references
to
OF
AC-sanctioned countries or
persons.
In
July
2011,
PayPal
implemented a "short
term
fix"
that allowed
the
company
to
scan
live
transactions
for
sanctions-related keywords
and
evaluate
any
potential
matches
while
the
completed payments
were
held
in
a pending
status.
Over
the
next two years,
Pay
Pal
implemented a number
of
enhancements
to
its interdiction software,
and
in
April2013,
PayPal
implemented a ''long
term
solution"
to
screen
in-process
transactions.
Using
the long
term
solution,
PayPal
began
screening
live
transactions against OFAC's List
of
Specially Designated
Nationals
and
Blocked Persons
(the
"SON List")
and
an
expanded version ofPayPal's list of
sanctions-related keywords.
Upon
implementation of the
long
term
screening solution,
PayPal
began
screening transactions
in
real
time
and
began
appropriately blocking
and
rejecting
OF
AC-
prohibited transactions before payment completion. Prior
to
the implementation
of
the "long
PayPai, Inc.
MUL-762365
term
solution"
PayPal
processed hundreds of transactions
in
apparent violation
of
multiple
U.S.
economic sanctions programs.
5.
Separately,
between
October
20,
2009
and April I,
2013,
Pay
Pal
processed
136
2
transactions totaling $7,091.77
to
or
from
a
Pay
Pal
account registered
to
Kursad
Zafer
Cire,
an
individual designated
by
the
U.S.
State Department
on
January
12,
2009
pursuant
to
Executive
Order 13382
of
June
28,
2005,
"Blocking
Property
of
Weapons
of
Mass
Destruction Proliferators
and
Their Supporters."
PayPal
explained
to
OFAC
that
it
failed to identify
its
customer
as
a
potential Specially Designated National
(SDN)
at the
time
of
his
designation because the MSB's
automated interdiction filter
was
not
"working properly." Approximately six
months
later,
PayPal's automated interdiction filter appropriately flagged Cire's account
as
a potential
match
to
the
SDN
List.
A
PayPal
Risk
Operations
Agent
mistakenly believed that the
system
had
generated the alert
in
order
to
confirm Cire's
name
and
address, however,
and
the
Risk
Operations Agent dismissed the alert without requesting or obtaining
any
additional information.
On
four
separate occasions between September
3,
2009
and
November
16,
2009, PayPal's
automated interdiction
flagged
Cire's account
for
review
due
to
a potential
match
to
the
SDN
List.
On
each occasion,
however,
separate
PayPal
Risk
Operations Agents dismissed the alerts
because the previous alerts
had
been
dismissed,
which
PayPal asserted
made
these alerts appear
as
though
they were duplicates.
PayPal
stated
that
this
conduct did not comply
with
the MSB's
internal policies
and
procedures
for
handling
SDN
name
matches.
6.
On
February
I4,
2013, PayPal's interdiction filter
again
flagged Cire's account
for
a potential match
to
the
SDN
List,
and
a
PayPal
Risk
Operations
Agent
followed
the MSB's
procedures for handling
an
SDN
name
match
by
creating a "case"
for
the
match,
restricting
Cire's account,
and
requesting additional information
from
the customer.
Upon
receiving
the
requested
information,
which
included a
copy
of
Cire's passport showing a date
of
birth
and
place
of
birth that
were
identical
to
those
of
the
SON,
PayPal's Risk Operations
Agent
dismissed
the
match
due
to
an
apparent misunderstanding of
why
the interdiction filter
had
flagged
Cire's
account
for
review.
On
April3,
2013,
PayPal's interdiction filter
flagged
Cire's account for a
seventh
time,
and
the
MSB
appropriately
blocked
the
account
and
reported
it
to
OFAC.
7.
Between December
17,
201
0
and
September
29,
2013, Pay
Pal
appears
to
have
violated§
515.201
ofthe
Cuban
Assets
Control
Regulations,
31
C.P.R.
part
515
(CACR),
by
processing
98
transactions totaling $19,344.89 involving Cuban-origin
goods,
or
in
which
Cuba
or a
Cuban
national
had
an
interest.
8.
Between September
19,
2009
and
August
5,
20I3,
PayPal
appears
to
have
violated§ 560.204
of
the Iranian Transactions
and
Sanctions Regulations,
31
C.P.R.
part
560
(ITSR),
when it exported financial services
to
Iran
by
processing
25
transactions totaling
$2,
I
09.82
that related
to
payment
for
purchases
of
goods
or services destined
for
Iran.
