A control you never test is a control you don’t have.
The TradeStation OFAC settlement, and what it means for broker-dealers and fintechs that rely on automated controls.
Enforcement · 19 Mar 2026
On March 17, 2026, the Treasury Department’s Office of Foreign Assets Control (OFAC) announced that TradeStation Securities, Inc., a Florida-based online brokerage, agreed to pay $1,110,661 to settle 481 apparent violations of U.S. sanctions on Iran, Syria, and Crimea. What makes this case worth reading is not the dollar figure. It is how ordinary the failure was: two tiers of mobile geo-blocking failed, and ineffective testing did not detect the deficiencies, and for nearly a year customers in sanctioned jurisdictions traded on a U.S. platform through a hole nobody knew was open.
What happened
TradeStation runs online platforms that let retail and institutional investors trade equities, options, and futures, with access to more than 160 exchanges and market centers worldwide. On paper, its sanctions controls were solid. New customers were screened against OFAC’s Specially Designated Nationals list, existing customers were re-screened daily, and the firm ran two tiers of geo-blocking technology meant to keep users in sanctioned jurisdictions off its platforms. It also subscribed to a third-party service that sent daily alerts whenever someone in a sanctioned location tried to log in.
Then the controls broke — in three separate, compounding ways. First, back in 2018, a software update meant to improve the mobile app inadvertently disabled the second tier of geo-blocking for mobile users; instead of reading each user’s real IP address, the system began reading the address of TradeStation’s own U.S. server, so it saw everyone as domestic. Second, on June 21, 2021, an employee installing a cloud update turned off the first tier of geo-blocking and never turned it back on. That left the mobile platform wide open until at least June 15, 2022. Third, the firm’s testing tool had been silently blocked by its own internet providers, was discontinued in November 2021 without replacement, and the daily OFAC alert subscription lapsed in September 2021 when an employee failed to renew it and told no one.
The result: for roughly twelve months, users in Iran, Syria, and Crimea executed 481 trades on the mobile app, totaling about $4.44 million. TradeStation caught the problem itself in June 2022, reviewed the transactions and their associated IP addresses, and disclosed the apparent violations to OFAC. OFAC alleged that the conduct violated the Iranian Transactions and Sanctions Regulations (31 C.F.R. part 560), the Syrian Sanctions Regulations (31 C.F.R. part 542), and the Ukraine-/Russia-Related Sanctions Regulations (31 C.F.R. part 589).
The penalty — and why it landed where it did
Because TradeStation voluntarily self-disclosed and the case was non-egregious, the base penalty under OFAC’s Enforcement Guidelines was calculated as one-half of the transaction value per violation: $2,221,322. The final settlement was exactly half of that, $1,110,661.
The aggravating factors are the instructive part. OFAC found that TradeStation “failed to exercise a minimal degree of caution or care” by leaving the deficiencies unaddressed for about a year — and, critically, that the firm should have known better because it had received a Cautionary Letter from OFAC earlier in 2021 over other geo-blocking problems. Despite that warning, it scrapped its testing tool and ignored eight months of missing daily alerts, each of which should have signaled that something was wrong. OFAC also weighed TradeStation’s sophistication as a heavily regulated, technology-driven firm.
The mitigating factors pulled the number back down: prompt and substantial remediation, the fact that the violations were a tiny fraction of overall trading volume (the firm earned under $2,000 in revenue from them), and genuine cooperation. Here is the counterintuitive lesson. The firm made almost no money and self-reported, yet still paid over a million dollars — OFAC weighed deficient care after its earlier warning, sanctions harm and the firm’s sophistication alongside the mitigating factors. Testing failures were part of that analysis, not its sole driver.
What this means for you
For broker-dealers, fintechs, and any platform business that relies on automated controls, this case carries three practical lessons.
- A control that is never tested is not really a control. TradeStation had the right architecture — screening, two tiers of geo-blocking, daily alerts. The mobile geo-blocking failures went undetected by ineffective testing. The release does not report a failure of SDN name screening, and the second geo-blocking tier continued to operate on the web platform. Independent, regular validation is what separates a compliance program that exists on paper from one that actually functions. Build testing that survives your own vendors and infrastructure, and confirm your test traffic reaches the systems it is supposed to probe.
- Treat the absence of expected signals as a red flag. The daily OFAC alerts stopped arriving, and compliance personnel did not adequately address the missing alerts for over eight months. Your program should surface not just alerts, but the failure of alerts — expiring subscriptions, dropped feeds, controls disabled during maintenance and never re-enabled. A prior warning from a regulator, like the Cautionary Letter here, sharply raises the stakes on all of this.
- Change management is sanctions risk. Two of the three failures came from routine software work: a mobile update and a cloud install. Any change to your stack should include a step that verifies sanctions controls still function afterward. Do not take a “set it and forget it” approach or lean on a patchwork of tools you assume are working.
From assuming to knowing
A control architecture can contain the intended safeguards while still developing a gap that its testing does not detect. The hard part of sanctions compliance is rarely designing the control; it is proving, month after month, that the control still does what you think it does. The move from assuming to knowing is what the TradeStation settlement is really about.
We help broker-dealers, fintechs, and other regulated firms map their sanctions exposure, pressure-test the controls they already rely on, and assess how they document whether those controls function. If you are not certain your controls would survive an honest test, that uncertainty is worth resolving now rather than in a disclosure letter. Contact Zimmermann Law to talk it through.
Sources: OFAC, TradeStation Securities, Inc. enforcement release (March 17, 2026), pp. 1–4. The release reports apparent violations, penalty factors and remediation. This is a historical enforcement account, not current transaction permission. Checked October 2, 2026.
This post is for general information and is not legal advice.
Attorney Advertising. Zimmermann Law PLLC · New York · +1 (917) 426-4625 · contact@zimmermann-law.com