On August 4, 2025, the Financial Crimes Enforcement Network (“FinCEN”) issued Notice FIN-2025-NTC1 (the “Notice”) to address mounting concerns over regulatory risks related to convertible virtual currency (“CVC”) kiosks, also known as cryptocurrency ATMs. This action is part of a broader response to the rise in money laundering, fraud, and other financial crimes linked to digital assets.

What Are CVC Kiosks? How Do They Work?

CVC kiosks are terminals that allow customers to exchange physical cash for cryptocurrencies such as Bitcoin or Ethereum. Their popularity has accelerated due to their user-friendly interfaces and widespread presence in public venues like convenience stores and supermarkets. Typically, a transaction begins with customer identification, ranging from providing basic details like a phone number to scanning a government-issued ID, depending on the kiosk operator’s compliance protocols. After verification, users enter or scan their personal crypto wallet address so the purchased funds can be transferred directly. Payment is settled either by depositing cash into the machine or using card payment options available at certain kiosks. These devices may connect in real time with online cryptocurrency exchanges or use pre-loaded inventories managed by operators.

While convenient access through high-traffic retail locations benefits legitimate consumers, including those who might otherwise avoid digital assets, the relative anonymity of CVC kiosk transactions and lower oversight compared to bank branches create significant opportunities for criminal misuse.

Why Is FinCEN Focusing on These Kiosks Now?

FinCEN has observed sharp increases in consumer complaints and financial losses associated with CVC kiosk-related scams. In 2024 alone, the FBI’s Internet Crime Complaint Center recorded over 10,956 complaints involving these machines, a year-over-year surge of nearly 99%, with aggregate victim losses approaching $246.7 million (an increase of about 31%). This pattern extends beyond consumer fraud. Criminal organizations such as Cartel Jalisco Nueva Generación have embraced virtual currencies for their rapid global transferability and anonymity unavailable through traditional banking channels.

These trends intersect with this administration’s priorities around anti-money laundering (“AML”) and countering terrorist financing (“CTF”): protecting vulnerable populations from fraud, disrupting cyber-enabled crime, and intercepting organized crime-driven money laundering activities.

Key Risks Identified by FinCEN

The Notice highlights several major risks linked to CVC kiosk usage. Organized crime groups increasingly exploit these terminals as alternatives to conventional cash-based schemes, particularly in U.S cities that have become hotspots for laundering proceeds via local kiosks instead of banks because transactions are faster and more difficult for authorities to monitor effectively. Vulnerable populations are especially at risk. FinCEN states that nearly two-thirds of scam-related losses involve individuals aged sixty or older. Many attacks begin with phone-based deception before victims are remotely guided through withdrawal processes at kiosks.

Prevalent scams exploiting CVC kiosks include tech support frauds where victims are told their computer is infected and instructed to pay via Bitcoin ATMs using QR codes supplied by scammers; government impostor schemes invent fake tax liabilities payable only through kiosk deposits; romance scams manipulate targets into sending cryptocurrency under false pretenses built on fabricated relationships; lottery hoaxes promise non-existent prizes contingent upon upfront payments made through crypto transfers at kiosks.

Regulatory Requirements

FinCEN reminds operators that they must register as Money Services Businesses (“MSBs”), comply fully with Bank Secrecy Act (“BSA”) obligations, including robust AML protocols. and maintain proper recordkeeping standards before operating any CVC kiosk business. Operators need strong Know Your Customer (“KYC”) procedures so customers can be properly identified, a critical measure against anonymous abuse facilitating illicit activity. In addition, ongoing monitoring for suspicious activity is required; this includes filing Suspicious Activity Reports (“SARs”) when detecting patterns such as structured deposits just below reporting thresholds or rapid withdrawals indicative of potential money laundering efforts.

Regular audits and compliance reviews are essential since lapses expose operators not only to civil penalties but potentially criminal liability under federal law. Common compliance failures include inadequate customer verification procedures; poor retention of documentation; marketing strategies promoting “no-ID required” features contrary to regulations; lack of state licensure; or use of fraudulent business identities or accounts, all vulnerabilities that regulatory authorities scrutinize closely.

Practical Guidance

To help detect suspicious activity involving CVC kiosks, the Notice outlines key red flags:

  1. Customers structuring payments just below reporting thresholds using multiple accounts or kiosks.
  2. Unusual high-value transactions from customers lacking transaction history, with rapid movement across wallets or currencies.
  3. Multiple interconnected accounts, phone numbers, or wallet addresses used across geographically distant locations.
  4. Transactions sent directly toward wallets flagged by blockchain analysis as tied either to scams, illicit conduct, or investment fraud institutions.
  5. Elderly customers conducting large transactions after remote direction, often following significant cash withdrawals.
  6. Operators running without appropriate federal or state registration.
  7. Advertising minimal or no-ID requirements despite regulatory mandates regarding identification/documentation collection practices.

FinCEN reminds financial institutions to file SARs whenever they identify these indicators, even if supporting evidence is limited at the outset. All SAR filings must be securely retained for at least five years after submission, in accordance with BSA requirements and strict access controls to protect sensitive information. Section §314(b) of the USA PATRIOT Act also permits voluntary sharing of this information among authorized organizations engaged in efforts to disrupt terrorist financing and money laundering networks globally.

Looking Ahead

The issuance of this Notice signals intensifying regulatory scrutiny prompted not just by rising incidents but also industry control gaps among certain market participants operating outside robust standards expected within digital asset sectors today.

As digital asset transactions expand, it is important for banks, cryptocurrency platforms, fintech companies, and kiosk operators to proactively integrate FinCEN’s red flag indicators and enhance AML/CFT protocols. Doing so helps safeguard clients while meeting legal obligations and promoting trust within the sector. Consumers are also encouraged to be aware of potential risks associated with using CVC kiosks until industry-wide protections are strengthened.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch.  Please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

On July 23, 2025, Senators John Fetterman (D-PA), Chuck Grassley (R-IA), Sheldon Whitehouse (D-RI), Bill Cassidy (R-LA), Andy Kim (D-NJ), and David McCormick (R-PA), introduced the federal Art Market Integrity Act (the “Act”). The Act is bipartisan legislation that would require art dealers and auction houses to comply with anti-money-laundering and counter-terrorism financing regulations under the Bank Secrecy Act (“BSA”).

