BitMEX: FinCEN Alleged Email-Only Accounts and a U.S. Ban Staff Helped Bypass

BitMEX’s AML case brought a $100 million civil assessment for missing anti-money laundering controls, followed by a pardon in its separate corporate criminal case. The Financial Crimes Enforcement Network alleged that the exchange accepted customers with only an email address, helped U.S. customers get around its own exclusion policy and left suspicious transactions unreported. For someone inside an exchange, the telling evidence is in the account settings, support conversations and decisions about which customers to keep.

BitMEX AML Case Pardon

The corporate pardon, signed March 27, 2025, names HDR Global Trading Limited, the company that owned and operated BitMEX. It grants a full and unconditional pardon for the offenses in that criminal case. The earlier civil assessments required payments and changes to the exchange’s controls.

What BitMEX Sold and Why U.S. Customers Mattered

BitMEX offered leveraged cryptocurrency derivatives, including futures, options and swaps. The exchange settled all derivatives in bitcoin and accepted deposits and withdrawals exclusively in bitcoin. The assessment described more than 1.3 million accounts. The customer-identification failure sat inside a substantial trading business.

The Seychelles incorporation told only part of the operating story. The Financial Crimes Enforcement Network described an exchange with employees and offices in the United States, including San Francisco and New York, that solicited and accepted orders from U.S. customers. Those customers supplied bitcoin or other property to back their trades. The business sold access to leveraged markets and accepted the assets supporting that access.

That combination mattered to the Bank Secrecy Act case. The agency treated BitMEX as a futures commission merchant, a business accepting customer orders and assets to support futures trading, and alleged that it failed to register with the Commodity Futures Trading Commission. The assessment described an obligation to maintain a written anti-money laundering program, identify customers and report suspicious activity.

The exchange’s own commercial relationships brought those obligations to its attention. According to the assessment, BitMEX sought relationships with U.S. exchanges to support trading liquidity. Those exchanges asked about customer identification and sanctions screening before agreeing to do business. The same questions BitMEX left out of its customer onboarding turned up when BitMEX tried to become somebody else’s customer.

FinCEN Alleged Email-Only Accounts Were a Business Decision

The Financial Crimes Enforcement Network alleged that BitMEX deliberately chose email-only accounts and declined to collect, maintain or update the customer information needed for due diligence. Its assessment quotes a senior leadership communication from 2014 discussing identity checks only if the company came under significant government pressure. The stated policy would remain a valid email address.

The assessment quotes the chief executive’s response to another exchange’s onboarding form requesting compliance information:

According to the assessment, in another onboarding exchange the chief executive said BitMEX performed no sanctions screening and required only a verified email address for non-U.S. customers. The prospective business partner declined to open an account and offered to reconsider if BitMEX changed its identification and screening processes. The agency alleged that BitMEX continued operating without adequate controls until at least late 2020.

The missing account information was part of a wider failure. The assessment also alleged that the company lacked an adequate written anti-money laundering program, employee training and independent testing. It described a senior manager asking in an internal chat when a compliance person would take over onboarding. The assessment says the company did not hire someone specifically responsible for anti-money laundering compliance until October 2020.

Those decisions belong together. A platform that declines to establish who its customers are leaves its monitoring staff without the customer history and risk information that the assessment described as necessary to assess their transactions. We work with an insider to establish who approved the account policy, who could change it and what happened when the missing controls were raised internally.

FinCEN Alleged Staff Helped Customers Bypass the U.S. Ban

The Financial Crimes Enforcement Network alleged that BitMEX represented that it excluded U.S. customers while employees helped them remain on the platform. Its assessment describes a support ticket telling a U.S. customer that trading was unavailable, then offering the option of setting up a non-U.S. company and opening a corporate account. The customer said they would do so.

The assessment describes internal revenue data contradicting the exclusion policy. It quotes a discussion in which a co-founder questioned why U.S. traders appeared in the company’s reports. An employee replied:

According to the assessment, the co-founder asked for the data to be removed. The proposed response to U.S. customers was to erase them from the report.

In another exchange described in the assessment, a co-founder changed a favored customer’s location to Canada even though the customer’s IP address placed them in New York. The customer-support employee then asked for the IP information to be changed too. The proposed fix was to the information showing the customer’s location.

