Issue #28 | November 3, 2026 | 8 min read
The Brief
In December 2025 FinCEN assessed Paxful $3.5 million for willful Bank Secrecy Act violations, and in February DOJ sentenced Paxful Holdings to a $4 million criminal penalty. The settlement between DOJ and Paxful was $112.5 million.
This issue covers a peer-to-peer crypto marketplace that had a registration, a compliance officer, a written policy and, eventually, a blockchain analytics vendor, and what the order says all of it failed to reach. It also covers why the penalty tells you more about Paxful's balance sheet than its conduct.
Main Feature
Paxful Bought Blockchain Analytics and Still Couldn't See 15 Currencies
FinCEN's order is a list of controls that existed in name. The gap between the control and the business it was supposed to cover is the finding.
Paxful ran a hosted wallet and a peer-to-peer marketplace where users traded bitcoin for more than 400 payment methods, from bank transfers to cash by mail. It registered with FinCEN as a money services business on July 27, 2015, 174 days after launch. Then it let the registration lapse. Paxful was required to renew by the end of 2016 and didn't until September 3, 2019, so it operated as an unregistered money transmitter for 974 days. The order says the former CTO later admitted to letting that happen while the business kept running.
FinCEN civil penalty: $3,500,000 (Dec 9, 2025), $1,750,000 credited for the DOJ payment
DOJ criminal penalty: $4,000,000 (sentenced Feb 2026), agreed appropriate figure was $112,500,000
Cash paid to the government: about $5.75 million ($4M to DOJ + $1.75M to Treasury)
FinCEN conduct period: Feb 3, 2015 to Apr 4, 2023
Suspicious activity not timely reported: more than $500 million
Unregistered MSB: 974 days
The compliance function was thin in a way that's easy to skim past. Through 2018 the designated compliance officer was the CEO, who the order says never received BSA training and was the person overseeing the lapsed registration, the missing KYC, and the absence of any SAR filings. There was no written AML program until 2019. Across the entire period the company commissioned a single independent test. And the first SAR Paxful ever filed went to FinCEN in November 2019. The order also says leadership refused to improve SAR reporting for years, "even instructing employees not to file SARs on suspicious activity."
Staff weren't silent. In 2017 an employee wrote that after looking into Backpage, "I hope someone closes it down[.] [I]t's disgusting trafficing [sic] children." Paxful ultimately processed over 4 million Backpage transactions worth more than $24 million, and didn't file a single SAR on any of it, including after the government seized the site in 2018. The reason isn't mysterious. The order says senior officials, including the CEO, were the ones seeking the Backpage relationship, and Paxful's social accounts walked Backpage vendors through opening accounts. An employee escalation path that ends at the person courting the customer isn't a path. DOJ adds that the founders boasted of a "Backpage Effect" on growth.
Here's the part of the order we'd underline for anyone testing a monitoring program. After KYC arrived on February 15, 2019, it applied only above $1,500 of activity and had nothing to catch users splitting trades to stay under it. Written transaction monitoring procedures didn't exist until July 2019. From May 2015 through December 2019 the top payment methods were iTunes and Amazon prepaid cards, over $1.7 billion in value, and the July 2019 procedures left significant gaps on prepaid access. In March 2020 Paxful bought blockchain analytics tools, which sounds like the fix. The order says the tools left out several of the currencies on the platform, and that for the entire period Paxful had no ability to identify and report suspicious activity in more than 15 of them, including Dogecoin, Ripple, Ethereum, Tron, and Tether. The vendor was on the contract. The coverage wasn't. Nobody appears to have reconciled the list of assets the platform traded against the list of assets the tool could read.
Law enforcement contact fared no better as a trigger. A member of the Lazarus Group, North Korea's state-sponsored hacking unit, did thousands of trades on Paxful between October 2017 and November 2018, converting crypto to iTunes cards and moving across the US, China, and Hong Kong, roughly $1.4 million in total. Law enforcement inquiries arrived in December 2018 and again in October 2019. Paxful acted in May 2020, two months after the trader's bitcoin address was added to OFAC's SDN list. Two Iranian exchangers designated by OFAC kept trading, and the order says Paxful took no action even after designation. FinCEN's reading is blunt: a law enforcement inquiry alone "should have alerted Paxful that additional due diligence" was required.
