Why is AML enforcement accelerating — and why is crypto next?

AML enforcement against financial institutions is not new. What is new is the speed at which regulators are extending that enforcement logic to crypto-asset service providers. The strongest evidence is not aggregate market commentary; it is the official enforcement record: FinCEN's Paxful penalty, DOJ's Samourai Wallet sentences, DOJ's 2026 Cartier sentence, and CySEC's 2024 supervisory activity.

The pattern is clear: regulators have spent years building frameworks (AMLD5, AMLD6, MiCA, EBA guidelines), and now they are enforcing them. For crypto companies, the question is no longer "will there be enforcement?" but "when will it reach us?"

The answer, for EU-licensed CASPs, is: the inspection infrastructure is already in place. CySEC's official March 2025 activity update says its Supervision and AML/CFT Departments carried out more than 850 on-site and remote thematic audits in 2024, imposed approximately EUR 2.76 million in administrative fines across regulated entities, requested corrective measures in 321 cases, and instructed more than 70 supervised entities to implement specific AML/CFT measures.

What changed in 2025-2026

The Tornado Cash sanctions status changed: Treasury/OFAC removed the economic sanctions on March 21, 2025. But the criminal cases did not disappear. Roman Storm was convicted on August 6, 2025, and DOJ brought additional crypto AML cases through late 2025 and 2026.

The cases below are not hypothetical scenarios. Each one represents real regulatory action, real fines, and real consequences for the people involved. They span different jurisdictions and different failure modes, but the lessons for small CASPs are consistent.

What went wrong in key enforcement cases — and what did it cost?

1. Binance -- EUR 3.3 million fine (Netherlands, 2022)

In July 2022, De Nederlandsche Bank (DNB) fined Binance EUR 3.3 million for offering crypto services in the Netherlands without registration. The breach spanned from May 2020 to at least December 2021 -- over 18 months of operating without authorization.

DNB applied its most severe penalty category (Category 3) and set the fine near the upper limit of the EUR 2-4 million range. The reasons: Binance had a "very large number of customers in the Netherlands," daily trading volumes of $13.7 billion, and gained a competitive advantage by avoiding supervision costs and levies that registered firms paid. DNB reduced the fine by 5% because Binance eventually cooperated and was transparent about its operations.

Lesson for CASPs

Registration is not optional. Even if your primary operations are elsewhere, serving customers in an EU member state triggers local registration requirements. "We didn't know we needed to register" is not a defense -- DNB explicitly warned Binance in August 2021 before issuing the fine.

This was only the beginning for Binance. In November 2023, the U.S. Department of Justice announced a $4.3 billion resolution after Binance pleaded guilty to BSA, money-transmission, and sanctions violations. Founder Changpeng "CZ" Zhao pleaded guilty to violating the Bank Secrecy Act, paid a personal $50 million fine, stepped down as CEO, and was sentenced to four months in prison. FinCEN separately assessed a $3.4 billion civil money penalty and later told Congress that Binance failed to file well over 100,000 SARs while instructing staff to never file SARs.

2. BitMEX -- $100 million settlement (US, 2021)

On August 10, 2021, the CFTC and FinCEN jointly imposed a $100 million civil monetary penalty on BitMEX for violations of the Commodity Exchange Act and the Bank Secrecy Act. This was FinCEN's first enforcement action against a futures commission merchant in the crypto space.

The failures were systematic. FinCEN found that BitMEX:

The penalty structure was notable: $80 million was due immediately, with $20 million suspended pending completion of a SAR lookback review and independent consultant review of BitMEX's AML controls.

The corporate criminal case continued after the civil settlement. BitMEX pleaded guilty in July 2024 to violating the BSA by willfully failing to establish, implement, and maintain an adequate AML program, and DOJ announced in January 2025 that the company was sentenced to a $100 million fine and two years of probation.

Personal liability

CEO Arthur Hayes pleaded guilty to BSA violations in February 2022. He was sentenced to six months of home detention, two years of probation, and a $10 million personal fine. The three BitMEX co-founders collectively paid $30 million in personal penalties via a separate CFTC order. Compliance failures are not abstract corporate risks -- they follow individuals.

3. Tornado Cash -- OFAC delisting + criminal convictions (US/Netherlands, 2022-2025)

On August 8, 2022, OFAC sanctioned Tornado Cash and added 45 Ethereum addresses to the SDN list, alleging the protocol facilitated the laundering of over $7 billion in cryptocurrency. Treasury and OFAC later changed that sanctions status: on March 21, 2025, Treasury said it had removed the economic sanctions against Tornado Cash, and OFAC's same-day recent action deleted Tornado Cash entries from the SDN list.

In May 2024, a Dutch court at 's-Hertogenbosch convicted Pertsev of money laundering and sentenced him to 64 months in prison (five years and four months). The court found he had "made a habit of committing money laundering" between July 2019 and August 2022. In addition to imprisonment, Pertsev was ordered to forfeit EUR 1.9 million in cryptocurrency and a Porsche that had been seized.

