Final rule: Special measure regarding Huione Group (90 FR 48295) (Part 1 of 2)
Document text
Research, not advice. Part of the Bitcoin research archive (October 2026). Claims labelled unverified, contested or fringe are reported, not endorsed; statuses of bills and rules are as of the date checked. Government, court and patent records are public domain; the research notes are CC BY 4.0.
48295
Rules and Regulations Federal Register
Vol. 90, No. 198
Thursday, October 16, 2025
This section of the FEDERAL REGISTER • One or more financial institutions Secretary is required to consult with
contains regulatory documents having general operating outside of the United States; both the Secretary of State and the
applicability and legal effect, most of which • One or more classes of transactions Attorney General.5 In addition, in the
are keyed to and codified in the Code of within, or involving, a jurisdiction case of a decision to apply one or more
Federal Regulations, which is published under outside of the United States; or of the special measures, in making a
50 titles pursuant to 44 U.S.C. 1510. • One or more types of accounts.’’ 1 finding that reasonable grounds exist for
Upon making such a finding, the concluding that a financial institution
The Code of Federal Regulations is sold by
the Superintendent of Documents. Secretary is authorized to require outside of the United States is of
domestic financial institutions and primary money laundering concern, the
domestic financial agencies to take Secretary is required to consider such
DEPARTMENT OF THE TREASURY certain ‘‘special measures.’’ 2 The five information as the Secretary determines
special measures set out in section 311 to be relevant, including the following
Financial Crimes Enforcement Network are safeguards that may be employed to potentially relevant institutional factors:
defend the U.S. financial system from • The extent to which such a
31 CFR Part 1010 money laundering and terrorist financial institution is used to facilitate
financing risks. The Secretary may or promote money laundering in or
RIN 1506–AB68 impose one or more of these special through a jurisdiction outside the
measures to protect the U.S. financial United States, including any money
Imposition of Special Measure system from such threats. Through laundering activity by organized
Regarding Huione Group, as a Foreign special measures one through four, the criminal groups, international terrorists,
Financial Institution of Primary Money Secretary may impose additional or entities involved in the proliferation
Laundering Concern recordkeeping, information collection, of weapons of mass destruction (WMD)
and reporting requirements on covered or missiles;
AGENCY: Financial Crimes Enforcement
Network (FinCEN), Treasury.
domestic financial institutions and • The extent to which such a
domestic financial agencies— financial institution is used for
ACTION: Final rule. collectively, ‘‘covered financial legitimate business purposes in the
institutions.’’ 3 Through special measure jurisdiction; and
SUMMARY: FinCEN is issuing this final
five, the Secretary may ‘‘prohibit, or • The extent to which such action is
rule to prohibit covered U.S. financial
impose conditions upon, the opening or sufficient to ensure, with respect to
institutions from opening or
maintaining in the United States of a transactions involving the jurisdiction
maintaining a correspondent account
correspondent account or payable- and institutions operating in the
for, or on behalf of Huione Group, a
through account’’ for or on behalf of a jurisdiction, that the purposes of section
foreign financial institution based in
foreign banking institution, if such 311 continue to be fulfilled, and to
Cambodia found to be of primary money
correspondent account or payable- guard against international money
laundering concern pursuant to section
through account involves the foreign laundering and other financial crimes.6
311 of the USA PATRIOT Act. The rule financial institution found to be of In selecting one or more special
further requires covered financial primary money laundering concern.4 measures, the Secretary ‘‘shall consult
institutions to apply special due Before making a finding that with the Chairman of the Board of
diligence to their foreign correspondent reasonable grounds exist for concluding Governors of the Federal Reserve
accounts that is reasonably designed to that a financial institution outside of the System, any other appropriate Federal
guard against the use of such accounts United States (or other jurisdiction, banking agency (as defined in section 3
to process transactions involving account, or class of transactions) is of of the Federal Deposit Insurance Act),
Huione Group. primary money laundering concern, the the Secretary of State, the Securities and
DATES: This final rule is effective Exchange Commission, the Commodity
November 17, 2025. 1 31 U.S.C. 5318A(a)(1). Futures Trading Commission, the
FOR FURTHER INFORMATION CONTACT:
2 On October 26, 2001, the President signed into
National Credit Union Administration
law the Uniting and Strengthening America by Board, and in the sole discretion of the
FinCEN’s Regulatory Support Section at Providing Appropriate Tools Required to Intercept
www.fincen.gov/contact. and Obstruct Terrorism Act of 2001, Public Law Secretary, such other agencies and
SUPPLEMENTARY INFORMATION: 107–56 (USA PATRIOT Act). Title III of the USA interested parties as the Secretary may
PATRIOT Act amended the anti-money laundering find appropriate.’’ 7 When imposing
I. Background (AML) provisions of the Bank Secrecy Act (BSA) to
promote the prevention, detection, and prosecution
special measure five, the Secretary must
A. Statutory Provisions of international money laundering and the do so ‘‘in consultation with the
financing of terrorism. The BSA, as amended, is the Secretary of State, the Attorney General,
Section 311 of the USA PATRIOT Act popular name for a collection of statutory and the Chairman of the Board of
(section 311), codified at 31 U.S.C. authorities that FinCEN administers that is codified
at 12 U.S.C. 1829b, 1951–1960 and 31 U.S.C. 5311–
Governors of the Federal Reserve
5318A, grants the Secretary of the 5314, 5316–5336, and includes other authorities
Treasury (Secretary) the authority to reflected in notes thereto. Regulations 5 31 U.S.C. 5318A(c)(1).
lotter on DSK11XQN23PROD with RULES1
make a finding that ‘‘reasonable grounds implementing the BSA appear at 31 CFR Chapter 6 31 U.S.C. 5318A(c)(2)(B)(i)–(iii). In addition, in
exist for concluding’’ that any of the X. the case of a finding relating to a particular
3 31 U.S.C. 5318A(b)(1)–(4). The term ‘‘covered jurisdiction, section 311 sets out certain
following ‘‘is of primary money
financial institution’’ has the same meaning as ‘‘jurisdictional factors’’ that the Secretary may
laundering concern: provided at 31 CFR 1010.605(e)(1); see infra section consider, which are not relevant here. See 31 U.S.C.
• A jurisdiction outside of the United IV.A.3. 5318A(c)(2)(A)(i)–(vii).
States; 4 31 U.S.C. 5318A(b)(5). 7 31 U.S.C. 5318A(a)(4)(A).
VerDate Sep<11>2014 15:47 Oct 15, 2025 Jkt 265001 PO 00000 Frm 00001 Fmt 4700 Sfmt 4700 E:\FR\FM\16OCR1.SGM 16OCR1
48296 Federal Register / Vol. 90, No. 198 / Thursday, October 16, 2025 / Rules and Regulations
System.’’ 8 In addition, the Secretary is parent company of, or otherwise foreign financial institution of primary
required to consider the following controls, several subsidiaries, affiliates, money laundering concern pursuant to
factors: and components—including, but not 31 U.S.C. 5318A.17
• Whether similar action has been or limited to: Haowang Guarantee, Huione As described in the NPRM, since its
is being taken by other nations or Pay PLC, and Huione Crypto (the establishment, Huione Group has set up
multilateral groups; ‘‘Components’’)—that coordinate to a network of businesses, each playing a
• Whether the imposition of any provide services that are useful for different role in its money laundering
particular special measure would create money laundering and carrying out enterprise. However, FinCEN’s analysis
a significant competitive disadvantage, cyber scams. FinCEN assesses that, as
including any undue cost or burden of Huione Group has identified the
discussed below, Huione Group and its
associated with compliance, for sharing of CVC infrastructure by Huione
Components operate as a coordinated
financial institutions organized or Group’s constituent entities, indicating
collective, and for that reason, FinCEN
licensed in the United States; that the entities, including the
will correspondingly refer to Huione
• The extent to which the action or controlling entity Huione Group, are
Group and its Components as the
the timing of the action would have a functionally operating as one and the
‘‘Huione Group.’’
significant adverse systemic impact on Although it was originally same, despite the various branding.
the international payment, clearance, incorporated in Hong Kong in 2018 as Because Huione Group shares CVC
and settlement system, or on legitimate Huione Group Limited, Huione Group, infrastructure, the structure makes it
business activities involving the the controlling entity of the challenging to ascertain the specific
particular jurisdiction, institution, class conglomerate, does not appear to be Component involved in any particular
of transactions, or type of account; and registered as a business in any transaction.
• The effect of the action on United jurisdiction,13 and several of Huione The overall Huione Group network
States national security and foreign Group’s Components have been offers services ranging from an online
policy.9 registered outside of Cambodia. marketplace selling items useful for
The authority of the Secretary to Nevertheless, Huione Group’s website is carrying out cyber scams to money
administer the Bank Secrecy Act (BSA) registered 14 to an individual with a laundering services that accept both fiat
and its implementing regulations, listed location of Phnom Penh, currencies and CVC. Huione Group has
including the authority under section Cambodia and Huione Group’s also created its own stablecoin, a type
311 to make such a finding and to operations are principally carried out in of CVC that is usually backed by a pre-
impose special measures, has been Cambodia. determined quantity of fiat currency,
delegated to the Director of FinCEN.10 For years, Huione Group has most often the U.S. dollar (USD). The
B. Huione Group laundered illicit proceeds from stablecoin, ‘‘USDH,’’ which is a ticker
cybercrimes—namely, cyber heists symbol for ‘‘U.S. Dollar Huione,’’ is
Huione Group 11 is a financial carried out by the Lazarus Group,15 an pegged to the USD at a one-to-one ratio
services conglomerate based in Phnom entity sanctioned by Treasury’s Office of and is represented as a stablecoin that
Penh, Cambodia.12 Huione Group is the Foreign Assets Control (OFAC)—and cannot be frozen.18 In contrast, many
Convertible Virtual Currency (CVC) stablecoin issuers develop their
8 31 U.S.C. 5318A(b)(5).
9 31 U.S.C. 5318A(a)(4)(B)(i)–(iv).
investment scams carried out by stablecoins to retain the ability to freeze
10 See Treasury Order 180–01 (Jan. 14, 2020).
transnational criminal organizations funds, which they have sometimes done
11 Huione Group is the parent company of several (TCOs) based in Southeast Asia.16 in cases of known criminal activity, or
subsidiaries and components, including Haowang II. FinCEN’s Section 311 Rulemaking at the request of law enforcement.