The Act seeks to amend the BSA to align the United States’s laws with international standards adopted by the United Kingdom, European Union, and Switzerland, preventing America from becoming a safe haven for illicit activities. The Act targets high-risk art market transactions while exempting artists and businesses with under $50,000 in annual art transactions.

The Act would expand the definition of “financial institution” in 31 U.S.C. § 5312(a)(2) to include:

a person engaged in the trade in works of art, including a dealer, advisor, consultant, custodian, gallery, auction house, museum, collector, or any other person who engages as a business as an intermediary in the sale of works of art, unless the person —

  • during the prior year, participated in no single transaction valued over $10,000 that involved a work of art;
  • has not, during the prior year, participated in total transactions valued at $50,000 that involved a work of art; or
  • is a person engaged in the art market for the sole purpose of selling works of art created by the person.

The Act defines “work of art” as “any original painting, sculpture, watercolor, print, drawing, photograph, installation art, or video art, not including — (A) applied art such as product design, fashion design, architectural design, or interior design; or (B) mass-produced decorative art, including ceramics, textiles, or carpets.’’

The Act directs the Treasury to coordinate with appropriate federal agencies revise its advisory issued by the Office of Foreign Asset Control on October 30, 2020, regarding the risks of high-value artwork transactions involving sanctioned persons or entities. The 2020 advisory highlighting the problem of individuals blocked by OFAC from entering the U.S. financial system trying to evade those restrictions through the commerce of art, and emphasizing sanctions for U.S. persons who engage in prohibited transactions. See our prior blog on the advisory.

The Act directs FinCEN to in consultation and coordination with appropriate Federal agencies, to issue proposed rules to carry out the amendments made by subsection (a), including —

  1. determining which persons should be subject to the rulemaking based on domestic or international geographical location;
  2.  the degree to which the regulations should apply based on status as an agent or intermediary acting on behalf of a purchaser; and
  3. whether certain exemptions should apply to the regulations.

The Act, if passed, would become effective on the earlier of (i) 360 days after enactment or (ii) the effective date of rules issued by FinCEN.

Similar legislative was introduced in 2020 to (i) add to the list of “financial institutions” covered by the BSA “a person trading or acting as an intermediary in the trade of antiquities, including an advisor, consultant or any other person who engages as a business in the solicitation of the sale of antiquities;” and (ii) require a study by the Secretary of the Treasury “on the facilitation of money laundering and terror finance through the trade of works of art or antiquities,” including an evaluation of whether art industry markets should be regulated under the BSA.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. Please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

We blogged last year about the Final Rule issued by the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) extending Anti-Money Laundering/Countering the Financing of Terrorism (AML/CFT) requirements to certain investment advisers.  The Final Rule, which was set to become effective as of January 1 of next year, was the result of years of effort to bring investment advisers within the scope of the Bank Secrecy Act.  The Final Rule required certain investment advisers to: (1) develop and maintain an AML/CFT compliance program; (2) file Suspicious Activity Reports (SARs) and Currency Transaction Reports (CTRs); (3) comply with the Recordkeeping and Travel Rules; (4) respond to Section 314(a) requests; and (5) implement special due diligence measures for correspondent and private banking accounts.

But this week, in yet another significant regulatory scale-back in the anti-money laundering space, the Treasury Department announced that FinCEN will postpone the effective date of the Final Rule two years, to January 1, 2028 – and, more portentously, that it intends to “revisit the scope” of the Rule “at a future date.”  The stated basis for this institutional about-face is “recogni[tion]…that the rule must be effectively tailored to the diverse business models and risk profiles of the investment adviser sector.”  The Department’s press release further stated that postponing the effective date “may help ease potential compliance costs for industry and reduce regulatory uncertainty while FinCEN undertakes a broader review” of the Rule.  (While the cost point is undoubtedly accurate, as firms will now be able to put off outlays for implementation of AML/CFT compliance programs, it is unclear how going back to the drawing board on the Rule will reduce regulatory uncertainty.)

This is the latest move by the Treasury Department to pause or delay enforcement of financial regulations.  We blogged in March about the Department’s announcement that it would not enforce penalties or fines associated with the Corporate Transparency Act’s beneficial ownership information reporting requirements, and that it would issue a proposed rulemaking to narrow the scope of the rule to only apply to foreign reporting companies.  At that time, the Department similarly spoke of “ensuring that the rule is appropriately tailored to advance the public interest.”  We’ve also blogged on Administration efforts to broadly limit regulation of digital assets. 

It remains to be seen whether FinCEN’s “broader review” of the Rule will indeed lead to “effective[] tailor[ing]” to the unique aspects of the investment adviser sector, or whether the AML/CFT requirements for the sector will simply die on the vine over the next few years.  We will continue to monitor developments on this front.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. Please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

On June 25, 2025, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (“FinCEN”) issued three orders designating CIBanco S.A., Intercam Banco S.A., and Vector Casa de Bolsa, S.A. de C.V. (collectively, the “Designated Institutions”) as “financial institutions of primary money laundering concern.” These measures, taken under the FEND Off Fentanyl Act of 2024, target the entities’ role in laundering proceeds linked to opioid trafficking and restrict U.S. financial institutions from transacting with them. The prohibitions will take effect 21 days after their publication in the Federal Register.

Legislative Authority and Background

The legislative foundation for these actions stems from the FEND Off Fentanyl Act, enacted to address the growing crisis of synthetic opioid trafficking, particularly fentanyl, which has significantly impacted the U.S. (See our previous blog post, located here.) The Act empowers the Secretary of the Treasury to designate foreign financial institutions as primary money laundering concerns when these entities are linked to opioid trafficking activities. Under this framework, FinCEN is authorized to impose “special measures” as described in 31 U.S.C. 5318A(b) and 21 U.S.C. 2313a. These measures can include prohibitions or conditions on transactions involving the designated institutions, creating a mechanism to disrupt illicit financial flows and safeguard the integrity of the U.S. financial system.