Separately in the US, co-founders Roman Storm and Roman Semenov were indicted in August 2023. On August 6, 2025, DOJ announced that Storm had been convicted after trial of willfully conspiring to operate an unlicensed money transmitting business that moved more than $1 billion in criminal proceeds. The key compliance point: the OFAC delisting changed the sanctions status of Tornado Cash, but it did not erase the money-transmission and money-laundering prosecutions.

Do not treat deleted Tornado Cash protocol/entity addresses as current OFAC SDN hits after March 21, 2025. Continue screening current SDN entries, including Roman Semenov, whose OFAC entry was changed the same day.

Lesson for CASPs

The Tornado Cash cases show that facilitating transactions without AML controls can result in criminal charges, not just fines. For CASPs: if your platform processes transactions without adequate screening, you face regulatory risk. If operators continue after learning that criminals are using the service, the risk can become criminal. Sanctions screening is not just a box to check -- it is part of the evidence that management took controls seriously.

4. N26 -- EUR 13.45 million in fines + operational restrictions (Germany, 2021-2024)

German neobank N26 provides one of the clearest case studies of how AML failures compound over time when not addressed. While N26 is a bank (not a CASP), the pattern is directly relevant because regulators apply the same AML framework across all financial institutions, including CASPs under MiCA.

The enforcement timeline tells the story:

Over three years, N26 accumulated at least EUR 13.45 million in fines, had its growth capped (directly impacting revenue), and received a special supervisor. The initial problem -- late SAR filings -- was not complex. It was a process failure that went unfixed.

The compounding cost

N26's customer cap at 50,000/month limited growth for over two years. For a company valued at $9 billion at its peak, the revenue impact of restricted customer acquisition dwarfed the fines themselves. For a small CASP, an equivalent growth restriction could be existential.

5. CySEC -- building the precedent (Cyprus, 2024-2026)

As of July 10, 2026, CySEC has not publicly disclosed fines specifically against CASPs for sanctions screening failures. But the supervisory direction is clear. CySEC's official March 2025 activity update reported more than 850 on-site and remote thematic audits in 2024, EUR 2.76 million in administrative fines across regulated entities, 321 corrective-measure requests, and more than 70 AML/CFT-specific remedial instructions.

CySEC's focus on crypto AML compliance has been signaled through five circulars in recent quarters: C679, C685, C686, C687, and C695 -- spanning guidance, consultations, and workshops specifically targeting CASP obligations. Circular C685 sets explicit expectations for sanctions screening against UN, EU, US, and UK lists.

Cyprus's updated sanctions framework entered into force on August 1, 2025, requiring supervised entities to demonstrate that their sanctions controls are "fit for purpose." The inspection infrastructure is in place. The rules are published. CASP-specific enforcement actions are a matter of timing, not intention.

6. OKX, Paxful, Samourai Wallet, Cartier -- newer US crypto AML cases (2025-2026)

Three recent official actions are useful comparators for EU CASPs because they focus on ordinary controls: registration, AML programs, transaction monitoring, and SARs.

The common thread is not exotic blockchain analytics. It is failure to register where required, failure to maintain effective AML controls, and failure to report suspicious activity.

What do regulators look for during an AML inspection?

Based on CySEC Circular C685 and EBA Guidelines GL/2024/15, here is what an inspector will ask about your sanctions screening setup. Every one of these items should have documented evidence.

Inspection area What they ask What they want to see
Sanctions list coverage Which lists do you screen against? Applicable Union and national restrictive measures; document any UN, OFAC, or OFSI coverage used for local-law, banking, group-policy, or risk reasons
Audit trail Show me the screening record for transaction X Timestamped log with address, list version, result, action taken
Match handling What happens when you get a positive match? Documented escalation procedure, freeze protocol, SAR filing process
Re-screening How do you handle list updates? Automated re-screening triggered by list changes, with evidence of each cycle
Staff training When was your compliance team last trained? Training records with dates, content covered, attestation signatures
Transaction monitoring What rules trigger alerts? Documented rule set with thresholds, alert volumes, false positive rates
Risk assessment How do you assess circumvention risk? Written methodology, customer risk scoring, geographic risk factors

The common thread across every enforcement case above: regulators did not find sophisticated evasion schemes. They found missing basics -- no SAR filings, no registration, no AML program, late reports. The bar is not perfection. The bar is having documented processes and following them consistently.

What is the penalty framework under MiCA?

MiCA (Regulation 2023/1114) introduces a graduated penalty structure in Articles 111-116 that national competent authorities must implement. The key point: MiCA sets minimum levels for the maximum fines national authorities must be able to impose. It does not make EUR 5 million an automatic minimum fine for every serious case.

For legal entities (the CASP)

For natural persons (directors, compliance officers)

Member states may set higher maximums in their national transposition. MiCA Article 111 also allows management-function bans for responsible natural persons in relevant CASP infringements -- meaning directors cannot treat enforcement as only a corporate balance-sheet issue.

Penalty math for a small CASP

A CASP with EUR 2 million annual revenue can face a regulator empowered to impose fines far beyond its annual income, even though the exact amount depends on the infringement, national law, facts, and proportionality. For larger CASPs, the percentage-based calculation can be just as material. Either way, a single serious enforcement action can threaten the company's existence.