Guarantee, Huione Pay PLC, and Huione Crypto. Because Huione Group claims that
FinCEN assesses that this grouping of exchange Regarding Huione Group
services operates as a coordinative collective, and
USDH cannot be frozen, this service
In a notice of proposed rulemaking offers Huione Group’s clientele a
for that reason, FinCEN will correspondingly refer
to the collective as the ‘‘Huione Group.’’ (NPRM) published in the Federal virtually risk-free ecosystem to move or
12 Cambodia Corporate Registry, ‘‘Huione’’ Register on May 5, 2025, FinCEN found store CVC without the possibility of
Search, https://www.businessregistration. that reasonable grounds exist for interception or ‘‘freezing’’ by law
moc.gov.kh/cambodia-master/service/create.html? concluding that Huione Group is a
targetAppCode=cambodia-master& enforcement.
targetRegisterAppCode=cambodia-br- 13 Hong Kong Companies Registry, Huione Group Indeed, much of the illicit revenue
companies&service=registerItemSearch (last
accessed Oct. 7, 2025); Huione Pay, Index, formerly Limited, at p. 54, https://www.cr.gov.hk/docs/wrpt/ laundered through Huione Group
available at https://www.huionepay.com.kh/index/ RNC063_2018.12.17-2018.12.23.pdf. originates from well-documented
14 The registration is valid through June 3, 2026.
help; Huione Group, About, which is no longer criminal activity, and numerous
accessible and will be discussed later in this See ICANN, Huione.com, https://lookup.icann.org/
en/huione.com (last accessed Oct. 7, 2025).
publicly available reports describe the
section, formerly available at https://huione.com/
html/about.jsp (last accessed Sept. 24, 2024). 15 The Lazarus Group is an agency, failings of Huione Group’s anti-money
Huione Crypto has numerous job announcements instrumentality, or controlled entity of the laundering/know your customer (AML/
with a work location in Phnom Penh, Cambodia. government of the Democratic People’s Republic of KYC) program. Despite these reports
See Huione Crypto, Career Opportunities, formerly Korea, that has stolen large volumes of Convertible and Huione Group’s public
available at https://www.huione.io/en-US/ Virtual Currency in numerous and often widely
careerOpportunities (last accessed Mar. 27, 2025). reported cyber heists. On September 13, 2019, the
Lazarus Group was sanctioned by OFAC. See 17 FinCEN, Special Measure Regarding Huione
Haowang Guarantee also lists job announcements
with a work location in Phnom Penh, Cambodia. Department of the Treasury, Press Release, Treasury Group, as a Foreign Financial Institution of Primary
See Haowang Guarantee, About, formerly available Sanctions North Korean State-Sponsored Malicious Money Laundering Concern, 90 FR 18934 (May 5,
at https://www.hwdb.la/about/ (last accessed Mar. Cyber Groups, (Sept. 13, 2019), https:// 2025).
home.treasury.gov/news/press-releases/sm774.
lotter on DSK11XQN23PROD with RULES1
27, 2025). This information was previously 18 See https://huione.money (website for ‘‘USDH
available as of the issuance of the NPRM, however, 16 These scams are also referred to as ‘‘pig (Huione USD), Stablecoin that Never be freezed’’
it has since been removed by Haowang Guarantee, butchering.’’ See FinCEN, FIN–2023–Alert005, describing USDH as ‘‘[a] stablecoin pegged 1:1 to
resulting in a ‘‘page not found’’ error. FinCEN FinCEN Alert on Prevalent Virtual Currency the US Dollar launched by Huione Labs under
assesses that this change is more likely than not Investment Scam Commonly Known as ‘‘Pig Huione Group.’’); Huione Crypto, USDH is a stable
caused by negative public attention following a Butchering’’ (Sept. 8, 2023), https:// currency in one word!, formerly available at https://
series of reports by blockchain analytic firms on www.fincen.gov/sites/default/files/shared/FinCEN_ huione.io/en-us/introduce (last accessed Mar. 27,
money laundering occurring at Huione Group. Alert_Pig_Butchering_FINAL_508c.pdf. 2025).
VerDate Sep<11>2014 15:47 Oct 15, 2025 Jkt 265001 PO 00000 Frm 00002 Fmt 4700 Sfmt 4700 E:\FR\FM\16OCR1.SGM 16OCR1
Federal Register / Vol. 90, No. 198 / Thursday, October 16, 2025 / Rules and Regulations 48297
acknowledgments of its failings,19 The BSA defines a ‘‘financial Guarantee; Huione Pay PLC; and Huione
FinCEN assesses that Huione Group has institution’’ to be any of several Crypto. FinCEN finds that reasonable
no meaningful AML/KYC program, even categories of entities, including money grounds exist to conclude that Huione
after FinCEN issued the NPRM on May transmitters.23 The BSA defines a Group and each of the Components
5, 2025.20 money transmitter as including ‘‘a engages in the business of money
This Final Rule (1) sets forth licensed sender of money or any other transmission, and is therefore a
FinCEN’s finding, based on public and person who engages as a business in the financial institution under the BSA and
non-public information, that Huione transmission of currency funds, or value its implementing regulations.
Group is a financial institution that substitutes for currency.’’ 24 A
operating outside of the United States of a. Huione Group
money transmitter does not require a
primary money laundering concern; and particular license, corporate structure, Huione Group is a Cambodia based,
(2) imposes special measure five, which or physical location. Hong Kong-registered,28 sole
prohibits covered financial institutions As detailed further below, much of proprietorship founded in or around
from opening or maintaining a Huione Group’s illicit money 2014, that appears to be owned and
correspondent account for, or on behalf transmitting activity occurs through controlled by an individual Cambodian
of, Huione Group. transactions in CVC. This is consistent national,29 and at times holds itself out
A. Findings with the money transmitter definition, as the parent entity of the
which includes services in CVC. Components.30 By its own account,
Section 311 authorizes FinCEN, FinCEN’s 2019 Guidance on CVC Huione Group began as a fiat currency
through delegated authority and in explains that for the purposes of the exchange service and over the past
relevant part, to make a finding ‘‘that BSA’s implementing regulations, decade, expanded its commercial
reasonable grounds exist for persons ‘‘may be a money transmitter interests to include finance, insurance,
concluding’’ that ‘‘[one] or more . . . regardless of the technology real estate entities,31 and most recently,
financial institutions operating outside employed for the transmittal of value or CVC exchange services.32 The
of the United States’’ is ‘‘of primary the type of asset the person uses as Components operate in an
money laundering concern.’’ 21 A value that substitutes for currency, or interconnected fashion to provide an
prerequisite to such a finding is that the whether such asset is physical or integrated payment service provider,
relevant institution is a ‘‘financial virtual.’’ 25 For the reasons explained in illicit online market, and CVC
institution operating outside of the that Guidance, the term ‘‘value that exchanger (a type of virtual asset service
United States.’’ 22 substitutes for currency’’ includes provider or VASP).
19 Following negative public reporting about
CVC.26 Huione Group, as an individual
Huione Group in July 2024, Huione Group provided entity, coordinates the Components’
1. Huione Group and Its Identified
a statement to ABC News, stating that ‘‘. . . because activities by operating the customer
Components Are Each a Financial
our [Huione Group’s] services are all public, service and public relations functions of
covering Asia, Europe and America, and the privacy Institution
attributes of [CVC] are superimposed, our KYC
[know your customer] capabilities are now
Huione Group is a parent entity that 28 Hong Kong Companies Registry, Huione Group
controls the following constituent Limited, at p. 54, https://www.cr.gov.hk/docs/wrpt/
seriously insufficient.’’ See ABC News, Cambodian
RNC063_2018.12.17-2018.12.23.pdf.
online marketplace outed as one-stop shop for entities or Components: 27 Haowang 29 See The Record, Tether freezes $29 million of
scammers’ money laundering and ‘detention
equipment’ needs (July 26, 2024), https:// cryptocurrency connected to Cambodian
authorizes ‘‘Prohibitions or Conditions on Opening marketplace accused of fueling scams (July 15,
www.abc.net.au/news/2024-07-27/online-
or Maintaining Certain Correspondent or Payable- 2024), https://therecord.media/tether-freezes-29-
marketplace-for-money-laundering-and-scammers/
Through Accounts.’’ The statute goes on to define million-crypto-connected-to-scam-marketplace.
104131624; see also The Record, Tether freezes $29
the terms correspondent account and payable- 30 See, e.g., Elliptic, Huione: The Company
million of cryptocurrency connected to Cambodian
through account in reference to payments made on Behind the Largest Ever Illicit Online Marketplace
marketplace accused of fueling scams (July 15,
behalf of a ‘‘foreign financial institution’’—a term Has Launched a Stablecoin (Jan. 14, 2025), https://
2024), https://therecord.media/tether-freezes-29-
otherwise undefined. For the purposes of this final www.elliptic.co/blog/huione-largest-ever-illicit-
million-crypto-connected-to-scam-marketplace;
Elliptic, Huione Guarantee: The multi-billion dollar rule, and under these facts, FinCEN finds that online-marketplace-stablecoin; Elliptic, Huione
marketplace used by online scammers (July 9, 2024, Huione Group is both a foreign financial institution Guarantee: The multi-billion dollar marketplace
updated Mar. 27, 2025), https://www.elliptic.co/ and a financial institution outside of the United used by online scammers (July 9, 2024, updated
blog/cyber-scam-marketplace; Elliptic, Huione: The States. Mar. 27, 2025), https://www.elliptic.co/blog/cyber-
23 See 31 U.S.C. 5312(a)(2).
Company Behind the Largest Ever Illicit Online scam-marketplace; Chainalysis, 2024 Crypto Crime
24 31 U.S.C. 5312(a)(2)(R) (allowing ‘‘a licensed
Marketplace Has Launched a Stablecoin (Jan. 14, Mid-year Update Part 2: China-based CSAM and
2025), https://www.elliptic.co/blog/huione-largest- sender of money or any other person . . .’’ to Cybercrime Networks on the Rise, Pig Butchering
ever-illicit-online-marketplace-stablecoin; constitute money transmitter). FinCEN’s Scams Remain Lucrative (Aug. 29, 2024), https://
Chainalysis, 2024 Crypto Crime Mid-year Update implementing regulations define ‘‘person’’ broadly www.chainalysis.com/blog/2024-crypto-crime-mid-
Part 2: China-based CSAM and Cybercrime as ‘‘an individual, a corporation, a partnership, a year-update-part-2/; ABC News, Cambodian online
Networks on the Rise, Pig Butchering Scams trust or estate, a joint stock company, an marketplace outed as one-stop shop for scammers’
Remain Lucrative (Aug. 29, 2024), https:// association, a syndicate, joint venture, or other money laundering and ‘detention equipment’ needs
www.chainalysis.com/blog/2024-crypto-crime-mid- unincorporated organization or group, an Indian (July 26, 2024), https://www.abc.net.au/news/2024-
year-update-part-2/. Tribe (as that term is defined in the Indian Gaming 07-27/online-marketplace-for-money-laundering-
20 In a June 18, 2025 comment on the NRPM, Regulatory Act), and all entities cognizable as legal and-scammers/104131624; Huione Crypto, Terms
outside counsel for Huione Pay PLC claimed that personalities.’’ 31 CFR 1010.100(mm). and Conditions, formerly available at https://
‘‘Huione Pay PLC is an independent entity and is 25 FinCEN, FIN–2019–G001, Application of www.huione.io/en-US/termsAndConditions/
undertaking substantial efforts to address and FinCEN’s Regulations to Certain Business Models userAgreement (last accessed Mar. 27, 2025). The
remediate compliance issues raised by the [NPRM]’’ Involving Convertible Virtual Currencies (May 9, Huione Group website is no longer accessible,
For reasons explained in Section II.C.1, FinCEN 2019), at Section 1.2.3, https://www.fincen.gov/ which FinCEN assesses is likely a response to
continues to assess that Huione Pay PLC is a sites/default/files/2019-05/ negative public attention following a series of
component of Huione Group. See infra Section FinCEN%20Guidance%20 reports by blockchain analytic firms on money
lotter on DSK11XQN23PROD with RULES1
II.C.1. CVC%20FINAL%20508.pdf. laundering occurring at Huione Group.
