NPRM: Special measure regarding Huione Group (90 FR 18934) (Part 1 of 2)
Document text
Research, not advice. Part of the Bitcoin research archive (October 2026). Claims labelled unverified, contested or fringe are reported, not endorsed; statuses of bills and rules are as of the date checked. Government, court and patent records are public domain; the research notes are CC BY 4.0.
18934 Federal Register / Vol. 90, No. 85 / Monday, May 5, 2025 / Proposed Rules
under the criteria of the Regulatory DEPARTMENT OF THE TREASURY (iii) One or more classes of
Flexibility Act. transactions within, or involving, a
Financial Crimes Enforcement Network jurisdiction outside of the United States;
Environmental Review
or
This proposal will be subject to an 31 CFR Part 1010 (iv) One or more types of accounts.1
environmental analysis in accordance Upon making such a finding, the
RIN 1506–AB68
with FAA Order 1050.1F, Secretary is authorized to require
‘‘Environmental Impacts: Policies and Special Measure Regarding Huione domestic financial institutions and
Procedures’’ prior to any FAA final Group, as a Foreign Financial domestic financial agencies to take
regulatory action. Institution of Primary Money certain ‘‘special measures.’’ 2 The five
Laundering Concern special measures set out in section 311
List of Subjects in 14 CFR Part 71 are safeguards that may be employed to
AGENCY: Financial Crimes Enforcement defend the U.S. financial system from
Airspace, Incorporation by reference, Network (FinCEN), Treasury. money laundering and terrorist
Navigation (air). ACTION: Notice of proposed rulemaking. financing risks. The Secretary may
The Proposed Amendment impose one or more of these special
SUMMARY: FinCEN is issuing a notice of
measures to protect the U.S. financial
In consideration of the foregoing, the proposed rulemaking (NPRM), pursuant system from such threats. Through
Federal Aviation Administration to section 311 of the USA PATRIOT Act, special measures one through four, the
proposes to amend 14 CFR part 71 as that proposes prohibiting the opening or Secretary may impose additional
follows: maintaining of a correspondent account recordkeeping, information collection,
in the United States for, or on behalf of, and reporting requirements on covered
PART 71—DESIGNATION OF CLASS A, Huione Group, a foreign financial domestic financial institutions and
B, C, D, AND E AIRSPACE AREAS; AIR institution based in Cambodia found to domestic financial agencies—
TRAFFIC SERVICE ROUTES; AND be of primary money laundering collectively, ‘‘covered financial
REPORTING POINTS concern. The NPRM also would require institutions.’’ 3 Through special measure
covered financial institutions to apply five, the Secretary may ‘‘prohibit, or
■ 1. The authority citation for 14 CFR special due diligence to their foreign impose conditions upon, the opening or
part 71 continues to read as follows: correspondent accounts that is maintaining in the United States of a
reasonably designed to guard against correspondent account or payable-
Authority: 49 U.S.C. 106(f), 106(g), 40103,
40113, 40120; E.O. 10854, 24 FR 9565, 3 CFR, their use to process transactions through account’’ for or on behalf of a
1959–1963 Comp., p. 389. involving Huione Group. foreign banking institution, if such
DATES: Written comments on the notice correspondent account or payable-
§ 71.1 [Amended] of proposed rulemaking must be through account involves the foreign
■ 2. The incorporation by reference in submitted on or before June 4, 2025. financial institution found to be of
14 CFR 71.1 of FAA Order JO 7400.11J, ADDRESSES: Comments must be primary money laundering concern.4
Airspace Designations and Reporting submitted by one of the following Before making a finding that
Points, dated July 31, 2024, and methods: reasonable grounds exist for concluding
effective September 15, 2024, is • Federal E-rulemaking Portal: that a financial institution outside of the
amended as follows: https://www.regulations.gov. Follow the United States (or other jurisdiction,
instructions for submitting comments. account, or class of transactions) is of
Paragraph 6005 Class E Airspace Areas Refer to Docket Number FINCEN–2025– primary money laundering concern, the
Extending Upward From 700 Feet or More
0004 in the submission. Secretary is required to consult with
Above the Surface of the Earth.
• Mail: Financial Crimes Enforcement both the Secretary of State and the
* * * * * Network, P.O. Box 39, Vienna, VA Attorney General.5 In addition, in
AWP AZ E5 Wickenburg, AZ [Establish] 22183. Refer to Docket Number making a finding that reasonable
Wickenburg Municipal Airport, AZ FINCEN–2025–0004 in the submission. grounds exist for concluding that a
(Lat. 33°58′14″ N, long. 112°47′42″ W) Please submit comments by one financial institution outside of the
That airspace extending upward from 700 method only and note that comments
feet above the surface at Wickenburg submitted in response to this NPRM 1 31 U.S.C. 5318A(a)(1).
Municipal Airport, Wickenburg, AZ, will become a matter of public record. 2 On October 26, 2001, the President signed into
beginning at point lat 34°01′27″ N, long FOR FURTHER INFORMATION CONTACT: The law the Uniting and Strengthening America by
Providing Appropriate Tools Required to Intercept
112°32′48″ W to lat 34°01′14″ N, long FinCEN Resource Center at and Obstruct Terrorism Act of 2001, Public Law
112°31′50″ W to lat 33°59′31″ N, long www.fincen.gov/contact. 107–56 (USA PATRIOT Act). Title III of the USA
112°32′238″ W then following the 12.8-mile PATRIOT Act amended the anti-money laundering
SUPPLEMENTARY INFORMATION:
radius from the airport clockwise to lat (AML) provisions of the Bank Secrecy Act (BSA) to
33°49′30″ N, long 112°58′57″ W to lat I. Statutory Provisions promote the prevention, detection, and prosecution
33°51′03″ N, long 113°02′00″ W to lat of international money laundering and the
33°52′07″ N, long 113°01′13″ W then Section 311 of the USA PATRIOT Act financing of terrorism. The BSA, as amended, is the
following the 12.8-mile radius from the (section 311), codified at 31 U.S.C. popular name for a collection of statutory
5318A, grants the Secretary of the authorities that FinCEN administers that is codified
airport clockwise to the point of origination.
ddrumheller on DSK120RN23PROD with PROPOSALS1
at 12 U.S.C. 1829b, 1951–1960 and 31 U.S.C. 5311–
* * * * * Treasury (Secretary) the authority to 5314, 5316–5336, and includes other authorities
make a finding that ‘‘reasonable grounds reflected in notes thereto. Regulations
Issued in Fort Worth, Texas, on April 29, exist for concluding’’ that any of the implementing the BSA appear at 31 CFR Chapter
2025. X.
following ‘‘is of primary money
Wayne L. Eckenrode, laundering concern:
3 31 U.S.C. 5318A(b)(1)–(4). The term ‘‘covered
Acting Manager, Operations Support Group, financial institution’’ has the same meaning as
(i) A jurisdiction outside of the United provided at 31 CFR 1010.605(e)(1); see infra section
ATO Central Service Center. States; V.A.3.
[FR Doc. 2025–07664 Filed 5–2–25; 8:45 am] (ii) One or more financial institutions 4 31 U.S.C. 5318A(b)(5).
BILLING CODE 4910–13–P operating outside of the United States; 5 31 U.S.C. 5318A(c)(1).
VerDate Sep<11>2014 16:16 May 02, 2025 Jkt 265001 PO 00000 Frm 00005 Fmt 4702 Sfmt 4702 E:\FR\FM\05MYP1.SGM 05MYP1
Federal Register / Vol. 90, No. 85 / Monday, May 5, 2025 / Proposed Rules 18935
United States is of primary money • The extent to which the action or operations are principally carried out in
laundering concern, the Secretary is the timing of the action would have a Cambodia.
required to consider such information as significant adverse systemic impact on For years, Huione Group has
the Secretary determines to be relevant, the international payment, clearance, laundered illicit proceeds from
including the following potentially and settlement system, or on legitimate cybercrimes—namely, cyber heists
relevant institutional factors: business activities involving the carried out by the Lazarus Group,15 an
• The extent to which such a particular jurisdiction, institution, class entity sanctioned by Treasury’s Office of
financial institution is used to facilitate of transactions, or type of account; and Foreign Assets Control (OFAC)—and
or promote money laundering in or Convertible Virtual Currency (CVC)
through a jurisdiction outside the • The effect of the action on United investment scams carried out by
United States, including any money States national security and foreign transnational criminal organizations
laundering activity by organized policy.9 (TCOs) based in Southeast Asia.16
criminal groups, international terrorists, The authority of the Secretary to Since its establishment, Huione
or entities involved in the proliferation administer the Bank Secrecy Act (BSA) Group has set up a network of
of weapons of mass destruction (WMD) and its implementing regulations, businesses, each playing a different role
or missiles. including the authority under section in its money laundering enterprise.
• The extent to which such a 311 to make such a finding and to However, FinCEN’s analysis of Huione
financial institution is used for impose special measures, has been Group has identified the sharing of CVC
legitimate business purposes in the delegated to FinCEN.10 infrastructure by Huione Group’s
jurisdiction; and constituent entities, indicating that the
• The extent to which such action is II. Summary of NPRM entities, including the parent Huione
sufficient to ensure, with respect to Group, are functionally operating as one
transactions involving the jurisdiction Huione Group 11 is a financial and the same, despite the various
and institutions operating in the services conglomerate based in Phnom branding. Because Huione Group’s
jurisdiction, that the purposes of section Penh, Cambodia.12 Huione Group’s subsidiaries have shared CVC
311 continue to be fulfilled, and to website is registered 13 to an individual infrastructure with its constituent
guard against international money with a listed location of Phnom Penh, entities, the structure makes it
laundering and other financial crimes.6 Cambodia, but Huione Group, the challenging to ascertain the specific
In selecting one or more special parent entity of the conglomerate, does subsidiary involved in any particular
measures, the Secretary ‘‘shall consult not appear to be registered as a business transaction.
with the Chairman of the Board of in any jurisdiction, though it was The overall Huione Group network
Governors of the Federal Reserve originally incorporated in Hong Kong in offers unique services ranging from an
System, any other appropriate Federal 2018 as Huione Group Limited.14 While online marketplace selling items useful
banking agency (as defined in section 3 several of Huione Group’s subsidiaries for carrying out cyber scams to money
of the Federal Deposit Insurance Act), are registered outside of Cambodia, their laundering services that accept both fiat
the Secretary of State, the Securities and currencies and CVC. Huione Group has
Exchange Commission, the Commodity 9 31 U.S.C. 5318A(a)(4)(B)(i)–(iv).
also created its own stablecoin, a type
10 Pursuant to Treasury Order 180–01 (Jan. 14,
Futures Trading Commission, the of CVC that is usually backed by a pre-
2020), the authority of the Secretary to administer
National Credit Union Administration the BSA, including, but not limited to, 31 U.S.C.
determined quantity of fiat currency,
Board, and in the sole discretion of the 5318A, has been delegated to the Director of most often the U.S. dollar (USD). The
Secretary, such other agencies and FinCEN. stablecoin, ‘‘USDH,’’ which is a ticker
interested parties as the Secretary may 11 As will be discussed in greater detail in section
symbol for ‘‘U.S. Dollar Huione,’’ is
find appropriate.’’ 7 When imposing III, Huione Group is the parent company of the pegged to the USD at a one-to-one ratio
following subsidiaries: Huione Crypto, Haowang
special measure five, the Secretary must Guarantee, and Huione Pay PLC. FinCEN assesses and is represented as a stablecoin that
do so ‘‘in consultation with the that this collective grouping of exchange services is cannot be frozen. In contrast, many
Secretary of State, the Attorney General, a single organization, and for that reason, FinCEN stablecoin issuers develop their
and the Chairman of the Board of will correspondingly refer to this collective as the stablecoins to retain the ability to freeze
Huione Group.