Building on this legislative foundation, FinCEN has targeted specific institutions due to their involvement in illicit activities.

Designation of Mexican Financial Institutions

FinCEN’s investigation determined that each of the designated institutions facilitated illicit financial flows for Mexican drug trafficking organizations (“DTO”s), including the Jalisco New Generation Cartel, the Sinaloa Cartel, and the Gulf Cartel. The findings include:

  1. CIBanco S.A., Institución de Banca Múltiple: Identified as having substantial ties to DTOs, which utilize its financial services to facilitate money laundering operations. Despite assertions from CIBanco regarding its anti-money laundering (“AML”) compliance measures, FinCEN’s investigation revealed significant gaps and inadequacies in its AML framework. Evidence points to CIBanco’s involvement in processing considerable funds that are subsequently channeled into DTO operations, supporting illicit opioid trafficking activities.
  2. Intercam Banco S.A., Institución de Banca Múltiple: Offering a range of financial services and maintains USD correspondent banking relationships with multiple U.S. financial institutions. According to FinCEN’s findings, Intercam has played a role in processing funds related to the importation of precursor chemicals necessary for the synthesis of synthetic opioids. The investigation indicated that Intercam had been persistently involved in money laundering activities tied to DTOs, underscoring its critical role in facilitating complex financial flows that support the drug trade.
  3. Vector Casa de Bolsa, S.A. de C.V.: Implicated in processing transactions for DTOs, including high-profile groups such as the Sinaloa and Gulf Cartels. Despite having an AML/CFT compliance program, FinCEN’s analysis revealed that Vector has facilitated ongoing transactions that benefit DTO operations. Its services reportedly involved processing funds associated with the importation of precursor chemicals and laundering profits back into Mexico, further entrenching its role in the illicit financial network.

Although the orders focus on operations located in Mexico, the practical effects will be felt by financial institutions globally, particularly U.S. firms with correspondent banking or payment relationships involving these entities.

Details of Prohibitions and Effective Dates

FinCEN’s orders prohibit all covered U.S. financial institutions from engaging in any transmittal of funds to or from the Designated Institutions. This includes:

  • Wire transfers
  • ACH transactions
  • Convertible virtual currency transfers
  • Any payment involving accounts or intermediaries administered by these institutions

Notably, these measures are civil in nature, but violations could trigger significant civil or criminal penalties under the Bank Secrecy Act and related statutes.

The orders are scheduled to become effective 21 days after publication in the Federal Register. While publication is still pending, U.S. financial institutions are expected to begin preparing immediately to comply with the prohibitions. The orders specify no expiration date but may be modified or rescinded in the future under certain conditions, such as litigation outcomes or resolution of underlying concerns.

Scope and Application of Restrictions

The prohibitions apply to:

  • The specified entities’ operations within Mexico
  • Any account or address (including crypto wallets) administered on behalf of those entities

They do not apply to the Designated Institutions’ branches or subsidiaries located outside Mexico, such as in the U.S.—but financial institutions should remain cautious of indirect exposures.

Rationale Behind FinCEN’s Action

The FEND Off Fentanyl Act authorizes Treasury to target foreign institutions facilitating illicit opioid trafficking. According to Treasury, these designations are part of a broader national security and public health strategy to combat the synthetic opioid crisis by cutting off DTOs from the global financial system.

DTOs often rely on sophisticated cross-border financial channels—including legitimate institutions—to launder proceeds from trafficking. The designations serve to disrupt those networks and signal the U.S. government’s zero-tolerance stance on enabling illicit drug finance.

Immediate Actions for Financial Institutions

U.S. financial institutions must take immediate compliance actions:

  • Screen for exposure: Review existing clients, counterparties, and transactions to identify any links to the Designated Institutions.
  • Update internal controls: Modify AML/CFT protocols, enhance transaction screening tools, and adjust payment routing mechanisms.
  • Reassess relationships: Evaluate correspondent banking ties and terminate or revise any arrangements involving the Designated Institutions.
  • Conduct training: Educate compliance teams and staff on the scope of the orders and risk of inadvertent violations.
  • Monitor updates: Stay alert for FAQs, clarifications, and guidance from FinCEN and other U.S. regulatory authorities.

Final Thoughts

FinCEN’s unprecedented use of Section 2313a authority under the FEND Off Fentanyl Act underscores a new era in countering global drug finance. The designations of CIBanco, Intercam, and Vector aim to cut off the financial lifelines of DTOs and disrupt illicit opioid flows into the U.S. U.S. financial institutions must act swiftly to ensure compliance—not only to avoid regulatory penalties, but also to safeguard the integrity of the global financial system.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch.  Please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

In a significant move to curb illegal activities at the U.S. Southwest border, the Financial Crimes Enforcement Network (FinCEN) issued an alert, on May 1, 2025, concerning oil smuggling from Mexico into the United States, orchestrated by notorious cartels such as the Cartel Jalisco Nueva Generacion (CJNG). This alert highlights the crucial role of financial institutions in identifying and reporting suspicious activities linked to this illicit trade. It forms part of a broader initiative involving U.S. law enforcement agencies, including the Treasury’s Office of Foreign Assets Control (OFAC), the DEA, FBI, and Homeland Security Investigations (HSI), all working in concert to dismantle the financial networks underpinning these transnational criminal operations. (See related blog posts here and here.) Simultaneously, OFAC announced sanctions against key individuals and entities connected to CJNG, which are involved in drug trafficking, fuel theft, and oil smuggling, generating extensive illicit revenues. Together, FinCEN and OFAC aim to outline specific financial typologies and red flags to effectively combat these smuggling schemes.

