On March 17, 2026, OFAC issued a new Enforcement Release: Florida-based brokerage firm TradeStation Securities, Inc., agreed to pay $1,110,661 to settle potential civil liability for 481 apparent sanctions violations. The case is a textbook example of how an OFAC compliance failure rooted not in intent but in technical error and staff negligence can translate into seven-figure penalties and lasting reputational damage.

What Happened

TradeStation has operated since 1995, offering retail and institutional investors access to equities, options, and futures trading through desktop, web, and mobile platforms. The firm operates across more than 160 electronic exchanges and market centers worldwide.

Between June 21, 2021, and June 15, 2022, customers located in Iran, Syria, and Crimea accessed TradeStation’s mobile app and executed 481 trades totaling $4,442,645. This happened because multiple layers of the firm’s compliance infrastructure broke down at the same time, and nobody noticed for nearly a year.

How the OFAC Compliance Failure Unfolded

TradeStation ran a two-tier geo-blocking system to prevent users in sanctioned jurisdictions from accessing its platforms. The first tier was a firewall that blocked IP addresses associated with sanctioned countries. The second was a third-party IP verification tool that screened users at login.

The trouble started in 2018. When TradeStation built a new mobile platform software, the update inadvertently disabled the second-tier geo-blocking: instead of detecting the user’s IP address, the system began detecting the IP address of TradeStation’s own U.S.-based server. That flaw went undetected for over three years.

Then, on June 21, 2021, a TradeStation employee disabled the first-tier geo-blocking to install a cloud provider update and simply forgot to turn it back on. It stayed off until at least June 15, 2022. With both layers of protection simultaneously down, customers in Iran, Syria, and Crimea traded freely through the mobile app for nearly twelve months.

What made the OFAC compliance failure especially damaging was the absence of any working testing mechanism. TradeStation had previously developed an automated tool that simulated access attempts from sanctioned-jurisdiction IP addresses, but discontinued it in November 2021 without a replacement. At the same time, a third-party alert service that sent daily notifications about blocked access attempts stopped functioning in September 2021 when a subscription lapsed. No one in the compliance department noticed the notifications had stopped arriving for eight months.

How OFAC Assessed the Violations

OFAC classified the violations as non-egregious, in part because TradeStation voluntarily self-disclosed them. The base civil penalty was $2,221,322. The final settlement came in at $1,110,661 – half the base amount.

Aggravating factors:

• TradeStation had already received a Cautionary Letter from OFAC earlier in 2021 for a separate but related geo-blocking deficiency. Rather than conducting a comprehensive systems audit in response, the firm failed to address similar vulnerabilities, and OFAC held that against it.
• The violations were systemic and continued for nearly a year.
• As a sophisticated, heavily regulated, technology-driven firm operating globally, TradeStation was expected to know better.

Mitigating factors:

• Voluntary self-disclosure and timely cooperation with OFAC’s investigation.
• Prompt implementation of new technical controls after discovering the violations.
• Minimal revenue from the violations: under $2,000.

Key Takeaways

1. Technical errors don’t excuse sanctions violations

An OFAC compliance failure caused by a software bug or employee oversight is still a sanctions violation. OFAC looks at outcomes, not intent. Prohibited transactions occurred – that is enough.

2. Having controls is not the same as controls working

Geo-blocking, SDN screening, and KYC procedures only protect you if they function. OFAC made this the central lesson of the case: testing and auditing are not box-checking exercises; they are core components of any effective compliance program.

3. Silence from your compliance systems is a red flag

Eight months passed without daily access-attempt notifications, and no one in TradeStation’s compliance department questioned it. When a system that routinely generates notifications suddenly goes quiet, that silence is itself a warning sign, and not a reassurance.

4. Prior OFAC warnings raise the stakes

TradeStation had been put on notice. When a firm receives a Cautionary Letter and fails to act on it comprehensively, any subsequent violation carries heavier consequences. OFAC’s message is clear: warnings are not formalities.

5. Voluntary self-disclosure cuts penalties in half

TradeStation’s decision to self-disclose reduced the penalty from $2.2 million to $1.1 million. Compare that to the Syrian real estate manager case, where no self-disclosure was made, and the penalty reached $3.77 million under broadly comparable circumstances. The math speaks for itself.

What This Means for Financial Firms and Technology Companies

This enforcement action speaks directly to brokers, fintech companies, payment processors, and any organization relying on automated compliance tools. The practical risks are clear:

• Geo-blocking and IP verification tools can break during software updates; independent testing must be routine, not occasional.
• Disabling any element of a compliance system, even temporarily, must be documented and subject to a formal re-enablement procedure.
• The disappearance of regular compliance reports or notifications is an independent red flag that demands immediate investigation.
• Prior OFAC warnings, such as a Cautionary Letter or Subpoena amplify liability in any subsequent enforcement action.

OFAC put it plainly: a “set it and forget it” approach to sanctions compliance is not acceptable.

Conclusion

An OFAC compliance failure rarely starts with bad intentions. More often, it begins with a small technical oversight, compounds through inaction, and ends with a penalty that no one anticipated. The TradeStation case makes this dynamic impossible to ignore: the combined cost of a forgotten software toggle, an expired subscription, and eight months of silence in a compliance inbox came to over a million dollars. Regular audits, independent system testing, and a culture of genuine compliance vigilance are not overhead – they are risk management.

If you would like a confidential assessment of your sanctions compliance program or advice on engaging with OFAC, contact us.