21 31 U.S.C. 5318A(a)(1). 26 Id. at Sections 1.2.1, 1.3. 31 Huione Group, Who We Are, formerly available
22 31 U.S.C. 5318A(a)(1) authorizes the 27 As explained further in Section II.B, since the at https://www.huione.com/html/about.jsp (last
imposition of special measures on, among others, NPRM was issued, Huione Group changed its accessed Sept. 24, 2024).
‘‘financial institutions operating outside of the business structure in an apparent effort to counter 32 Huione Crypto, Introduce, formerly available at
United States.’’ Of the five special measures governmental scrutiny, including the special https://www.huione.io/en-US/introduce (last
authorized by the statute, the fifth measure measure proposed in FinCEN’s May 2025 NPRM. accessed Mar. 26, 2025).
VerDate Sep<11>2014 15:47 Oct 15, 2025 Jkt 265001 PO 00000 Frm 00003 Fmt 4700 Sfmt 4700 E:\FR\FM\16OCR1.SGM 16OCR1
48298 Federal Register / Vol. 90, No. 198 / Thursday, October 16, 2025 / Rules and Regulations
the Huione Group. Huione Group Guarantee was rebranded as Haowang and determined it had processed at least
historically does this by hosting Guarantee, announcing the change on USD 49 billion worth of CVC since
Telegram channels 33 to aid customers September 30, 2024, and offering 2021. Chainalysis also determined that
experiencing problems with the services customer discount following the merchants operating on Haowang
that the Components provide.34 One of rebrand to thank its long-term Guarantee’s marketplace offered various
Huione Group’s Telegram channels also customers.37 The reason for the illicit services, including the
provides public relations commentary Haowang Guarantee rebrand is unclear, technology, infrastructure, and
on behalf of the whole of the Huione although FinCEN assesses that it could resources to conduct cyber scams.43
Group network. On March 9, 2025, that be to distance itself from the negative In addition, Elliptic reports that
public relations channel responded to public reporting about Huione Group.38 Haowang Guarantee provides money
counter news media reports that the Multiple blockchain analytic firms laundering services to criminal
Cambodian government revoked Huione have analyzed and reported on organizations, helping them transfer the
Pay PLC’s banking license.35 Through Haowang Guarantee for facilitating the proceeds of investment frauds and other
coordination by Huione Group, Huione sale of contraband and illicit services. cyber scams to the legitimate banking
Group’s Components all share CVC For example, a public report issued by sector undetected.44 Because Haowang
infrastructure, making it challenging to blockchain analytics company Elliptic Guarantee offers ‘‘virtual digital
ascertain the specific Component found that Haowang Guarantee appears products and transaction services’’ and
involved in a particular transaction. to operate in a manner similar to a facilitates CVC transactions, FinCEN
FinCEN finds that reasonable grounds darknet market.39 This assessment is finds that there are reasonable grounds
exist to conclude that Huione Group is based on the fact that Haowang to conclude that it is engaged as a
a money transmitter. By providing Guarantee offers a marketplace where business in the transmission of value
customer service and public relations third party merchants can sell goods that substitutes for currency.
services on behalf of the Components, and services, including money Accordingly, FinCEN finds that
Huione Group is itself part of a network laundering services and equipment that reasonable grounds exist to conclude
of people who engage as a business in can be used to detain people, which that Haowang Guarantee is a financial
facilitating the transfer of money. could be used for illicit purposes such institution as that term is used in the
Furthermore, through Huione Group’s as human trafficking.40 While FinCEN BSA and section 311.
apparent control of the Components does not have evidence that Haowang
c. Huione Pay PLC
(each of which is itself a money Guarantee operates on the darknet,
transmitter and responds to Huione FinCEN assesses that Haowang As of January 2025, Huione Pay PLC
Guarantee deals in the sale of illicit was registered as a payment services
Group’s coordination of the
goods and services in a manner similar institution with the National Bank of
Components’ business activities such
to a darknet market but on the open Cambodia.45 On March 6, 2025, a media
that they form a self-contained
internet.41 report indicated that Huione Pay PLC’s
ecosystem of exchange, payment, and
Chainalysis, a separate blockchain banking license was revoked by the
market services), Huione Group is
analytics company, found similar Cambodian government.46 According to
engaged as a business in the
results. In its 2024 Crypto Crime Mid- a July 31, 2025 update, the National
transmission of value that substitutes for
Year Update Report, it determined that Bank of Cambodia rescinded this license
currency. Accordingly, FinCEN finds
that reasonable grounds exist to Haowang Guarantee operates as a peer-
43 Id.
conclude that Huione Group is a to-peer marketplace that connects
44 Elliptic, Huione: The Company Behind the
financial institution as defined by the buyers and sellers and facilitates
Largest Ever Illicit Online Marketplace Has
BSA and as that term is used in section transactions.42 Chainalysis reviewed Launched a Stablecoin (Jan. 14, 2025), https://
311. blockchain data of Haowang Guarantee www.elliptic.co/blog/huione-largest-ever-illicit-
online-marketplace-stablecoin.
b. Haowang Guarantee (Formerly 37 Telegram, Haowang Guarantee Customer 45 National Bank of Cambodia, List of Payment
Service Institutions (Dec. 31, 2024), https://
Huione Guarantee) Service Channel (Sept. 30, 2024), formerly available
www.nbc.gov.kh/english/supervision/payment_
at https://t.me/s/kefu (last accessed Mar. 27, 2025).
Haowang Guarantee described itself 38 See supra note 30. service.php (last accessed Mar. 21, 2025). The
as ‘‘a professional e-commerce platform 39 Darknet Markets almost exclusively accept CVC
National Bank of Cambodia’s List of Payment
Service available on its website only reflects the
that provides users with virtual digital as payment for a large range of illegal services and most recent reporting period. As such, the
products and transaction services . . . goods, including ransomware-as-a-service (RaaS). information presented by FinCEN reflects
CVC is often the payment method of choice on information that was available at the time indicated,
[that] does not participate in nor darknet marketplaces because illicit actors who in this example, the above mentioned information
understand the specific business of the transact on the darknet often incorrectly believe indicates that as of March 21, 2025, Huione Pay
customer. . . . Huione cannot verify or virtual currencies to be an anonymous and PLC was registered as a payment service institution.
guarantee the process of funds or untraceable means of exchange. Future references to this list correspondingly
40 Elliptic, Huione Guarantee: The multi-billion
goods.’’ 36 On October 19, 2024, Huione indicate the information as it was available on the
dollar marketplace used by online scammers (July date indicated.
9, 2024, updated Mar. 27, 2025), https:// 46 See Radio Free Asia, Exclusive: World’s Largest
33 Following the issuance of the NPRM, Telegram
www.elliptic.co/blog/cyber-scam-marketplace. online black market’ Loses banking license (Mar. 6,
blocked Huione Group’s telegram channels, which 41 For example, Haowang Guarantee has many
2025), https://www.rfa.org/english/cambodia/2025/
Haowang Guarantee notified customers of on its similar characteristics to the darknet market 03/06/huione-cambodia-cyberscam-
website. Haowang Guarantee, Announcements, described here See Department of the Treasury, cryptocurrency/. Huione Group responded to the
formerly available at https://www.hwbd.la/ Press Release, Treasury Sanctions Russia-Based allegations, refuting them by noting that Huione Pay
announcement (last accessed May 15, 2025). Hydra, World’s Largest Darknet Market, and PLC does not require a banking license for its
34 Telegram, Huione Group Customer Service
Ransomware-Enabling Virtual Currency Exchange operations. Telegram, Huione Group Customer
Center, formerly available at https://t.me/huionekf/ Garantex (Apr. 5, 2022), https://home.treasury.gov/
lotter on DSK11XQN23PROD with RULES1
Service, Huione Statement (Mar. 9, 2025), formerly
138 (last accessed Mar. 27, 2025). news/press-releases/jy0701. available at https://t.me/huionekf/346. As of March
35 Telegram, Huione Group Customer Service, 42 Chainalysis, 2024 Crypto Crime Mid-year 31, 2025, Huione Pay PLC is no longer listed as
Huione Statement (Mar. 9, 2025), formerly available Update Part 2: China-based CSAM and Cybercrime having an active license for ‘‘other financial
at https://t.me/huionekf/346. Networks on the Rise, Pig Butchering Scams services activities.’’ National Bank of Cambodia,
36 Haowang Guarantee, About, formerly available Remain Lucrative (Aug. 29, 2024), https:// List of Payment Service Institutions (Mar. 31, 2025),
at https://www.hwbd.la/about (last accessed July www.chainalysis.com/blog/2024-crypto-crime-mid- https://www.nbc.gov.kh/english/supervision/
28, 2025). year-update-part-2/. payment_service.php (last accessed May 14, 2025).