The rest of the exposure is a typology catalog. The order counts wallet interactions with at least 13 unregistered mixing services, over $35 million in value, including Helix, which FinCEN fined $60 million in 2020. It counts ransomware proceeds from 26 different strains. It counts nearly 100 transactions with a darknet child exploitation site across more than 50 accounts that Paxful maintained for that site's customers. It also counts Black Axe, a romance-scam and laundering ring that moved over $620 million through Paxful across more than three years, about a year of it after DOJ indicted one of the founders.
DOJ and Paxful agreed the right criminal penalty was $112.5 million. DOJ's independent analysis then found Paxful couldn't pay more than $4 million, so $4 million it was. FinCEN set $3.5 million and credited $1.75 million of it against the DOJ payment. The cash comes to about $5.75 million, roughly 5 percent of the agreed figure. For scale, the order's own maximum is $10,556 per day for failing to register after November 2015. Applied to the 974 unregistered days, that one violation alone runs to about $10.3 million, almost three times the FinCEN penalty and more than both payments combined. DOJ puts Paxful's revenue at over $29.7 million from January 2017 to September 2019, the stretch it was unregistered.
A penalty set by ability to pay says something about the business Paxful had become by 2023, and nothing about the conduct. New owners and management took over in April 2023. FinCEN weighed that, along with the thousands of backlog SARs filed since, and credited the removal of the people who ran the company when all of this happened. The founders aren't a footnote either: the co-founder and former CTO pleaded guilty in July 2024 to conspiracy to fail to maintain an effective AML program.
Red Flags in This Case
A money transmitter whose registration has lapsed, with nobody assigned to the renewal date
A CEO serving as compliance officer, with no BSA training on file
KYC that starts only above a dollar threshold and has no structuring or aggregation logic
Prepaid card trades making up more than half of bitcoin volume with no dedicated monitoring
A monitoring vendor whose supported assets haven't been reconciled to the assets the platform actually lists
Law enforcement inquiries and OFAC designations that open no review of the account
Employees raising concerns about a customer to the executive who solicited that customer
The question the order leaves for a program like this is who reconciles coverage. At Paxful the policy, the officer, and the analytics tool each existed, and each was measured against its own existence rather than against the business. The audit finding writes itself: nobody owned the question of what the controls couldn't see.
Source: FinCEN Consent Order, Paxful, Inc. and Paxful USA, Inc., No. 2025-02 | FinCEN, Dec. 9, 2025 | DOJ, Feb. 11, 2026
Controls & Testing
Risk & Control Matrix
Risk | Control |
|---|---|
Assets, payment methods, and products on the platform sit outside what the monitoring tool can read | A coverage matrix mapping every listed asset, chain, and payment method to a monitoring scenario or vendor data source, reconciled whenever a product launches and reviewed by the BSA officer quarterly |
Customer verification has a dollar floor and can be avoided by splitting activity | Risk-tiered KYC with aggregation across linked accounts, wallets, devices, and IP addresses, plus geolocation and VPN-detection controls for restricted jurisdictions |
Law enforcement inquiries and sanctions designations don't trigger a look at the customer | An inquiry and designation log that opens an enhanced review of the account, with a documented lookback and a SAR decision, and rescreening of historical customers and wallets whenever the SDN list adds an address |
Registration, compliance ownership, and escalation depend on one or two executives | A regulatory calendar with a named owner for MSB registration and renewal, a qualified BSA officer outside the revenue chain, annual independent testing, and a rule that any instruction not to file a SAR is escalated to the board or audit committee |
Audit Test Steps
An audit program built around this typology could test for it by:
Pulling the list of assets, chains, and payment methods the platform supports and comparing it against what the monitoring vendor actually covers, then sizing the transaction volume in any asset or method with no coverage.
