https://www.orrick.com/en/Insights/2024/03/US-Indicts-KuCoin-What-It-Means-for-Cryptocurrency-Companies-Offering-Money-Transmission-Services

In a display of the United States' jurisdictional reach, the Justice Department has indicted KuCoin, a prominent global cryptocurrency exchange, along with founders Chun Gan and Ke Tang, for Bank Secrecy Act (BSA) and unlicensed money transmission offenses.

The indictment follows similar enforcement actions against other large cryptocurrency exchanges, such as BitMex in 2020 and Binance in 2023. It emphasizes the United States' stance on enforcing its financial regulations, particularly the BSA, on actors that knowingly offer financial services involving cryptocurrency to U.S. residents.

The case highlights the importance of registering with the Financial Crimes Enforcement Network (FinCEN), a bureau of the United States Department of the Treasury, implementing programs to comply with the BSA and ensuring accurate disclosures, among other things.

What Prosecutors Allege

The indictment, filed in the Southern District of New York, accuses KuCoin and associated entities registered in the Cayman Islands, the Republic of Seychelles, and Singapore, of willfully failing to implement an anti-money laundering (AML) program that complied with the stringent AML and Know Your Customer (KYC) protocols mandated by the BSA, a criminal offense under federal law.

The lack of these critical compliance measures allegedly facilitated the laundering of over $5.39 billion, potentially linked to a spectrum of criminal activities, including sanctions evasion and cybercrime.

Central to the charges is the applicability of the BSA to non-U.S. entities engaging in money transmission services with U.S. residents. That includes a wide array of cryptocurrency activities, such as the issuance and exchange of cryptocurrency occurring “in substantial part” in the United States. The BSA requires such entities to implement policies, procedures and internal controls designed to identify and report potential money laundering to FinCEN and to mitigate risks associated with money laundering and terrorist financing.

In many instances, the BSA also requires such entities to obtain and verify personal information of customers and to register with FinCEN triggering government examinations for compliance with the BSA.

Cosmetic Compliance?

The indictment alleges that KuCoin systematically circumvented these U.S. legal requirements despite having a substantial user base in the United States. According to the indictment, from November 2022 through March 2023, KuCoin knowingly permitted U.S.-based customers to open multiple accounts and conduct trades, including spot and futures trades with margin, without requiring any personal identifying information or documents.

Moreover, even after implementing a new AML program in July 2023 and purporting to block U.S. residents, KuCoin is accused of knowingly continuing to serve them. As an example, the indictment alleges that visitors to www.kucoin.com from U.S. IP addresses were greeted with a pop-up message stating services were not available in their region due to local laws and regulations. Yet, the indictment contends this measure was superficial at best; without any additional meaningful measures, it did not prevent those customers from accessing their accounts, suggesting a cosmetic compliance rather than a substantive one.

Prosecutors are seeking forfeiture of all properties associated with the alleged offenses, highlighting the severe consequences of non-compliance with U.S. anti-money laundering requirements. This enforcement action could have a significant impact on the operational assets of KuCoin, given the scale of the alleged legal infractions. In the days after the indictment, customers withdrew nearly $2 billion worth of assets held by KuCoin.

The indictment acts as a potent reminder to the international cryptocurrency community of the U.S. government's capability and willingness to enforce its financial laws against anyone engaging with U.S. residents, irrespective of where they are formed or from where they are operating.

It also offers an object lesson on the importance of aligning operational practices with U.S. legal standards for foreign-based financial institutions if they have a substantial U.S. nexus.  While the government thus far has focused on the largest exchanges, history suggests that prosecutors and regulators will eventually turn to smaller institutions operating in a similar fashion to KuCoin that remain undeterred by prior enforcement.

Key Lessons From the KuCoin Case

Any person engaging in money transmission services in substantial part in the United States, including by operating in the United States or knowingly servicing large numbers of U.S. customers, is required to register with FinCEN.

This includes most cryptocurrency exchanges, cryptocurrency custodians, and many cryptocurrency issuers. Crypto exchanges doing business with U.S. residents should also carefully review licensing requirements under state money transmitter laws and the virtual currency licensing laws of New York, Louisiana, and California.

Anti-money laundering and ‘Know Your Customer’ programs are essential components of BSA compliance.

Financial entities must have policies, procedures, and internal controls to prevent money laundering and terrorist financing. They also must conduct ongoing customer due diligence. FinCEN’s view is that difficulty in conducting KYC caused by the technical design of blockchain transfers is not a mitigating factor in assessing noncompliance.

Regulatory bodies and law enforcement agencies are scrutinizing cryptocurrency exchanges for compliance with AML laws.

Non-compliant entities may face legal action, including civil penalties and criminal indictments for willful failure to comply with the BSA.

Accurate disclosures matter.

Misrepresenting to investors or regulators the geographic distribution of customers or compliance with AML laws can compound legal troubles for businesses.

The reach of U.S. AML laws extends beyond its borders.

International companies offering money transmission services to U.S. residents, even without a physical presence in the U.S., are subject to U.S. AML regulations. KuCoin’s global operations did not exempt it from compliance with U.S. laws.

Senior management is responsible for ensuring that their company complies with AML regulations.

The indictment charges KuCoin’s top executives, demonstrating that senior company leaders cannot ignore their company’s obligations without risking criminal liability.