VerDate Sep<11>2014 15:47 Oct 15, 2025 Jkt 265001 PO 00000 Frm 00004 Fmt 4700 Sfmt 4700 E:\FR\FM\16OCR1.SGM 16OCR1
Federal Register / Vol. 90, No. 198 / Thursday, October 16, 2025 / Rules and Regulations 48299
by updating its list of ‘‘Payment Service FinCEN finds that reasonable grounds Huione Group website is registered to a
Institutions.’’ 47 Further, as of March exist to conclude that Huione Pay PLC Cambodian address in Phnom Penh,
2025, Huione Pay PLC was registered is a financial institution as that term is uses a Cambodian Top-Level Domain,
with the Cambodian Ministry of used in the BSA and section 311. and communicates predominately in the
Commerce for ‘‘other financial service Chinese language via a Cambodian
d. Huione Crypto
activities,’’ however, as of July 29, 2025, website and one or more Telegram
it no longer appears in the Ministry of Huione Crypto provides CVC trading channels operated from Cambodia.58
Commerce’s business registration services through its ‘‘Huione Exchange’’ Accordingly, FinCEN finds that
database, indicating that Huione Pay brand, which it owns and operates. reasonable grounds exist to conclude
PLC lacks an active corporate Huione Exchange provides a platform that Huione Group is operated from and
registration or payment service for its customers to trade CVC using located in Cambodia and thus operates
license.48 Until December 2023, there either its ‘‘peer to peer’’ or outside of the United States.
was a likely related entity, ‘‘Huione ‘‘centrali[z]ed exchange platform.’’ 54 In
Pay,’’ registered as a money services other words, Huione Crypto is a VASP b. Haowang Guarantee (Formerly
business in Canada, which was operating under the Huione Group Huione Guarantee)
incorporated in the country as Huione umbrella, and other Huione Group
Haowang Guarantee has operated a
Pay Inc.49 In March 2025, Huione Group entities use Huione Crypto’s
Telegram-based marketplace that allows
advertised its plans to expand Huione infrastructure to engage in CVC
its customers to buy and sell goods and
Pay PLC into new markets, including in transactions. Separately, Huione Crypto
services, relying on other Huione Group
North America.50 issues the USDH stablecoin.55 By
services and infrastructure to execute
Huione Pay PLC offers its customers facilitating CVC value exchanges for its
the exchanges. FinCEN assesses that
the ability to trade CVC on different customers through its trading platform,
Haowang Guarantee deliberately
blockchains, and to convert CVC to or and by issuing a stablecoin that
obfuscates its location to shield its
from various fiat currencies; however, as facilitates the transfer of money outside
the conventional financial institution enterprise and customers from law
of July 30, 2025, the Huione Pay PLC enforcement. However, Haowang
website was inaccessible.51 Part of systems, Huione Crypto is engaged in
money transmission as described at 31 Guarantee is integrated into Huione
Huione Pay PLC, Huione International Group’s operations and is apparently
Payments, acts as a merchant on U.S.C. 5312(a)(2)(R). Accordingly,
FinCEN finds that reasonable grounds subject to Huione Group’s control.
Haowang Guarantee’s platform, FinCEN assesses that it is operated from
exchanging CVC to facilitate the transfer exist to conclude that Huione Crypto is
a financial institution as that term is Cambodia and Haowang Guarantee
of the proceeds of cyber scams.52 advertises job opportunities based in
Huione Pay PLC previously held the used in the BSA and section 311.
Phnom Phen, Cambodia. Accordingly,
local equivalent of a money transmitting 2. Huione Group and Its Identified FinCEN finds that reasonable grounds
business license issued by the Kingdom Components Operate Outside the exist to conclude that Haowang
of Cambodia and engages in the United States Guarantee is operated from and located
exchange of CVC in a manner consistent in Cambodia and thus operates outside
with the definition of a money As in the NPRM, FinCEN finds that
reasonable grounds exist for concluding of the United States.
transmitting business.53 Accordingly,
that Huione Group is a foreign financial c. Huione Pay PLC
47 National Bank of Cambodia, List of Payment institution.56 As described in section
Service Institutions (July 31, 2025), https:// II.A.1, Huione Group is a financial Huione Pay PLC operates, or has
www.nbc.gov.kh/english/supervision/payment_ services conglomerate based in Phnom operated, eight Cambodian domestic
service.php (last accessed Oct. 7, 2025). Penh, Cambodia, and its network offers branch locations, located in Battambang,
48 Cambodia Corporate Registry, Huione Search,
https://www.businessregistration.moc.gov.kh/
unique services ranging from an online Phnom Penh, Poipet, Siem Reap, and
cambodia-master/service/create.html? marketplace selling items useful for Sihanoukville.59 Huione Pay PLC has
targetAppCode=cambodia-master& carrying out cyber scams to money advertised on social media that it has,
targetRegisterAppCode=cambodia-br-companies& laundering services that accept both fiat or had, operated a branch in
service=registerItemSearch (last accessed Mar. 27,
2025; July 29, 2025).
currencies and CVC. Laukkaing,60 the capital of the Kokang
49 Financial Transactions and Reports Analysis Self-Administered Zone in northern
a. Huione Group
Centre of Canada (FINTRAC), Money Services Burma and a known center for criminal
Business Registry, Huione Pay Inc, https://fintrac- Based on publicly available CVC investment scams, before a 2023–
canafe.canada.ca/msb-esm/reg-eng (last accessed information, Huione Group is operated 2024 crackdown shuttered the majority
Mar. 13, 2025). by a Cambodian person, from Phnom
50 Telegram, Huione Group Customer Service, of these operations.61 As noted above,
Huione Statement (Mar. 9, 2025), formerly available
Penh, Cambodia.57 Furthermore, the
at https://t.me/huionekf/346. multi-billion dollar marketplace used by online
51 Huione Pay website, Index, formerly available www.nbc.gov.kh/english/supervision/payment_ scammers (July 9, 2024, updated Mar. 27, 2025),
at https://www.huionepay.com.kh/index/help (last service.php (last accessed Mar. 21, 2025). https://www.elliptic.co/blog/cyber-scam-
accessed Mar. 27, 2025). 54 Huione Crypto, Legal, formerly available at marketplace.
52 FinCEN assesses that Huione International https://www.huione.io/en-US/termsAndConditions/ 58 On May 13, 2025, Telegram shut down Huione
Payments is part of Huione Pay PLC and that the userAgreement (last accessed Mar. 27, 2025). Group’s Telegram channel, however, there is
entity supports Haowang Guarantee’s facilitation of 55 See Section I.B. evidence that Huione Group is creating new
transactions connected to money laundering 56 FinCEN, Special Measure Regarding Huione channels under different names to circumvent the
activities. See Elliptic, Huione Guarantee: The Group, as a Foreign Financial Institution of Primary action taken by Telegram.
59 Telegram, Huione Branch, formerly available at
multi-billion dollar marketplace used by online Money Laundering Concern, 90 FR 18934 (May 5,
scammers (July 9, 2024, updated Mar. 27, 2025), 2025). https://t.me/huionestoreaddress/7 (last accessed
lotter on DSK11XQN23PROD with RULES1
https://www.elliptic.co/blog/cyber-scam- 57 The Record, Tether freezes $29 million of Mar. 27, 2025).
marketplace; The New York Times, How Scammers 60 Telegram, Huione Group Customer Service
cryptocurrency connected to Cambodian
Launder Money and Get Away With It (Mar. 23, marketplace accused of fueling scams (July 15, Center, formerly available at https://t.me/huionekf/
2025), https://www.nytimes.com/2025/03/23/world/ 2024), https://therecord.media/tether-freezes-29- 138 (last accessed Mar. 27, 2025).
asia/cambodia-money-laundering-huione.html. million-crypto-connected-to-scam-marketplace; see 61 Recorded Future, Myanmar rebels take control
53 National Bank of Cambodia, List of Payment also ICANN, Huione.com, https://lookup.icann.org/ of ‘pig butchering’ scam city amid China pressure
Service Institutions (Dec. 31, 2024), https:// en/huione.com; Elliptic, Huione Guarantee: The Continued
VerDate Sep<11>2014 15:47 Oct 15, 2025 Jkt 265001 PO 00000 Frm 00005 Fmt 4700 Sfmt 4700 E:\FR\FM\16OCR1.SGM 16OCR1
48300 Federal Register / Vol. 90, No. 198 / Thursday, October 16, 2025 / Rules and Regulations
Huione Pay PLC held a corporate Huione Pay PLC and Haowang identified any actual physical location
registration in Cambodia as well as a Guarantee, and collectively comprise a or other information suggesting Huione
payment services institution license, single organization. Group or the Components are operating
both of which have been revoked as of Huione Crypto advertises jobs in in the United States.
March 2025.62 Based on the foregoing, Phnom Penh, Cambodia indicating it is Based on the foregoing, FinCEN
FinCEN finds that reasonable grounds likely operated out of Cambodia, instead assesses that Huione Group, including
exist to conclude that Huione Pay PLC of Poland. Additionally, the Standard the Components, are predominately
is operated from and located in Terms and Conditions of Huione Crypto operated from and located in Cambodia,
Cambodia, and thus operates outside of stated that the ‘‘Group provides the with a limited connection to Poland
the United States. Services through www.7572.com, the where Huione Crypto holds a corporate
Group’s mobile application or any registration. While the three MSB
d. Huione Crypto Huione application programming registrations by Huione Crypto, Huione
Huione Crypto is registered in Poland interface.’’ The listed web page Pay Inc., and Huione LTD suggest that
under the name Huione Crypto Spó5ka (www.7572.com) formerly, but no Huione Group may intend to expand its
Z Ograniczona˛ Odpowiedzialnościa˛ 63 longer, redirects to the website of business to the United States in the
and is also registered as a Money Huione Pay PLC future, as of the date of this final rule,
Services Business (MSB) 64 with (www.huionepay.com.kh), however, as FinCEN is not aware of any physical
FinCEN. However, despite its of August 19, 2025, it appears to be a presence by Huione Group or the
registration in Poland and the United website used exclusively by Huione Pay Components in the United States, or any
States, FinCEN assesses that Huione PLC. Indeed, Huione Crypto’s user substantial business with customers in
Crypto actually operates in and from agreement expressly disclaims that the United States. Accordingly, FinCEN
Cambodia,65 and FinCEN has found no persons inside the United States may finds that there are reasonable grounds
evidence consistent with activity in the not avail themselves of Huione Group’s to conclude that Huione Group,
United States.66 FinCEN assesses that services.68 Accordingly, FinCEN finds including the Components, are foreign
the ‘‘Group’’ referenced in Huione that reasonable grounds exist to financial institutions that operate
Crypto’s previously used Standard conclude that Huione Crypto is operated outside the United States.
Terms and Conditions, which does not from and located in Cambodia and thus
appear on its new website 3. Huione Group and Its Identified
operates outside of the United States.
