Huione Group: Conversion Services and Indirect Correspondent Access

The Financial Crimes Enforcement Network’s Huione money laundering rule uses Section 311 of the USA PATRIOT Act to bar covered U.S. financial institutions from opening or maintaining correspondent accounts for Huione Group and require safeguards against indirect access through foreign banks. The rule took effect on November 17, 2025. The agency traced money from scam victims and crypto thefts into the Cambodia-based group’s conversion services. For a payment, exchange or banking insider, the revealing connection is between the crypto received, the cash sent out and the people who approved the business.

Huione’s Crypto Conversion Business

The agency assessed that Huione Group combined a marketplace, payment services and a crypto exchange in one business despite its different brands. It identified the Phnom Penh, Cambodia-based group as controlling Haowang Guarantee, formerly Huione Guarantee, alongside Huione Pay PLC and Huione Crypto.

The final rule describes how the services fit together. According to the agency’s assessment, Haowang Guarantee connected buyers and sellers of goods and services, including money laundering services. Huione Pay offered trading across blockchains and conversion between virtual currencies and ordinary money. Its Huione International Payments business also acted as a merchant on the marketplace. Huione Crypto operated the exchange infrastructure used by other group businesses and issued the USDH stablecoin.

The agency found shared crypto infrastructure beneath those separate names. That sharing made it difficult to identify which component handled a particular transaction. A company name on a screen could describe only one part of a coordinated service.

The final rule also identified U.S. money services business registrations for Huione Crypto, Huione Pay Inc. and Huione LTD. Huione Pay Inc. listed a Denver, Colorado virtual mail-forwarding address, and Huione LTD appeared to use the same service. Huione Crypto also held a Polish corporate registration, though the agency assessed that it operated from Cambodia.

The agency assessed that illicit actors sent convertible virtual currency into the group, where it was converted into fiat currency or another virtual currency, or withdrawn later to another virtual-asset service provider. The conversion was the useful service: proceeds from a scam or theft could leave in another form or through another business.

What FinCEN Found in the Money Flows

The agency assessed that Huione Group received at least $4 billion in illicit proceeds between August 2021 and January 2025. Within the flows it examined, the final rule identified at least $37.6 million in virtual currency received from North Korean cyber actors and traced to North Korean cyber heists. The agency drew on blockchain analysis as well as public and nonpublic information. The May 2024 theft from Japanese crypto service DMM was already widely reported when Huione received stolen crypto from it that July.

The scam business supplied another stream. The agency identified at least $36 million in virtual-currency investment-scam proceeds received since at least August 2021, within its broader assessment of approximately $300 million connected to cyber scams.

The rule calls these investment scams pig-butchering and describes how they worked: a scammer built trust, directed the victim to a fraudulent investment website or application, and pressed for additional payments. When a victim tried to withdraw, the scammer could demand supposed taxes or withdrawal fees. The money arriving for conversion came from people who had been persuaded to keep paying into a fiction.

What Senior Huione Pay Leaders Knew

The agency assessed that senior Huione Pay leadership knew a counterparty was affiliated with North Korea while company officials helped that person transfer crypto and fiat currency. The agency described repeated dealings between 2022 and 2024 with a North Korean national closely tied to the country’s foreign intelligence organization.

The agency described personal relationships with several Huione Pay officials and regular meetings with at least one. In mid-2023, the counterparty sought their help with a plan to remit U.S. dollars to Hong Kong. In late 2023, the counterparty worked with company officials to convert virtual currency into fiat and send it to an associate.

The rule also recounts Huione’s acknowledgment in July 2024 that its customer-identification capabilities were seriously insufficient. Huione Crypto’s published terms barred users from North Korea and prohibited using its services to disguise illicit proceeds. The agency assessed that the laundering activity on the platform showed its controls were ineffective or unenforced.

The terms banned North Korean users while, according to the agency, senior leaders knew of the North Korean affiliation and officials helped convert the counterparty’s crypto. For an insider, the decisions behind that gap are as important as the transaction trail.

A Stablecoin Marketed Against Freezing

The final rule reported that a stablecoin issuer froze over $29 million in a Huione wallet in July 2024 because of alleged links to fraud and transnational crime. In September 2024, Huione launched USDH and advertised it as a stablecoin that could not be frozen.

