Hacker News Reader

Comment by pieno | Hacker News Reader

Well completing Know Your Customer checks and audits is sort of their job, isn’t it? They provide a service, saying that they will process payments unless the payment is prohibited by government sanctions. But instead of carrying out actual due diligence, they just block anything remotely related and put the onus and cost of doing their own job on their customers. At least they should have a better process to start proper diligence once a customer complains about overreach of their blacklist, to avoid improperly sanctioning innocent businesses.

What if an arms trader used the name “Tickets Limited”? Would they block all payments mentioning tickets? Surely not, as it would hurt their business, clearly illustrating that their conduct is not at all due to “compliance with mandatory laws and nothing we can do about it” but “we did the math and we feel we can screw you over in this case.”

View on HN

You're right but I think you'd perhaps be surprised how international sanctions monitoring works.

Example, I know one of the largest banks in Europe used to have payments they sent to one of their South American branch offices blocked from time to time because their address in Brazil or Argentina or something was on a street called "Avenue de Cuba".

But PayPal specifically isn't under banking laws which is how they cover their ass normally (like if you have money at PayPal and they terminate your account you never get your money , which there are thousands and thousands of cases of PayPal doing which would be illegal for an actuall bank), so banking law has nothing to do with PayPal.

In the US, the PATRIOT act, and thus KYC laws, apply to money service businesses. This includes PayPal.

in the EU they are an actual Bank based in Luxembourg.

Yes they would, the fines are up to 250,000 per incident. If you share a name with someone on the AML list, good luck opening up a financial account anywhere and if you do manage to get an account, being able to fund the account from another source.

You're not comparing like with like there. If you share a name with a suspicious group, yes, that's a hard problem to solve. That's not this. This is a _product_ with the same name as a suspicious group. It's categorically irrelevant.

No, aggressive filtering is the rational move here. The risks are highly asymmetric. A false positive gets you a frustrated customer that, as in this case, you can work with to modify the product description. Annoying.

A false negative can get you a fi ne of $250,000 and criminal penalties.

This isn't an issue of ( or not just an issue of) "not solving scale". Even if filtering issues if this sort were 99.9999% solved the risk asymmetry would still come down on taking an abundance of caution on nation-state levels of "oh crap" if you miss something.

There is precious little "working" with PayPal. We had an unauthorized transfer of $1000 out of our bank account by PayPal, and they have a completely useless circular IVR, their chat bot is nigh non-functional, and their support documentation is woefully out of date. We ended up detecting the odd activity early enough to redirect the funds before someone (who added an unknown number to the account) did anything with it, but we started a dispute and chargeback just-in-case. Further business being cut off be damned.

I've worked in fintech/self-banking institutions. PayPal is a mockery of the entire industry. The example of the literal worst implementation anyone can think of and which leaves everyone scratching their head at how they manage to get away with running as fast and loose as they do.

It doesn't matter. The searches are based on the same methodology. Scanning fields for the banned entity or individual. Also if you spell it phonetically, it should get blocked as well. Even if you can raise to the compliance officer, they aren't going to change it. There's are also criminal penalties that enforce AML.

Is there any way to access this list so I don't end up naming any product, service or company with something on there?

https://www.treasury.gov/ofac/downloads/sdnlist.pdf

Or you can do searches.

https://sanctionssearch.ofac.treas.gov

I suspect there's a false positive rate on some teams's dashboard and it's kept at an acceptable level that won't require raising transaction fees or incurring too many more OFAC fines.

How would they know what transactions were true positives vs false positives? That would require them to know whether a transaction is bad or not, which as we know, is a hard problem

Random sampling, Monte Carlo methods, statistical inference, etc

>saying that they will process payments unless the payment is prohibited by government sanctions

if they say that they will process payments unless prohibited by government sanctions and then do not process payments that is not prohibited I guess they would be getting sued for those payments.

evidently not given the downvotes, but then I don't understand, if their terms of service say we pay out unless the payment would be of type X and then they keep from paying out on payments of type Y they have violated their terms of service and thus would be open to being sued.

PayPal can pretty much always refuse to process any given transaction. They are not keeping anyone’s money, they are just refusing to accept a transaction request. There’s no money to “pay out.”

Of course, that makes sense, reading the parent comment I thought it implied that they were letting some money in and not letting it back out. In fact I could swear I've read about PayPal doing that - letting money in, not letting it out.

PayPal DOES do that frequently, mostly if you trigger some risk threshold on your account. But, then again, so do regular credit card processors.

>They are not keeping anyone’s money, they are just refusing to accept a transaction request.

Wrong. Assets under U.S. jurisdiction that are owned by or being transferred to persons or organizations on the Specially Designated Nationals and Blocked Persons List must be frozen. Furthermore, the Department of Treasury has a right to seize these funds without due process.

Please read the article. These are people trying to buy tardigrade-themed items from an online store. PayPal is not taking and then freezing their funds, they are just refusing to process the transaction.

Reply on news.ycombinator.com