Huione and Section 311: How FATF Rules Get Teeth in 2026

A Cambodian conglomerate called Huione Group did almost everything the world’s anti-money-laundering rulebook was written to stop. American investigators say it laundered at least $4 billion in criminal proceeds between August 2021 and January 2025, including funds stolen by North Korean hackers and the payouts from the romance-and-investment frauds that wipe out retirees. The blockchain-analytics firm Elliptic traced far more than that through its platforms and called its online marketplace the largest online illicit marketplace ever to operate. Huione even issued its own stablecoin, USDH, and advertised the fact that nobody could freeze it as a selling point.

The Financial Action Task Force, the intergovernmental body that writes the global standards on money laundering, had described this exact kind of threat in guidance paper after guidance paper. Offshore crypto businesses, laundering-as-a-service marketplaces, freeze-resistant stablecoins, North Korean cyber-theft: all of it sat in FATF reports years before Huione became a household name in compliance departments. And yet FATF never shut Huione down. It could not. FATF has no police, no prosecutors, and no power to freeze a single wallet.

What finally severed Huione from the financial system was not FATF but a single, rarely used American rule. That gap, between the body that writes the standards and the authorities that actually enforce them, is the most important thing to understand about FATF guidance in 2026. This piece uses the Huione case as a lens: what FATF is, what its crypto rules say, why they could not stop a laundering hub operating in plain sight, and how the US Treasury turned a soft-law standard into a hard ban. For context, Bitcoin trades around $81,000 and the stablecoin supply that now carries most illicit crypto value sits near $291 billion.

What FATF Is, and What It Cannot Do

The Financial Action Task Force was created in 1989 by the G7 in Paris, and it still sits at the OECD headquarters there. Its job is narrow and enormous at the same time: to set the global standards that governments use to fight money laundering and, since 2001, terrorist financing. Those standards are the 40 Recommendations, a document that most of the world’s financial regulators treat as the baseline for their own laws. FATF has about 40 full members, but its reach runs through a Global Network of FATF-style regional bodies covering more than 200 jurisdictions.

Here is the part that surprises people. FATF cannot fine anyone. It cannot arrest anyone, seize a coin, or close a company. It is not a treaty organization, and its Recommendations are not law anywhere until a national parliament copies them into national law. What FATF actually does is three things: it writes the standards, it grades countries against them through a peer-review process called mutual evaluation, and it publishes two lists that tell the world which jurisdictions are falling short.

That grading power is the whole of FATF’s leverage. A poor mutual evaluation, or a place on one of the lists, raises the cost of doing business with a country: correspondent banks pull back, transactions draw extra scrutiny, and capital gets nervous. It is reputational and financial pressure, applied to governments, not a hammer applied to criminals. Understanding that distinction is the key to the Huione story, because Huione was not a country. It was a company, and FATF does not regulate companies at all.

The Crypto Rulebook: R.15, VASPs, and the Travel Rule

FATF came late to crypto, then moved fast. In October 2018 it amended Recommendation 15 to add two terms to its glossary: the virtual asset (VA) and the virtual asset service provider (VASP). In June 2019 it published an Interpretive Note to R.15 and its first risk-based guidance, extending the decades-old banking Travel Rule to crypto. In October 2021 it updated that guidance to address stablecoins, decentralized finance, peer-to-peer transfers, and unhosted wallets.

The definitions matter for the Huione case. A virtual asset is a digital representation of value that can be traded or transferred for payment or investment; it excludes central-bank digital currencies and assets already covered as securities. A VASP is any business that, for someone else, does one of five things: exchanges crypto for fiat, exchanges crypto for crypto, transfers crypto, holds or administers it, or provides financial services around a token’s issuance. If you do those things for customers, FATF expects your national regulator to license you, screen your users, and make you keep records.

The Travel Rule is the crypto adaptation of Recommendation 16. When value moves between two VASPs above a threshold (FATF suggests the equivalent of $1,000), the sending business must pass identifying information about the sender and recipient to the receiving business, just as banks do for wire transfers. In the United States that obligation runs through the Bank Secrecy Act and FinCEN, not the Securities and Exchange Commission; the SEC only enters where a token is also a security. That FinCEN-not-SEC point trips up a lot of readers, and it is central to how Huione was eventually stopped.

Meet Huione: A Bank, a Marketplace, and a Stablecoin

On paper, Huione Group was a diversified Cambodian financial conglomerate. In practice, US investigators describe it as a one-stop shop for cybercrime. It ran three things that map neatly onto FATF’s categories. Huione Pay PLC was a licensed payment-services institution. Huione Crypto was a virtual-asset service provider, a VASP in FATF’s own language. And Haowang Guarantee, previously called Huione Guarantee, was an online marketplace.

The marketplace is what made Huione notorious. A guarantee platform does not sell goods itself; it is an escrow service that lets merchants sell to strangers with the platform vouching for both sides. On Huione Guarantee, the largest category of merchants sold money-laundering services: they accepted victim payments from around the world, moved them across borders, and converted them into cash, stablecoins, and Chinese payment apps. Others sold stolen personal data, scam scripts, and even the physical infrastructure of the fraud compounds. Elliptic first exposed the marketplace in July 2024 and later called it the largest online illicit marketplace ever to operate.