Governors of the Federal Reserve 12 Cambodia Corporate Registry, Huione Search,
funds, which they have sometimes done
System.’’ 8 In addition, the Secretary is https://www.businessregistration.moc.gov.kh/ in cases of known criminal activity, or
required to consider the following cambodia-master/service/ at the request of law enforcement.
factors: create.html?targetAppCode=cambodia- Because Huione Group claims that
• Whether similar action has been or master&targetRegisterAppCode=cambodia-br-
USDH cannot be frozen, this service
companies&service=registerItemSearch (last
is being taken by other nations or accessed Mar. 27, 2025); Huione Pay, Index, https:// offers Huione Group’s clientele a
multilateral groups; www.huionepay.com.kh/index/help; Huione Group,
• Whether the imposition of any About, which is no longer accessible and will be 15 The Lazarus Group is an agency,
particular special measure would create discussed later in this section, formerly available at instrumentality, or controlled entity of the
https://huione.com/html/about.jsp (last accessed government of the Democratic People’s Republic of
a significant competitive disadvantage, Sept. 24, 2024). Huione Crypto has numerous job Korea, that has stolen large volumes of Convertible
including any undue cost or burden announcements with a work location in Phnom Virtual Currency in numerous and often widely
associated with compliance, for Penh, Cambodia. See Huione Crypto, Career reported cyber heists. On September 13, 2019, the
financial institutions organized or Opportunities, https://www.huione.io/en-US/ Lazarus Group was sanctioned by OFAC. See
ddrumheller on DSK120RN23PROD with PROPOSALS1
careerOpportunities (last accessed Mar. 27, 2025). Department of the Treasury, Press Release, Treasury
licensed in the United States; Haowang Guarantee also lists job announcements Sanctions North Korean State-Sponsored Malicious
with a work location in Phnom Penh, Cambodia. Cyber Groups, (Sept. 13, 2019), https://
6 31 U.S.C. 5318A(c)(2)(B)(i)–(iii). In addition, in See Haowang Guarantee, About, https:// home.treasury.gov/news/press-releases/sm774.
the case of a finding relating to a particular www.hwdb.la/about/ (last accessed Mar. 27, 2025). 16 These scams are also referred to as ‘‘pig
jurisdiction, section 311 sets out certain 13 The registration is valid through June 3, 2025.
butchering.’’ See FinCEN, FIN–2023-Alert005,
‘‘jurisdictional factors’’ that the Secretary may See ICANN, Huione.com, https://lookup.icann.org/ FinCEN Alert on Prevalent Virtual Currency
consider, which are not relevant here. See 31 U.S.C. en/huione.com (last accessed Mar. 27, 2025). Investment Scam Commonly Known as ‘‘Pig
5318A(c)(2)(A)(i)–(vii). 14 Hong Kong Companies Registry, Huione Group Butchering’’ (Sept. 8, 2023), https://
7 31 U.S.C. 5318A(a)(4)(A).
Limited, at p. 54, https://www.cr.gov.hk/docs/wrpt/ www.fincen.gov/sites/default/files/shared/FinCEN_
8 31 U.S.C. 5318A(b)(5). RNC063_2018.12.17-2018.12.23.pdf. Alert_Pig_Butchering_FINAL_508c.pdf.
VerDate Sep<11>2014 16:16 May 02, 2025 Jkt 265001 PO 00000 Frm 00006 Fmt 4702 Sfmt 4702 E:\FR\FM\05MYP1.SGM 05MYP1
18936 Federal Register / Vol. 90, No. 85 / Monday, May 5, 2025 / Proposed Rules
virtually risk-free ecosystem to move or prerequisite to such a finding is that the A. Huione Group and Its Three
store CVC without the risk of relevant institution is a ‘‘financial Identified Subsidiaries Are Each a
interception or ‘‘freezing’’ by law institution operating outside of the Financial Institution
enforcement. United States.’’ 19
Finally, much of the illicit revenue Huione Group is a parent entity that
laundered through Huione Group The BSA defines a ‘‘financial controls three subsidiaries: (i) Haowang
originates from well-documented institution’’ to be any of several Guarantee; (ii) Huione Pay PLC; and (iii)
criminal activity, and numerous categories of entities, including money Huione Crypto (collectively, the
publicly available reports describe the transmitters.20 The BSA defines a ‘‘Subsidiaries’’). Based on the following,
failings of Huione Group’s anti-money money transmitter as including ‘‘a FinCEN finds that reasonable grounds
laundering/know your customer (AML/ licensed sender of money or any other exist to conclude that Huione Group
KYC) program. Despite these reports person who engages as a business in the and each of the Subsidiaries engages in
and Huione Group’s public transmission of currency funds, or value the business of money transmission, and
acknowledgments of its failings,17 that substitutes for currency.’’ 21 A is thereby a financial institution under
FinCEN assesses that Huione Group has money transmitter does not require a the BSA and its implementing
made no meaningful steps to effectively particular license, corporate structure, regulations.
address these AML/KYC deficiencies. or physical location. 1. Huione Group
This NPRM (1) sets forth FinCEN’s
As detailed further below, much of
finding, based on public and non-public Huione Group is a Cambodia based,
Huione Group’s illicit money
information, that Huione Group is a Hong Kong-registered 24 sole
transmitting activity occurs through proprietorship founded in or around
financial institution operating outside of
the United States of primary money transactions in CVC. This is consistent 2014, appears to be owned and
laundering concern; and (2) proposes with the money transmitter definition, controlled by an individual Cambodian
that, under special measure five, which includes services in CVC. national,25 and holds itself out as the
covered financial institutions be FinCEN’s May 9, 2019, Guidance on parent entity of the Subsidiaries.26 By
prohibited from opening or maintaining CVC explains that for the purposes of its own account, Huione Group began as
a correspondent account for, or on the BSA’s implementing regulations, a fiat currency exchange service and
behalf of, Huione Group. persons ‘‘may be a money transmitter over the past decade, expanded its
. . . regardless of the technology commercial interests to include finance,
III. Finding That Huione Group Is a employed for the transmittal of value or insurance, real estate entities,27 and
Financial Institution Operating Outside
the type of asset the person uses as most recently, CVC exchange services.28
of the United States and a Foreign
value that substitutes for currency, or The Subsidiaries operate an
Financial Institution
whether such asset is physical or interconnected payment service
As set forth above, section 311 virtual.’’ 22 For the reasons explained in provider, illicit online market, and a
authorizes FinCEN, through delegated the May 9, 2019, Guidance, the term
authority and in pertinent part, to make ‘‘value that substitutes for currency’’ 24 Hong Kong Companies Registry, Huione Group
a finding ‘‘that reasonable grounds exist includes CVC.23 Limited, at p. 54, https://www.cr.gov.hk/docs/wrpt/
for concluding’’ that ‘‘[one] or more RNC063_2018.12.17-2018.12.23.pdf.
25 See The Record, Tether freezes $29 million of
financial institutions operating outside 19 31 U.S.C. 5318A(a)(1) authorizes the
cryptocurrency connected to Cambodian
of the United States’’ is ‘‘of primary imposition of special measures on, among others, marketplace accused of fueling scams (July 15,
money laundering concern.’’ 18 A ‘‘financial institutions operating outside of the 2024), https://therecord.media/tether-freezes-29-
United States.’’ Of the five special measures million-crypto-connected-to-scam-marketplace.
