How Evolve Facilitated Remittances to Sanctioned Venezuela Using "Mirror" Transactions
FICO Launches "Focused" LLMs, Choice's Qube Chaos, Who's Using Crypto For Payments?
Hey all, Jason here.
And just like that, fall is upon us. Autumn is actually my favorite time of year here in the Netherlands (assuming it isn’t raining). I’m happy to be at home until it’s time to head to Vegas for the annual Money2020 pilgrimage, less than a month from now.
In addition to moderating a session on Why the “Fintech-Bank Partnership” was Doomed Before it Started (I didn’t pitch this topic, I swear!), I’ll be recording two live podcasts: Fintech Recap, with Fintech Takes’ Alex Johnson, and a discussion on Real-Time Infrastructure As A Competitive Advantage with Oscilar’s head of product, Saurabh Bajaja, and SoFi’s senior direct of risk data and decisioning, Adam Colclasure.
Join Fintech Biz Weekly at Fintech Nerdcon: Where Operators & Innovation Converge
Jason here. I’m excited to speak at Fintech Nerdcon this year, a 2-day summit for fintech operators, by operators. Taking place in Miami (November 19-20), the room will be stacked with high potential founders and leaders working in the industry today. We’ll dig into what matters now, including sustainable unit economics, BaaS risk management, AI use cases, payments infrastructure, and the policy shifts shaping the future.
NO sales booths, NO fluff, and operators you won’t see speaking anywhere else. If you read FBW for signal over noise, this is your room.
Come say hi, and meet your fellow fintech nerds! And as a subscriber to FBW, use promo code: FBW20 for 20% off your ticket.
How Evolve Facilitated Remittances to Sanctioned Venezuela Using “Mirror” Transactions
Given that Evolve Bank & Trust worked with over 1,000 third-party fintechs, there are surely a plethora of smaller or defunct programs that have never received public or regulatory scrutiny.
In fact, as this newsletter reported earlier this month, Evolve doesn’t even seem to be able to pin down the exact number of programs it has worked with, owing to the numerous middleware platforms it worked with and delegated key regulatory responsibilities to.
With the breadth of programs and Evolve’s cavalier approach to supervising them, it seems likely more embarrassing revelations will continue to pop up for the embattled bank.
The latest such problematic partner uncovered by Fintech Business Weekly through data released in the Russia-linked hack of the bank and the Synapse bankruptcy filings is MercaDolar, a peer-to-peer marketplace that enabled remittances and foreign exchange with individuals and business entities in Venezuela, which shut down around late 2020.
According to the company’s cofounder and CEO, Hugo Padilla, MercaDolar began working with Synapse around 2015, and actually initially operated through Synapse’s short-lived first partner bank, Triumph, before Synapse and its programs moved to Evolve.
Padilla told Fintech Business Weekly by phone that, when it came to MercaDolar, the fintech only interacted with Synapse and the middleware company’s team and “never had any interaction with Evolve.”
The company publicly launched in April 2016. Its launch announcement described the platform by saying:
MercaDolar connects Venezuelans abroad who need to send money home with others in the country in search for scarce U.S. dollars – all within a secure, anonymous, and quick process. MercaDolar does not purchase or sell currency, and it does not impose any artificial exchange rate; it simply provides a market in which transactions occur within a predefined framework, thus safeguarding the best interests of both parties.
The company explained that (emphasis added) “[t]o use MercaDolar, all that is needed is to submit a one-time application… Once the documentation is reviewed and approved — usually within 24 hours — access is granted to buy and sell dollars in the market, and a new world of freedom and economic opportunities become available. It is important to state that in order to use MercaDolar, a bank account in the U.S. is required. However, buyers can use any ACH-enabled virtual payment account, such as Payoneer, to receive their funds.”
Given the higher-risk nature of MercaDolar’s business model, one would expect the bank sponsoring it — Evolve — to conduct extensive initial due diligence of the program’s BSA/AML and sanctions screening framework, whether operationalized by MercaDolar, Synapse, or some combination of the two.
However, it’s not even clear if Evolve was aware of the program’s existence at the time it began operating through Evolve. When asked if the bank knew of the program and its high-risk business model and what steps, if any, it took to conduct due diligence prior to MercaDolar beginning to operate through the bank, Evolve’s SVP of marketing and communications, Eric Helvie, declined to comment.
Seeking A Refuge From 345,000% Inflation
The reason why Venezuelans would want to be able to send, receive, exchange, and hold US dollars is obvious enough: in 2016, the annualized inflation rate was approaching 300%.