The Cartel’s Revenue Streams: Beyond Drugs

Crude oil smuggling has emerged as a significant revenue source for cartels like CJNG, Sinaloa, and Gulf Cartel, who have been implicated in stealing oil from Petróleos Mexicanos (Pemex). This stolen oil crosses the U.S. southwest border, finding its way into the hands of small U.S.-based oil companies. The ramifications are significant: exacerbating violence and corruption in Mexico while disrupting legitimate business operations in the U.S. oil market. Recognized as a Foreign Terrorist Organization (FTO) and Specially Designated Global Terrorist (SDGT), CJNG is involved in trafficking fentanyl and other narcotics into the U.S., contributing to economic instability. Recently, these groups have broadened their criminal portfolios to include fuel theft and crude oil smuggling, resulting in notable financial losses for the Mexican government and facilitating violence along the border.

Huachicol: The Mechanics of Smuggling

Cartels exploit existing trade flows to smuggle crude oil into the United States, taking advantage of Mexico’s export of unrefined and partially refined crude oil. They employ various illicit methods such as bribing employees, tapping pipelines, and hijacking tanker trucks to steal oil from Pemex. The stolen oil is often mislabeled as “waste oil” to avoid scrutiny and is sold at discounted rates by complicit importers in U.S. energy markets. This practice, known as huachicol, represents a substantial revenue source for cartels, with profits funneled back to sustain their operations.

Financial Institutions’ Role in Reporting

FinCEN has requested financial institutions to include the term “FIN-2025-OILSMUGGLING” in Suspicious Activity Reports (SARs) to enhance tracking of these activities. This initiative leverages financial oversight to combat transnational criminal organizations (TCOs), aiding law enforcement agencies in gathering data for targeted investigations.

Financial Typologies and Red Flags

Oil smuggling operations are characterized by complex financial maneuvers designed to disguise the origin and movement of funds. Cartels employ brokers to transport stolen oil, collaborating with U.S. importers who sell it in domestic and international markets. The proceeds are routed through multiple accounts, often via wire transfers that obscure transactions. Front and shell companies further mask operations, making it difficult for authorities to trace funds. FinCEN’s alert advises financial institutions to monitor for indicators such as below-market pricing, unusual profit margins, lack of appropriate registrations, and complex wire transfers across jurisdictions. To assist financial institutions in identifying suspicious activities related to oil smuggling, FinCEN has outlined several red flag indicators:

  1. Transactional Activity and Profit Margins: Companies exhibiting transactional activity or profit margins significantly above industry norms may warrant further scrutiny.
  2. Pricing of Crude Oil: Selling crude oil at prices well below market rates could indicate illicit sourcing.
  3. Online Presence: Companies with minimal online presence or websites that mimic major industry players may be attempting to legitimize illicit operations.
  4. Inconsistencies in Business Operations: Discrepancies between claimed business activities and transactional behavior, such as purchasing waste oil despite a focus on crude oil sales, are potential indicators.
  5. EPA Registrations: Companies dealing with waste oil or hazardous materials without appropriate registrations from the U.S. Environmental Protection Agency (EPA) should be examined.
  6. Shell Company Activity: Sudden, significant transactional activity with companies lacking online presence and exhibiting other characteristics of shell companies.
  7. Wire Transfer Patterns: Complex wire transfer patterns involving multiple jurisdictions and accounts may be designed to obscure the origins and destinations of funds.

These indicators are not individually determinative of illicit activity, but when combined, they can provide a comprehensive profile of potentially suspicious operations.

Strategic Sanctions: Targeting Key Players

The FinCEN alert aligns with OFAC sanctions targeting individuals and entities involved in oil smuggling, aiming to dismantle networks facilitating illegal activities. Key figures sanctioned under Executive Orders 14059 and 13224 include CJNG leader Cesar Morfin Morfin, linked to both drug trafficking and oil theft. Associates and transportation companies involved in these operations have also been sanctioned, reinforcing efforts to dismantle the operational infrastructure of CJNG.

Collaborative Efforts and Compliance

FinCEN emphasizes the importance of information sharing under section 314(b) of the USA PATRIOT Act. Collaboration among financial institutions is crucial for tracing and preventing the movement of illicit funds. Sharing account or transaction information does not violate SAR confidentiality unless it reveals a SAR, allowing institutions to support investigations without legal complications. This complements the Treasury Department’s strategy of using sanctions to counter TCOs, reinforcing efforts to address narcotics trafficking and related crimes.

Conclusion: A Unified Approach

The FinCEN alert and OFAC sanctions represent a coordinated strategy to address cartel operations like those of CJNG. These measures provide insights into oil smuggling methodologies and aim to impact illicit revenue streams. Financial institutions play a key role in this process by adhering to outlined measures, supporting the integrity of the financial system and enhancing regional security. By targeting key figures and networks, U.S. authorities aim to contribute to a safer and more stable international environment, with financial entities playing an essential role in these efforts.

In this multifaceted approach, the collaboration between law enforcement and financial institutions is important to dismantling the intricate networks that support these criminal enterprises, paving the way for more effective interventions and a reduction in cartel-driven violence and instability.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. Please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

On May 1, 2025, the Financial Crimes Enforcement Network (FinCEN) released a Notice of Proposed Rulemaking (NPRM) regarding the Huione Group, a foreign financial institution located in Cambodia. This proposal, enacted under section 311 of the USA PATRIOT Act, suggests prohibiting U.S. financial institutions from forming or maintaining correspondent banking relationships with Huione Group. The NPRM identifies Huione Group as a significant money laundering concern, based on its purported role in facilitating unlawful financial activities.

Following an investigation, FinCEN found that Huione Group was involved in laundering at least $4 billion in illegal proceeds between August 2021 and January 2025, with the funds distributed as follows:

  • Approximately $37 million was linked to cyber thefts conducted by North Korea;
  • Around $36 million originated from scams known as “pig butchering”;
  • About $300 million was related to various other cyber fraud schemes.

Background: Understanding Section 311 of the USA PATRIOT Act

Section 311 of the USA PATRIOT Act grants the Secretary of the Treasury the authority to identify foreign jurisdictions, financial institutions, or types of transactions that pose significant money laundering concerns. Upon such identification, the Secretary can impose special measures to mitigate risks to the U.S. financial system. These special measures can range from requiring enhanced record-keeping and reporting to prohibiting certain types of banking relationships.