The agency also alleged that BitMEX lacked adequate controls over virtual private networks that could defeat IP monitoring. The assessment records an employee raising VPN detection with the co-founders while internal account information was already revealing location problems. It also alleged that BitMEX provided a Tor webpage for transactions without additional controls to address the concealed user locations.

The criminal case added a banking connection. The Justice Department’s account of the criminal information and court filings alleged that BitMEX lied to a bank about a subsidiary’s purpose and nature so it could move millions of dollars through the U.S. financial system. The company’s July 10, 2024 guilty plea concerned its willful failure to maintain an adequate anti-money laundering program.

What the Missing Monitoring Let Through

The Financial Crimes Enforcement Network identified at least $15 million across at least 588 transactions for which BitMEX failed to file suspicious activity reports. The assessment says those transactions were suspicious when they occurred or became suspicious as additional information reached the company. That makes the later information about a customer or counterparty part of the monitoring story too.

The assessment identified dealings with darknet marketplaces, Iranian cryptocurrency exchanges, unregistered mixing services and counterparties publicly associated with alleged fraud. Its fraud examples included pyramid schemes and elder financial exploitation. These were specific destinations and counterparties that a functioning monitoring program could examine.

The assessment explained that address-clustering tools could connect cryptocurrency wallets, while public transaction records and internal customer information could help identify suspicious activity. It alleged that BitMEX failed to establish controls to review bitcoin transactions as they occurred or when new information became available. The chief executive’s stated approach to potential terrorist-financing concerns was to assist if law enforcement alerted the company. The agency said BitMEX had to monitor transactions itself, rather than wait for law enforcement to call.

The 2024 Wharton Initiative on Financial Policy and Regulation paper Anti-Money Laundering: Opportunities for Improvement explains why gaps like these matter beyond an individual platform. Its analysis argues that people moving illicit funds gravitate toward channels with lower detection risk and easier access:

In BitMEX’s case, the assessment connected the missing identification and monitoring controls to transactions with suspicious counterparties, including those linked to schemes targeting older people. The people cheated by those schemes are why the missing checks matter.

The Civil Penalties Required More Than a Payment

The BitMEX civil penalties required $80 million paid at once under the coordinated Financial Crimes Enforcement Network and Commodity Futures Trading Commission settlements. The August 2021 assessment tied suspended portions of the penalty to a review of past suspicious transactions and testing of U.S. customer controls.

The conditions followed the failures. BitMEX agreed to have an independent consultant review past deposits, withdrawals and attempted transactions to identify activity requiring suspicious activity reports. It also agreed to independent testing of user verification and restrictions on U.S. access. That review would examine whether U.S. customers could actually trade or use the platform, and how they were getting through.

The same assessment describes the Commodity Futures Trading Commission order’s requirements for restricting U.S. access and removing U.S. operations, with limited exceptions for specified technical, administrative and compliance functions. These were commitments to test and change how the exchange operated.

What an Exchange Insider Can Explain

An exchange insider may know how the customer information, trading access and transaction records fit together. Hosted exchanges can record transfers on internal ledgers while a public blockchain shows only some movements. The account behind a wallet, the customer’s location and the reason for an exception may sit in different systems or with different teams.

BitMEX makes that division concrete. The assessment described customer-verification reports showing U.S. identification, revenue reports showing U.S. business, support messages offering continued access and changes to customer-location data. Our work with an insider connects those records to the decisions they describe: what the business knew, who could act and which customers continued trading.

The same access problem appeared in Binance’s case. In its guilty plea, Binance admitted retaining U.S. business while publicly claiming to exclude it, including coaching valuable customers to use offshore entities. Email-only onboarding and missing suspicious activity reports also formed part of that account. The recurring issue is the distance between the published customer policy and the access staff preserve in practice.

BitMEX’s case concerned the Bank Secrecy Act, which has its own whistleblower reward program. A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. We work with exchange insiders to identify the program that fits their evidence and pursue a reward.

You Know How the Accounts Stayed Open

If you saw customer locations changed, access exceptions approved or monitoring concerns set aside, speak to one of our Whistleblower Experts about what kept those accounts open. We build your strongest anti-money laundering whistleblower case with you, bring in money laundering whistleblower lawyers who understand exchange controls and stay beside you through the pursuit of a recovery.