(www.huione.me),67 refers to Huione Components Are of Primary Money
Group, and that Huione Crypto’s CVC e. Huione Group’s Connections to the Laundering Concern
services share infrastructure with United States FinCEN assesses that Huione Group is
The most evidence of activity in the used to facilitate and promote money
on junta (Jan. 8, 2024), https://therecord.media/ United States by Huione Group or its laundering, particularly in support of
myanmar-rebels-control-pig-butchering-scam-hub. individual Components are three MSB illicit financial activities connected to
62 National Bank of Cambodia, List of Payment
registrations 69 with FinCEN and an the Democratic People’s Republic of
Service Institutions (Dec. 31, 2024), https://
www.nbc.gov.kh/english/supervision/payment_ address reported on two registrations.70 Korea (DPRK) and Southeast Asia-based
service.php (last accessed Mar. 21, 2025); As of In April 2023, Huione Crypto registered TCOs. Because Huione Group has
March 31, 2025, Huione Pay PLC is no longer listed as a dealer in foreign exchange, and shared infrastructure with its
as having an active license for ‘‘other financial provided a business address in Phnom constituent entities, the structure makes
services activities.’’ National Bank of Cambodia,
List of Payment Service Institutions (Mar. 31, 2025), Penh, Cambodia, while noting no it challenging to ascertain the specific
https://www.nbc.gov.kh/english/supervision/ branches in the United States. In August Component involved in any particular
payment_service.php (last accessed Oct 7, 2025); As 2024, Huione Pay Inc. registered to transaction. Nevertheless, FinCEN bases
of July 30, 2025, Huione Pay PLC has also lost its conduct multiple MSB activities, this assessment on information available
corporate registration. See Cambodia Corporate
Registry, Huione Search, https://
including check cashing, dealing in through both public and non-public
www.businessregistration.moc.gov.kh/cambodia- foreign exchange, and money reporting, and after thorough
master/service/create.html?targetAppCode= transmission. Huione Pay Inc. provided consideration of each of the following
cambodia-master&targetRegisterAppCode= an address in Denver, Colorado factors: (1) Huione Group provides
cambodia-br-companies&
service=registerItemSearch (last accessed July 29,
associated with a virtual mail services that DPRK government entities
2025). forwarding service, and it also noted no use to launder the proceeds of cyber
63 Polish corporate registration database, Huione branches in the United States. Finally, heists; (2) TCOs based in Southeast Asia
Crypto SPÓ4KA Z OGRANICZONA ˛ in February 2025, Huione LTD have used Huione Group to launder
ODPOWIEDZIALNOŚCIA ˛ , https:// registered as a dealer in foreign
www.biznes.gov.pl/en/wyszukiwarka-firm/wpis/krs/
illicit proceeds of cyber scams,
0001043802 (last accessed Oct. 6, 2025). exchange, money transmitter, and seller including CVC investment scams; and
64 For more information on what type of business of money orders, and noted no branches (3) Huione Group operates an illicit
or activity requires registration as a money service in the United States. Huione LTD online market.
business, see FinCEN, Money Services Business appears to use the same Denver,
Definition, https://www.fincen.gov/money-services-
Colorado mail forwarding service as a. Huione Group Facilitates
business-definition. See also 31 CFR 1010.100(ff). Transactions for DPRK Actors To
65 Huione Crypto, Career Opportunities, formerly Huione Pay Inc. FinCEN has not
Launder Funds From Sanctions Evasion
available at https://Huione.io/en-US/
careerOpportunities (last accessed Mar. 27, 2025); 68 Huione Crypto, Legal, formerly available at and Cyber Heists
Huione Crypto, Legal, formerly available at https:// https://www.huione.io/en-US/termsAndConditions/ DPRK-affiliated actors have
www.huione.io/en-US/termsAndConditions/ userAgreement (last accessed Mar. 27, 2025).
userAgreement (last accessed Mar. 27, 2025); 69 FinCEN’s MSB Registrant Search web page
extensively used the Huione Group to
Huione Pay PLC, formerly available at reflects only what the registrant has provided to launder stolen CVC for the benefit of the
lotter on DSK11XQN23PROD with RULES1
www.huionepay.com.kh (last accessed Mar. 27, FinCEN, and FinCEN does not approve or endorse DPRK government and in support of
2025). any business that has registered as an MSB. DPRK’s WMD and ballistic missile
66 See FinCEN, MSB Registrant Search, Huione, 70 An examiner attempted to contact Huione Pay
programs, in violation of U.S. and
https://www.fincen.gov/msb-state-selector. Inc. at the Denver, Colorado location in November
67 Huione Crypto website, www.huione.me/ 2024, but the examiner did not identify a Huione
multilateral sanctions programs,
home?ts=1755613352122 (last accessed Aug. 19, Pay Inc. representative, nor any other evidence of including United Nation Security
2025). a physical presence by Huione Pay Inc. Council Resolutions (UNSCRs). The
VerDate Sep<11>2014 15:47 Oct 15, 2025 Jkt 265001 PO 00000 Frm 00006 Fmt 4700 Sfmt 4700 E:\FR\FM\16OCR1.SGM 16OCR1
Federal Register / Vol. 90, No. 198 / Thursday, October 16, 2025 / Rules and Regulations 48301
United States has consistently taken (FBI), the Cybersecurity and used by the Lazarus Group sent CVC
measures to counter DPRK’s abuse of Infrastructure Security Agency (CISA), valued at over USD 150,000 to Huione
CVC and protect the United States from and Treasury issued a joint Group.81
DPRK’s illicit financial activity.71 Cybersecurity Advisory to highlight the FinCEN conducted blockchain
However, as outlined in Treasury’s 2024 cyber threat associated with analysis, using commercially available
National Proliferation Financing Risk cryptocurrency thefts and tactics used blockchain analytic software, of flows of
Assessment, DPRK has continued to by the DPRK state-sponsored advanced CVC associated with several heists
advance its illicit exploitation of new persistent threat group, since at least carried out by DPRK. This analysis
financial technology, including the theft 2020.77 The U.S. government has identified that Huione Group received a
and laundering of CVC, to raise and observed DPRK cyber actors targeting a combined total of approximately USD
move money to fund its illicit weapons variety of organizations in the 2.6 million worth of CVC from the June
programs.72 Indeed, the UNSCR 1718 blockchain technology and 2, 2023 Atomic Wallet heist and the
Committee’s Panel of Experts (UNSCR cryptocurrency industry, including June 22, 2023 Coinspaid 82 and Alphapo
1718 POE) found that the malicious cryptocurrency exchanges, heists.83 In July 2024, Huione Group
cyber activities of the DPRK generates decentralized finance protocols, play-to- received USD 35 million worth of stolen
approximately 50 percent of its foreign earn CVC video games, CVC trading CVC, later attributed to the Lazarus
currency income. In its March 2024 companies, venture capital funds Group by the FBI, from the May 2024
annual report, the UNSCR 1718 POE investing in CVC, and individual heist targeting DMM, a Japanese
indicated that it was investigating 17 holders of large amounts of VASP.84 While the DMM heist was not
CVC heists in 2023 for which the DPRK cryptocurrency or valuable non-fungible initially attributed to the Lazarus Group
may be responsible, valued at more than tokens.78 FinCEN assesses that, over (or any other prohibited entity or
USD 750 million.73 time, the DPRK’s money laundering jurisdiction), the heist itself was widely
processes have become more complex in reported by the time Huione Group
i. Background on DPRK CVC Heists received the CVC, and FinCEN would
order to evade OFAC sanctions, law
In the same March 2024 report, the enforcement, and BSA reporting expect covered financial institutions to
UNSCR 1718 POE noted it was obligations from hacked entities or CVC have an effective AML/KYC program to
investigating 58 suspected cyberattacks entities used in the laundering process. appropriately monitor transactions for
by DPRK’s Reconnaissance General DPRK is leveraging sophisticated CVC red flags indicating connections to a
Bureau (RGB),74 to which the Lazarus methods and a range of intermediary high profile heist such as this. In total,
Group 75 is related, on CVC companies entities, often operating across multiple based on publicly and non-publicly
between 2017 and 2023, valued at jurisdictions in East Asia, to further available information available to
approximately USD 3 billion. FinCEN obfuscate its laundering. In fact, in FinCEN, FinCEN’s analysis has
assesses that these funds likely August 2023, the FBI alerted the public identified that Huione Group has
bolstered DPRK’s WMD development.76 to several thefts from CVC companies received at least USD 37.6 million worth
The Federal Bureau of Investigation that it attributed to the Lazarus Group of CVC from DPRK cyber actors
and warned that there could be another stemming from DPRK-attributed heists.
71 See FinCEN, READOUT: FinCEN Hosts Public-
USD 40 million worth of CVC being On multiple occasions between 2022
Private Dialogue on Countering the DPRK’s Illicit prepared for laundering through and 2024, a DPRK national with deep
Cyber Activities (Aug. 31, 2023), https://
www.fincen.gov/news/news-releases/readout- VASPs.79 ties to the RGB, DPRK’s primary foreign
fincen-hosts-public-private-dialogue-countering- intelligence organization, worked with
dprks-illicit-cyber.
ii. Huione Group Launders the Proceeds Huione Pay PLC officials to transfer
72 Department of the Treasury, National of DPRK Cyber Heists
CVC and fiat currency. FinCEN assesses
Proliferation Financing Risk Assessment (Feb. 7, Despite the 2023 FBI alert and other
2024), at pp. 2, 18, https://home.treasury.gov/
that senior Huione Pay PLC leadership
system/files/136/2024-National-Proliferation-
public reporting, Huione Group has was aware of the individual’s affiliation
Financing-Risk-Assessment.pdf. continued to receive and process these with DPRK. This DPRK national
73 United Nations, S/2024/215, UN Panel of illicit proceeds. There is wide reporting maintained personal relationships with
Experts Letter (Mar. 7, 2024), at p. 60, https:// that Huione Group has received stolen multiple Huione Pay PLC officials and
documents.un.org/doc/undoc/gen/n24/032/68/pdf/ CVC from multiple heists linked to
n2403268.pdf. regularly met in person with at least one
74 On January 2, 2015, OFAC sanctioned DPRK’s
DPRK actors, namely the Lazarus of these officials. In late 2023, the DPRK
RGB for being a controlled entity of the Government Group.80 For example, between June national worked with Huione Pay PLC
of North Korea. See Department of the Treasury, 2023 and February 2024, a CVC wallet officials to convert CVC into fiat
Press Release, Treasury Imposes Sanctions Against
the Government of The Democratic People’s
currency and subsequently transfer fiat
77 Department of the Treasury, Press Release,
Republic Of Korea (Jan. 2, 2015), https:// Treasury Sanctions North Korean State-Sponsored 81 Reuters, Exclusive: North Korean hackers sent
home.treasury.gov/news/press-releases/jl9733. RGB Malicious Cyber Groups (Sept. 13, 2019), https://
was also previously listed in the annex to E.O. home.treasury.gov/news/press-releases/sm774. stolen crypto to wallet used by Asian payment firm
13551 on August 30, 2010. Executive Order 13551, 78 CISA, AA22–108A, TraderTraitor: North (July 15, 2024), https://www.reuters.com/
‘‘Blocking Property of Certain Persons With Respect technology/cybersecurity/north-korean-hackers-
Korean State-Sponsored APT Targets Blockchain
to North Korea,’’ 75 FR 53837 (Aug. 30, 2010). sent-stolen-crypto-wallet-used-by-asian-payment-
Companies (Apr. 20, 2022), https://www.cisa.gov/
75 This group is commonly referred to by the
news-events/cybersecurity-advisories/aa22-108a. firm-2024-07-15/.
82 FBI, FBI Identifies Cryptocurrency Funds
cybersecurity industry as Lazarus Group, APT38, 79 FBI, FBI Identifies Cryptocurrency Funds
BlueNoroff, and Stardust Chollima. For the Stolen by DPRK (Aug. 22, 2023), https:// Stolen by DPRK (Aug. 22, 2023), https://
purposes of this final rule, FinCEN will refer to this www.fbi.gov/news/press-releases/fbi-identifies- www.fbi.gov/news/press-releases/fbi-identifies-
group as Lazarus Group. See Department of the cryptocurrency-funds-stolen-by-dprk. cryptocurrency-funds-stolen-by-dprk.
Treasury, Press Release, Treasury Sanctions North 83 Id.