The intention behind section 311 is to provide the U.S. government with flexible tools to protect the financial system from being exploited by money launderers and terrorist financiers. By targeting specific entities or jurisdictions, the U.S. aims to cut off illicit actors from accessing the global financial infrastructure.

Huione Group: A Profile of Concern

Huione Group, operating primarily out of Phnom Penh, Cambodia, is a conglomerate that includes several subsidiaries: Huione Crypto, Haowang Guarantee, and Huione Pay PLC. FinCEN’s investigations have identified the group as being involved in activities that significantly contribute to international money laundering schemes.

Key Findings

  1. Laundering Proceeds from Cybercrimes and Sanctions Evasion

FinCEN’s analysis indicates that Huione Group has been utilized to launder funds associated with cyber heists, notably those executed by the Lazarus Group, a North Korean entity known for its cybercriminal activities. (Explore other blog posts about Lazarus Group here, here, and here.) These heists have targeted cryptocurrency exchanges and other digital asset platforms, resulting in the theft of substantial amounts of convertible virtual currency (CVC). The proceeds from these activities allegedly support the North Korean regime’s evasion of international sanctions, which are intended to prevent the financing of its weapons programs.

The relationship between Huione Group and North Korean actors is particularly concerning due to the geopolitical implications. By facilitating the movement of illicit funds, Huione Group potentially undermines international efforts to curb North Korea’s nuclear ambitions. This connection underscores the severity of the risk posed by the group’s activities.

    2.  Facilitation of CVC Investment Scams

In addition to laundering cybercrime proceeds, Huione Group is reportedly involved in facilitating CVC investment scams, commonly referred to as “pig butchering” scams. (We have previously discussed pig-butchering scams in our blog post here.) These scams are orchestrated by transnational criminal organizations (TCOs) operating primarily in Southeast Asia. They involve deceiving victims into investing in fraudulent CVC schemes under the pretense of high returns. Once the funds are invested, they are channeled through networks like Huione Group, where they are layered and integrated to obscure their illicit origins.

The prevalence of these scams highlights the vulnerabilities in the global financial system, especially regarding digital assets. The ability of criminal organizations to exploit these vulnerabilities has significant implications for consumer protection and financial stability. It also raises questions about the adequacy of regulatory frameworks governing the use of digital assets.

    3.  Ineffective AML/KYC Practices

Another critical finding from FinCEN’s analysis is the inadequacy of Huione Group’s anti-money laundering (AML) and know-your-customer (KYC) practices. Despite being subject to various reports and criticisms, the group has not implemented effective measures to detect and prevent money laundering activities. This lack of robust compliance infrastructure is a significant factor contributing to its designation as a primary money laundering concern.

Public statements from Huione Group have acknowledged these deficiencies, citing challenges in maintaining effective KYC capabilities. Such admissions raise concerns about the group’s ability to comply with international AML standards and its willingness to address identified shortcomings.

Proposed Special Measures

In response to these findings, FinCEN proposes to implement special measure five, under Section 311 of the USA PATRIOT Act, which involves prohibiting U.S. financial institutions from opening or maintaining correspondent accounts for Huione Group. This measure seeks to mitigate the risks by severing the group’s access to the U.S. financial system, thereby limiting its ability to facilitate illicit financial activities.

Rationale for the Proposed Measures

  1. Effectiveness in Addressing Risks

The proposed prohibition is considered the most effective measure to prevent Huione Group from engaging in activities that pose a risk to the U.S. financial system. Given the group’s history and the complexity of its operations, other measures, such as enhanced reporting or additional due diligence requirements, may not adequately deter or monitor its activities. The prohibition aims to directly cut off the pathways through which illicit funds are processed.

      2.  Impact on Legitimate Business Activities

While the prohibition may impact some legitimate business activities conducted by Huione Group, FinCEN’s analysis suggests that a substantial portion of the group’s transactions are linked to illicit activities. By focusing on correspondent banking relationships, FinCEN seeks to target specific channels through which money laundering risks are most pronounced, minimizing the impact on legitimate operations to the extent possible.

    3.  Alignment with International Efforts

Although similar actions have not been widely adopted by other countries, FinCEN’s proposal aligns with broader international efforts to combat money laundering and financial crimes. The global nature of financial networks means that actions taken in one jurisdiction can have ripple effects worldwide. This proposal underscores the importance of international cooperation and coordination in tackling these issues.

Broader Implications for the Financial Sector

The proposed measures against Huione Group have significant implications for the financial sector, both domestically and internationally. For U.S. financial institutions, the prohibition necessitates a reevaluation of existing correspondent banking relationships and the implementation of enhanced due diligence procedures. Institutions must ensure compliance with the proposed rule to avoid potential penalties and reputational damage.

On an international level, FinCEN’s actions may prompt other jurisdictions to reassess their regulatory frameworks and cooperation mechanisms. The designation of Huione Group as a primary money laundering concern highlights the need for robust AML/CFT (counter-financing of terrorism) measures that can effectively address the challenges posed by digital assets and transnational financial crimes.

Conclusion

FinCEN’s proposal to impose special measures against Huione Group represents an important development in efforts to maintain the integrity of the U.S. financial system. This action is part of a broader initiative by the Treasury Department to address financial entities that contribute to cybercrime and sanctions evasion, particularly in regions with weaker regulatory environments. By concentrating on issues such as crypto-related fraud, state-sponsored cybercrime, and international money laundering networks, FinCEN highlights its commitment to using the tools available under Section 311. This strategy addresses immediate threats while emphasizing the need for global collaboration to combat money laundering and financial crimes. If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. Please click here to find out about Ballard Spahr’s Anti-Money Laundering

In March, we wrote about the Department of Treasury’s Financial Crimes Enforcement Network (FinCEN) issuing a Geographic Targeting Order (GTO) aimed to combat Mexican-based drug cartels.  The GTO signals Treasury’s efforts to combat cartel activity by requiring heightened anti-money laundering reporting for money services business (MSBs) along the southwest border.  The GTO—which went into effect on April 14, 2025—can be found here.  It requires all MSBs—check cashing companies, currency transmitters and foreign exchange dealers, among other financial services businesses—located in 30 ZIP codes across the U.S.-Mexico border in California and Texas to file Currency Transaction Reports (CTRs) with FinCEN at a $200 threshold in connection with cash transactions.  FinCEN announced that the purpose of the GTO was to “further combat the illicit activities and money laundering of Mexico-based cartels and other criminal actors along the southwest border” and is one of many examples of the new administration’s significant shifts in its approach to criminal enforcement and prosecution of money laundering cases

But two recent challenges successfully—at least temporarily—enjoined the enforcement of the GTO for certain MSBs.