Beyond MiCA, national authorities retain their existing powers. CySEC can impose fines under the Prevention and Suppression of Money Laundering Activities Law. BaFin operates under GwG (Geldwaeschegesetz). The AMF in France has its own penalty schedule. A CASP operating across multiple EU jurisdictions could theoretically face enforcement from multiple NCAs simultaneously.

How do you prepare — what compliance checklist protects you?

Every enforcement case above could have been mitigated -- or avoided entirely -- with documented compliance processes. The investment required is not enormous. What regulators want to see is evidence of effort, not perfection. Here is what to prioritize:

1. Document everything

Write down your AML policy. Write down your sanctions screening procedures. Write down your escalation process. If it is not documented, it does not exist in the eyes of a regulator. BitMEX had no written AML program. That alone was a violation, regardless of whether laundering actually occurred.

2. Automate screening with multi-list coverage

Configure screening around the restrictive measures that apply to your firm, starting with applicable Union and national measures. Add UN, OFAC, UK OFSI, or other lists where local law, banking partners, group policy, or your risk assessment requires them. Automate re-screening when lists update; a purely periodic manual batch is harder to evidence.

3. Build and retain your audit trail

Every screening event needs: timestamp, address or name screened, list version at time of screening, result, and action taken. Retain records for the period required by your NCA (typically 5 years under AMLD). N26's problems started with late SAR filings -- a process and record-keeping failure.

4. Test your match handling

Run a tabletop exercise. What happens when your screening tool returns a positive match at 2 AM on a Saturday? Who gets notified? What transactions are frozen? How quickly can you file a SAR? If you do not know the answers, your team will not either.

5. Train your team and document the training

Schedule regular AML and sanctions training. Keep records: date, attendees, material covered, any assessments completed. Training records are one of the first things an inspector reviews. They are cheap to create and expensive to lack.

6. Conduct internal audits before the regulator does

Run your own inspection. Use the table above ("What regulators look for") as your checklist. Find your own gaps before CySEC, BaFin, or the AMF does. Document the audit and the remediation. Self-identified and corrected issues are viewed far more favorably than issues found during inspection.

The cost comparison

A sanctions screening setup still requires budget for tooling, staff time, evidence retention, and periodic testing. MiCA and national AML laws can expose the same firm to fines, restrictions, public findings, and management consequences if those controls are missing or ineffective.

Is your screening ready for inspection?

Take our 2-minute compliance self-check. Ten questions based on EBA GL/2024/15 and CySEC C685 -- see where you stand before your next regulatory review.

Read the regulatory guides →

Frequently asked questions

What is the maximum fine for a CASP under MiCA?

MiCA (Regulation 2023/1114) requires Member States to give national competent authorities powers to impose maximum administrative fines of at least EUR 5,000,000 or a turnover-based percentage for many legal-entity infringements, depending on the article breached. This is a maximum-fine framework, not an automatic minimum fine. For natural persons (e.g., directors), maximums can reach at least EUR 700,000 for many infringements and higher for market-abuse breaches. These penalties are in addition to non-monetary sanctions like license revocation and public censure.

Can directors be held personally liable for AML failures at a crypto company?

Yes. MiCA Article 111 includes penalties and management-function bans for natural persons responsible for infringements, and national AML/criminal law can add further exposure. The BitMEX case demonstrates this in practice: CEO Arthur Hayes pleaded guilty to BSA violations and was sentenced to six months of home detention plus a $10 million personal fine. The three BitMEX co-founders collectively paid $30 million in personal penalties via CFTC proceedings.

Has CySEC fined any CASPs specifically for sanctions screening failures?

As of July 10, 2026, CySEC has not publicly disclosed fines specifically against CASPs for sanctions screening failures. However, CySEC's March 2025 activity update reported more than 850 on-site and remote thematic audits in 2024 and approximately EUR 2.76 million in total administrative fines across regulated entities. Circular C685 also sets clear expectations for sanctions screening systems. The absence of public CASP-specific cases does not mean the risk is low.

What sanctions lists must an EU-licensed CASP screen against?

EBA Guidelines GL/2024/15 require CASPs to have systems for compliance with applicable Union and national restrictive measures. The EU consolidated financial sanctions list is the practical source for EU financial-sanctions screening. UN, OFAC, OFSI, or other third-country lists may also be required by local law, group policy, correspondent-banking requirements, or risk appetite, but they are not a universal MiCA requirement.

How often should a CASP re-screen existing customers and wallets against updated sanctions lists?

EBA Guidelines GL/2024/15 require CASPs to screen existing customers when designations or restrictive measures change and to keep evidence of screening decisions. The EU consolidated list and third-country lists can change without a fixed cadence, so automated list-update triggers are easier to evidence than a purely periodic manual batch.

Sources

Related articles

Operations CySEC CASP Compliance Checklist: Sanctions Screening in 2026 Read → Regulations EBA Guidelines on Restrictive Measures: What Every Small CASP Must Do Read →