Photo courtesy of the author
For more than a decade, as part of its oversight of financial institutions’ compliance with the Bank Secrecy Act (BSA) and regulations thereunder, the Financial Crimes Enforcement Network (FinCEN) has repeatedly stated that any person accepting and transmitting convertible virtual currencies (“cryptocurrencies”) must register with FinCEN as money transmitters and thereafter comply with the anti-money laundering/counter-terrorism financing program, recordkeeping, and reporting requirements.[1] Even so, a number of cryptocurrency or virtual currency businesses have ignored these longstanding requirements, sometimes resulting in massive criminal and civil penalties.[2]
Most recently, on January 27, the United States Attorney’s Office for the Southern District of New York announced that Peken Global Limited (“Peken”), a Seychelles-based entity that, since at least September 2019, has operated KuCoin, one of the largest cryptocurrency exchanges in the world, pleaded guilty to one count of operating an unlicensed money transmitting business. The United States Attorney’s Office stated that KuCoin flouted U.S. anti-money laundering laws by failing to implement effective anti-money laundering (“AML”) and know-your-customer (“KYC”) programs designed to prevent KuCoin from being used for money laundering and terrorist financing, failing to report suspicious transactions, and failing to register with the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (“FinCEN”). In connection with its guilty plea, PEKEN agreed to pay monetary penalties totaling more than $297.4 million.[*]
This post will explain the background of the prosecution, discuss the penalties in the case, and note key lessons to be learned from the case.
Background
On March 26, 2024, the United States Attorney’s Office for the Southern District of New York announced the unsealing of a four-count indictment against KuCoin and two of its founders, Chun Gan and Ke Tang.[3] The indictment charged five defendants – Flashdot Limited (formerly known as Phoenixfin Limited), Peken, Phoenixfin Private Limited (with Flashdot and Peken, doing business as KuCoin), Gan, and Tang –with two counts of conspiracy to violate the BSA and conspiracy to operate an unlicensed money transmitting business; and Flashdot, Peken, and Phoenixfin with a substantive BSA violation and with operation of an unlicensed money transmitting business.[4]
In brief, the indictment alleged that KuCoin, which had become one of the largest global cryptocurrency exchange platforms since its founding in 2017, had willfully failed to maintain the required AML and KYC programs, and had been used as a vehicle to launder large sums of criminal proceeds, including proceeds from darknet markets and malware, ransomware, and fraud schemes. KuCoin allegedly received more than $5 billion, and sent more than $4 billion, of suspicious and criminal proceeds.
Simultaneously, on March 26, 2024, the Commodity Futures Trading Commission (CFTC) announced the filing of a civil enforcement action in the U.S. District Court for the Southern District of New York charging Mek Global Limited, PhoenixFin PTE Ltd., Flashdot, and Peken, which collectively operated a centralized digital asset exchange under the name KuCoin, with multiple violations of the Commodity Exchange Act (CEA) and CFTC regulations.[5]
The complaint charged KuCoin illegally dealt in off-exchange commodity futures transactions and leveraged, margined, or financed retail commodity transactions; solicited and accepted orders for commodity futures, swaps, and leveraged, margined, or financed retail commodity transactions without registering with the CFTC as a futures commission merchant (FCM); failed to diligently supervise its FCM activities; operated a facility for the trading or processing of swaps without registering with the CFTC as a swap execution facility (SEF) or designated contract market (DCM); and failed to implement an effective customer identification program (CIP).
In its complaint, the CFTC sought disgorgement, civil monetary penalties, permanent trading and registration bans, and a permanent injunction against further violations of the CEA and CFTC regulations.[6]
Guilty Plea and Penalties
Peken pleaded guilty to a single count of operating an unlicensed money transmitting business. According to the United States Attorney’s Office, KuCoin operates its exchange platform, which allows registered users to place orders for spot trades in cryptocurrencies, including Bitcoin, Ethereum, and others, and orders for derivative products, including futures contracts, tied to the value of Bitcoin and other cryptocurrencies. As a result, KuCoin has been a money transmitting business required to register with FinCEN and reported suspicious transactions, and required to comply with applicable BSA provisions requiring maintenance of an adequate AML program, including conducting KYC processes.
Despite these obligations, and its substantial presence in the U.S. market, KuCoin failed to implement an adequate KYC program in numerous respects:
- Until at least July 2023, KuCoin did not require customers to provide any identifying information.
- KuCoin employees repeatedly stated on public social media sites that KYC was not mandatory on KuCoin, including in response to posts from customers who had identified themselves as being in the United States.
- It was only in August 2023 that KuCoin adopted a mandatory KYC program for new customers and existing customers who wanted to continue to actively participate in KuCoin’s services. However, KuCoin did not impose this necessary KYC process on existing customers that wanted to continue to use KuCoin’s services only to withdraw or close positions, which it was required to do.
