Let's suppose you have Bob's Traditional Bank. They keep meticulous records, and comply with US government requests for them (regardless of what you think of s

Let's suppose you have Bob's Traditional Bank. They keep meticulous records, and comply with US government requests for them (regardless of what you think of such practices, let's just say that this particular bank happens to do those things). They also facilitate transactions on behalf of North Korea. Bob's Traditional Bank would be sanctioned here, because transacting with North Korea in that way is what triggers these sanctions. This is why Tornado is being sanctioned. The privacy thing may or may not be illegal, despite its ineffectiveness, but the transacting with North Korea thing definitely is.