17 Following negative public reporting about authorized by the statute, the fifth measure 26 See, e.g., Elliptic, Huione: The Company
Huione Group in July 2024, Huione Group provided authorizes ‘‘Prohibitions or Conditions on Opening Behind the Largest Ever Illicit Online Marketplace
a statement to ABC News, stating that ‘‘. . . because or Maintaining Certain Correspondent or Payable- Has Launched a Stablecoin (Jan. 14, 2025), https://
our [Huione Group’s] services are all public, Through Accounts.’’ The statute goes on to define www.elliptic.co/blog/huione-largest-ever-illicit-
covering Asia, Europe and America, and the privacy the terms correspondent account and payable- online-marketplace-stablecoin; Elliptic, Huione
attributes of [CVC] are superimposed, our KYC through account in reference to payments made on Guarantee: The multi-billion dollar marketplace
[know your customer] capabilities are now behalf of a ‘‘foreign financial institution’’—a term used by online scammers (July 9, 2024, updated
seriously insufficient.’’ See ABC News, Cambodian otherwise undefined. For the purposes of this Mar. 27, 2025), https://www.elliptic.co/blog/cyber-
online marketplace outed as one-stop shop for NPRM, and under these facts, FinCEN finds that scam-marketplace; Chainalysis, 2024 Crypto Crime
scammers’ money laundering and ‘detention Huione Group is both a foreign financial institution Mid-year Update Part 2: China-based CSAM and
equipment’ needs (July 26, 2024), https:// and a financial institution outside of the United Cybercrime Networks on the Rise, Pig Butchering
www.abc.net.au/news/2024-07-27/online- States. Scams Remain Lucrative (Aug. 29, 2024), https://
marketplace-for-money-laundering-and-scammers/ 20 See 31 U.S.C. 5312(a)(2). www.chainalysis.com/blog/2024-crypto-crime-mid-
104131624; see also The Record, Tether freezes $29 21 31 U.S.C. 5312(a)(2)(R) (allowing ‘‘a licensed
year-update-part-2/; ABC News, Cambodian online
million of cryptocurrency connected to Cambodian marketplace outed as one-stop shop for scammers’
sender of money or any other person . . .’’ to money laundering and ‘detention equipment’ needs
marketplace accused of fueling scams (July 15,
constitute money transmitter). FinCEN’s (July 26, 2024), https://www.abc.net.au/news/2024-
2024), https://therecord.media/tether-freezes-29-
implementing regulations define ‘‘person’’ broadly 07-27/online-marketplace-for-money-laundering-
million-crypto-connected-to-scam-marketplace;
as ‘‘an individual, a corporation, a partnership, a and-scammers/104131624; Huione Crypto, Terms
Elliptic, Huione Guarantee: The multi-billion dollar
trust or estate, a joint stock company, an and Conditions, https://www.huione.io/en-US/
marketplace used by online scammers (July 9, 2024,
updated Mar. 27, 2025), https://www.elliptic.co/ association, a syndicate, joint venture, or other termsAndConditions/userAgreement (last accessed
blog/cyber-scam-marketplace; Elliptic, Huione: The unincorporated organization or group, an Indian Mar. 27, 2025). The Huione Group website is no
ddrumheller on DSK120RN23PROD with PROPOSALS1
Company Behind the Largest Ever Illicit Online Tribe (as that term is defined in the Indian Gaming longer accessible, which FinCEN assesses is more
Marketplace Has Launched a Stablecoin (Jan. 14, Regulatory Act), and all entities cognizable as legal likely than not caused by negative public attention
2025), https://www.elliptic.co/blog/huione-largest- personalities.’’ 31 CFR 1010.100(mm). following a series of reports by blockchain analytic
22 FinCEN, FIN–2019–G001, Application of firms on money laundering occurring at Huione
ever-illicit-online-marketplace-stablecoin;
Chainalysis, 2024 Crypto Crime Mid-year Update FinCEN’s Regulations to Certain Business Models Group.
Part 2: China-based CSAM and Cybercrime Involving Convertible Virtual Currencies (May 9, 27 Huione Group, Who We Are, formerly available
Networks on the Rise, Pig Butchering Scams 2019), at Section 1.2.3, https://www.fincen.gov/ at https://www.huione.com/html/about.jsp (last
Remain Lucrative (Aug. 29, 2024), https:// sites/default/files/2019-05/ accessed Sept. 24, 2024).
www.chainalysis.com/blog/2024-crypto-crime-mid- FinCEN%20Guidance%20 28 Huione Crypto, Introduce, https://
year-update-part-2/. CVC%20FINAL%20508.pdf. www.huione.io/en-US/introduce (last accessed Mar.
18 31 U.S.C. 5318A(a)(1). 23 Id. at Sections 1.2.1, 1.3. 26, 2025).
VerDate Sep<11>2014 16:16 May 02, 2025 Jkt 265001 PO 00000 Frm 00007 Fmt 4702 Sfmt 4702 E:\FR\FM\05MYP1.SGM 05MYP1
Federal Register / Vol. 90, No. 85 / Monday, May 5, 2025 / Proposed Rules 18937
CVC exchanger (a type of virtual asset that provides users with virtual digital technology, infrastructure and resources
service provider or VASP). products and transaction services . . . to conduct cyber scams.37
Huione Group, as an individual [that] does not participate in nor In addition, Elliptic reports that
entity, coordinates the Subsidiaries’ understand the specific business of the Haowang Guarantee provides money
activities by operating the customer customer. . . . Huione cannot verify or laundering services to criminal
service and public relations functions of guarantee the process of funds or organizations, helping them transfer the
the Huione Group. Huione Group does goods.’’ 32 Multiple blockchain analytic proceeds of investment frauds and other
this by hosting Telegram channels to aid firms have analyzed and reported on cyber scams to the legitimate banking
customers experiencing problems with Haowang Guarantee for facilitating the sector undetected.38 Because Haowang
the services that the Subsidiaries sale of contraband and illicit services. Guarantee offers ‘‘virtual digital
provide.29 One of Huione Group’s For example, a public report issued by products and transaction services’’ and
Telegram channels also provides public blockchain analytics company Elliptic facilitates CVC (digital asset)
relations commentary on behalf of the found that Haowang Guarantee appears transactions, FinCEN finds that there are
whole of the Huione Group collective. to operate in a manner similar to a reasonable grounds to conclude that it is
Most recently, that public relations darknet market.33 This assessment is engaged as a business in the
channel responded to counter news based on the fact that Haowang transmission of value that substitutes for
media reports that the Cambodian Guarantee offers a marketplace where currency. Accordingly, FinCEN finds
government revoked Huione Pay PLC’s third party merchants can sell goods that reasonable grounds exist to
banking license.30 Lastly, Huione and services, including money conclude that Haowang Guarantee is a
Group’s Subsidiaries all have shared laundering services and equipment that financial institution as that term is used
CVC infrastructure, making it in the BSA and section 311.
can be used to detain people, which
challenging to ascertain the specific
could be used for illicit purposes such 3. Huione Pay PLC
subsidiary involved in a particular
as enabling human trafficking.34 While
transaction. As of January 2025, Huione Pay PLC
FinCEN finds that reasonable grounds FinCEN does not have evidence that
was registered as a payment services
exist to conclude that Huione Group is Haowang Guarantee operates on the
institution with the National Bank of
a money transmitter. By providing darknet, FinCEN assesses that Haowang
Cambodia.39 Until December 2023, there
customer service and public relations Guarantee deals in the sale of illicit
was a likely related entity, ‘‘Huione
services on behalf of the Subsidiaries, goods and services in a manner similar
Pay,’’ registered as a money services
Huione Group is itself part of ‘‘a to a darknet market but on the open
business in Canada, which was
network of people who engage as a internet.35
incorporated in the country as Huione
business in facilitating the transfer of Chainalysis, a separate blockchain Pay Inc.40 In March 2025, Huione Group
money.’’ Furthermore, through Huione analytics company, found similar advertised its plans to expand Huione
Group’s apparent control of the results. In its 2024 Crypto Crime Mid- Pay PLC into new markets, including in
Subsidiaries (each of which is itself a year Update Report, it determined that North America.41
money transmitter, and through Huione Haowang Guarantee operates as a peer- Huione Pay PLC offers its customers
Group’s coordination of the to-peer marketplace that connects the ability to trade CVC on different
Subsidiaries’ business activities such buyers and sellers and facilitates blockchains, and to convert CVC to or
that they form a self-contained transactions.36 Chainalysis reviewed from various fiat currencies.42 Huione
ecosystem of exchange, payment, and blockchain data of Haowang Guarantee Pay PLC is registered with the
market services), Huione Group is and determined it had processed at least Cambodian Ministry of Commerce for
engaged as a business in the USD 49 billion worth of CVC since ‘‘other financial service activities.’’ 43
transmission of value that substitutes for 2021. Chainalysis also determined that
currency. Accordingly, FinCEN finds merchants operating on Haowang 37 Id.
that reasonable grounds exist to Guarantee’s marketplace offered various 38 Elliptic, Huione: The Company Behind the
conclude that Huione Group is a Largest Ever Illicit Online Marketplace Has
illicit services, including the Launched a Stablecoin (Jan. 14, 2025), https://
financial institution as defined by the www.elliptic.co/blog/huione-largest-ever-illicit-
BSA and as that term is used in section 32 Haowang Guarantee, About, https:// online-marketplace-stablecoin.
311. www.hwbd.la/about (last accessed Mar. 27, 2025). 39 National Bank of Cambodia, List of Payment
33 Darknet Markets almost exclusively accept CVC Service Institutions (Dec. 31, 2024), https://
2. Haowang Guarantee (Formerly as payment for a large range of illegal services and www.nbc.gov.kh/download_files/data/english/En/
Known as Huione Guarantee) 31 goods, including ransomware-as-a-service (RaaS). EN-PSIs.pdf (last accessed Mar. 21, 2025).
CVC is often the payment method of choice on 40 Financial Transactions and Reports Analysis
Haowang Guarantee describes itself as darknet marketplaces because illicit actors who Centre of Canada (FINTRAC), Money Services
‘‘a professional e-commerce platform transact on the darknet often incorrectly believe Business Registry, Huione Pay Inc, https://fintrac-
virtual currencies to be an anonymous and canafe.canada.ca/msb-esm/reg-eng (last accessed
29 Telegram, Huione Group Customer Service untraceable means of exchange. Mar. 13, 2025).
Center, https://t.me/huionekf/138 (last accessed 34 Elliptic, Huione Guarantee: The multi-billion 41 Telegram, Huione Group Customer Service,
Mar. 27, 2025). dollar marketplace used by online scammers (July Huione Statement (Mar. 9, 2025), https://t.me/
