OFAC Says New Mobile Software Inadvertently Rendered a Brokerage's Second-Tier Geo-Blocking Ineffective for Users of Its Mobile Platform

On March 17, 2026, the U.S. Treasury's Office of Foreign Assets Control (OFAC) published an enforcement release on a Florida-headquartered brokerage firm that operates online securities trading platforms. The firm agreed to pay $1,110,661 to settle its potential civil liability for 481 apparent violations of multiple sanctions programs. OFAC determined that the apparent violations were non-egregious and voluntarily self-disclosed. Parts of the release follow, not the whole.

The Controls

From June 2021 to June 2022, the firm used two tiers of geo-blocking to verify where its users were and to prevent access to its web-based and mobile platforms from sanctioned jurisdictions. The first was a firewall designed to deny users with IP addresses associated with sanctioned jurisdictions. The second was a third-party tool that checked a user's IP address at login and denied access based on location. A third-party service also alerted sanctions compliance staff, daily, to access attempts the two tiers had prevented.

In April 2018 the firm built new software to improve its mobile platform. It "inadvertently rendered" the second tier ineffective for mobile users, the release says. Instead of reading the IP address of the person logging in, the second-tier protocol "detected the IP address of the U.S.-located server from which" the new mobile software ran. On the mobile platform, that left the control incapable of identifying users in Iran, Syria and Crimea.

The first tier went down on June 21, 2021. An employee disabled it to install a software update from the firm's cloud services provider, and "inadvertently failed to reenable" it. It stayed effectively disabled until at least June 15, 2022. The release calls the result "a nearly 12-month period" in which the firm was not restricting access to its mobile platform from IP addresses associated with sanctioned jurisdictions, although sanctioned users attempting to access the web-based platform would have been blocked by the second tier. Users in Iran, Syria and Crimea executed 481 trades through the mobile application in that time, for a total of $4,442,645.

A control that runs is not the same as a control that works.

The Checks That Were Not There

In 2018 a technology affiliate developed an automated testing tool for its on-premises servers that simulated access attempts from IP addresses associated with sanctioned jurisdictions. The firm later found that its internet service and cloud providers were blocking those test attempts before they could reach its systems. It "discontinued the use of this tool in November 2021 without replacing it." So, the release says, when the apparent violations occurred it had no effective testing mechanism, neither for its on-premises servers nor for its mobile platform, to ensure that its geo-blocking controls were functioning as intended.

On September 21, 2021, an affiliated employee received an email from the third-party provider of its daily notifications that the subscription would be expiring, did not renew it, and did not tell others in the sanctions compliance department. "For a period of over eight months," the release says, compliance personnel "failed to address the absence of its once-daily OFAC alerts and did not consider or act on what the lack of notifications might have signaled" about the firm's sanctions compliance program.

What OFAC Weighed, and What It Advises

Among the aggravating factors, OFAC says the firm received a Cautionary Letter from OFAC earlier in 2021 about apparent violations from other deficiencies related to its geo-blocking software, and despite that warning failed to ensure its controls were properly tested. The absence of the daily alerts, it says, "should have served as an additional warning sign." Among the mitigating factors it lists the firm's prompt remedial steps, including new technical controls and solutions so that any future failures of its geo-blocking or alert functions "could be quickly identified."

Under the heading "Compliance Considerations," the release says "controls only work if they are effectively implemented," and "the most well-designed sanctions compliance program can be rendered wholly ineffectual by human and technical errors." Such controls, it says, may also include controls "to validate proper system operation and execution following any outage, including due to planned maintenance or upgrade."

The release treats the silence of the alerts as a signal the firm should have read. How many systems would notice that a daily message has stopped arriving?