Paxful FinCEN $3.5 Million Penalty: Crypto Platform AML Lessons

On 9 December 2025 the US Financial Crimes Enforcement Network (FinCEN) assessed a $3.5 million civil money penalty against Paxful, Inc. and Paxful USA, Inc., which ran a peer-to-peer platform for trading convertible virtual currency such as bitcoin. The amount is small next to the bank cases, but the order is one of the clearest descriptions available of what regulators expect from a crypto platform. It sets out failures in registration, know-your-customer (KYC) checks, sanctions controls, transaction monitoring and suspicious activity reporting. If you are building your AML knowledge, see our CPD courses.

This guide is based on FinCEN's news release of 9 December 2025 and consent order number 2025-02. We read both through a summarising tool, so check every figure against the original documents before you quote it.

The penalty and the legal basis

The civil money penalty is $3.5 million. FinCEN credits $1.75 million of it for a payment made to the US Department of Justice (DOJ), so Paxful pays $1.75 million to the Treasury. The order covers 3 February 2015 to 4 April 2023. Paxful admitted willful violations of the Bank Secrecy Act (BSA), with willfulness defined as it is in civil enforcement, meaning reckless disregard or wilful blindness. The order cites the rules on registration of money services businesses (31 U.S.C. 5330 and 31 C.F.R. 1022.380), AML programmes (31 U.S.C. 5318(h)(1) and 31 C.F.R. 1022.210) and suspicious activity reports (SARs) (31 U.S.C. 5318(g)(1) and 31 C.F.R. 1022.320).

What FinCEN found

Operating unregistered

Paxful first registered as a money services business in July 2015. Its re-registration was due by the end of 2016 but did not happen until September 2019, so the order says it operated unregistered for 974 days.

No real AML programme for years

The order says there was no written AML programme until July 2019. Through 2018 there was no qualified compliance officer; the former chief executive was listed in the role with no BSA or AML training. Independent testing happened only once in the period, and the internal controls were not tailored to the business.

KYC that came late and stopped short

FinCEN found no KYC before February 2019, and says more than $3.5 billion of virtual currency transactions took place before any KYC policy existed. The policy introduced in February 2019 applied only above $1,500 of activity, with no controls against customers splitting transactions to stay below it. Our suspicious activity reporting guide describes why structuring is a classic red flag.

Geo-blocking and sanctions exposure

Before January 2018 the platform had no meaningful restrictions on users connecting from North Korea, Iran, Syria or Cuba. The order says more than 1,500 accounts used Iranian, Syrian, Cuban, Crimean or Sudanese IP addresses between May 2015 and August 2018, and that tens of millions of logins came from US IP addresses by users not located in the United States. It describes trades involving North Korean and Iranian counterparties and failures to act even after designations by the Office of Foreign Assets Control. Our guide to crypto sanctions evasion covers the same risks from a UK angle.

Transaction monitoring gaps

Monitoring was minimal until at least 2018 and written policies did not exist until July 2019. The order says more than 15 virtual currencies were not monitored at all, and that there were significant gaps in monitoring of prepaid access products, with more than $1.7 billion of prepaid card transactions between May 2015 and December 2019.

Suspicious activity that went unreported

Paxful filed its first SAR in November 2019. FinCEN says more than $500 million of suspicious activity was not reported on time, including ransomware payments, child sexual exploitation material, darknet marketplaces, unregistered mixers, stolen funds and links to criminal networks. The order also describes more than four million transactions, worth over $24 million, connected to a classified-advertising site that the DOJ seized in 2018 over prostitution and sex trafficking, with no SAR filed.

Cooperation and remediation

Paxful did not voluntarily disclose the violations. FinCEN describes its cooperation as forthcoming, with complete and timely productions and a tolling agreement. Since April 2023 new leadership has engaged independent consultants, reviewed a backlog of transactions and filed thousands of SARs for the relevant period. FinCEN's release also notes that the company ended the employment of the leadership that oversaw operations at the time. The order has no stated monitorship; ongoing obligations include cooperation with FinCEN, six-year record retention and written agreement by any successor to comply.

Why this matters for crypto firms

The order stresses that growth was partly driven by high-risk transactions and that compliance was under-resourced. The message is that a platform cannot rely on being peer-to-peer to avoid money transmitter obligations: if it handles value for customers, registration, an AML programme and SARs apply. Our guide to sanctions screening and alert resolution is a good starting point for the screening controls regulators expect.

Practical lessons

• Register first. Operating without registration is a standalone violation and a signal of wider weakness.
• Verify customers before they trade. Low thresholds and missing checks are hard to defend later.
• Block sanctioned jurisdictions properly. IP restrictions need to be tested against VPN use and spoofing.
• Cover every asset and product. Monitoring that omits some currencies or prepaid products leaves blind spots.
• File SARs from day one. A first SAR years after launch is hard to explain.

Frequently asked questions

How much was Paxful fined?

$3.5 million, with $1.75 million credited for a DOJ payment.

Does FinCEN regulate crypto exchanges?

FinCEN treats exchangers and administrators of convertible virtual currency as money transmitters, which means registration, an AML programme and SAR reporting apply.

What period does the order cover?

3 February 2015 to 4 April 2023.

What we could not confirm

We read the release and order through a summarising tool. We did not read the separate DOJ resolution, and the order's other terms may contain detail we have not captured. Please check all figures against the original FinCEN documents.