30 Telegram, Huione Group Customer Service, 9, 2024, updated Mar. 27, 2025), https:// huionekf/346.
Huione Statement (Mar. 9, 2025), https://t.me/ www.elliptic.co/blog/cyber-scam-marketplace. 42 Huione Pay website, Index, https://
huionekf/346. 35 See Department of the Treasury, Press Release, www.huionepay.com.kh/index/help (last accessed
ddrumheller on DSK120RN23PROD with PROPOSALS1
31 On October 19, 2024, Huione Guarantee was Treasury Sanctions Russia-Based Hydra, World’s Mar. 27, 2025).
rebranded as Haowang Guarantee, announcing the Largest Darknet Market, and Ransomware-Enabling 43 See Cambodia Corporate Registry, Huione
change on September 30, 2024, and offering Virtual Currency Exchange Garantex (Apr. 5, 2022), Search, https://
customer discount following the rebrand to thank https://home.treasury.gov/news/press-releases/ www.businessregistration.moc.gov.kh/cambodia-
their long-term customers. The reason for such a jy0701. master/service/
rebrand is unclear, although it could be to distance 36 Chainalysis, 2024 Crypto Crime Mid-year create.html?targetAppCode=cambodia-
itself from the recent negative public reporting Update Part 2: China-based CSAM and Cybercrime master&targetRegisterAppCode=cambodia-br-
about Huione Group. Telegram, Haowang Networks on the Rise, Pig Butchering Scams companies&service=registerItemSearch (last
Guarantee Customer Service Channel (Sept. 30, Remain Lucrative (Aug. 29, 2024), https:// accessed Mar. 27, 2025). On March 6, 2025, a media
2024), https://t.me/s/kefu (last accessed Mar. 27, www.chainalysis.com/blog/2024-crypto-crime-mid- report indicated that Huione Pay PLC’s banking
2025). year-update-part-2/. Continued
VerDate Sep<11>2014 16:16 May 02, 2025 Jkt 265001 PO 00000 Frm 00008 Fmt 4702 Sfmt 4702 E:\FR\FM\05MYP1.SGM 05MYP1
18938 Federal Register / Vol. 90, No. 85 / Monday, May 5, 2025 / Proposed Rules
Part of Huione Pay PLC, Huione money transmission as described at 31 Poipet, Siem Reap, and Sihanoukville.48
International Payments, acts as a U.S.C. 5312(R). Accordingly, FinCEN Huione Pay PLC also advertises on
merchant on Haowang Guarantee’s finds that reasonable grounds exist to social media that it has operated a
platform and exchanging CVC to conclude that Huione Crypto is a branch in Laukkaing,49 the capital of the
facilitate the transfer of the proceeds of financial institution as that term is used Kokang Self-Administered Zone in
cyber scams.44 Huione Pay PLC holds in the BSA and section 311. northern Burma and a known center for
the local equivalent of a money criminal CVC investment scams, before
transmitting business license issued by B. Huione Group Operates Outside the a 2023–2024 crackdown shuttered the
the Kingdom of Cambodia and engages United States majority of these operations.50 Huione
in the exchange of CVC in a manner 1. Huione Group Pay PLC is registered as a payment
consistent with the definition of a services institution with the National
money transmitting business. Based on publicly available Bank of Cambodia.51 Based on the
Accordingly, FinCEN finds that information, Huione Group is operated foregoing, FinCEN finds that reasonable
reasonable grounds exist to conclude by a Cambodian person, from Phnom grounds exist to conclude that Huione
that Huione Pay PLC is a financial Penh, Cambodia.47 Furthermore, the Pay PLC is operated from and located in
institution as that term is used in the Huione Group website is registered to a Cambodia and thus operates outside of
BSA and section 311. Cambodian address in Phnom Penh, the United States.
uses a Cambodian Top-Level Domain,
4. Huione Crypto and communicates predominately in the 4. Huione Crypto
Huione Crypto provides CVC trading Chinese language via a Cambodian Huione Crypto, under the name
services through its ‘‘Huione Exchange’’ website and Telegram Channel operated Huione Crypto Spó5ka Z Ograniczona˛
brand, which it owns and operates. from Cambodia. Accordingly, FinCEN Odpowiedzialnościa˛, is registered in
Huione Exchange provides a platform finds that reasonable grounds exist to Poland.52 Despite its Polish registration,
for its customers to trade CVC using conclude that Huione Group is operated however, FinCEN assesses that Huione
either its ‘‘peer to peer’’ or from and located in Cambodia and thus Crypto operates in and from
‘‘centrali[z]ed exchange platform.’’ 45 In operates outside of the United States. Cambodia.53 Huione Crypto is registered
other words, Huione Crypto is a VASP as a Money Services Business (MSB) 54
operating under the Huione Group 2. Haowang Guarantee (Formerly with FinCEN; however, FinCEN has
umbrella, and other Huione Group Huione Guarantee) found no evidence consistent with
entities use Huione Crypto’s Haowang Guarantee operates activity in the United States by this
infrastructure to engage in CVC Telegram-based marketplace that allows entity. FinCEN assesses that the
transactions. Separately, Huione Crypto its customers to buy and sell goods and ‘‘Group’’ referenced in Huione Crypto’s
issues the USDH stablecoin.46 By services, relying on other Huione Group Standard Terms and Conditions refers
facilitating CVC value exchanges for its services and infrastructure to execute to Huione Group, and that Huione
customers through its trading platform, the exchanges. Haowang Guarantee Crypto’s CVC services share
and by issuing a stablecoin that appears to serve, in significant part, infrastructure with Huione Pay PLC and
facilitates the transfer of money outside fraudsters based in Southeast Asia. Haowang Guarantee, and collectively
the conventional financial institution FinCEN assesses that Haowang comprise a single organization.
systems, Huione Crypto is engaged in Guarantee deliberately obfuscates its Regardless of this distinction, FinCEN
location in order to shield its enterprise will discuss Huione Crypto as a related,
license was revoked by the Cambodian government.
and customers from law enforcement. but distinct subsidiary of Huione Group.
See Radio Free Asia, Exclusive: World’s Largest Huione Crypto advertises jobs in Phnom
online black market’ Loses banking license (Mar. 6, Haowang Guarantee is integrated into
2025), https://www.rfa.org/english/cambodia/ 2025/ Huione Group’s operations and is Penh, Cambodia indicating it is likely
03/06/huione-cambodia-cyberscam-cryptocurrency/
. Huione Group responded to the allegations,
apparently subject to Huione Group’s 48 Telegram, Huione Branch, https://t.me/
refuting them by noting that Huione Pay PLC does control. FinCEN assesses that it is huionestoreaddress/7 (last accessed Mar. 27, 2025).
not require a banking license for its operations. operated from Cambodia and Haowang 49 Telegram, Huione Group Customer Service
Telegram, Huione Group Customer Service, Huione Guarantee advertises job opportunities Center, https://t.me/huionekf/138 (last accessed
Statement (Mar. 9, 2025), https://t.me/huionekf/ Mar. 27, 2025).
346. However, as of March 10, 2025, Huione Pay based in Phnom Phen, Cambodia.
50 Recorded Future, Myanmar rebels take control
PLC is still listed as having an active license for Accordingly, FinCEN finds that
of ‘pig butchering’ scam city amid China pressure
‘‘other financial services activities.’’ See Cambodia reasonable grounds exist to conclude
Corporate Registry, Huione Search, https:// on junta (Jan. 8, 2024), https://therecord.media/
www.businessregistration.moc.gov.kh/cambodia-
that Haowang Guarantee is operated myanmar-rebels-control-pig-butchering-scam-hub.
master/service/ from and located in Cambodia and thus 51 National Bank of Cambodia, List of Payment
create.html?targetAppCode=cambodia- operates outside of the United States. Service Institutions (Dec. 31, 2024), https://
master&targetRegisterAppCode=cambodia-br- www.nbc.gov.kh/download_files/data/english/En/
companies&service=registerItemSearch (last 3. Huione Pay PLC EN-PSIs.pdf (last accessed Mar. 21, 2025).
52 Polish corporate registration database, Huione
accessed Mar. 27, 2025).
44 FinCEN assesses that Huione International Huione Pay PLC operates eight Crypto SPÓ4KA Z OGRANICZONA ˛
Payments is part of Huione Pay PLC and that the Cambodian domestic branch locations, ODPOWIEDZIALNOŚCIA ˛ , https://
entity supports Haowang Guarantee’s facilitation of www.biznes.gov.pl/en/wyszukiwarka-firm/wpis/krs/
transactions connected to money laundering
located in Battambang, Phnom Penh, 0001043802 (last accessed Mar. 27, 2025).
activities. See Elliptic, Huione Guarantee: The 53 Huione Crypto, Career Opportunities, https://
ddrumheller on DSK120RN23PROD with PROPOSALS1
multi-billion dollar marketplace used by online 47 The Record, Tether freezes $29 million of Huione.io/en-US/careerOpportunities (last accessed
scammers (July 9, 2024, updated Mar. 27, 2025), cryptocurrency connected to Cambodian Mar. 27, 2025); Huione Crypto, Legal, https://
https://www.elliptic.co/blog/cyber-scam- marketplace accused of fueling scams (July 15, www.huione.io/en-US/termsAndConditions/
marketplace; The New York Times, How Scammers 2024), https://therecord.media/tether-freezes-29- userAgreement (last accessed Mar. 27, 2025);
Launder Money and Get Away With It (Mar. 23, million-crypto-connected-to-scam-marketplace; see Huione Pay PLC, www.huionepay.com.kh (last
2025), https://www.nytimes.com/2025/03/23/world/ also ICANN, Huione.com, https://lookup.icann.org/ accessed Mar. 27, 2025).
asia/cambodia-money-laundering-huione.html. en/huione.com; Elliptic, Huione Guarantee: The 54 For more information on what type of business
45 Huione Crypto, Legal, https://www.huione.io/
multi-billion dollar marketplace used by online or activity requires registration as a money service
en-US/termsAndConditions/userAgreement (last scammers (July 9, 2024, updated Mar. 27, 2025), business, see FinCEN, Money Services Business
accessed Mar. 27, 2025). https://www.elliptic.co/blog/cyber-scam- Definition, https://www.fincen.gov/money-services-
46 See supra Section II. marketplace. business-definition.
VerDate Sep<11>2014 16:16 May 02, 2025 Jkt 265001 PO 00000 Frm 00009 Fmt 4702 Sfmt 4702 E:\FR\FM\05MYP1.SGM 05MYP1
Federal Register / Vol. 90, No. 85 / Monday, May 5, 2025 / Proposed Rules 18939
operated out of Cambodia, instead of Based on the foregoing, FinCEN through both public and non-public
Poland. Additionally, the Standard assesses that Huione Group and the reporting, and after thorough
Terms and Conditions of Huione Crypto Subsidiaries are predominately operated consideration of each of the following
state that the ‘‘Group provides the from and located in Cambodia, with a factors: (1) Huione Group provides
Services through www.7572.com, the limited connection—a corporate services that DPRK government entities
Group’s mobile application or any registration—to Poland. While the three use to launder the proceeds of cyber
Huione application programming MSB registrations by Huione Crypto, heists; (2) TCOs based in Southeast Asia
interface.’’ The listed web page Huione Pay Inc., and Huione LTD have used Huione Group to launder
(www.7572.com) automatically redirects suggest that Huione Group may intend illicit proceeds of cyber scams,
to the website of Huione Pay PLC to expand its business to the United including CVC investment scams; and
(www.huionepay.com.kh).55 Indeed, States in the future, as of the date of this (3) Huione Group operates an illicit
Huione Crypto’s terms expressly NPRM, FinCEN is not aware of any online market.
