ShapeShift had no sanctions compliance program in place to check for violations, which OFAC claims showed “a minimal degree of caution.”