The first challenge came from the Texas Association for Money Services Businesses (TAMSB), a trade group who filed in the Western District of Texas a complaint for declaratory judgment and injunctive relief in a case captioned Texas Association for Money Services Businesses, et al. v. Bondi et al., No. 5:25-cv-00344 (W.D. Tex. Apr. 1, 2025)(with amended complaint filed on April 18, 2025).  TAMSB claimed the new over-$200 reporting obligation would be extremely burdensome administratively. For example, TAMSB claimed that one of its members predicted that it will go from filing an average of nine CTRs per week across its dozens of locations in Texas to nearly 50,000 under the GTO. TAMSB further claimed that the administrative burden will be “financially ruinous” or customers will simply take their business elsewhere. The amended complaint alleged that the GTO violated the Administrative Procedures Act (APA) and TAMSB’s Fifth Amendment’s due process and equal protection guarantees by “depriving [the TAMSB members] of protected property interests without notice” and “targeting . . . particular zip codes.” 

In granting TAMSB’s motion for a temporary restraining order (TRO) on the original complaint, the court found that the TAMSB: (a) demonstrated a substantial likelihood of success on the merits of its claims under the APA and Fifth Amendment; and (b) will suffer irreparable harm absent emergency injunctive relief, including the threat of business closure, reputational injury, and loss of customers and good will.  That TRO—which applied only to TAMSB members and not more broadly—expired on April 25, 2025. Briefing on the TAMSB’s motion for preliminary injunction is ongoing.

The second challenge came from an MSB operating in San Diego, California and its owner and operator that filed a similar claim for injunctive relief in the Southern District of California in Novedades Y Servicios, Inc. et al v. Financial Crimes Enforcement Network et al., Docket No. 3:25-cv-00886 (S.D. Cal. Apr 15, 2025).  On April 22, 2025, the court granted an ex parte motion for a TRO temporarily blocking the GTO.  Plaintiffs asserted challenges under the APA and Fifth Amendment but also that the GTO violates the Fourth Amendment and “operates as a general warrant insofar as it was fashioned by law enforcement to sweep up information about otherwise private cash transactions throughout the targeted zip codes” in order for law enforcement to “combat[] Mexican cartels, without any individualized probable cause.”  Plaintiffs allege that the $200 threshold “results in an unreasonable search because it requires businesses to report information about their customers’ ordinary, everyday cash transaction without any individualized suspicion or showing of probable cause.”  Among other procedural and due process arguments, plaintiffs argue that the GTO will result in “hours of new paperwork daily” and will “impose crushing costs” on the MSB.

In granting the TRO, the court found that: (a) plaintiffs demonstrated a substantial likelihood of success on the merits of their claim that the GTO was unlawfully issued without notice and that the GTO was arbitrary and capricious; (b) that plaintiffs have suffered immediate and irreparable harm, including the threat of business closure and the loss of customers and goodwill; and (c) that the balance of equities favor plaintiffs while not significantly intruding on FinCEN’s ability to continue to regulate financial institutions.  This TRO too is limited; it applies only to covered businesses (as defined in the GTO) located in the Southern District of California.  The court set a hearing for mid-May to hear plaintiffs’ motion for preliminary injunction.

These decisions temporarily halt enforcement of the GTO for a limited population of MSBs located in the impacted areas.  But they signal that the new administration will need to litigate the legality of the GTO on multiple fronts and engage on multiple legal theories (including allegations of violations of the Fourth and Fifth Amendments and the APA) before the GTO is fully implemented and up and running.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. Please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

In a significant policy shift, Deputy Attorney General Todd Blanche issued a memorandum titled “Ending Regulation By Prosecution,” on April 7, 2025, signaling a change in the Department of Justice’s (DOJ) approach to digital assets. The memorandum, outlines a move away from the previous administration’s enforcement efforts, which the memo called “reckless” and “ill conceived and poorly executed.” This shift aligns with Executive Order 14178 and President Trump’s vision to foster innovation within the digital assets industry without punitive regulatory measures.

Key Takeaways

The memorandum marks a pivotal change in how digital assets are treated by the DOJ, moving away from regulatory prosecutions to focus on criminal activities. Below are the main points of this policy shift:

  1. Focus on Individual Criminal Activity: The DOJ will now prioritize prosecuting criminal activity of individuals who cause financial hardship to digital asset investors and consumers and those who use digital assets to further criminal conduct, such as fentanyl trafficking, terrorism, cartels, organized crime, and human trafficking.
  2. Ceasing “Regulation by Prosecution”: At the same time, prosecutors are directed to stop pursuing cases related to regulatory violations by cryptocurrency entities. Investigations not aligned with the new focus on criminal activity are to be discontinued.
  3. Alignment with Administration Policy: This change aligns with President Trump’s executive order aimed at promoting innovation in the cryptocurrency sector by reducing regulatory hurdles.
  4. Disbandment of the NCET: The DOJ has dissolved the National Cryptocurrency Enforcement Team, established in 2022. The DOJ clarified that it does not serve as a regulatory body for digital assets.  To that end, DOJ will no longer pursue cases that “superimpose[e] regulatory frameworks on digital assets.”

This policy shift reflects a transition towards addressing the criminal misuse of digital assets rather than focusing on regulatory compliance. (For more information, check out our recent blog posts on cryptocurrency regulation here and here.) What remains to be seen is whether DOJ’s move away from “regulation by prosecution” will apply more broadly and impact priorities related to other industries outside of digital assets that are not the subject of an Executive Order.