disclaim that persons inside the United physical presence by Huione Group or
States may not avail themselves of the Subsidiaries in the United States or 1. Huione Group Facilitates
Huione Group’s services.56 Accordingly, any substantial business with customers Transactions for DPRK Actors To
FinCEN finds that reasonable grounds in the United States. Launder Funds From Sanctions Evasion
exist to conclude that Huione Crypto is Accordingly, FinCEN finds that there and Cyber Heists
operated from and located in Cambodia are reasonable grounds to conclude that
Huione Group and the Subsidiaries are DPRK-affiliated actors have
and thus operates outside of the United extensively used the Huione Group to
States. foreign financial institutions that
operate outside the United States. launder stolen CVC for the benefit of the
5. Huione Group’s Registrations With DPRK government and in support of
IV. Finding That Huione Group Is of DPRK’s WMD and ballistic missile
FinCEN and Absence of United States
Primary Money Laundering Concern programs, in violation of U.S. and
Operations
Pursuant to 31 U.S.C. 5318A(a)(1), multilateral sanctions programs,
The most evidence of activity in the FinCEN finds that reasonable grounds including United Nation Security
United States by Huione Group or the exist for concluding that Huione Council Resolutions (UNSCRs). The
Subsidiaries are three MSB Group 59 is of primary money United States has consistently taken
registrations 57 with FinCEN and an laundering concern. Below is a measures to counter DPRK’s abuse of
address reported on two registrations.58 discussion of the relevant statutory CVC and protect the United States from
In April 2023, Huione Crypto registered institutional factors FinCEN considered DPRK’s illicit financial activity.61
as a dealer in foreign exchange, and in making this finding related to this However, as outlined in Treasury’s 2024
provided a business address in Phnom Cambodia-based financial institution. National Proliferation Financing Risk
Penh, Cambodia, while noting no Assessment, DPRK has continued to
A. The Extent to Which Huione Group
branches in the United States. In August advance its illicit exploitation of new
Is Used To Facilitate or Promote Money
2024, Huione Pay Inc. registered to financial technology, including the theft
Laundering, Including Any Money
conduct multiple MSB activities, and laundering of CVC, to raise and
Laundering Activity by Organized
including check cashing, dealing in move money to fund its illicit weapons
Criminal Groups, International
foreign exchange, and money programs.62 Indeed, a United Nations
Terrorist, or Entities Involved in the
transmission. Huione Pay Inc. provided Panel of Experts (UN POE) found that
Proliferation WMD or Missiles
an address in Denver, Colorado the malicious cyber activities of the
associated with a virtual mail Under section 311, in deciding to DPRK generates approximately 50
forwarding service, and it also noted no apply one or more special measures, percent of its foreign currency income.
branches in the United States. Finally, FinCEN may consider the extent to In its March 2024 annual report, the UN
in February 2025, Huione LTD which the financial institution is ‘‘used POE indicated that it was investigating
registered as a dealer in foreign to facilitate or promote money 17 CVC heists in 2023 for which the
exchange, money transmitter, and seller laundering’’ including ‘‘any money DPRK may be responsible, valued at
of money orders, and noted no branches laundering activity by organized more than USD 750 million.63
in the United States. Huione LTD criminal groups, international terrorists,
appears to use the same Denver, or entities involved in the proliferation a. Background on CVC Heists Carried
Colorado mail forwarding service as of weapons of mass destruction or Out by DPRK
Huione Pay Inc. FinCEN has not missiles.’’ 60 FinCEN assesses that
Huione Group is used to facilitate and In the same March 2024 report, the
identified any actual physical location UN POE noted it was investigating 58
or other information suggesting Huione promote money laundering, particularly
in support of illicit financial activities suspected cyberattacks by DPRK’s
Group or the Subsidiaries are actually Reconnaissance General Bureau
operating in the United States. connected to the Democratic People’s
Republic of Korea (DPRK) and Southeast
61 See FinCEN, READOUT: FinCEN Hosts Public-
55 See FinCEN, MSB Registrant Search, Huione,
Asia-based TCOs. Because Huione
Private Dialogue on Countering the DPRK’s Illicit
https://www.fincen.gov/msb-state-selector. Group has shared infrastructure with its Cyber Activities (Aug. 31, 2023), https://
56 Huione Crypto, Legal, https://www.huione.io/ constituent entities, the structure makes www.fincen.gov/news/news-releases/readout-
ddrumheller on DSK120RN23PROD with PROPOSALS1
en-US/termsAndConditions/userAgreement (last it challenging to ascertain the specific fincen-hosts-public-private-dialogue-countering-
accessed Mar. 27, 2025). subsidiary involved in any particular dprks-illicit-cyber.
57 FinCEN’s MSB Registrant Search web page 62 Department of the Treasury, National
transaction. FinCEN bases this
reflects only what the registrant has provided to Proliferation Financing Risk Assessment (Feb. 7,
FinCEN, and FinCEN does not approve or endorse assessment on information available 2024), at pp. 2, 18, https://home.treasury.gov/
any business that has registered as an MSB. system/files/136/2024-National-Proliferation-
58 An examiner attempted to contact Huione Pay 59 As described in section III, Huione Group is a Financing-Risk-Assessment.pdf.
Inc. at the Denver, Colorado location in November parent entity that controls three subsidiaries: (a) 63 United Nations, S/2024/215, UN Panel of
2024, but the examiner did not identify a Huione Haowang Guarantee; (b) Huione Pay PLC; and (c) Experts Letter (Mar. 7, 2024), at p. 60, https://
Pay representative, nor any other evidence of a Huione Crypto. documents.un.org/doc/undoc/gen/n24/032/68/pdf/
physical presence by Huione Pay. 60 31 U.S.C. 5318A(c)(2)(B)(i). n2403268.pdf.
VerDate Sep<11>2014 16:16 May 02, 2025 Jkt 265001 PO 00000 Frm 00010 Fmt 4702 Sfmt 4702 E:\FR\FM\05MYP1.SGM 05MYP1
18940 Federal Register / Vol. 90, No. 85 / Monday, May 5, 2025 / Proposed Rules
(RGB),64 to which the Lazarus Group 65 of CVC being prepared for laundering profile heist such as this. In total,
is related, on CVC companies between through VASPs.69 FinCEN’s analysis has identified that
2017 and 2023, valued at approximately Huione Group has received at least USD
b. Huione Group’s Laundering of
USD 3 billion. FinCEN assesses that 37.6 million worth of CVC from DPRK
Proceeds of DPRK Cyber Heists
these funds likely bolstered DPRK’s cyber actors stemming from DPRK-
WMD development.66 The Federal Despite the 2023 FBI alert and other attributed heists.
public reporting, Huione Group has On multiple occasions between 2022
Bureau of Investigation (FBI), the
continued to receive and process these and 2024, a DPRK national with deep
Cybersecurity and Infrastructure
illicit proceeds. There is wide reporting ties to the RGB, DPRK’s primary foreign
Security Agency (CISA), and Treasury that Huione Group has received stolen
issued a joint Cybersecurity Advisory to intelligence organization, worked with
CVC from multiple heists linked to Huione Pay PLC officials to transfer
highlight the cyber threat associated DPRK actors, namely the Lazarus
with cryptocurrency thefts and tactics CVC and fiat currency. FinCEN assesses
Group.70 For example, between June that senior Huione Pay PLC leadership
used by the DPRK state-sponsored 2023 and February 2024, a CVC wallet was aware of the individual’s affiliation
advanced persistent threat group, since used by the Lazarus Group sent CVC with DPRK. This DPRK national
at least 2020.67 The U.S. government has valued at over USD 150,000 to Huione maintained personal relationships with
observed DPRK cyber actors targeting a Group.71 multiple Huione Pay PLC officials and
variety of organizations in the FinCEN conducted blockchain regularly met in person with at least one
blockchain technology and analysis, using commercially available of these officials. In late 2023, the DPRK
cryptocurrency industry, including blockchain analytic software, of flows of
national worked with Huione Pay PLC
cryptocurrency exchanges, CVC associated with several heists
officials to convert CVC into fiat
decentralized finance protocols, play-to- carried out by DPRK. This analysis
currency and subsequently transfer fiat
earn CVC video games, CVC trading identified that Huione Group received a
currency to an associate. In total, the
companies, venture capital funds combined total of approximately USD
DPRK national transferred CVC values
investing in CVC, and individual 2.6 million worth of CVC from the June
at tens of thousands USD to the Huione
2, 2023 Atomic Wallet heist and the
holders of large amounts of Pay PLC official. In mid-2023, the DPRK
June 22, 2023 Coinspaid 72 and Alphapo
cryptocurrency or valuable non-fungible national also planned to remit USD
heists.73 In July 2024, Huione Group
tokens.68 FinCEN assesses that, over internationally to Hong Kong and
received USD 35 million worth of stolen
time, the DPRK’s money laundering CVC, later attributed to the Lazarus sought Huione Pay PLC officials help to
processes have become more complex in Group by the FBI, from the May 2024 do so.