Just three years later, annualized inflation hit 345,000% percent (yes, you read that right. Puts the COVID-era inflation in the US into perspective…)
Because the country has long faced a shortage of foreign exchange reserves, the limited resources available have often only been available to the Venezuelan government itself or certain “priority” sectors, specifically the oil sector.
The imposition of various currency control regimes resulted in a multi-tiered exchange rate structure, with an official government-set rate (“Cencoex Rate”), rates ostensibly set by auction (“Sicad Rate,” “Simadi Rate,”) and a significant black market, in which the cost in bolivars to buy dollars could be multiples of the official and auction rates.
To circumvent these currency controls, MercaDolar employed a “peer-to-peer” model.
That is, MeraDolar, as explained in its announcement above, did not buy or sell US dollars nor Venezuelan bolivars. Rather, MercaDolar operated a marketplace where users could list offers to sell US dollars at an exchange rate of their choosing.
Such a marketplace or peer-to-peer matching platform could be used both to effectuate remittances from a person holding dollars in the United States into bolivars to a person or business entity in Venezuela or merely to convert between dollars and bolivars, if both parties to the transaction were based in Venezuela.
The hitch? Because MercaDolar wasn’t actually conducting foreign exchange operations, both parties to the transaction needed to have a US-based dollar-denominated account.
Per archived versions of MercaDolar’s site, the service required dollar buyers’ US bank accounts to be personal accounts in the buyers’ names, though, on the Venezuelan side, it supported both consumer and commercial accounts.
According to an archived version of MercaDolar’s website, the process worked as follows:
A user looking to sell dollars / remit funds to Venezuela would create an “offer” on MercaDolar’s platform, including information on the recipient of funds in Venezuela (this could be a relative of the user selling dollars, a commercial entity, or, presumably, the user himself);
MercaDolar, through Synapse and its bank partner, Evolve Bank & Trust, would debit the seller’s US bank account for the amount they were offering (plus a 4% fee);
MercaDolar would hold these funds in “escrow,” which was handled through Synapse’s “FBO” accounts at Evolve Bank & Trust;
When a buyer (counterparty looking to sell bolivars and buy dollars) accepted the offer, they would remit Venezuelan bolivars to the seller’s destination account in Venezuela (whether belonging to the seller themself or to a relative, friend, business, etc.);
Upon confirmation that the destination account in Venezuela received the agreed upon amount of bolivars, MercaDolar would release the US dollars it held in escrow at Evolve Bank & Trust to the buyers’s US bank account (less a 4% fee.)
No funds actually moved from the US to Venezuela; rather, US dollars were moving from the seller of US dollars to the buyer, via Synapse’s FBO account at Evolve, and, on the Venezuelan side of the transaction, the buyer is sending bolivars to the seller/seller’s recipient via the Venezuelan banking system.
This is known as a “mirror” transaction. Mirror transactions aren’t inherently illegal, and can be used for a number of legitimate reasons, including to take advantage of arbitrage opportunities.
However, mirror transactions do pose significantly higher risks of regulatory arbitrage and financial crime risks, most commonly money laundering and sanctions evasion.
That MercaDolar, through Synapse and Evolve, was facilitating mirror transactions with entities in Venezuela carried significantly elevated risks, given the increasingly strict sanctions in place during the 2016 to 2021 period in which MercaDolar was operating:
following Nicolás Maduro’s rise to power in 2013, the United States’ sanctions policy toward Venezuelan began to shift. Congress passed the Venezuela Defense of Human Rights and Civil Society Act in 2014, which applied sanctions to Venezuelan officials responsible for violence, human rights abuses, and the suppression of free speech and anyone who materially assisted such acts;
in 2015, Obama’s Executive Order 13692 declared a “national emergency” regarding the situation in Venezuela, citing the erosion of human rights guarantees, persecution of political opponents, curtailment of press freedoms, violence and human rights violations in response to antigovernment protests, arbitrary arrests, and corruption. The order leveraged the International Emergency Economic Powers Act (IEEPA) to freeze the property and interests of specified Venezuelan officials;
in 2017, Trump’s Executive Order 13808 blocked Venezuela’s access to US financial markets and prohibited new debt and equity transactions with the Venezuelan government and the state-owned oil company, known as PdVSA;
in 2018, Trump’s Executive Orders 13835 and 13827 blocked debt purchases, dividend payments, and transfers of equity in Venezuelan state-owned enterprises and US transactions in the Venezuelan government-issued oil-backed crypto currency “Petro”;
also in 2018, Trump’s Executive Order 13850, which dramatically expanded sanctions to include persons operating in the gold sector of the Venezuelan economy, as well as any persons “responsible for or complicit in, or to have directly or indirectly engaged in, any transaction or series of transactions involving deceptive practices or corruption and the Government of Venezuela or projects or programs administered by the Government of Venezuela, or to be an immediate adult family member of such a person” and any persons materially assisting, sponsoring, or providing financial, material, or technological support for such activities or transactions;
Executive Orders 13850 and 13857 were later expanded to block the Venezuelan central bank and PdVSA, the state oil company, from accessing the US financial system, as well as to extended elements of 13850 to the entire “financial sector” of the Venezuelan economy.
