On March 17, 2026, the U.S. Department of the Treasury’s Office of Foreign Assets Control announced that TradeStation Securities, Inc., a Florida-based brokerage firm that operates online securities trading platforms for customers around the world, agreed to pay more than $1.1 million to settle potential civil liability for 481 apparent violations of U.S. sanctions laws. According to OFAC, a series of compliance control failures caused TradeStation to provide investment services to customers located in Iran, Syria, and the Crimea region of Ukraine, between June 2021 and June 2022. OFAC determined that the apparent violations were voluntarily self-disclosed and non-egregious in nature, which is reflected in the settlement amount. The amount of the settlement also reflects the “significant remedial measures” that TradeStation implemented after it discovered the apparent violations.
From June 2021 to June 2022, TradeStation implemented several measures designed to prevent users in sanctioned jurisdictions from accessing their web-based and mobile platforms, including the use of two tiers of geo-blocking technology that could verify the location of a user based on their IP address. However, the company’s second-tier geo-blocking tool was allegedly rendered ineffective by a propriety software that the company had been using since 2018. According to OFAC, the software inadvertently caused the second-tier geo-blocking tool to review the IP address of the software’s U.S.-based server rather than the IP addresses of platform users. In 2021, a TradeStation employee also inadvertently failed to reenable the first-tier geo-blocking control after disabling it to install a software update. Both mishaps allegedly enabled users located in Iran, Syria, and Crimea to temporarily have unrestricted access to the company’s mobile platform. The company also had problems testing or validating its sanctions compliance systems. In 2021, the company decided to discontinue its use of an automated testing tool that would simulate access attempts by users with IP addresses in sanctions jurisdictions, leaving the company with no effective testing mechanism. While the company believed that the tool was ineffective, it later discovered that its third-party internet service and cloud providers had been inadvertently blocking the tools’ test access attempts before they could reach TradeStation’s systems. OFAC indicated that these failures, and others, enabled the execution of 481 trades in less than 12 months, in violation of the Iranian Transaction and Sanctions Regulations, 31 C.F.R. part 560; the Syrian Sanctions Regulations, 31 C.F.R. part 542; and the Ukraine-/Russia-Related Sanctions Regulations, 31 C.F.R. part 589.
OFAC emphasized that this enforcement action highlights how important is for companies to conduct regular testing and auditing of their sanctions control programs to ensure that the risk of sanctions violations is minimized and that tools are operating as expected. Companies were also urged to be mindful that sanctions compliance programs can be rendered ineffective by human and technical failures. OFAC recommended that companies implement a “comprehensive, independent, and objective” testing and auditing plan that will not only to allow them to catch problems early but will also provide them with opportunities to evaluate whether existing controls appropriately and effectively address their sanctions risks.
OFAC Recent Actions | OFAC Enforcement Release