order to evade OFAC sanctions, law heist targeting DMM, a Japanese Given the opacity of Huione Group
enforcement, and BSA reporting VASP.74 While the DMM heist was not and the inherent limitation of
obligations from hacked entities or CVC initially attributed to the Lazarus Group blockchain analytics, FinCEN is largely
entities used in the laundering process. (or any other prohibited entity or unable to determine what DPRK actors
In fact, in August 2023, the FBI alerted jurisdiction), the heist itself was widely do with the CVC after they send it to
the public to several thefts from CVC reported by the time Huione Group Huione Group. However, given the close
companies that it attributed to the received the CVC, and FinCEN would connection between Huione Pay PLC
Lazarus Group and warned that there expect covered financial institutions to officials and DPRK nationals with close
could be another USD 40 million worth have an effective AML/KYC program to ties to DPRK’s RGB, FinCEN assesses
appropriately monitor transactions for DPRK most likely uses Huione Group to
64 On January 2, 2015, OFAC sanctioned DPRK’s red flags indicating connections to high convert CVC to fiat currencies.
RGB for being a controlled entity of the Government 2. Huione Group’s Laundering of
of North Korea. See Department of the Treasury, 69 FBI, FBI Identifies Cryptocurrency Funds
Proceeds of Organized Criminal Groups’
Press Release, Treasury Imposes Sanctions Against Stolen by DPRK (Aug. 22, 2023), https://
the Government of The Democratic People’s www.fbi.gov/news/press-releases/fbi-identifies- Cyber Scams
Republic Of Korea (Jan. 2, 2015), https:// cryptocurrency-funds-stolen-by-dprk. Huione Group also has significant
home.treasury.gov/news/press-releases/jl9733. RGB 70 The U.S. government has previously issued
was also previously listed in the annex to E.O. advisories to publicly highlight the Lazarus Group’s exposure to, and has facilitated
13551 on August 30, 2010. Executive Order 13551, threat and tactics associated with CVC theft transactions associated with suspected
‘‘Blocking Property of Certain Persons With Respect targeting organizations in the blockchain and CVC fraud activity, including CVC
to North Korea,’’ 75 FR 53837 (Aug. 30, 2010). industry. See CISA, AA22–108A, TraderTraitor: investment scams, also referred to as
65 This group is commonly referred to by the North Korean State-Sponsored APT Targets
Blockchain Companies (Apr. 20, 2022), https:// pig-butchering. FinCEN assesses that
cybersecurity industry as Lazarus Group, APT38,
BlueNoroff, and Stardust Chollima. For the www.cisa.gov/news-events/cybersecurity-advisories/ Huione Group’s extensive CVC services
aa22-108a. and its online marketplace, Haowang
purposes of this NPRM, FinCEN will refer to this 71 Reuters, Exclusive: North Korean hackers sent
group as Lazarus Group. See Department of the Guarantee, has made Huione Group, a
Treasury, Press Release, Treasury Sanctions North stolen crypto to wallet used by Asian payment firm
(July 15, 2024), https://www.reuters.com/ ‘‘one stop shop’’ for criminals to launder
Korean State-Sponsored Malicious Cyber Group
technology/cybersecurity/north-korean-hackers- CVC obtained through illicit activities,
(Sept. 13, 2019), https://home.treasury.gov/news/
press-releases/sm774.
sent-stolen-crypto-wallet-used-by-asian-payment- and ultimately convert it to fiat
firm-2024-07-15/.
66 Department of the Treasury, Press Release,
72 FBI, FBI Identifies Cryptocurrency Funds
currency.
Treasury Imposes Sanctions Against the Stolen by DPRK (Aug. 22, 2023), https:// a. Background on CVC Investment
ddrumheller on DSK120RN23PROD with PROPOSALS1
Government of The Democratic People’s Republic www.fbi.gov/news/press-releases/fbi-identifies-
Of Korea (Jan. 2, 2015), https://home.treasury.gov/ cryptocurrency-funds-stolen-by-dprk.
Scams
news/press-releases/jl9733.
67 Department of the Treasury, Press Release,
73 Id.
In 2023, FinCEN published an alert on
74 FBI, FBI, DC3, and NPA Identification of North
Treasury Sanctions North Korean State-Sponsored the ‘‘Pig Butchering’’ CVC investment
Korean Cyber Actors, Tracked as TraderTraitor,
Malicious Cyber Groups (Sept. 13, 2019), https:// Responsible for Theft of $308 Million USD from scams.75 These scams are largely
home.treasury.gov/news/press-releases/sm774. Bitcoin.DMM.com (Dec. 23, 2024), https://
68 CISA, AA22–108A, TraderTraitor: North 75 FinCEN, FIN–2023–Alert005, FinCEN Alert on
www.fbi.gov/news/press-releases/fbi-dc3-and-npa-
Korean State-Sponsored APT Targets Blockchain identification-of-north-korean-cyber-actors-tracked- Prevalent Virtual Currency Investment Scam
Companies (Apr. 20, 2022), https://www.cisa.gov/ as-tradertraitor-responsible-for-theft-of-308-million- Commonly Known as ‘‘Pig Butchering’’ (Sept. 8,
news-events/cybersecurity-advisories/aa22-108a. from-bitcoindmmcom. 2023), https://www.fincen.gov/sites/default/files/
VerDate Sep<11>2014 16:16 May 02, 2025 Jkt 265001 PO 00000 Frm 00011 Fmt 4702 Sfmt 4702 E:\FR\FM\05MYP1.SGM 05MYP1
Federal Register / Vol. 90, No. 85 / Monday, May 5, 2025 / Proposed Rules 18941
perpetrated by criminal organizations CVC to Huione Group, CVC is then governing the use of its services. In
based in Southeast Asia, who use converted to fiat currency or different relevant part, the agreement prohibits
victims of human trafficking to conduct CVC, or withdrawn at a later point to the use of Huione Crypto’s platform by
outreach to millions of unsuspecting move to a different VASP, as part of the citizens, nationals or residents of
individuals around the world. The money laundering process. particular countries, including the
frontline scammers in these schemes are United States, Iran or North Korea, as
3. Huione Group’s Lax Anti-Money
themselves often victims of trafficking, well as individuals sanctioned under
Laundering Policies and Procedures
including forced labor, and are various national regimes, including
subjected to physical and mental abuse. The risks presented by Huione those of the United States and United
The traffickers also force victims to Group’s association with illicit actors Nations. The agreement also states that
work up to 15 hours a day and, in some and transactions linked to illicit activity ‘‘the [u]ser may not use the interface or
cases, ‘‘resell’’ victims to other scam are compounded by either an absence services to disguise the origin or nature
operations or subject them to sex of, or ineffective, AML/KYC policies of illicit proceeds.’’ 82 However, the
trafficking.76 and procedures among Huione Group’s extent of the criminal and money
Once trust or a relationship has been components, as well as recent changes laundering activity on Huione Crypto’s
established, the scammer will introduce that have served to obfuscate Huione platforms that violate its terms and
the victim to a supposedly lucrative Group’s involvement in illicit activity. conditions agreement reflects that its
investment opportunity in CVC and For example, in July 2024, Huione AML/KYC program is either ineffective
direct them to use CVC investment Group was the subject of reporting by or unenforced.
websites or applications designed to several blockchain analytic firms Despite this, and as described in
appear legitimate, but are instead describing the use of its various services greater detail in section IV. A.1–2, since
fraudulent and ultimately controlled or by TCOs for scam activity, including at least August 2021, FinCEN
manipulated by the scammer. When a those offered by Haowang Guarantee.78 identified—through analysis of non-
victim’s pace of investment slows or Elliptic reported that Haowang public information—that Huione Group
stops, the scammer will use even more Guarantee offered scam-enabling received at least USD 37 million worth
aggressive tactics to extract any final products and services used by scam of illicit proceeds from sanctioned
payments. The scammer may present compound operators to imprison and entities—including DPRK entities—and
the victim with supposed losses on the torture their workers. The products at least USD 300 million worth of CVC
investment and encourage them to make included tear gas, electric batons, and from various cyber and CVC scam
up the difference through additional electronic shackles, among other related activity. FinCEN’s analysis identified
deposits. If the victim attempts to devices. The same month, in a post to that, in the aggregate, Huione Group has
withdraw their investment, the scammer its website in response to the adverse received at least USD 4 billion worth of
may demand that the victim pay media reporting, Haowang Guarantee illicit proceeds, between August 2021
purported taxes or early withdrawal confirmed that ‘‘detention equipment’’ and January 2025.83 This large-scale,
fees. Once the victim is unable or is not necessarily human trafficking.’’ 79 persistent use of Huione Group by
unwilling to pay more into the scam, the Subsequent to these events, Huione DPRK actors and TCO-driven CVC
scammer will abruptly cease Group, namely Huione Pay PLC, investment scams to launder their illicit
communication with the victim, taking removed all references to Haowang proceeds belies the adequacy or
the victim’s entire investment with Guarantee from its websites.80 effectiveness of Huione Group’s AML/
Neither Huione Pay PLC nor Haowang KYC procedures.
them.77
Guarantee have published AML/KYC Huione Group itself has conceded the
b. Huione Group’s Laundering of policies.81 Huione Crypto does not have deficiencies in its AML regime. In a July
Proceeds of Cyber Scams, Including a published AML/KYC policy either. 2024 media statement, for example,
CVC Investment Scams Rather, it maintains a ‘‘standard terms Huione Group stated ‘‘our [Know Your
Based on FinCEN analysis of non- and conditions’’ on its website Customer] capabilities are now seriously
public information, Huione Group insufficient.’’ 84 This statement was
received at least USD 36 million worth
78 See Chainalysis, 2024 Crypto Crime Mid-year
made after previously claiming earlier
Update Part 2: China-based CSAM and Cybercrime that month—in response to public
of CVC investment scam proceeds since Networks on the Rise, Pig Butchering Scams
at least August 2021. More broadly, the Remain Lucrative (Aug. 29, 2024), https:// identification of one heist, the proceeds
analysis identified that in the aggregate, www.chainalysis.com/blog/2024-crypto-crime-mid- of which were transmitted to Huione
year-update-part-2/; Elliptic, Huione: The Company
inclusive of the cyber scam proceeds, Behind the Largest Ever Illicit Online Marketplace 82 Huione Crypto, Legal, https://www.huione.io/
Huione Group received approximately Has Launched a Stablecoin (Jan. 14, 2025), https:// en-US/termsAndConditions/userAgreement (last
USD 300 million worth of CVC relating www.elliptic.co/blog/huione-largest-ever-illicit- accessed Mar. 27, 2025).
to other cyber scams. Despite the online-marketplace-stablecoin. 83 By illicit category, Huione Group has received
79 Haowang Guarantee, To all public friends on
limitations noted above, FinCEN the following proceeds in CVC, denominated in
social media (July 17, 2024), https:// equivalent USD value: USD 1,363 from child sexual
assesses that, after illicit actors send www.yu444.com/gonggao/detail/2237. abuse material; USD 618,861 from Darknet Markets/
80 Elliptic, Huione: The Company Behind the
Illicit Cyber Vendors; USD 3,246 from FinCEN
shared/FinCEN_Alert_Pig_Butchering_FINAL_ Largest Ever Illicit Online Marketplace Has Primary Money Laundering Concerns; USD
508c.pdf. Launched a Stablecoin (Jan. 14, 2025), https:// 3,248,510,440 from Identified Illicit Cyber actors;
76 Department of the Treasury, Press Release, www.elliptic.co/blog/huione-largest-ever-illicit- USD 47,393,602 from VASPs without KYC policies;
ddrumheller on DSK120RN23PROD with PROPOSALS1
Treasury Sanctions Cambodian Tycoon and online-marketplace-stablecoin. USD 407,129,792 from OFAC Specially Designated
Businesses Linked to Human Trafficking and 81 Repeated searches of their respective websites, Nationals (U.S. sanctioned entities); USD
Forced Labor in Furtherance of Cyber and Virtual including most recently on March 27, 2025, failed 347,549,705 from Scams; USD 22,133,556 from
Currency Scams (Sept. 12, 2024), https:// to yield any evidence of a policy. Haowang seized and/or stolen funds; and 2,627,009 from
home.treasury.gov/news/press-releases/jy2576. Guarantee’s website did contain cursory fraud terrorist financing.