- KuCoin also never registered with FinCEN as a money transmitting business or filed any required suspicious activity reports.
As a result of KuCoin’s failure to maintain the required AML and KYC programs, KuCoin was used to transmit billions in suspicious transactions and potentially criminal proceeds, including proceeds from darknet markets and malware, ransomware, and fraud schemes.
The guilty plea required Peken to pay criminal forfeiture of $184.5 million and a criminal fine of approximately $112.9 million. In addition, Peken agreed that KuCoin will exit the U.S. market for at least the next two years, and that the two KuCoin founders named in the indictment, Gan and Tang, will no longer have any role in KuCoin’s management or operations. Finally, the Justice Department agreed to defer prosecution against Gan and Tang, who were at large at the time of the indictment, for a period of two years, and Gan and Tang each agreed to forfeit approximately $2.7 million in funds received as a result of KuCoin’s operations in the United States.
The announcement of the plea made no mention of the CFTC enforcement action, and the CFTC website to date has posted no update on the action.
Lessons To Be Learned
The KuCoin case is instructive for two main reasons. First, KuCoin’s conduct reflects a belief still prevalent in certain quarters of the global crypto community that crypto exchanges, brokers, and dealers can operate beyond the reach of U.S. or foreign AML-related laws. That attitude likely contributed to KuCoin’s ignoring even the most basic BSA/AML requirements and, as a result, becoming a major conduit for criminal proceeds.
Second, the indictment and the plea announcement provide lawyers advising crypto firms and crypto firms’ compliance officers ample material for benchmarking against the firms’ current BSA/AML compliance programs. Every crypto firm that operates an exchange platform in the United States, or that otherwise accepts or conducts transactions in the United States, must accept that noncompliance, sporadic compliance, or selective compliance with BSA/AML requirements is not an option.
Footnotes
[1] See Financial Crimes Enforcement Network, Application of FinCEN’s Regulations to Certain Business Models Involving Convertible Virtual Currencies, FIN-2019-G001 at 1 (May 9, 2019), https://www.fincen.gov/sites/default/files/2019-05/FinCEN%20Guidance%20CVC%20FINAL%20508.pdf.
[2] See, e.g., United States Dep’t of the Treasury, Release: U.S. Treasury Announces Largest Settlements in History with World’s Largest Virtual Currency Exchange Binance for Violations of U.S. Anti-Money Laundering and Sanctions Laws, November 21, 2023, https://home.treasury.gov/news/press-releases/jy1925; Financial Crimes Enforcement Network, FinCEN Announces $100 Million Enforcement Action Against Unregistered Futures Commission Merchant BitMEX for Willful Violations of the Bank Secrecy Act, August 10, 2021, https://www.fincen.gov/news/news-releases/fincen-announces-100-million-enforcement-action-against-unregistered-futures.
[*] See U.S. Attorney’s Office, Southern District of New York, Kucoin Pleads Guilty To Unlicensed Money Transmission Charge And Agrees To Pay Penalties Totaling Nearly $300 Million (January 27, 2025), https://www.justice.gov/usao-sdny/pr/kucoin-pleads-guilty-unlicensed-money-transmission-charge-and-agrees-pay-penalties
[3] See U.S. Attorney’s Office, Southern District of New York, Prominent Global Cryptocurrency Exchange KuCoin And Two Of Its Founders Criminally Charged With Bank Secrecy Act And Unlicensed Money Transmission Offenses, March 26, 2024, https://www.justice.gov/usao-sdny/pr/prominent-global-cryptocurrency-exchange-kucoin-and-two-its-founders-criminally.
[4] See Indictment, United States v. Flashdot Limited et al. (S.D.N.Y., indictment unsealed March 26, 2024), https://www.justice.gov/usao-sdny/media/1345231/dl.
[5] See Commodity Futures Trading Commission, CFTC Charges KuCoin with Operating Illegal Digital Asset Derivatives Exchange, March 26, 2024, https://www.cftc.gov/PressRoom/PressReleases/8884-24.
[6] See Complaint, Commodity Futures Trading Commission v. MEK Global Limited et al., No. 24-cv-2255 (S.D.N.Y., filed March 26, 2024), available at https://www.cftc.gov/PressRoom/PressReleases/8884-24.
Jonathan J. Rusch is Director of the U.S. and International Anti-Corruption Law Program and Adjunct Professor at American University Washington College of Law and a Senior Fellow with the NYU Program on Corporate Compliance and Enforcement at New York University Law School.
The views, opinions and positions expressed within all posts are those of the author(s) alone and do not represent those of the Program on Corporate Compliance and Enforcement (PCCE) or of the New York University School of Law. PCCE makes no representations as to the accuracy, completeness and validity or any statements made on this site and will not be liable any errors, omissions or representations. The copyright of this content belongs to the author(s) and any liability with regards to infringement of intellectual property rights remains with the author(s).