This is all to say that, although Venezuela is not a comprehensively sanctioned jurisdiction, like Cuba or North Korea, the sanctions policies during the time MercaDolar operated and Evolve facilitated mirror transactions with counterparties in Venezuela were incredibly far reaching and difficult to navigate, leading many US financial institutions to dramatically curtail or cease doing business in or related to the country.
According to Padilla, the MeraDolar cofounder and CEO, Synapse offboarded the company around 2020 as part of a derisking effort after Synapse raised a its Series B round of funding, led by Andreessen Horowitz. MercaDolar was able to migrate its operations to now-bankrupt Prime Trust, but the reprieve seems to have been short lived.
The Maduro government blocked access to MercaDolar in the country in September 2020.
And around this time, the Venezuelan government also began shifting its policy away from strict controls over foreign exchange, either removing or no longer enforcing many elements of its currency control regime. This led to significant convergence between the official and black market exchange rates, ultimately dramatically reducing demand for peer-to-peer platforms like MercaDolar. By the end of 2020, MercaDolar had shut down.
Synapse and Evolve’s Ineffective OFAC Checks Left Gaping Holes In Sanctions Screening
According to archived versions of MercaDolar’s site and Fintech Business Weekly’s conversation with Padilla, the company’s cofounder, MercaDolar did have processes in place to verify the identity of both parties in the mirror transactions it facilitated, including by requiring submission of identity documents, such as a passport.
A review of a snapshot export of Synapse user data released in the Russia-linked hack of Evolve shows that about 85% of MercaDolar’s users listed an address in Venezuela. This is roughly consistent with Padilla’s estimate that 60%-70% of the users on the platform were Venezuelan.
Despite Section 326 of the PATRIOT Act’s requirement that financial institutions collect accountholders’ name, physical address, date of birth, and identification number (which must be a Social Security number, if an accountholder has one), a review of MercaDolar user records released in the hack of Evolve shows that nearly 90% of user records do not have an identification number, and many have just a four digit number that seems unlikely to be a legitimate identifier. The purpose of the reviewed file is unclear and it may not be a statistically accurate representation of MercaDolar’s user base.
At one point, MercaDolar also launched a “wallet” product that enabled users to directly hold funds at Evolve through the platform, in addition to the “escrow” role the company played between sender and receiver — meaning that users based in Venezuela, which Evolve may not have known even existed and seemingly did no KYC on, held something akin to a deposit account at the bank.
MercaDolar’s site suggests and Padilla confirmed that, when operational, the company was registered as a money services business with FinCEN. Fintech Business Weekly could not independently confirm this, as FinCEN’s database does not include firms that do not have a current registration.
MSBs generally must comply with the registration, reporting, recordkeeping, and anti-money laundering program requirements contained in regulations that implement the Bank Secrecy Act and other relevant anti-money laundering legislation.
MercaDolar did not hold any state money transmission licenses, per a review of NMLS records, which Padilla confirmed.
Instead, MercaDolar relied on transmitting US dollar funds by way of an FBO account at Evolve, which, if structured and titled correctly, would obviate the need for the company to hold its own money transmission licenses.
While, per MercaDollar’s Padilla, the company did have its own compliance program, it also depended to some extent on Synapse and Evolve — neither of which had functional sanctions screening, per Fintech Business Weekly’s prior reporting.
Former Synapse compliance vice president Sejal Patel has described Synapse’s homegrown screening software as not fit for purpose, telling Fintech Business Weekly in July 2024 that “[t]he reality was Synapse’s sanctions screening process was home grown and the code didn’t work. Multiple BSA audits revealed the model was broken.”
And Evolve, per prior reports, failed to properly run OFAC checks for as long as seven years, due to a “coding error” by then-chief technology officer Hank Word.
Anti-money laundering subject matter expert and president of Palmera Consulting, Sara Beth Felix, pointed out to Fintech Business Weekly that Evolve has been one of the few banks that had OFAC compliance specifically called out in its consent order.
Felix explained, “From an OFAC perspective, MercaDolar would’ve needed a sizable group of compliance folks to ensure that each of the individuals on the bolivar side were not related to the government and that these payments were truly personal remittances or for humanitarian needs.”