80 The U.S. Government has previously issued
Korean State-Sponsored Malicious Cyber Group
lotter on DSK11XQN23PROD with RULES1
84 FBI, FBI, DC3, and NPA Identification of North
advisories to publicly highlight the Lazarus Group’s
(Sept. 13, 2019), https://home.treasury.gov/news/ threat and tactics associated with CVC theft Korean Cyber Actors, Tracked as TraderTraitor,
press-releases/sm774. targeting organizations in the blockchain and CVC Responsible for Theft of $308 Million USD from
76 Department of the Treasury, Press Release, Bitcoin.DMM.com (Dec. 23, 2024), https://
industry. See CISA, AA22–108A, TraderTraitor:
Treasury Imposes Sanctions Against the North Korean State-Sponsored APT Targets www.fbi.gov/news/press-releases/fbi-dc3-and-npa-
Government of The Democratic People’s Republic Blockchain Companies (Apr. 20, 2022), https:// identification-of-north-korean-cyber-actors-tracked-
Of Korea (Jan. 2, 2015), https://home.treasury.gov/ www.cisa.gov/news-events/cybersecurity-advisories/ as-tradertraitor-responsible-for-theft-of-308-million-
news/press-releases/jl9733. aa22-108a. from-bitcoindmmcom.
VerDate Sep<11>2014 15:47 Oct 15, 2025 Jkt 265001 PO 00000 Frm 00007 Fmt 4700 Sfmt 4700 E:\FR\FM\16OCR1.SGM 16OCR1
48302 Federal Register / Vol. 90, No. 198 / Thursday, October 16, 2025 / Rules and Regulations
currency to an associate. In total, the Once trust or a relationship has been Group was the subject of reporting by
DPRK national transferred CVC valued established, the scammer will introduce several blockchain analytic firms
at tens of thousands USD to the Huione the victim to a supposedly lucrative describing the use of its various services
Pay PLC official. Furthermore, based on investment opportunity in CVC and by TCOs for scam activity, including
publicly and non-publicly available direct them to use CVC investment those offered by Haowang Guarantee.88
information available to FinCEN, in websites or applications designed to Elliptic reported that Haowang
mid-2023, the DPRK national also appear legitimate, but are instead Guarantee offered scam-enabling
planned to remit USD internationally to fraudulent and ultimately controlled or products and services used by scam
Hong Kong and sought Huione Pay PLC manipulated by the scammer. When a compound operators to imprison and
officials help to do so. victim’s pace of investment slows or torture their workers. The products
Given the opacity of Huione Group stops, the scammer will use even more included tear gas, electric batons, and
and the inherent limitation of aggressive tactics to extract any final electronic shackles, among other related
blockchain analytics, FinCEN is largely payments. The scammer may present devices. The same month, in a post to
unable to determine what DPRK- the victim with supposed losses on the its website in response to the adverse
affiliated actors do with the CVC after investment and encourage them to make media reporting, Haowang Guarantee
they send it to Huione Group. However, up the difference through additional confirmed that ‘‘detention equipment’’
given the close connection between deposits. If the victim attempts to is not necessarily human trafficking.’’ 89
Huione Pay PLC officials and DPRK withdraw their investment, the scammer Subsequently, Huione Pay PLC removed
nationals with close ties to DPRK’s RGB, may demand that the victim pay all references to Haowang Guarantee
FinCEN assesses DPRK most likely uses purported taxes or early withdrawal from its websites.90
Huione Group to convert CVC to fiat fees. Once the victim is unable or Neither Huione Pay PLC nor Haowang
currencies. unwilling to pay more into the scam, the Guarantee have published AML/KYC
scammer will abruptly cease policies.91 Huione Crypto does not have
b. Huione Group Launders the Proceeds communication with the victim, taking a published AML/KYC policy either.
of Organized Criminal Groups’ Cyber the victim’s entire investment with Rather, it maintains a ‘‘standard terms
Scams them.87 and conditions’’ on its website
Huione Group also has significant governing the use of its services. In
ii. Huione Group’s Laundering of relevant part, the agreement prohibits
exposure to, and has facilitated Proceeds of Cyber Scams, Including
transactions associated with suspected the use of Huione Crypto’s platform by
CVC Investment Scams citizens, nationals or residents of
fraud activity, including CVC
investment scams, also referred to as Based on FinCEN analysis of non- particular countries, including the
‘‘pig-butchering.’’ FinCEN assesses that public information, Huione Group United States, Iran or North Korea, as
Huione Group’s extensive CVC services received at least USD 36 million worth well as individuals sanctioned under
and its online marketplace, Haowang of CVC investment scam proceeds, since various national regimes, including
Guarantee, has made Huione Group, a at least August 2021. More broadly, the those of the United States and United
‘‘one stop shop’’ for criminals to launder analysis identified that in the aggregate, Nations. The agreement also states that
CVC obtained through illicit activities, inclusive of the cyber scam proceeds, ‘‘the [u]ser may not use the interface or
and ultimately convert it to fiat Huione Group received approximately services to disguise the origin or nature
currency. USD 300 million worth of CVC relating of illicit proceeds.’’ 92 However, the
to other cyber scams. Despite the
i. Background on CVC Investment limitations noted above, and based on 88 See Chainalysis, 2024 Crypto Crime Mid-year
Scams publicly and non-publicly available Update Part 2: China-based CSAM and Cybercrime
Networks on the Rise, Pig Butchering Scams
In 2023, FinCEN published an alert on information, FinCEN assesses that, after Remain Lucrative (Aug. 29, 2024), https://
the ‘‘Pig Butchering’’ CVC investment illicit actors send CVC to Huione Group, www.chainalysis.com/blog/2024-crypto-crime-mid-
CVC is then converted to fiat currency year-update-part-2/; Elliptic, Huione: The Company
scams.85 These scams are largely Behind the Largest Ever Illicit Online Marketplace
perpetrated by criminal organizations or different CVC, or withdrawn at a later Has Launched a Stablecoin (Jan. 14, 2025), https://
based in Southeast Asia, who use point to move to a different VASP, as www.elliptic.co/blog/huione-largest-ever-illicit-
victims of human trafficking to conduct part of the money laundering process. online-marketplace-stablecoin; Elliptic, Huione
Guarantee: the Multi-billion dollar marketplace
outreach to millions of unsuspecting c. Huione Group’s Lax Anti-Money used by online scammers (July 9, 2024), https://
individuals around the world. The Laundering Policies and Procedures www.elliptic.co/blog/cyber-scam-marketplace.
frontline scammers in these schemes are 89 Haowang Guarantee, To all public friends on
The risks presented by Huione
themselves often victims of trafficking, social media (July 17, 2024), formerly available at
Group’s association with illicit actors https://www.yu444.com/gonggao/detail/2237.
including forced labor, and are
and transactions linked to illicit activity 90 Elliptic, Huione Guarantee: the Multi-billion
subjected to physical and mental abuse. dollar marketplace used by online scammers (July
are compounded by either an absence
The traffickers also force victims to 9, 2024), https://www.elliptic.co/blog/cyber-scam-
of, or ineffective, AML/KYC policies
work up to 15 hours a day and, in some marketplace.
and procedures among Huione Group’s
cases, ‘‘resell’’ victims to other scam 91 Repeated searches of their respective websites,
components, as well as recent changes including most recently on July 28, 2025, failed to
operations or subject them to sex
that have served to obfuscate Huione yield any evidence of a policy. Haowang
trafficking.86 Guarantee’s website did previously contain cursory
Group’s involvement in illicit activity.
fraud indicators available to customers, which has
85 FinCEN, FIN–2023–Alert005, FinCEN Alert on For example, in July 2024, Huione since been taken down, likely in response to the
Prevalent Virtual Currency Investment Scam NPRM. Regardless, in FinCEN’s assessment, this
Commonly Known as ‘‘Pig Butchering’’ (Sept. 8, Currency Scams (Sept. 12, 2024), https:// falls short of reasonable policies and procedures
lotter on DSK11XQN23PROD with RULES1
2023), https://www.fincen.gov/sites/default/files/ home.treasury.gov/news/press-releases/jy2576. aimed at combatting money laundering. See
shared/FinCEN_Alert_Pig_Butchering_FINAL_ 87 FinCEN, FIN–2023–Alert005, FinCEN Alert on Haowang Guarantee, Fangpian, formerly available
508c.pdf. Prevalent Virtual Currency Investment Scam at https://hwdb.la/fangpian (last accessed Mar. 27,
86 Department of the Treasury, Press Release, Commonly Known as ‘‘Pig Butchering’’ (Sept. 8, 2025).
Treasury Sanctions Cambodian Tycoon and 2023), at p. 4, https://www.fincen.gov/sites/default/ 92 Huione Crypto, Legal, formerly available at
Businesses Linked to Human Trafficking and files/shared/FinCEN_Alert_Pig_Butchering_FINAL_ https://www.huione.io/en-US/termsAndConditions/
Forced Labor in Furtherance of Cyber and Virtual 508c.pdf. userAgreement (last accessed Mar. 27, 2025).
VerDate Sep<11>2014 15:47 Oct 15, 2025 Jkt 265001 PO 00000 Frm 00008 Fmt 4700 Sfmt 4700 E:\FR\FM\16OCR1.SGM 16OCR1
Federal Register / Vol. 90, No. 198 / Thursday, October 16, 2025 / Rules and Regulations 48303
extent of the criminal and money d. Huione Group Continues Its CVC- ineffective AML policies, procedures,
laundering activity on Huione Crypto’s Related Operations Despite Regulatory and controls, provision of services that
platforms that violate its terms and Prohibition offer anonymity and an ability to evade
conditions agreement reflects that its Further illustrating the money sanctions, and development of a
AML/KYC program is either ineffective laundering risk posed by Huione Group stablecoin designed to hinder the ability
or unenforced. is the fact that a significant portion of of law enforcement to recover the
Despite this, and as described in its assessed illicit transactional activity proceeds of crime—is being used
greater detail in section II.A.3 since at involves CVC, which the National Bank extensively to facilitate or promote
least August 2021, FinCEN identified— of Cambodia, Huione Group’s primary money laundering, in particular by
regulator, expressly prohibits. In a 2024 organized criminal groups and entities
through analysis of non-public
public statement, the National Bank of involved in the proliferation of WMD or
information—that Huione Group
Cambodia stated that payment firms are missiles.