77 FinCEN, FIN–2023–Alert005, FinCEN Alert on indicators available to customers, however, in 84 See ABC News, Cambodian online marketplace
Prevalent Virtual Currency Investment Scam FinCEN’s assessment, this falls short of reasonable outed as one-stop shop for scammers’ money
Commonly Known as ‘‘Pig Butchering’’ (Sept. 8, policies and procedures aimed at combatting money laundering and ‘detention equipment’ needs (July
2023), at p. 4, https://www.fincen.gov/sites/default/ laundering. See Haowang Guarantee, Fangpian, 26, 2024), https://www.abc.net.au/news/2024-07-
files/shared/FinCEN_Alert_Pig_Butchering_FINAL_ https://hwdb.la/fangpian (last accessed Mar. 27, 27/online-marketplace-for-money-laundering-and-
508c.pdf. 2025). scammers/104131624.
VerDate Sep<11>2014 16:16 May 02, 2025 Jkt 265001 PO 00000 Frm 00012 Fmt 4702 Sfmt 4702 E:\FR\FM\05MYP1.SGM 05MYP1
18942 Federal Register / Vol. 90, No. 85 / Monday, May 5, 2025 / Proposed Rules
Pay PLC—that it had not known that Given the various aggravating factors transactions through U.S. correspondent
Huione Pay PLC ‘‘received funds described above, FinCEN finds that the bank accounts, between December 2020
indirectly’’ from the heist, due to the Huione Group—with its weak and and December 2024.
layers of transactions between the ineffective AML policies, procedures, Huione Group’s activity, through
source of the heist and the Huione and controls, provision of services that these constituent services, indicates
Group-owned wallets that ultimately offer anonymity and an ability to evade some legitimate business transiting the
received the funds.85 sanctions, and development of a financial institution. However, under
stablecoin designed to hinder the ability the totality of circumstances, FinCEN
4. Huione Group Is Expanding of law enforcement to recover the assesses that the benefits of any
Problematic CVC-Related Operations proceeds of crime—is being used legitimate business activities Huione
Despite Regulatory Prohibition extensively to facilitate or promote Group conducts are outweighed by the
money laundering, in particular by substantial money laundering risks it
Further illustrating the money poses.
organized criminal groups and entities
laundering risk posed by Huione Group
involved in the proliferation WMD or C. The Extent to Which Action Proposed
is the fact that a significant portion of
missiles. by FINCEN Would Guard Against
its assessed illicit transactional activity
involves CVC, which the National Bank B. The Extent to Which Huione Group International Money Laundering and
of Cambodia, Huione Group’s primary Is Used for Legitimate Business Other Financial Crimes
regulator, expressly prohibits. In a 2024 Purposes Under section 311 and FinCEN’s
public statement, the National Bank of Under section 311 and FinCEN’s delegated authority, in deciding to
Cambodia stated that payment firms are delegated authority, in deciding to apply one or more special measures,
‘‘not allowed to deal or trade any apply one or more special measure, FinCEN may consider the extent to such
cryptocurrencies and digital assets.’’ 86 FinCEN may consider the extent to action is ‘‘sufficient to ensure,’’ that the
Despite this prohibition, Huione Group which the financial institutions ‘‘are purpose of section 311 ‘‘continue[s] to
has continued to develop its CVC used for legitimate business be fulfilled, and to guard against
services and has even expanded its CVC purposes.’’ 89 In addition to the payment international money laundering and
offerings in recent months. In and CVC exchange services outlined in other financial crimes.’’ 92 A finding that
September 2024, Huione Group this NPRM, the Huione Group Huione Group is of primary money
launched USDH, a stablecoin it advertises ostensibly legitimate business laundering concern would make clear
explicitly advertised as ‘‘unfreezable’’ services, such as systems for telephone, the illicit finance risk it poses to
and ‘‘not restricted by traditional water, and electricity bill payments. domestic financial institutions, and by
regulatory agencies.’’ 87 FinCEN assesses Huione Group also offers a point-of-sale extension, to their foreign
that Huione Group is likely taking this system for Cambodian businesses, correspondents. This awareness is likely
unusual step to hamper compliance though there is no indication such a to cause those financial institutions, or
with applicable anti-money laundering system is operational in the United their regulators, to take their own action
laws. Huione Group’s intentional States.90 Huione Group’s payment to mitigate the risks posed by Huione
launching of this ‘‘unfreezable’’ services are also ubiquitous in Group. Moreover, such a finding and
stablecoin differs from other stablecoin Cambodia, most often in the form of subsequent imposition of special
issuers that generally respond to law ‘‘quick response’’ codes, generally measure five, as proposed here, would
enforcement requests to freeze CVC tied referred to as ‘‘QR’’ codes. These QR protect the U.S. financial system from
to illicit activity. One particular codes are common across Cambodia, money laundering and other financial
example of this contrast occurred in July and are used to pay hotel, restaurant, crimes by severing Huione Group’s
2024, when one stablecoin issuer froze and supermarket bills, among other access to the U.S. financial system.
CVC valued at over USD 29 million that general purchases. While FinCEN does V. Proposed Special Measure
was located in a Huione Group CVC not know the full extent of Huione
wallet because it was ‘‘associated with Group’s legitimate business activity, Having found that Huione Group is a
activities allegedly linked to fraudulent Huione Group’s transactional volume financial institution operating outside of
and transnational criminal since inception is believed to be at least the United States and is of primary
operations.’’ 88 By offering USDH, which USD 49 billion worth of CVC since money laundering concern (particularly
is ‘‘unfreezable,’’ even upon a lawful 2021,91 including licit and illicit regarding its laundering of illicit
request from law enforcement, Huione volume. While FinCEN lacks insight proceeds from DPRK-affiliated cyber
Group facilitates and profits from into most of Huione Groups fiat heists and CVC investment scams
money laundering, benefiting TCOs and currency transaction activity, additional carried out by TCOs based in Southeast
DPRK actors exfiltrating the proceeds of FinCEN analysis revealed that Huione Asia), FinCEN proposes imposing a
their crimes. Group engaged in at least USD 41 prohibition on covered financial
million in cleared international institutions under special measure five.
85 Reuters, Exclusive: North Korean hackers sent Special measure five authorizes the
stolen crypto to wallet used by Asian payment firm 89 31 U.S.C. 5318A(c)(2)(B)(ii). Secretary to impose conditions upon the
(July 15, 2024), https://www.reuters.com/ 90 Huione Pay, Service Items: Omni-Directional opening or maintaining in the United
technology/cybersecurity/north-korean-hackers- Service, https://www.huionepay.com.kh/index/ States of a correspondent account or
ddrumheller on DSK120RN23PROD with PROPOSALS1
sent-stolen-crypto-wallet-used-by-asian-payment- service?lang=en (last accessed Mar. 27, 2025).
firm-2024-07-15/. payable-through account, if such
91 Chainalysis, 2024 Crypto Crime Mid-year
86 Id.
Update Part 2: China-based CSAM and Cybercrime
account ‘‘involves’’ a financial
87 Huione Crypto, USDH is a stable currency in
Networks on the Rise, Pig Butchering Scams institution of primary money laundering
one word!, https://huione.io/en-us/introduce (last Remain Lucrative (Aug. 29, 2024), https:// concern.93 Although Huione Group does
accessed Mar. 27, 2025). www.chainalysis.com/blog/2024-crypto-crime-mid- not have correspondent accounts with
88 The Record, Tether freezes $29 million of year-update-part-2/; The New York Times, How
cryptocurrency connected to Cambodian Scammers Launder Money and Get Away With It
U.S. financial institutions, it has
marketplace accused of fueling scams (July 15, (Mar. 23, 2025), https://www.nytimes.com/2025/03/
92 31 U.S.C. 5318A(c)(2)(B)(iii).
2024), https://therecord.media/tether-freezes-29- 23/world/asia/cambodia-money-laundering-
million-crypto-connected-to-scam-marketplace. huione.html. 93 31 U.S.C. 5318A(b)(5).
VerDate Sep<11>2014 16:16 May 02, 2025 Jkt 265001 PO 00000 Frm 00013 Fmt 4702 Sfmt 4702 E:\FR\FM\05MYP1.SGM 05MYP1
Federal Register / Vol. 90, No. 85 / Monday, May 5, 2025 / Proposed Rules 18943
accounts with foreign financial burdens are neither undue nor D. The Effect of the Proposed Action on
institutions that maintain U.S. inappropriate in view of the threat United States National Security and
correspondent accounts. Those U.S. posed by the illicit activity facilitated by Foreign Policy
correspondent accounts involve Huione Huione Group. As described above and As described above, evidence
Group when transactions involving the according to public and non-public available to FinCEN demonstrates that
financial institution are processed information, Huione Group has no Huione Group serves as a significant
through those accounts. Thus, FinCEN direct USD correspondent relationships conduit for money laundering by TCOs
has determined that special measure with U.S. financial institutions and engaged in CVC investment scams and
five will most effectively mitigate the instead, accesses USD through nested DPRK-related actors engaging in CVC
risks posed by Huione Group.
corresponding relationships, outside the heists. Imposing special measure five
FinCEN considered the other special
measures available under section 311. United States. These accounts may be will: (1) close Huione Group’s access to
As discussed further in section IV.E. used for commercial payments, as well USD; (2) inhibit Huione Group’s ability
below, it determined that none of them as foreign exchange and money markets. to act as an illicit finance facilitator for
would appropriately address the risks Covered financial institutions and DPRK and TCOs engaged in CVC
posed by Huione Group. transaction partners have ample investment scams; and (3) raise
In proposing this special measure, opportunity to arrange for alternative awareness of the way illicit actors
FinCEN consulted with representatives payment mechanisms in the absence of exploit weaknesses in vulnerable
and staff of the Board of Governors of correspondent banking relationships jurisdictions to circumvent sanctions
the Federal Reserve System, the Office with Huione Group. and finance WMD and ballistic missile
of the Comptroller of the Currency, the proliferation.
