Paxful: The Customers Came Before the Controls

Paxful faced a $3.5 million civil penalty from the Financial Crimes Enforcement Network for anti-money laundering failures at its cryptocurrency marketplace. The agency identified more than $500 million in suspicious activity. Employees raised concerns, management pursued high-risk business, and suspicious activity went unreported. For someone inside a crypto platform, the story is in those decisions.

The Justice Department announced the co-founder’s guilty plea on July 8, 2024. FinCEN’s December 9, 2025 consent order addressed Paxful, Inc. and Paxful USA, Inc. The companies admitted the facts and violations in that order, which describes conduct from February 2015 through April 2023.

What Paxful Sold and Controlled

Paxful connected buyers and sellers of convertible virtual currency and operated a hosted wallet service. Customers could exchange value through more than 400 payment methods, including prepaid cards, bank transfers and cash-by-mail. FinCEN described more than 50 million successful trades during the period covered by its order.

A hosted wallet provider holds and transmits customer value, and transfers between customers can occur on an internal ledger without appearing individually on a public blockchain. FinCEN’s guidance on virtual-currency business models describes the functions behind those businesses. The platform’s account records can connect a wallet movement to the customer credited for it. Its screening and escalation records can show what staff knew.

The Wharton Initiative on Financial Policy and Regulation’s 2024 paper, Anti-Money Laundering: Opportunities for Improvement, observes that the Financial Crimes Enforcement Network clarified the application of existing anti-money laundering obligations to convertible virtual currencies in 2013, yet compliance appeared to remain low for years afterward. Paxful’s own history makes that gap concrete: it registered with the agency, then let the registration lapse while continuing to transmit money.

What Are Violations of the Bank Secrecy Act?

Bank Secrecy Act violations include operating an unregistered money transmitter, failing to run an effective anti-money laundering program and failing to report suspicious transactions accurately and on time. The Financial Crimes Enforcement Network found all three at Paxful.

Paxful implemented no written anti-money laundering program until July 2019. Its chief executive held the compliance-officer title without the relevant training or experience.

Customer identification failed before and after Paxful introduced controls. Before February 2019, it had no know-your-customer process. The mandatory requirements announced that month applied only when user activity exceeded $1,500, with no controls to identify customers splitting transactions to evade them. Employees then promoted the lax policy to attract users from exchanges with stronger checks.

The written program also called for collecting customers’ money services business registrations. Paxful did not put that requirement into practice or establish controls to identify smaller unregistered exchangers using its platform.

Other gaps followed the money across products. Written transaction-monitoring procedures arrived in July 2019, and blockchain tools acquired the following year still omitted currencies including Ethereum, Tether and Tron.

Prepaid-card monitoring remained inadequate even though iTunes and Amazon cards accounted for more than $1.7 billion in value transmitted from May 2015 through December 2019. Cards were a major part of the business that the controls failed to cover.

FinCEN’s order quotes a member of management explaining a referral to the platform:

Geography was another missing check. Paxful lacked effective controls against customers disguising their locations through VPNs. Its own assessment identified more than 1,500 accounts opened with IP addresses in Iran, Syria, Cuba, Crimea or Sudan. The platform had location information that its controls failed to use effectively.

Backpage Was a Business Opportunity

According to the facts Paxful admitted in the consent order, the company actively solicited Backpage business after credit card operators dropped the site. It advertised how Backpage customers could create Paxful accounts and enabled vendors to receive virtual currency and prepaid cards. Backpage carried advertisements depicting children who were victims of sex trafficking.

Inside Paxful, employees questioned the relationship as early as 2017. One employee explicitly raised the trafficking of children in an internal message.

Paxful processed more than $24 million in transactions involving Backpage. Even without requiring customer identification, it held usernames, email addresses, wallet addresses and payment details that should have raised red flags. It filed no suspicious activity report on that business, even after the government seized Backpage in 2018.

The employee’s warning and the company’s payment records were already inside the business. The business kept the customers.

Ransomware, Sanctions and the Reports Nobody Filed

Paxful’s leadership instructed employees not to file suspicious activity reports, according to the consent order. The company filed its first report only in November 2019, and reporting failures continued afterward.

An account used by a member of the North Korean Lazarus Group converted virtual currency to iTunes cards while moving money across jurisdictions. Paxful received law-enforcement inquiries but took no action until after the customer’s Bitcoin address appeared on the Treasury sanctions list.

The reporting failures also reached child-exploitation marketplaces, darknet markets, mixing services and wallets holding cybercrime proceeds. The order connects those failures to missing customer information, transaction monitoring and reporting.

The Wharton paper helps explain what those missing reports cost investigators. Reviewing a Government Accountability Office survey, it reports that most respondents at each agency surveyed used Bank Secrecy Act data to start or assist new investigations. The Financial Crimes Enforcement Network found that Paxful’s failures deprived investigators of crucial reporting and allowed bad actors to avoid detection.

The Co-Founder’s AML Plea

Paxful’s co-founder and former chief technology officer pleaded guilty to conspiring to run the platform without a working anti-money laundering program. In its announcement of the criminal plea, the Justice Department described his conduct from July 2015 through June 2019. He allowed customers to trade without sufficient identifying information and marketed the platform as requiring no customer checks. He presented third parties with fake anti-money laundering policies he knew were not enforced and failed to file suspicious activity reports despite knowing about suspicious and criminal use.

That is a policy written for the people outside the business while the people inside it operated another way.

What Proof Do You Need as a Whistleblower?

For a platform-control case like Paxful, useful evidence connects the transactions to the customer information, warnings and management decisions inside the company. An account history can identify the user behind a wallet. A product-coverage record can show which currencies a monitoring tool missed. An employee’s warning can show that leadership knew about activity the company kept processing.

The same business pressure appeared at Binance. In its criminal guilty plea, Binance admitted retaining U.S. business while publicly claiming to exclude it and coaching valuable users toward offshore entities. Paxful’s admitted facts describe employees attracting customers with weaker identification checks. Both cases show why the instructions given inside an exchange matter alongside its published policy.

Your role may give you a view of onboarding exceptions, payment methods, geographic checks or escalation decisions. We work with you to connect that knowledge to the transactions and the people responsible for the controls.

Does FinCEN Have a Whistleblower Program?

Yes. The Financial Crimes Enforcement Network’s whistleblower program offers awards for information about Bank Secrecy Act and certain sanctions violations that leads to covered enforcement actions with monetary sanctions exceeding $1 million. Our whistleblower experts assess how the information you hold fits that program.

The False Claims Act provides a separate whistleblower route. A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers.

You Saw Which Controls Were Missing

If you saw an exchange recruit customers it would not check or ignore transactions its employees questioned, talk with our whistleblower experts about what happened inside the platform. We build the case with you, bring in crypto money laundering whistleblower lawyers who understand exchange controls, and stay alongside you through the pursuit of an award.