Coinbase, the largest U.S.-based cryptocurrency trading exchange, will pay a $50 million penalty to New York state for “significant failures” in its compliance program and must invest an additional $50 million to improve it.  

The exchange violated virtual currency, money transmitter, transaction monitoring, and cybersecurity regulations, according to a statement by the New York State Department of Financial Services (DFS).  “These failures made the Coinbase platform vulnerable to serious criminal conduct, including, among other things, examples of fraud, possible money laundering, suspected child sexual abuse material-related activity, and potential narcotics trafficking,” it read.

“It is critical that all financial institutions safeguard their systems from bad actors, and the Department’s expectations with respect to consumer protection, cybersecurity, and anti-money laundering programs are just as stringent for cryptocurrency companies as they are for traditional financial services institutions,” said Superintendent of Financial Services Adrienne A. Harris. “Coinbase failed to build and maintain a functional compliance program that could keep pace with its growth. That failure exposed the Coinbase platform to potential criminal activity requiring the Department to take immediate action including the installation of an Independent Monitor.” 

In the course of its investigation, the DFS found that:

• During much of the relevant period, Coinbase’s Know Your Customer/Customer Due Diligence (KYC/CD) program, both as written and as implemented, was immature and inadequate. Coinbase treated customer onboarding requirements as a simple check-the-box exercise and failed to conduct appropriate due diligence;

• Coinbase was unable to keep pace with the growth in the volume of alerts generated by its Transaction Monitoring System (TMS). By late 2021, Coinbase’s failure to keep pace with its alerts resulted in a significant and growing backlog of over 100,000 unreviewed transaction monitoring alerts; and

• One consequence of Coinbase’s failed TMS was that as uninvestigated TMS alerts languished for months in the backlog, Coinbase routinely failed to timely investigate and report suspicious activity as required by law. The Department’s investigation found numerous examples of [Suspicious Activity Reports] filed months after the suspicious activity was first known to Coinbase. 

Coinbase has “taken substantial measures to address these historical shortcomings and remains committed to being a leader and role model in the crypto space, including partnering with regulators when it comes to compliance,” Paul Grewal, Coinbase’s chief legal officer, said in a statement reported by the Washington Post.

The company’s market capitalization stands at $8.6 billion, roughly a tenth of its value when it went public in April 2021, the Post reported.