A New Focus on Digital Assets Enforcement

The digital assets industry is increasingly recognized as a component of modern economic development, with potential for innovation. The DOJ’s revised strategy focuses on ensuring clarity and certainty in enforcement policies, as directed by Executive Order 14178. The memorandum emphasizes that the DOJ “is not a digital assets regulator;” instead, it commits to prosecuting individuals who exploit digital assets for criminal activities.

Under the new framework, prosecutions will prioritize investigations and prosecutions that involve: (1) conduct victimizing digital asset investors (e.g., embezzlement and misappropriation of customers’ funds on exchanges, digital asset investment scams, hacking of exchanges, etc.); and (2)  individuals who use digital assets to facilitate crimes such as terrorism, narcotics trafficking, human trafficking, organized crime, hacking, and cartel financing. This approach emphasizes investor protection and the security of digital asset markets, while delegating regulatory compliance to other bodies. The memorandum also notes the increasing reliance on digital assets by certain criminal elements and aligns with the administration’s focus on transnational criminal organizations, foreign terrorist organizations, and designated global terrorists. 

Charging Considerations and Regulatory Clarity

A key aspect of the new policy is guidance for federal prosecutors on charging decisions. Prosecutors are instructed to prioritize cases holding individuals accountable for causing financial harm to digital asset investors or using digital assets in furtherance of criminal conduct. While the DOJ will pursue individuals and enterprises involved in these illicit activities, it will refrain from targeting platforms unless they are complicit. Cases based on regulatory violations, such as unlicensed money transmitting or violations of the Bank Secrecy Act, will not be pursued unless there is clear evidence of willful law violations.

It remains to be seen what impact, if any, this policy will have on ongoing criminal prosecutions. The memorandum notes that the DOJ “will no longer target virtual currency exchanges, mixing and tumbling services, and offline wallets for the acts of their end users or unwitting violations of regulations . . . .” Instead, the DOJ will now focus on individuals who use these technologies for illicit activities. Later this year, the DOJ is scheduled to put Roman Storm, co-founder of mixing service Tornado Cash, on trial for crimes including conspiracy to launder money and sanctions violations. This case raises questions about the liability of developers for open-source code used by others to commit crimes. However, the DOJ’s policy does not apply to 18 U.S.C. §1960(b)(1)(C), indicating that knowingly transmitting funds derived from or intended for illegal activities remains a prosecutable offense. (See additional blog posts about Tornado Cash here, here and here.)

The memorandum outlines a discretionary approach to charging violations under the Securities Act of 1933, the Securities Exchange Act of 1934, and the Commodity Exchange Act. Prosecutors are advised to avoid cases that require the DOJ to litigate the classification of a digital asset as a “security” or “commodity” unless no alternative criminal charge is available.

Compensating Victims in the Digital Assets Space

The memorandum addresses compensating victims of digital asset fraud, particularly after the market downturn in 2022. The DOJ acknowledges that current regulations may prevent victims from recovering the full value of lost assets, especially when asset values fluctuate significantly. To address this, the DOJ’s Office of Legal Policy and Office of Legislative Affairs are tasked with evaluating legislative and regulatory changes to improve asset-forfeiture efforts and ensure fair compensation for victims.

Reallocating Resources and Future Engagement

Aligned with the narrowed focus on digital asset enforcement, the DOJ will reallocate resources. The Market Integrity and Major Frauds Unit will cease cryptocurrency enforcement activities, and the National Cryptocurrency Enforcement Team (NCET) will be disbanded. However, the Criminal Division’s Computer Crime and Intellectual Property Section (CCIPS) will continue to provide guidance and liaise with the digital asset industry.

Additionally, the DOJ will participate in the President’s Working Group on Digital Asset Markets, as established by Executive Order 14178. DOJ representatives will contribute to identifying and recommending regulatory and legislative measures that align with administration policies and priorities. This collaborative effort aims to shape a balanced regulatory environment that supports innovation while ensuring robust protections against criminal exploitation.

A New Stance on Crypto

The DOJ’s policy shift is part of a broader rollback of government efforts to regulate the crypto industry, with regulatory bodies like the Securities and Exchange Commission refocusing their enforcement strategies and banking regulators allowing some crypto activities. This realignment reflects President Trump’s campaign promises in the sector. .

Conclusion

The memorandum from Deputy Attorney General Blanche represents a significant shift in the DOJ’s approach to digital assets. By moving away from prosecuting virtual currency platforms, the DOJ aims to create a regulatory environment that encourages innovation while maintaining a focus on prosecuting individuals who victimize digital asset investors and preventing criminal misuse of digital assets. This strategy underscores the importance of balancing industry growth with robust enforcement measures to protect investors and national security.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. Please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

On March 13, 2025, the Guiding and Establishing National Innovation for U.S. Stablecoins (GENIUS) Act, which aims to establish a regulatory framework for payment stablecoins, passed the United States Committee on Banking, Housing, and Urban Affairs with a bipartisan 18-6 vote, paving the way for Congressional approval. The bill was introduced and sponsored by Senator Bill Hagerty (R-Tenn.) and has earned the support of Senator Tim Scott (R-SC), Senator Kristen Gillibrand (D-NY) and Senator Cynthia Lummis (R-Wyo.). Senator Warren (D-Mass) requested that the Act include treating stablecoin issuers as “financial institutions” under the Bank Secrecy Act.

The GENIUS Act seeks to regulate payment stablecoins by limiting US stablecoin business to “permitted stablecoin issuers” who are subject to state and federal licensing and oversight, reserve requirements, and prompt redemption.  Stablecoin custodians are also subject to regulation.  For purposes of clarity, the draft GENIUS Act specifies that stablecoins are not to be treated as securities.

Currently, the top two stablecoins are Tether with a market capitalization of approximately 143 billion and USDC with a market capitalization of 59 billion, each of which is designed to be linked on a 1:1 basis with the USD. Stablecoins like Tether and USDC allow owners to purchase digital assets like Bitcoin or Ethereum without involving banks to move dollars on and off of exchanges. Circle, which sponsors USDC, is regulated in Bermuda, France, Singapore and the UK, as well as licensed as a money transmitter in 49 states. Tether is based in the Caribbean and is registered with FinCEN as a Money Service Business.  According to reports, Tether is not regulated on the state level. 