Taking a sample of customers who stayed just under the KYC trigger and checking for linked accounts, shared devices, shared wallets, and IP or VPN anomalies that would aggregate their activity over the threshold.
Obtaining every law enforcement inquiry and subpoena received in the last three years and confirming each opened an account review, with a documented SAR decision made within 30 days.
Taking the last five OFAC designation updates that included digital currency addresses and testing whether historical customers, wallets, and counterparties were rescreened, and when.
Requesting the MSB registration history, the BSA officer's qualifications and reporting line, the independent test reports for the last three years, and any internal record of a decision not to file a SAR, and tracing each to who made the call.
Intelligence Briefing
FinCEN withdraws its proposed mixing and unhosted wallet rules. On October 5, FinCEN withdrew two digital asset proposals: the special measure that would have designated convertible virtual currency mixing as a class of transactions of primary money laundering concern, and the proposed recordkeeping, verification, and reporting requirements for certain transactions involving CVC and unhosted wallets. FinCEN cited the administration's "deregulatory agenda" and efforts to make digital asset regulation "fit-for-purpose." Paxful's order shows the existing rule set still reaches the conduct: the penalty for interacting with 13 unregistered mixers rests on the plain SAR requirement, not on a mixing-specific rule.
Source: FinCEN, Oct. 5, 2026
FATF's October plenary leaves its blacklist unchanged and removes four jurisdictions from the grey list. FinCEN's October 30 notice says Iran and North Korea remain subject to a call for countermeasures and Burma to enhanced due diligence. Bulgaria, Cote d'Ivoire, the Democratic Republic of the Congo, and Monaco came off the list of jurisdictions under increased monitoring. FinCEN's notice also repeats its warning against wholesale or indiscriminate de-risking of any class of customers or institutions, and reminds money services businesses that foreign agent and counterparty due diligence applies to them too.
Source: FinCEN, Oct. 30, 2026
Career Intel
The skill gap in Paxful's order isn't exotic. Someone had to compare a list of assets with a list of supported assets and report the difference. If you can build and defend a coverage matrix for a crypto platform, MSB, or fintech, covering assets, chains, payment methods, and the geolocation logic around them, you're doing the work regulators now cite by name. Pair that with the ability to read blockchain analytics output critically (what did the vendor actually label, and what does it leave unattributed?) and you have a profile that fits both first-line monitoring teams and the audit groups testing them.
AI in Financial Crimes Compliance
Paxful's analytics tool didn't fail. It never saw the assets it wasn't connected to, and nobody asked for a list of what it couldn't see. AI-assisted monitoring has the same blind spot in a more convincing format: a model scores the data it's fed with confidence, and the transactions that never reach it produce no alerts and no complaints.
Before buying or approving an AI model for alert triage, ask the vendor for a coverage report, meaning which products, assets, and data fields feed the model and which don't. The first control to test is the inventory, not the model.
Source: FinCEN Consent Order, Paxful, Inc. and Paxful USA, Inc.
Tip Line
Got any idea for something you'd want to see covered here? Doesn't have to fit neatly into a category. If you think it's interesting, we probably will too.
Send it to [email protected].
If someone forwarded this to you, welcome.
The AML Brief goes out every Tuesday. Subscribe for free and get the Top 10 AML Red Flags cheat sheet as a thank-you:
[BUTTON: Subscribe → theamlbrief.com]
Already subscribed? Forward this to one colleague who works in financial crimes. That's how we grow.
The AML Brief | theamlbrief.com
Disclaimer: The AML Brief is an independent financial crimes intelligence publication. All content is sourced from publicly available regulatory documents, enforcement actions, and published research. Nothing published here constitutes legal, compliance, or regulatory advice. The AML Brief is not affiliated with any financial institution, regulator, law firm, or employer. For advice specific to your situation, consult a qualified attorney or compliance professional.