As such, a prohibition on
Secretary of State, the staff of the correspondent banking with Huione E. Consideration of Alternative Special
Securities and Exchange Commission, Group is expected to impose minimal Measures
the Commodity Futures Trading additional compliance costs for covered In assessing the appropriate special
Commission, staff of the National Credit
financial institutions, which would measure to impose, FinCEN considered
Union Administration, the Federal
most commonly involve adding Huione alternatives to a prohibition on the
Deposit Insurance Corporation, and the
Group to existing sanctions and money opening or maintaining in the United
Attorney General.94 These consultations
laundering screening tools. FinCEN States of correspondent accounts or
involved obtaining interagency views on
assesses that given the risks posed by payable-through accounts, including the
the imposition of special measure five
Huione Group’s facilitation of money imposition of one or more of the first
and the effects that such a prohibition
laundering, the additional burden on four special measures, or imposing
would have on the U.S. domestic and
covered financial institutions in conditions on the opening or
international financial systems.
In addition, FinCEN considered the preventing the opening of maintaining of correspondent accounts
factors set forth in section 311, as set correspondent accounts with Huione under special measure five. Having
forth below.95 Group, as well as conducting due considered these alternatives and for the
diligence on foreign correspondent reasons set out below, FinCEN assesses
A. Whether Similar Action Has Been or that none of the other special measures
Is Being Taken by Other Nations or account holders and notifying them of
available under section 311 would
Multilateral Groups Regarding Huione the prohibition, will be minimal and not
appropriately address the risks posed by
Group undue.
Huione Group and the urgent need to
In March 2025, at least one news C. The Extent to Which the Action or the prevent it from accessing USD through
outlet reported that the National Bank of Timing of the Action Would Have a correspondent banking.
Cambodia stripped Huione Pay PLC of Significant Adverse Systemic Impact on With its public acknowledgements of
its banking license.96 FinCEN is not the International Payment, Clearance, its failure to address significant AML/
otherwise aware of any other nation or and Settlement System, or on Legitimate KYC deficiencies, Huione Group
multilateral group that has imposed, or Business Activities of Huione Group continues to present a significant money
is currently imposing, similar action laundering risk, particularly related to
against Huione Group. FinCEN assesses that imposing the DPRK cyber heists and TCO-run scams.
proposed special measure would have Taken as a whole, Huione Group’s
B. Whether the Imposition of Any minimal impact upon the international history of involvement in laundering
Particular Special Measure Would proceeds of illicit activities, and its
payment, clearance, and settlement
Create a Significant Competitive creation of an unfreezable stablecoin,
system. As a comparatively small
Disadvantage, Including Any Undue presents a heightened risk that Huione
financial institution responsible for a
Cost or Burden Associated With Group will continue to be used by illicit
Compliance, for Financial Institutions nominal amount of transaction volume
in the region, Huione Group is not a actors. A key feature of Huione Group’s
Organized or Licensed in the United service offerings includes a marketplace
States systemically important financial
institution in Cambodia, regionally, or to sell items that enable CVC investment
While FinCEN assesses that the globally. FinCEN views that prohibiting scams, and money laundering services
prohibition proposed in this NPRM to launder the proceeds of the scams.
Huione Group’s access to U.S.
ddrumheller on DSK120RN23PROD with PROPOSALS1
would place some cost and burden on Huione Group serves as a significant
correspondent banking channels would
covered financial institutions, these node of the money laundering
not affect overall cross-border ecosystem that enables criminals to both
94 See 31 U.S.C 5318A(b)(5). transaction volumes. Further, a obtain necessary items to carry out
95 31 U.S.C. 5318A(a)(4)(B)(i)–(iv). prohibition under special measure five various crimes, and the services to
96 Radio Free Asia, Exclusive: World’s Largest would not prevent Huione Group from launder the proceeds of those crimes.
online black market’ Loses banking license (Mar. 6, conducting legitimate business activities
2025), https://www.rfa.org/english/cambodia/2025/
Because of the nature, extent, and
03/06/huione-cambodia-cyberscam-cryptocurrency/
in other foreign currencies. purpose of the obfuscation engaged in
. by Huione Group, any special measure
VerDate Sep<11>2014 16:16 May 02, 2025 Jkt 265001 PO 00000 Frm 00014 Fmt 4702 Sfmt 4702 E:\FR\FM\05MYP1.SGM 05MYP1
18944 Federal Register / Vol. 90, No. 85 / Monday, May 5, 2025 / Proposed Rules
intended to mandate additional correspondent accounts.100 Given VI. Section-by-Section Analysis
information collection would likely be Huione Group’s longstanding ties to
The goal of this proposed rule is to
ineffective and insufficient to determine DPRK proliferation finance, coupled combat and deter DPRK-affiliated
the true identity of illicit finance actors with money laundering tied to CVC money laundering and the laundering of
who transact with the group. For investment scams, and public
example, the provision under special proceeds from cyber scams including,
acknowledgment of failures of its AML/ CVC investment scams carried out by
measure one, that ‘‘the identity and KYC program, FinCEN determined that
address of the participants in a TCOs through Huione Group, and to
imposing any condition would not be an prevent Huione Group from using the
transaction or relationship, including effective measure to safeguard the U.S.
the identity of the originator of any U.S. financial system to enable its illicit
financial system. FinCEN assesses that finance behavior.
funds transfer’’ be collected in records the billions of dollars’ worth of CVC and
and reports, could be circumvented by fiat laundered through Huione Group’s A. 1010.664(a)—Definitions
the operations of shell companies,
exploitation of its access to USD, and 1. Definition of Huione Group
wherein the reported identity of the
the exposure of U.S. financial
originator serves to obscure the true The term ‘‘Huione Group’’ means all
beneficial owner or originator.97 This institutions to Huione Group’s illicit
activity, outweigh the value in subsidiaries, branches, and offices of
would be ineffective in preventing illicit Huione Group operating as a financial
transactions. Huione Group’s record of providing conditioned access to the U.S.
institution in any jurisdiction outside of
such circumvention suggests that financial system for any purportedly
the United States, including Haowang
special measure one would not legitimate business activity. Conditions
Guarantee (formerly known as Huione
adequately protect the U.S. financial on the opening or maintaining of
Guarantee), Huione Pay PLC, and
system from the threats posed by the correspondent accounts would likely be Huione Crypto Spó5ka Z Ograniczona˛
financial institution. Further, the insufficient to prevent illicit financial Odpowiedzialnościa˛ (d/b/a Huione
requirements under special measures flows through the U.S. financial system, Crypto).
three and four, that domestic financial given Huione Group’s inadequate AML/
institutions obtain ‘‘with respect to each KYC program. 2. Definition of Correspondent Account
customer (and each such In sum, FinCEN assesses that any The term ‘‘correspondent account’’
representative), information that is condition or additional recordkeeping has the same meaning as the definition
substantially comparable to that which or reporting requirement would be an contained in 31 CFR 1010.605(c)(1)(ii).
the depository institution obtains in the ineffective measure to safeguard the In the case of a U.S. depository
ordinary course of business with respect U.S. financial system from the illicit institution, this broad definition
to its customers residing in the United includes most types of banking
behavior facilitated by Huione Group.
States,’’ are also likely to be relationships between a U.S. depository
Such measures would not prevent
ineffective.98 Huione Group’s use of institution and a foreign bank that are
nested correspondent account access Huione Group from accessing the
correspondent accounts of U.S. financial established to provide regular services,
through layers of payment systems dealings, and other financial
would render these alternative measures institutions, thus leaving the U.S.
financial system vulnerable to transactions, including a demand
ineffective. Only significant effort and deposit, savings deposit, or other
expense by U.S. institutions could fill processing illicit transfers that are likely
to finance DPRK’s nuclear proliferation, transaction or asset account, and a
this gap, which would impose a credit account or other extension of
disproportionate compliance burden, or CVC investment scams, resulting in
significant national security and money credit. FinCEN is using the same
with no guarantee that the money
laundering risk. In addition, no definition of ‘‘account’’ for purposes of
laundering threat would be addressed
this proposed rule as is established for
through customer due diligence recordkeeping or reporting requirements
depository institutions in the final rule
research. FinCEN also considered or conditions would be sufficient to
implementing the provisions of section
special measure two, which may require guard against the risks posed by a
312 of the USA PATRIOT Act, requiring
domestic financial institutions to financial institution that processes
enhanced due diligence for
‘‘obtain and retain information transactions that are designed to obscure correspondent accounts maintained for
concerning the beneficial ownership of the transactions’ true nature and are certain foreign banks.101 Under this
any account opened or maintained in ultimately for the benefit of DPRK and
the United States by a foreign definition, ‘‘payable-through accounts’’
TCOs. Therefore, FinCEN has are a type of correspondent account.
person.’’ 99 The agency determined that determined that a prohibition on
this special measure would likely be In the case of securities broker-
opening or maintaining correspondent dealers, futures commission merchants,
ineffective since the concerns involving banking relationships is the only
Huione Group do not involve the introducing brokers in commodities,
available special measure available and investment companies that are
opening or maintaining of accounts in under section 311 that can adequately
the U.S. by foreign persons. open-end companies (mutual funds),
protect the U.S. financial system from FinCEN is also using the same
FinCEN similarly assesses that merely
the illicit finance risk posed by Huione definition of ‘‘account’’ for purposes of
imposing conditions under special
Group. For these reasons, and after this proposed rule as was established for
measure five would be inadequate to
ddrumheller on DSK120RN23PROD with PROPOSALS1
thorough consideration of alternate these entities in the final rule
address the risks posed by Huione
measures, FinCEN assesses that no implementing the provisions of section
Group’s activities. Special measure five
measures short of full prohibition on 312 of the USA PATRIOT Act, requiring
enables FinCEN to impose conditions as
an alternative to a prohibition on the correspondent or payable-through due diligence for correspondent
opening or maintaining of banking access would be sufficient to accounts maintained for certain foreign
address the money laundering risks banks.102
97 31 U.S.C. 5318A(b)(1)(B)(i). posed by Huione Group.