Federal prosecutors are currently investigating internal practices at Block, a financial technology firm founded by Jack Dorsey, co-founder of Twitter. According to sources familiar with the matter, a former employee has disclosed alleged compliance failures spanning several years at Block's main units, Square and Cash App.
The former employee provided documents to prosecutors from the Southern District of New York, alleging that Square and Cash App did not collect sufficient information from customers to assess risks. Additionally, Square reportedly processed numerous transactions involving countries under economic sanctions, while Block processed cryptocurrency transactions for terrorist groups. The former employee alleged that most of these transactions were not reported to the government as required, and that Block did not address these issues when alerted.
Documents provided by the former employee identify transactions involving entities from countries under U.S. sanctions, such as Cuba, Iran, Russia, and Venezuela. The former employee criticized the compliance section at Block, stating that it was flawed and led by individuals unsuitable for managing a regulated compliance program.
A second source, familiar with Block's monitoring programs, supported these claims. Both sources requested anonymity due to concerns about potential reprisals.
Edward Siedle, a former Securities and Exchange Commission lawyer representing the former employee, stated that compliance lapses were known to Block's leadership and board in recent years. The inquiry by prosecutors follows earlier reports from whistleblowers regarding compliance failures at Cash App, a popular mobile payment platform owned by Block.
In response to these allegations, Block stated that it has a comprehensive compliance program, regularly adapting practices to address emerging threats and comply with evolving sanctions regulations. The company claimed to have voluntarily reported thousands of transactions to the Office of Foreign Assets Control (OFAC), a U.S. Treasury department responsible for enforcing economic sanctions. However, the former employee disputed this claim, stating that thousands of transactions were not reported.
Square, another main business unit at Block, faced issues with basic customer due diligence on international merchant sellers and improper reimbursement of funds frozen for sanctions violations, according to documents reviewed by NBC News.
Cash App's design was noted to increase the risk of compliance lapses, as customers often depleted stored balances quickly, limiting the ability to block or reject funds.
An outside consultant hired by Block identified nearly 50 deficiencies in monitoring suspicious activities and screening for sanctions violations last year. Block defended its actions, stating that hiring the consultant demonstrated its commitment to compliance and that the number of deficiencies cited was not unusual given the report's scope.
Block declined to address specific deficiencies cited in the documents but stated that when deficiencies are identified, the company works with legal teams and consultants to advise on appropriate remediation. The company conducts recurring sanctions screening on all merchants and claims its program meets the essential components expected by OFAC.
The former employee also informed prosecutors that the Block board of directors was aware of extensive lapses at the company. Block recently announced the departure of two directors, Lawrence Summers and Sharon Rothstein, citing their desire to focus on other activities. Summers had served on the audit committee overseeing the company's risk assessment and management policies.
Block has faced regulatory challenges in the past. In late 2021, the Bank of Lithuania ordered Verse Payments Lithuania UAB, Block's European Cash App version, to identify clients whose identities had not been established or were not compliant with anti-money laundering laws.
Mobile payment apps like Cash App, PayPal, and Venmo have become popular but pose risks to users and the financial system, according to regulators. Criminals have used these platforms to evade laws, such as laundering stolen Covid relief funds.
Cash App, while not a bank, uses external banking partners for services. Sutton Bank, which issues Cash App's prepaid Visa debit cards, settled a consent order with the Federal Deposit Insurance Corp. (FDIC) regarding anti-money laundering practices. The FDIC order required Sutton Bank to revise its internal programs to improve supervision and direction of anti-money laundering efforts and ensure compliance with the Bank Secrecy Act.
Block stated that the Sutton consent order was unlikely to affect Cash App's ongoing business relationship with Sutton Bank.