Huione was selling resistance to that intervention as a product feature. The agency assessed that marketing the service as beyond regulators’ reach was likely intended to attract illicit actors and obstruct anti-money laundering compliance.

What Is Correspondent Banking in AML?

Correspondent banking lets one financial institution receive deposits, make payments or process transactions for another. In a nested arrangement, a foreign bank gives downstream institutions access through its own correspondent relationship. The U.S. bank sees its direct banking customer while the underlying transactions can belong to that customer’s customers.

The agency said Huione had no direct dollar correspondent relationships with U.S. financial institutions. Instead, it reached dollars through nested relationships outside the United States. Removing an account with Huione’s name on it would therefore miss the route the agency said Huione actually used.

The rule reaches transactions involving Huione even when the direct account holder has a different name.

Danske Bank’s criminal case shows why the representations made to a correspondent matter. In its guilty plea, the bank admitted misrepresenting its Estonian branch’s customers and anti-money laundering controls to preserve access to U.S. banks. The parallel is the value of access and the information used to keep it. What a foreign institution tells its correspondent can differ from what people inside the business know.

What the Final Rule Requires

The final rule’s fifth special measure cuts off Huione’s U.S. correspondent access. Its requirements prohibit covered U.S. financial institutions from opening or maintaining a correspondent account for Huione and require reasonable steps to prevent a foreign bank’s U.S. correspondent account from processing transactions involving the group.

The duties reach beyond screening the direct customer’s name. Institutions must notify foreign correspondent account holders they know or have reason to believe serve Huione that the account cannot provide Huione access. They must take reasonable steps to identify Huione’s use from transaction records maintained in their ordinary business and use a risk-based approach to additional checks.

Where an institution knows or has reason to believe a foreign correspondent account has processed Huione transactions, it must investigate and prevent that access, including terminating the account where necessary. It must also document compliance with the notification requirement. These are concrete decisions and records inside a bank: what it recognized, whom it notified and what it did about continued access.

Why More Information Was Not Enough

The agency concluded that more reporting would leave Huione’s banking route open while shell companies and layers of payment services concealed who was using it.

A 2024 Wharton Initiative on Financial Policy and Regulation white paper, Anti-Money Laundering: Opportunities for Improvement, argues that enforcement can achieve more by concentrating on the gaps that evasion depends on:

The paper also explains how weak controls in one jurisdiction can undermine stronger controls elsewhere. Huione illustrates that problem. The agency’s response aimed at the U.S. banking connection through which the foreign network could reach dollars.

The Marketplace’s Backend and the H-Pay Proposal

The Justice Department’s June 23, 2026 cloud-account seizure announcement described the technical services behind the marketplace. In that announcement, prosecutors alleged that Huione subsidiaries helped move cryptocurrency investment-fraud and cyber-scam proceeds on blockchains and convert them into the banking sector undetected.

The department said the account hosted backend infrastructure for the subsidiaries and helped operate Huione Guarantee, also known as Haowang Guarantee. Its account of the court documents described Telegram channels offering illicit goods and services, along with escrow for transactions that included cryptocurrency laundering. The alleged service supported the transaction between customers as well as the movement of the proceeds afterward.

The same release reported that FinCEN had proposed adding H-Pay Service PLC to the rule’s definition of Huione Group. The agency assessed H-Pay to be part of the group and of primary money laundering concern.

What an Insider Can Connect

The useful account connects the customer, the conversion and the banking access to the people who knew what was happening. A blockchain trail can show movements between wallets. An exchange’s internal ledger, customer records and conversion instructions can explain whose money moved and what happened inside the service.

Those pieces sit in different places. Hosted exchanges can record transfers internally while public chains show only some movements. A bank may hold the correspondent questionnaire and payment messages, while a payment service holds the customer identity and conversion details. Warnings, escalation records and decisions about account access can connect the transaction history to management’s knowledge.

Our work with an insider is to bring those pieces together around the conduct: who the customer really was, what the business understood, and why the transfers continued. That is where firsthand knowledge can add to a public account of wallet activity.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. Bring us what you know about the money laundering, and our experts will assess the whistleblower program for your information.

You Saw Who Kept the Money Moving

If you know who approved the conversions or kept the banking route open, speak with our whistleblower experts about what you saw. We build the case with you and bring in money laundering whistleblower lawyers who understand cross-border payments and crypto conversion. We stay beside you as the account you can give becomes a case grounded in the transactions and decisions behind them.