received at least USD 37 million worth
‘‘not allowed to deal or trade any
of illicit proceeds from sanctioned cryptocurrencies and digital assets. B. Post-NPRM Developments
entities—including DPRK entities—and According to that same reporting, this
at least USD 300 million worth of CVC In the wake of the NPRM, Huione
ban has been in effect since 2018, ‘‘to Group has continued to facilitate money
from various cyber and CVC scam avoid investment losses due to crypto’s
activity. FinCEN’s analysis identified laundering. For example, a June 16,
volatility, cybercrime and the 2025 media report indicates that
that, in the aggregate, Huione Group has anonymity of the technology ‘‘which
received at least USD 4 billion worth of approximately USD 6.9 million worth of
may cause risks of money laundering
illicit proceeds, between August 2021 CVC stolen from a compromised device
and financing of terrorism.’’ ’’ 96 Despite
and January 2025.93 This large-scale, was quickly funneled through one of
this prohibition, Huione Group has
Huione Group’s Components following
persistent use of Huione Group by continued to develop its CVC services
and has even expanded its CVC the theft.99 Analysis by blockchain
DPRK actors and TCO-driven CVC
offerings in recent months. In analytic firm, Global Ledger found that
investment scams to launder their illicit
September 2024, Huione Group between May 1 and June 17, 2025,
proceeds belies the adequacy or
launched USDH, a stablecoin it transactions involving Huione Group
effectiveness of Huione Group’s AML/
explicitly advertised as ‘‘unfreezable’’ wallets amounted to more than USD 10
KYC procedures.
and ‘‘not restricted by traditional billion worth of the CVC Tether on
Huione Group itself has conceded the regulatory agencies.’’ 97 FinCEN assesses Tron,100 and USD 219 million worth of
deficiencies in its AML regime. In a July that Huione Group is likely taking this the CVC Ethereum.101 Global Ledger’s
2024 media statement, for example, step and marketing itself as outside analysis also found that Huione Crypto
Huione Group stated ‘‘our [Know Your regulatory agency reach to increase its and Huione Pay continue to operate
Customer] capabilities are now seriously appeal to illicit actors and hamper under the wider Huione Group
insufficient.’’ 94 This statement was compliance with applicable AML laws. operational structure.102 Huione
made after previously claiming earlier Notably, Huione Group’s intentional Group’s continued operations point to
that month—in response to public launching of this ‘‘unfreezable’’ the challenges of shuttering
identification of one heist, the proceeds stablecoin differs from other stablecoin decentralized, opaque illicit
of which were transmitted to Huione issuers that generally respond to law marketplaces.103
Pay PLC—that it had not known that enforcement requests to freeze CVC tied
to illicit activity. One particular C. Consideration of Comments
Huione Pay PLC ‘‘received funds
indirectly’’ from the heist, due to the example of this contrast occurred in July FinCEN published the NPRM, with a
layers of transactions between the 2024, when one stablecoin issuer froze 30-day comment period. In response,
source of the heist and the Huione CVC valued at over USD 29 million that
Group-owned wallets that ultimately was located in a Huione Group CVC 99 Cointelegraph, Crypto user loses $6.9 million to
received the funds.95 wallet because it was ‘‘associated with a cold wallet from China’s TikTok (June 16, 2025),
activities allegedly linked to fraudulent https://cointelegraph.com/news/crypto-investor-
93 By illicit category, Huione Group has received
and transnational criminal loses-6m-douyin-cold-wallet-scam.
100 Tether, a stablecoin with a 1:1 peg to the USD,
the following proceeds in CVC, denominated in operations.’’ 98 By trumpeting that its
stablecoin is ‘‘not restricted by does not operate its own blockchain, instead, it is
equivalent USD value: USD 1,363 from child sexual issued on the blockchains of other CVCs, in this
abuse material; USD 618,861 from Darknet Markets/ traditional regulatory agencies’’ and case, it is deployed to the Tron blockchain. For the
Illicit Cyber Vendors; USD 3,246 from FinCEN offering USDH, which is ‘‘unfreezable,’’ purposes of this final rule, FinCEN considers Tether
Primary Money Laundering Concerns; USD even upon a lawful request from law on Tron to be one type of CVC. See Cointelegraph,
3,248,510,440 from Identified Illicit Cyber actors; What Is Tether USDT and How Does it Work (Feb.
USD 47,393,602 from VASPs without KYC policies; enforcement, Huione Group facilitates
9, 2025) https://cointelegraph.com/explained/what-
USD 407,129,792 from OFAC Specially Designated and profits from money laundering, is-tether-usdt-and-how-does-it-work.
Nationals (U.S. sanctioned entities); USD benefiting TCOs and DPRK actors 101 Cointelegraph, Huione wallets moved $1B to
347,549,705 from Scams; USD 22,133,556 from exfiltrating the proceeds of their crimes. crypto exchanges since FinCEN action (July 8,
seized and/or stolen funds; and 2,627,009 from Given the various aggravating factors 2025), https://cointelegraph.com/news/huione-
terrorist financing. wallets-moved-crypto-exchanges-fincen.
94 See ABC News, Cambodian online marketplace
described above, FinCEN finds that the 102 Id.
outed as one-stop shop for scammers’ money Huione Group—with its weak and 103 Bloomberg, World’s Biggest Illicit Marketplace
laundering and ‘detention equipment’ needs (July Becomes an ‘Amazon for Criminals,’ (Aug. 1, 2025)
26, 2024), https://www.abc.net.au/news/2024-07- 96 Id.
https://www.bloomberg.com/news/features/2025-
27/online-marketplace-for-money-laundering-and-
lotter on DSK11XQN23PROD with RULES1
97 Huione Crypto, USDH is a stable currency in
08-01/huione-s-24-billion-hub-for-cybercrime-is-an-
scammers/104131624. one word!, formerly available at https://huione.io/ amazon-for-criminals (last accessed Aug. 18, 2025);
95 Reuters, Exclusive: North Korean hackers sent en-us/introduce (last accessed Mar. 27, 2025). CoinDesk, Telegram Bans $35B scam Marketplace.
stolen crypto to wallet used by Asian payment firm 98 The Record, Tether freezes $29 million of Only to see Illicit Crypto Trades Surge Elsewhere,
(July 15, 2024), https://www.reuters.com/ cryptocurrency connected to Cambodian (July 30, 2025), https://www.coindesk.com/
technology/cybersecurity/north-korean-hackers- marketplace accused of fueling scams (July 15, business/2025/07/30/illicit-crypto-trade-quickly-
sent-stolen-crypto-wallet-used-by-asian-payment- 2024), https://therecord.media/tether-freezes-29- rebounds-despite-telegram-s-shutdown-of-usd35b-
firm-2024-07-15/. million-crypto-connected-to-scam-marketplace. huione-marketplace.
VerDate Sep<11>2014 15:47 Oct 15, 2025 Jkt 265001 PO 00000 Frm 00009 Fmt 4700 Sfmt 4700 E:\FR\FM\16OCR1.SGM 16OCR1
48304 Federal Register / Vol. 90, No. 198 / Thursday, October 16, 2025 / Rules and Regulations
FinCEN received eight comments.104 procedures, practices, trainings, and of Huione Group. FinCEN weighed the
Those comments are summarized user base; and benefit of a more expansive definition of
below, along with FinCEN’s responses. • Examine the company’s information Huione Group with the benefit of
One Huione Group component, Huione technology infrastructure, databases, regulatory certainty. FinCEN considered
Pay PLC, commented on the NPRM controls, and records, and confirm the the benefit of a more flexible and
through counsel. technical configurations of the Content expansive definition of Huione Group in
Distribution Network (CDN) used by countering its opaque and evolving
1. Huione Pay PLC’s Comment and Huione Pay PLC to enforce the blocking
Request for Extension organizational structure. However,
of IP addresses originating from
On May 27, 2025, a law firm (‘‘outside FinCEN assessed that the burden on
sanctioned jurisdictions.
counsel’’) representing Huione Pay PLC In light of the firm’s work, the covered financial institutions of a
emailed FinCEN requesting an comment sought an additional flexible ‘‘direct or indirect control’’
extension of the public comment period unspecified extension of time to submit definition would be considerable and
so that Huione Pay PLC might provide a late comment in order to allow for the that the probability of misidentification
a fulsome comment addressing firm’s work to generate additional would be significant. Accordingly,
FinCEN’s concerns, as outlined in the information, which would be FinCEN determined that final rule
NPRM. FinCEN granted that initial transmitted to FinCEN. FinCEN should implement the definition of
request for an extension, providing an considered granting a longer extension Huione Group that was proposed in the
additional 14 days for Huione Pay PLC and the benefit of greater insight into NPRM.
and any other similarly situated party to Huione Pay PLC’s claims of AML/KYC The same commenter also suggests
submit a late comment, and outside compliance. However, having already FinCEN establish a standalone
counsel submitted a comment on June provided Huione Pay PLC an additional definition for ‘‘Correspondent Account’’
18, 2025, which FinCEN posted to 14 days to submit a comment—resulting
as part of the final rule. FinCEN assesses
regulations.gov. in a total of 44 calendar days to provide
In that comment, Huione Pay PLC that altering such a definition would be
substantive comments on the NPRM—
claims, without evidence or further FinCEN declined to grant a further beyond the scope of this rulemaking.
explanation, that Huione Pay PLC is an extension of time, taking into account The same comment also suggests that
‘‘independent entity,’’ distinct from public and nonpublic information about FinCEN include a provision that would
Huione Group, presumably seeking to Huione Pay PLC’s deep integration and cover any successor entity noting that it
have Huione Pay PLC excluded from the essential role in Huione Group’s money should include, ‘‘any attempt to
definition of Huione Group in the laundering activities, Huione Group’s rebrand, restructure, or create shell
proposed rule. However, Huione Pay consistent pattern of obfuscation in the companies with the intent to avoid
PLC had adequate time to identify and face of government action, the volume regulatory oversight shall be considered
produce information about its own of money laundering occurring through a violation, subject to immediate
structure and organization—information Huione Group, the danger of the enforcement action.’’ FinCEN assesses
that a legitimate enterprise should be schemes perpetrated by Huione Group’s this final rule sufficiently covers entities
willing to produce and have readily at criminal customers, FinCEN’s past that covered financial institutions know
hand. Having no factual support for the practices relating to public comment or have reason to believe are a
proposition that Huione Pay PLC is periods,106 and the inadequate basis that component, branch, or office of Huione
independent of Huione Group, and had been presented to further delay a Group operating as a financial
considering contradictory public and final rule in light of the attendant institution in any jurisdiction outside of
nonpublic information, FinCEN finds risks.107 the United States and, as such, more
this claim unpersuasive and continues
to assess that Huione Pay PLC is a 2. Comment Suggesting That FinCEN explicit provisions are unnecessary.
component of Huione Group.105 Modify Certain Definitions and Include The same commenter also suggests
In its comment, Huione Pay PLC also Provisions To Improve Enforceability that FinCEN use less subjective
claims that it is ‘‘undertaking In response to the NPRM, FinCEN language, including more concise
substantial efforts to address and received one comment that was definitions of ‘‘reasonable steps,’’ and
remediate compliance issues raised by generally supportive of the rule but suggesting that the phrase ‘‘knows or
the Proposed Rulemaking,’’ and that it suggesting that FinCEN modify certain has reason to believe’’ leaves too much
had retained ‘‘an independent, definitions. That comment suggests that room for subjective interpretation.
reputable, U.S.-based, global consulting FinCEN adopt a more comprehensive FinCEN assesses that covered financial
firm’’ in order ‘‘to assist Huione Pay definition of Huione Group that institutions are best suited to make the
PLC in identifying and remediating encompasses any entity under determination of whether they have
potential compliance deficiencies.’’ demonstrable direct or indirect control
obligations to implement the special
Huione Pay PLC represented that the
measure. Similarly, the commenter
firm would, or had begun to: 106 The Al-Huda Bank NPRM was published on
• Speak with Huione Pay PLC staff January 31, 2024, and the final rule was published suggested that ‘‘[t]he proposed measure
responsible for various business on July 3, 2024. See FinCEN, Proposal of Special does not explicitly detail the
Measure Regarding Al-Huda Bank, as a Foreign consequences for noncompliance,’’ and
functions . . . to understand the Financial Institution of Primary Money Laundering
company’s operations, management Concern, 89 FR 6074 (Jan. 31, 2024); FinCEN, that ‘‘FinCEN should incorporate
structure, products, and services; Imposition of Special Measure Regarding Al-Huda language specifying that violations will
• Gather information related to the Bank as a Financial Institution of Primary Money trigger enforcement actions, including
Laundering Concern, 89 FR 55051 (July 3, 2024).
lotter on DSK11XQN23PROD with RULES1
company’s compliance policies, 107 Since Huione Pay PLC lodged its request,
fines, account restrictions, or other
FinCEN has looked for evidence of action by any sanctions as detailed in this section.’’