9.
Between September
16,
2009
and
October
II,
2013,
PayPal
appears
to
have
violated § 560.206
of
the
ITSR
when
it
engaged
in
transactions related
to
goods
of
Iranian origin
by
processing
100
transactions totaling
$6,14
7.84
that
related
to
the
sale
or purchase
of
Iranian-
origin goods.
PayPal,
Inc.
MUL-762365
10.
Between May
9,
2010 and August 19,2013, PayPal appears to have violated
§
538.205
of
the Sudanese Sanctions Regulations,
31
C.F.R. part 538 (SSR), when it exported
services to Sudan by processing 33 transactions totaling $3,314.43 involving Sudan.
II.
Between November 29, 2009 and May 11, 2013, PayPal appears to have violated
§
594.201
ofthe
Global Terrorism Sanctions Regulations,
31
C.F.R. part 594 (GTSR), when
it
dealt
in
blocked property by processing
94
transactions totaling $5,925.27 involving Interpal
(designated by OFAC on August 21, 2003) and Kahane Tzadak (designated by the U.S. State
Department on October 12, 1999).
12.
Between October
20,2009
and April1, 2013, PayPal appears to have violated
§
544.201
ofthe
Weapons
ofMass
Destruction Proliferators Sanctions Regulations,
31
C.F.R.
part 544 (WMDPSR), when it dealt
in
blocked property by processing 136 transactions totaling
$7,091.77 to or from
an
account registered
to
Kursad Zafer Cire, an individual designated by
OFAC on January 12,2009.
13.
The apparent violations described above qualify as voluntarily self-disclosed
to
OFAC within the meaning
ofOFAC's
Economic Sanctions Enforcement Guidelines.
See
31
C.F.R. part 501, app A.
14.
The apparent violations
of
the CACR, ITSR, SSR, and GTSR constitute a non-
egregious case.
15.
The apparent violations
of
the WMDPSR constitute an egregious case.
In
3
reaching its determination that the apparent violations
of
the WMDPSR were egregious, OFAC
considered the following facts and circumstances: PayPal demonstrated reckless disregard for
U.S. economic sanctions requirements when its interdiction software failed to identify Cire as a
potential match to the SDN List for approximately six months after Cire's designation and when,
after the software ultimately flagged the accountholder as a potential match to the SDN List,
employees cleared name matches against Cire's account on six separate occasions prior to
appropriately identifying and blocking the account. The conduct was particularly reckless with
respect to those transactions on or after September 3,
2009-the
date that a PayPal Risk
Operation Agent dismissed the second alert. Further, Pay Pal agents engaged in a pattern
of
conduct by repeatedly ignoring certain warning signs about potential matches to the SDN List;
in
the course
ofthis
conduct, Pay Pal provided economic benefit to Cire and undermined the
integrity
of
the WMDPSR and its policy objectives; and multiple PayPal Risk Operation Agents
failed to adhere to the
MSB's
policies and procedures pertaining to SDN match escalation.
16.
Pay Pal has taken remedial action by hiring new management within its
Compliance Division, and undertaking various measures to strengthen Pay Pal's OFAC screening
processes and measures, including steps to implement more effective controls.
17.
PayPal substantially cooperated with OFAC's investigation, including by
submitting the relevant documents and information
in
a clear and organized fashion, answering
numerous follow-up inquiries for information over the course
of
OFAC's investigation, and by
entering into a statute
of
limitations tolling agreement and an extension to the agreement.
PayPal, Inc.
MUL-762365
18.
OF
AC
has not
issued
a penalty notice
or
Finding
of
Violation against PayPal
in
4
the five years preceding the earliest date
of
the transactions giving rise to the apparent violations.
Ill.
TERMS OF SETTLEMENT
IT
IS
HEREBY
AGREED
by
OFAC
and
PayPal that:
19.
In
consideration
of
the undertakings
of
Pay
Pal
in
paragraph 20 below,
OF
AC
agrees
to
release
and
forever discharge PayPal, without any finding
of
fault,
from
any and
all
civil liability arising under the
lega
l a
uth
orities that
OFAC
administers
in
connection with
the
apparent violations detailed
in
this Agreement (the "Apparent Violations").
agrees:
20.