The draft GENIUS Act provides that a “permitted payment stablecoin issuer shall be treated as a financial institution for purposes of the Bank Secrecy Act” (“BSA”). However, issuers of stablecoins are already deemed to be BSA financial institutions.  Current 13 USC 5312(a)(2) defines “financial institution” to include “A licensed sender of money or any other person who engages as a business in the transmission of funds, including any person who engages as a business in an informal money transfer system or any network of people who engage as a business in facilitating the transfer of money domestically or internationally outside of the conventional financial institutions system.” In 2019, FinCEN Guidance FIN-2019-G001, made it relatively clear that stablecoin issuers were money service businesses and hence financial institutions. (See related blog posts here and here.)  As a result, it appears that both Tether and USDC are already treated as financial institutions for AML purposes and the specific inclusion in the GENIUS Act should be unnecessary.  We suspect that Senator Warren was concerned that FinCEN’s interpretation of the BSA could be challenged under Loper Bright, which removed the concept of Chevron deference and the inclusion of specific congressional intent to include stablecoin issuers as financial institutions added certainty.   

Overall, from an anti-money laundering perspective, the GENIUS Act is unlikely to have a major impact on issuers who were already subject to regulation as a financial institution. 

Next Steps

The future of the GENIUS Act remains uncertain. Proponents of the GENIUS Act stress the importance of regulatory clarity in the crypto space. Circle’s chief strategy officer (an issuer of U.S. stablecoin) lauded the bill and stated that it “provides a pathway for the U.S. to lead rather than be led.” Critics of the bill, however, worry that the passage of the GENIUS Act as is could destabilize banking, increase anti-social access to funds and increase risk overall.

Ballard Spahr will continue to monitor the bill’s progress, which will need bipartisan support to pass in the Senate.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. Please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

On March 7, 2025, the Office of the Comptroller of the Currency (“OCC”) released Interpretive Letter 1183, marking a pivotal change in regulatory guidance for national banks and federal savings associations engaging in cryptocurrency activities. This recent directive, issued under Acting Comptroller Rodney Hood, rescinds the requirements set by Interpretive Letter 1179 from November 2021. The updated guidance reaffirms the permissibility of certain crypto-related activities while eliminating the need for prior supervisory non-objection.

Background

Interpretive Letter 1183 marks a significant regulatory update under Acting Comptroller Rodney Hood, who assumed his role earlier this year. This letter aims to standardize how banks engage with digital assets, removing the constraints imposed by previous guidance. The rescinded directive from former Acting Comptroller Michael Hsu required banks to seek supervisory approval before participating in crypto activities—a process that was often seen as a barrier to innovation and growth in the sector.

In contrast, the new guidance focuses on reducing regulatory burdens and fostering transparency, thereby encouraging responsible innovation within the banking industry. The OCC continues to support activities outlined in earlier interpretive letters, such as crypto asset custody (IL 1170), stablecoin reserves (IL 1172), and blockchain payment facilitation (IL 1174), initially introduced under former Comptroller Brian Brooks.

Understanding the Interpretive Letters

The OCC’s interpretive letters serve as legal clarification for national banks, delineating the scope of permissible activities concerning digital assets. These letters play a central role in shaping the regulatory landscape, offering clarity on the integration of traditional banking operations with emerging cryptocurrency technologies. Each letter addresses specific aspects of crypto involvement, reflecting the evolving understanding and acceptance of digital finance within the regulatory framework:

  • IL 1170 (July 2020): This letter was a milestone, officially allowing banks to offer crypto asset custody services. It enabled banks to securely store digital assets for their customers, integrating cryptocurrency management into mainstream banking services.
  • IL 1172 (September 2020): Focused on stablecoins, this letter permits banks to hold deposits as reserves for these digital currencies. It acknowledges the growing role of stablecoins in financial transactions, providing a regulated pathway for banks to engage with this asset class under specific conditions, such as compliance with anti-money laundering protocols.
  • IL 1174 (January 2021): This letter authorized banks to utilize distributed ledger technology, facilitating payment activities involving stablecoins. It highlights the potential of blockchain technologies to enhance payment systems, allowing banks to act as nodes on verification networks, thereby increasing efficiency and transparency in financial transactions.
  • IL 1179 (November 2021): Introduced under the Biden administration, this letter required banks to obtain a supervisory non-objection before engaging in cryptocurrency activities. This regulatory step aimed to ensure adequate risk management but posed a hurdle for institutions eager to innovate in the crypto space.
  • IL 1183 (March 2025): The latest letter rescinds IL 1179, removing the non-objection requirement and reaffirming the permissibility of activities outlined in previous letters. It reflects the OCC’s confidence in banks’ risk management capabilities, promoting a streamlined approach to integrating digital asset services while maintaining safety and soundness standards.

Through these interpretive letters, the OCC provides a structured approach for banks to navigate the complexities of digital assets, ensuring that innovation can proceed within a safe and regulated environment.

Evolving Policies

Alongside Interpretive Letter 1183, the OCC has retracted its support for joint statements on crypto-asset risks issued in collaboration with the Federal Reserve and FDIC earlier this year. These statements highlighted the potential risks posed by crypto markets to banking stability, particularly after high-profile incidents like the FTX collapse. The withdrawal signifies a shift in the OCC’s approach, focusing on integrating digital assets within traditional banking frameworks while maintaining safety and soundness.

Looking ahead, the updated guidance may pave the way for banks to re-enter the crypto sector, potentially through partnerships with established service providers. However, the industry anticipates further regulatory adjustments from the Federal Reserve and FDIC to establish a comprehensive framework for crypto banking services.

Conclusion

The OCC’s latest interpretive letter marks a transition in the regulatory landscape for banks dealing with digital assets. By re-affirming and broadening the scope of permissible activities, the letter indicates a growing acceptance of cryptocurrencies within the banking sector, setting the stage for future developments. As banks explore these opportunities, they must continue to uphold robust risk management practices to ensure the safety and soundness of their operations.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. Please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.