The transactions enabled by MercaDolar, through Synapse and Evolve, were “100% facilitation of sanctions evasion,” Felix said. She added that, “MercaDolar doesn’t touch [bolivars] but facilitates a platform in which people — sanctioned or not — can easily evade sanctions detection. It’s almost better if MercaDolar would’ve actually touched [bolivars] and applied for the OFAC license, than to knowingly facilitate sanctions evasion under the guise of ‘technology.’”
Evolve’s spokesperson declined to respond to questions about how, assuming the bank was aware of the program’s existence, it was comfortable processing the US-side of mirror transactions enabling remittances and foreign exchange for counterparties in Venezuela.
Asked if it conducted any kind of Know Your Customer (KYC), Customer Due Diligence (CDD), or Enhanced Due Diligence (EDD) on either party in the mirror transactions Evolve facilitated, Helvie, the bank’s spokesperson, declined to comment.
Given the mirror structure of the transactions, it would have been difficult if not impossible for MercaDolar, Synapse, or Evolve to conclusively verify the identity of the owners of the Venezuelan accounts involved in the transactions.
Further, as US sanctions on Venezuela escalated from 2016 until the Venezuelan government blocked MercaDolar in late 2020, specific banks in the country that facilitated the Venezuelan side of the mirror transactions may have themselves been subject to sanctions.
Evolve’s Data Breach Settlement: $20, One Year of Credit Monitoring
In other Evolve news, customers of the bank, including via third-party fintech programs, should begin receiving notifications of the settlement Evolve reached after the massive data breach it experienced last year.
Some 33 terabytes of the bank’s data — including Social Security numbers, images of identity credentials, account numbers, balances, and transaction histories, confidential internal legal materials prepared for the bank’s regulators, and staff emails — were released on the dark web by a Russian cybercrime gang, Lockbit.
Per terms of the class action settlement, class members may elect one year of credit monitoring and either a flat cash payment of $20 or up to $3,000, if class members can document “losses incurred as a result of the Data Incident.”
It’s unclear if MercaDolar’s Venezuelan users who had sensitive personal information compromised in the Evolve hack qualify for identity monitoring and the $20 compensation payments.
FICO Launches “Focused” LLMs
Last week, credit scoring behemoth FICO announced it is rolling out new “focused” generative AI models trained on risk-specific data and “trust scores” to help lenders manage hallucination risk.
The company debuted its Focused Foundation Model (FFM), Focused Language Model (FLM), Focused Sequence Model (FSM), and Trust Scores.
The repeated use of “focused” is in contrast to general-purpose commercially available generative AI models, like ChatGPT, Claude, and Perplexity, which are trained in part by ingesting ever-larger volumes of data -- functionally, the entire internet and whatever other data (written, audio, video, visual, etc.) AI companies can get their hands on (with legal permission or otherwise).
FICO’s announcement explains that its focused approach uses training data specific to the tasks at hand, resulting in models that are significantly more efficient to run, requiring up to 1,000x fewer resources, and less prone to hallucinations, according to the company.
The Focused Sequence Model is intended to better understand long transaction sequences, enabling lenders to detect critical relationships in transaction histories not normally captured in traditional analytics approaches, FICO’s news release says. Use cases include payment fraud detection, next-best action, and real-time risk assessment.
FICO’s Trust Score is designed to provide a risk-ranking of the reliability of the output of FICO’s custom generative AI models. Such scores, FICO claims, enable organizations to calibrate their own risk tolerances when using its generative AI “focused” models.
FICO’s move to offer its own generative AI models is notable, but it is far too early to say what impact, if any, they will have on how lenders approach underwriting credit risk - particularly as the most sophisticated lenders tend to develop their own credit models (whether or not they incorporate LLMs/GenAI), and lenders that rely on out-of-the-box models tend to be slow to adopt new ones.
Further, one can’t help but wonder if the generative AI play isn’t at least in part a bid to boost FICO’s stock price -- particularly after the beating it has taken at the hands of Federal Housing Finance Agency Director Bill Pulte, who has taken an aggressive posture towards use of the company’s eponymous score in mortgage underwriting.
FICO traded at over $2,200 per share as recently as May but now trades around $1,500, thanks in large part to Pulte’s onslaught.
Everything Else: Choice’s Qube Chaos, Who’s Using Crypto for Payments?
Choice Bank’s self-imposed deadline to wind down its fintech partner program Qube Money is Tuesday, September 30th. The bank informed users of the budgeting app that, if they don’t move their funds out of their “Qubes” before that deadline, Choice will forcibly close the accounts and mail a paper check to the address on file.
But, some users are having a hard time moving funds, according to a number of complaints on social media.