104 Published comments are available online at
Huione Group entity towards AML/KYC Willful violations of this final rule are
https://www.regulations.gov/document/FINCEN- compliance. Except for some superficial
2025-0004-0003.
subject to civil and criminal penalties
restructuring apparently intended to evade further
105 See supra Sections II.A.1.c, II.A.2.c, and scrutiny, Huione Group’s money laundering set forth at 31 CFR 1010.821 and
II.A.3.a.ii. enterprise appears to operate just as before. 1010.840, and 31 U.S.C. 5321 and 5322.
VerDate Sep<11>2014 15:47 Oct 15, 2025 Jkt 265001 PO 00000 Frm 00010 Fmt 4700 Sfmt 4700 E:\FR\FM\16OCR1.SGM 16OCR1
Federal Register / Vol. 90, No. 198 / Thursday, October 16, 2025 / Rules and Regulations 48305
4. Comments Expressing Support for the After reviewing the comments and United States. These accounts may be
NPRM, and Suggesting Additional Steps considering all potential special used for commercial payments, as well
To Combat CVC Investment Scams measures, FinCEN concludes that a as foreign exchange and money markets.
In response to the NPRM, FinCEN prohibition under special measure five Covered financial institutions and
received one comment expressing is warranted. Consistent with the transaction partners have ample
support for FinCEN’s identification of finding that Huione Group is a foreign opportunity to arrange for alternative
Huione Group as a primary money financial institution of primary money payment mechanisms in the absence of
laundering concern. The commenter laundering concern, and in correspondent banking relationships
suggests that targeting Huione Group consideration of additional relevant with Huione Group.
factors, this final rule imposes a As such, a prohibition on
alone is insufficient to effectively
prohibition on covered financial correspondent banking with Huione
safeguard the U.S. financial system, and
institutions from opening or Group will impose minimal additional
that FinCEN should work with other
maintaining a correspondent account compliance costs for covered financial
government agencies to take additional
for, or on behalf of, Huione Group. This institutions, which would most
steps, including punitive measures
prohibition will help guard against the commonly involve adding Huione
against other large facilitators of money
money laundering risks to the U.S. Group to existing sanctions and money
laundering. FinCEN assesses that this
financial system posed by Huione laundering screening tools. FinCEN
final rule is an important step in
Group, as identified in the NPRM and assesses that given the risks posed by
safeguarding the U.S. financial system Huione Group’s facilitation of money
and will continue to take steps to this final rule.
laundering, the additional burden on
safeguard the U.S. financial system. A. Whether Similar Action Has Been or covered financial institutions in
5. Non-Responsive Comments Is Being Taken by Other Nations or preventing the opening of
Multilateral Groups Regarding Huione correspondent accounts with Huione
FinCEN received five other comments Group
that were not responsive to the NPRM, Group, as well as conducting due
including suggestions to investigate In March 2025, National Bank of diligence on foreign correspondent
other, unrelated alleged financial Cambodia stripped Huione Pay PLC of account holders and notifying them of
crimes, and separate comments entirely its banking license.109 Nevertheless, as the prohibition, will be minimal.
unrelated to this rulemaking process. established above, Huione Group has
C. The Extent to Which the Action or the
continued to operate CVC services
D. Summary of FinCEN’s Ongoing Timing of the Action Would Have a
which are expressly prohibited in
Significant Adverse Systemic Impact on
Concerns Regarding Huione Group Cambodia.110 Thus, FinCEN assesses
the International Payment, Clearance,
After considering comments received that this special measure is appropriate
and Settlement System, or on Legitimate
from the public, as well as other given Huione Group’s ongoing and Business Activities of Huione Group
information available to the agency, egregious conduct, continuing even after
one component lost its license to FinCEN assesses that imposing the
including both public and non-public
operate. final rule would have minimal impact
information, and Huione Group’s
upon the international payment,
ongoing efforts to engage in money B. Whether the Imposition of Any clearance, and settlement system. As a
laundering activities and evade scrutiny Particular Special Measure Would comparatively small financial
and accountability, FinCEN continues to Create a Significant Competitive institution responsible for a nominal
find that reasonable grounds exist to Disadvantage, Including Any Undue amount of transaction volume in the
conclude that Huione Group remains a Cost or Burden Associated With region, Huione Group is not a
financial institution operating outside Compliance, for Financial Institutions systemically important financial
the United States that is of primary Organized or Licensed in the United institution in Cambodia, regionally, or
money laundering concern. States globally. FinCEN views that prohibiting
III. Imposition of a Special Measure While FinCEN assesses that the final Huione Group’s access to U.S.
Regarding Huione Group as a Foreign rule would place some cost and burden correspondent banking channels would
Financial Institution of Primary Money on covered financial institutions, these not substantially affect the volume of
Laundering Concern burdens are neither undue nor legitimate cross-border transactions.
Based upon this finding, FinCEN is inappropriate in view of the threat Further, a prohibition under special
authorized to impose one or more posed by the illicit activity facilitated by measure five will not prevent Huione
special measures. Following the Huione Group. As described in the Group from conducting legitimate
required consultations and the NPRM, Huione Group has no direct business activities in other foreign
consideration of all relevant factors USD correspondent relationships with currencies.
discussed in the NPRM, FinCEN U.S. financial institutions and instead, D. The Effect of the Proposed Action on
proposed a prohibition under the fifth accesses USD through nested United States National Security and
special measure.108 corresponding relationships, outside the Foreign Policy
108 Prior to issuing the NPRM and this final rule, international financial systems. Those views are As described above, evidence
FinCEN consulted with representatives and staff of reflected in FinCEN’s explanation of the reasons for available to FinCEN demonstrates that
the Board of Governors of the Federal Reserve issuing this final rule. Huione Group serves as a significant
109 National Bank of Cambodia, List of Payment
System, the Office of the Comptroller of the conduit for money laundering by TCOs
Currency, the Secretary of State, the staff of the Service Institutions (Mar. 31, 2025), https://
www.nbc.gov.kh/english/supervision/payment_ engaged in CVC investment scams and
lotter on DSK11XQN23PROD with RULES1
Securities and Exchange Commission, the
Commodity Futures Trading Commission, staff of service.php (last accessed July 28, 2025). DPRK-related actors engaging in CVC
the National Credit Union Administration, the 110 Reuters, Exclusive: North Korean hackers sent heists. Imposing special measure five
Federal Deposit Insurance Corporation, and the stolen crypto to wallet used by Asian payment firm will: (1) close Huione Group’s access to
Attorney General. These consultations involved (July 15, 2024), https://www.reuters.com/
obtaining interagency views on the imposition of technology/cybersecurity/north-korean-hackers-
USD; (2) inhibit Huione Group’s ability
special measure five and the effects that such a sent-stolen-crypto-wallet-used-by-asian-payment- to act as an illicit finance facilitator for
prohibition would have on the U.S. domestic and firm-2024-07-15/. DPRK and TCOs engaged in CVC
VerDate Sep<11>2014 15:47 Oct 15, 2025 Jkt 265001 PO 00000 Frm 00011 Fmt 4700 Sfmt 4700 E:\FR\FM\16OCR1.SGM 16OCR1
48306 Federal Register / Vol. 90, No. 198 / Thursday, October 16, 2025 / Rules and Regulations
investment scams; and (3) raise beneficial owner or originator.111 This institutions to Huione Group’s illicit
awareness of the way illicit actors would be ineffective in preventing illicit activity, outweigh the value in
exploit weaknesses in vulnerable transactions. Huione Group’s record of providing conditioned access to the U.S.
jurisdictions to circumvent sanctions such circumvention suggests that financial system for any purportedly
and finance WMD and ballistic missile special measure one would not legitimate business activity. Conditions
proliferation. adequately protect the U.S. financial on the opening or maintaining of
system from the threats posed by the correspondent accounts would likely be
E. Consideration of Alternative Special
financial institution. insufficient to prevent illicit financial
Measures Further, the requirements under flows through the U.S. financial system,
In assessing the appropriate special special measures three and four, that given Huione Group’s inadequate AML/
measure to impose, FinCEN considered domestic financial institutions obtain
alternatives to a prohibition on the KYC program.
‘‘with respect to each customer (and
opening or maintaining in the United each such representative), information In sum, FinCEN assesses that any
States of correspondent accounts or that is substantially comparable to that condition or additional recordkeeping
payable-through accounts, including the which the depository institution obtains or reporting requirement would be an
imposition of one or more of the first in the ordinary course of business with ineffective measure to safeguard the
four special measures, or imposing respect to its customers residing in the U.S. financial system from the illicit
conditions on the opening or United States,’’ are also likely to be behavior facilitated by Huione Group.
maintaining of correspondent accounts ineffective.112 Huione Group’s use of Such measures would not prevent
under special measure five. Having nested correspondent account access Huione Group from accessing the
considered these alternatives and for the through layers of payment systems correspondent accounts of U.S. financial
reasons set out below, FinCEN assesses would render these alternative measures institutions, thus leaving the U.S.
that none of the other special measures ineffective. Only significant effort and financial system vulnerable to
available under section 311 would expense by U.S. institutions could fill processing illicit transfers that are likely
appropriately address the risks posed by this gap, which would impose a to finance DPRK’s nuclear proliferation,
Huione Group and the urgent need to disproportionate compliance burden, or CVC investment scams, resulting in
prevent it from accessing USD through with no guarantee that the money significant national security and money
correspondent banking. laundering threat would be addressed
With public acknowledgements of its laundering risk. In addition, no
through customer due diligence
failure to address significant AML/KYC recordkeeping or reporting requirements
research. FinCEN also considered
deficiencies, Huione Group continues to or conditions would be sufficient to
special measure two, which may require
present a significant money laundering guard against the risks posed by a