BitMEX FinCEN $100 Million Penalty: Crypto Derivatives Platform AML Lessons

BitMEX was a cryptocurrency derivatives platform. In August 2021 the US Financial Crimes Enforcement Network (FinCEN) assessed a $100 million civil money penalty against its operating companies for failing to register, to run an anti-money laundering (AML) programme and to file suspicious activity reports (SARs). FinCEN credited $50 million for a payment to the Commodity Futures Trading Commission (CFTC), which ran a parallel case. The order is a clear description of an exchange that advertised that it needed no personal information from users while handling more than $1 trillion of trades. To build your AML knowledge, see our CPD courses.

This guide is based on FinCEN assessment number 2021-02. We read it through a summarising tool, so check every figure against the order before you quote it.

The penalty and the period

The order is dated 10 August 2021 and covers 1 November 2014 to 12 December 2020. The penalty is $100 million, payable jointly and severally. Of this, $50 million is credited for a payment to the CFTC, and two $10 million amounts are suspended pending completion of undertakings. FinCEN found that BitMEX operated as a futures commission merchant that should have registered with the CFTC and did not, and that it was also a money transmitter. The order cites the AML programme rule (31 U.S.C. 5318(h)(1) and 31 C.F.R. 1026.210), the customer identification programme rule (31 U.S.C. 5318(l)(1) and 31 C.F.R. 1026.220) and the SAR rule (31 U.S.C. 5318(g) and 31 C.F.R. 1026.320).

What FinCEN found

No AML programme until late 2020

No written, senior-management-approved AML programme existed until at least late 2020. There were no risk-based policies or internal controls, no designated compliance officer until October 2020, no employee training, no independent testing and no risk-based ongoing customer due diligence.

Know your customer: an email address

Accounts required only an email address, and the company collected or verified almost no customer information. Its sign-up page advertised that no personal information was needed. Leadership reportedly planned to introduce verification only under "significant government pressure".

Sanctions and location controls

There was no screening against the Office of Foreign Assets Control sanctions lists, according to a statement by the company's chief executive. In October 2018 the platform identified 43,422 accounts linked to the United States and its territories, to sanctioned countries including Cuba, Iran, Syria, North Korea and Sudan, or to Quebec IP addresses. More than 800 China-based accounts logged in from US IP addresses, staff reportedly altered customer location data to conceal US customers, and users could access the platform through an anonymising network mirror site until about 2016. Our guide to sanctions screening and alert resolution explains why location controls need testing.

Scale and unreported activity

The platform had more than 1.3 million accounts and handled over $1 trillion of trades, more than $11 billion of virtual currency deposits and over $1 billion in fees. At least $209 million moved in transactions with darknet markets, unregistered money services businesses, high-risk jurisdictions and fraud schemes, and at least $15 million across 588 transactions should have been reported. The company filed no SARs. Examples include 2,371 transactions with 17 darknet markets, 2,036 transactions with 11 unregistered mixers, 16 transactions worth $138,189 involving Iran, 133 transactions worth over $3 million with a sanctioned exchange and more than 4,000 transactions worth over $5 million with 23 counterparties linked to fraud. Our Bittrex case study describes another exchange with similar gaps.

Founders and parallel actions

The order records that the CFTC sued the company and its founders, and that the Southern District of New York indicted the founders, not the company, for intentionally violating the Bank Secrecy Act and conspiring to do so. We have not followed those cases, so please check their outcomes separately.

Cooperation, remediation and undertakings

BitMEX did not voluntarily disclose the violations, even after it learned of other agencies' investigations. It partly cooperated, producing documents, giving presentations on remediation and agreeing to toll limitation periods, but FinCEN found its cooperation slow and incomplete in places. Since late 2020 it has developed KYC procedures and a written AML programme, hired a chief compliance officer, launched a user verification programme and begun to remove US customers, work FinCEN described as ongoing.

The order requires two reviews. The first is a SAR lookback by an independent consultant of transactions from 1 November 2014 to 12 December 2020, with a report due by 31 December 2021, and any required SARs filed within 30 days of the report, with one 60-day extension available. The second is a review of US controls by an independent consultant at 90 days and one year, confirming the platform blocks US customers and solicitation, with negative findings to be remedied within 30 days. A parallel CFTC order requires BitMEX to remove US operations and personnel, with limited exceptions.

Practical lessons

• Verify identity from the start. An email address is not customer due diligence.
• Do not market the absence of controls. Advertising that no personal information is needed is evidence against you.
• Test geo-blocking. Location controls must resist spoofing and anonymising tools.
• Screen against sanctions lists. No screening at all is the clearest failure.
• Cover mixers and darknet exposure. Monitoring must follow wallets, not just accounts.
• Know which regulators apply. Registration with one regulator does not remove duties to another.

Frequently asked questions

How much was the BitMEX penalty?

$100 million, with $50 million credited for a payment to the CFTC and two $10 million amounts suspended pending completion of undertakings.

Did BitMEX file any SARs?

No. The order says the company filed no SARs for the relevant period.

What period did the order cover?

1 November 2014 to 12 December 2020.

What we could not confirm

We read FinCEN's assessment through a summarising tool. The text describes immediate payments of $80 million, which we could not reconcile with the CFTC credit and suspended amounts, and the outcomes of the parallel criminal and civil cases against the founders are not covered. Please check all figures against the original document.