Block Inc., the company behind Cash App and led by Jack Dorsey, has been fined $40 million by the New York Department of Financial Services (NYDFS).
The penalty, announced on April 10, stems from widespread lapses in the company’s anti-money laundering (AML) and compliance systems related to its virtual currency operations.
NYDFS Superintendent Adrienne Harris said companies must scale their compliance programs alongside their growth. She noted that Block’s shortcomings created vulnerabilities that could have been avoided with proper oversight.
Harris said:
“All financial institutions, whether traditional financial services companies or emerging cryptocurrency platforms, must adhere to rigorous standards that protect consumers and the integrity of the financial system.”
Block is required to pay the fine within 10 days and will also be placed under the supervision of an independent monitor for 12 months. During this period, the firm must overhaul its AML controls, sanctions screening, and transaction monitoring processes
Block’s weak oversight over Bitcoin transactions
According to the Consent Order, the financial regulator found that Block failed to meet state requirements for monitoring digital asset transactions.
According to the NYDFS, the company’s compliance program did not detect or flag Bitcoin transactions linked to wallets associated with illicit or sanctioned activity unless certain thresholds were exceeded.
Specifically, alerts were not triggered unless a receiving wallet had more than 1% exposure to terrorist-connected wallets.
Additionally, transactions to such wallets were not blocked until that exposure crossed 10%. The threshold-based approach violated regulatory expectations, which mandate proactive risk management.
The authorities emphasized that any engagement with high-risk wallets, even below 1%, requires a solid, risk-based rationale. Without it, the company fell short of its obligations under federal and state financial crime prevention laws.
Engaging with mixers
Another area of concern was Block’s handling of transactions routed through crypto mixers, services that mask the origin and destination of funds, making them attractive to criminals.
Despite their high-risk nature, Block continued to classify these transactions as “medium” risk rather than “high,” ignoring repeated warnings from regulators.
NYDFS also criticized Block’s inability to handle the volume of transaction alerts. From 2018 to 2020, the company’s backlog of unprocessed alerts ballooned from 18,000 to over 169,000.
This surge was blamed on the firm’s failure to anticipate the compliance demands tied to Cash App’s rapid growth. As a result, some suspicious activity reports (SARs) were filed more than a year after the initial alerts, significantly delaying investigations.