In
consideration
of
the undertakings
of
OFAC in paragraph
19
above, Pay
Pal
a.
Within
15
days
of
the date
Pay
Pal receives
the
unsigned copy
of
this Agreement
to:
i.
sign, date, and
mail
the original copy
of
this Agreement
to
the
Office
of
Foreign Assets Control,
U.S.
Department
of
the Treasury
-
Sa
nctions Compliance
and
Evaluation, 1500
,
NW:'Washington,
DC
20220. PayPal should retain a copy
of
the signed
Agreement and a receipt or other evidence that shows the date that PayPal
mailed
the
signed Agreement
to
OF
AC; and
ii.
pay
to
the
U.S. Department
of
the
Treasury the amount of$7,658,30
0.
PayPal's payment must
be
made either by
an
electronic funds transfer
in
accordance with
the
enclosed "Electron
ic
Funds Transfer (EFT)
Instructions," or
by
cashier's or certified check
or
money order payable
to
the
"U.S. Treasury"
and
referencing MUL-762365. PayPal must either:
(I)
ind
icate payment
by
electronic funds transfer, by checking the
box
on
the signature page
of
this Agreement;
or
(2) enclose payment by cashier's
or certified check or
money
order together with
the
signed original
Agreement
to
be
returned
to
OF
AC
at the address
in
paragraph a(i) above.
b.
Within six months
of
the date
of
this Agreement,
to
provide OFAC with a
presentation summarizing PayPal's current policies
and
procedures as they relate
to
screening transactions and/or customers for the purpose
of
compliance with
the
regulations
adm
ini
stered by
OFAC.
c.
To waive (i) any claim by
or
on beha
lf
of
PayPal, whether asserted
or
unasserted,
against
OFAC,
the
U.S.
Department
of
the Treasury, and/or its officials
and
employees arisi
ng
out
of
the
facts
giving rise
to
the enforcement matter that
resulted
in
this Agreement,
inc
luding but not limited
to
OF
AC' s investigation
of
Pay
Pal,
Inc.
MUL-762365
the apparent violations and
(ii)
any possible legal objection to this Agreement at
any future date.
IV.
MISCELLANEOUS PROVISIONS
21.
This Agreement shall not constitute an admission or denial by PayPal
of
any
allegation made or implied
by
OFAC
in
connection with the Apparent Violations.
22.
Except
as
provided
in
paragraphs 7-12 above, this Agreement has
no
bearing on
any past, present, or future OFAC actions, including the imposition
of
civil monetary penalties,
with respect to any activities by Pay Pal other than those set forth
in
the Apparent Violations.
23.
OFAC may,
in
its sole discretion, issue a public statement about the facts ofthis
Agreement, on its Web site or otherwise, including the identity
of
any entity involved, the
settlement amount, and a brief description
of
the Apparent Violations.
24.
This Agreement consists
of
six pages and expresses the complete understanding
ofOFAC
and PayPal regarding resolution
ofOFAC's
enforcement matter involving the
Apparent Violations. No other agreements, oral or written, exist between OF AC and Pay Pal
regarding resolution
of
this matter.
25.
This Agreement shall inure to the benefit
of
and be binding on each party,
as
well
as its respective successors or assigns.
26.
All communications regarding this Agreement shall be addressed to:
PayPal, Inc.
2211
N.
1
51
St.
San Jose, CA 95131
Attn: Sanctions Compliance
&
Evaluation
Office ofForeign Assets Control
U.S. Department
of
the Treasury
1500 Pennsylvania Avenue, NW
Washington,
DC
20220
THIS SPACE LEFT INTENTIONALLY BLANK
5
PayPal,
Inc.
MUL-762365
27.
00o..v1:,h
PayPal
accepts
the
terms
of
this
Settlement Agreement
thi&day
of
, 2015.
~'b:?u~
.
(]Amiei~Boucher,
Esq
Partner, Skadden, Arps, Slate, Meagher
&
Flom
LLP
Counsel
for PayPal,
Inc.
Please check
this
box
if
you
have
not
enclosed payment
with
this
Agreement
and
will
instead
be
paying or
have
paid
by
electronic funds transfer
(see
paragraph 2(A)(ii)
and
the Electronic
Funds
Transfer Instructions enclosed
with
this Agreement).
AGREED:
Acting
Director
Office of
Foreign
Assets Control
6