How big was it? This is where the numbers require care, because there are two very different ones. FinCEN’s legal finding says Huione laundered at least $4 billion in illicit proceeds between August 2021 and January 2025, including more than $37 million tied to North Korean cyber-heists, at least $36 million from crypto investment and romance scams, and around $300 million from other cyber scams, according to the US Treasury. Elliptic’s tracing produces a far larger figure: by mid-2026 it put the total value received across Huione’s platforms at about $134 billion, roughly $103 billion through Huione Pay and $31 billion through the Guarantee marketplace. An earlier Elliptic estimate in May 2025 had put the crypto received near $98 billion.

Those figures are not contradictory; they measure different things. The $4 billion is what investigators can attribute to specific crimes, the number that supports a legal action. The $134 billion is total throughput, most of which was ordinary payments flowing alongside the illicit share. The gap is a lesson in itself: even with blockchain’s transparency, pinning down exactly what is dirty is hard, and the headline figure you see depends entirely on what is being counted.

One Entity, Every FATF Blind Spot

Huione is a useful case study precisely because it embodies almost every risk FATF’s crypto guidance has flagged over the years. It was an offshore VASP operating from a jurisdiction with weak enforcement. It was, in FATF’s language, a business that offered laundering as a service. It issued a freeze-resistant stablecoin. It relied on nested and correspondent relationships to reach the mainstream financial system. And it served as a laundering node for North Korea, a state FATF blacklists by name.

Elisa de Anda Madrazo, who led FATF as president through June 2026, put the offshore problem bluntly when the task force published its dedicated report on offshore VASPs in March 2026. The report, she said, “exposes how oVASPs create blind spots that criminals are clearly exploiting, to scam vulnerable people through fraud or fuel terror around the world.” Huione is what one of those blind spots looks like when it is fully built out.

If FATF Wrote the Rules, Why Couldn’t It Stop Huione?

So FATF had described the threat. Why did nothing happen for years while Huione grew? The answer is the enforcement gap that runs through this whole subject. FATF writes standards for governments; it does not act against firms. For FATF to reach Huione, Cambodia would have had to license, supervise, and then sanction its own conglomerate. It did not.

Worse, FATF’s main tool pointed the wrong way. Cambodia sat on the FATF grey list, the roster of jurisdictions under increased monitoring, from February 2019 until February 2023, when the task force removed it after judging that it had improved its anti-money-laundering regime. Huione was operating throughout that period and kept growing after the delisting. By early 2026, with the scam-center economy impossible to ignore, Cambodia was reportedly working to avoid a return to the grey list. The country that hosted the largest crypto-laundering hub on record had been graded as improving at the very moment the hub was scaling.

This is not a failure unique to FATF; it is the design. A mutual evaluation grades a country’s laws and institutions, not the live behavior of every company inside its borders. A grey-list decision is a diplomatic judgment made by consensus among members. Neither is built to move at the speed of a Telegram marketplace adding merchants. If Huione was going to be stopped, it would have to be stopped by an authority that could act against the company directly, and reach it where it was vulnerable.

Section 311: The Chokepoint With Teeth

That authority turned out to be the US Treasury, and the tool was Section 311 of the USA PATRIOT Act. Section 311 lets the Treasury, acting through FinCEN, designate a foreign entity or jurisdiction a primary money laundering concern and then impose one or more of five special measures. The fifth and most severe of those measures prohibits US financial institutions from opening or maintaining correspondent accounts for the target, as the final rule against Huione spelled out.

To see why that is devastating, follow the dollars. Almost all international finance touches the US dollar, and dollar transactions ultimately clear through US banks. A correspondent account is the doorway a foreign institution uses to reach that system. Cut the correspondent account, and you cut the target off from the dollar, and from most of the banks in the world that value access to it. Section 311 does not require arresting anyone or persuading a foreign government to act. It is the United States, unilaterally, closing its door and letting the dollar’s centrality do the rest.

Two things about Section 311 are worth stressing. First, this is FinCEN and the Treasury, the anti-money-laundering authorities, not the SEC; the securities regulator plays no role in a laundering designation. Second, the measure is aimed at an institution, not a country, which is exactly the gap FATF’s country-level lists leave open. Section 311 is the sharp instrument that FATF’s standards imply but cannot themselves wield.

The Huione Takedown, Step by Step

The action against Huione unfolded over more than a year, and its timeline shows how a designation becomes a ban.

FinCEN issued its finding on May 1, 2025, naming Huione Group a primary money laundering concern and proposing to cut its correspondent-account access. Treasury Secretary Scott Bessent did not hedge. Huione, he said, “has established itself as the marketplace of choice for malicious cyber actors like the DPRK and criminal syndicates, who have stolen billions of dollars from everyday Americans.” The practical effect began immediately, because banks do not wait for a rule to be final before backing away from a named launderer.

On October 14, 2025, the United States and the United Kingdom announced what Treasury called the largest action ever taken against the cybercriminal networks of Southeast Asia, with Bessent warning that “the rapid rise of transnational fraud has cost American citizens billions of dollars, with life savings wiped out in minutes.” FinCEN’s final rule was published on October 16, 2025 and took effect on November 17, 2025. In June 2026 the Treasury returned to refine the designation with a further rule clarifying the definition of Huione Group, and that same month the FBI seized a cloud-computing account used by Huione subsidiaries, an operation Elliptic said it supported with intelligence used to trace the fraud proceeds.

The reach extended into courtrooms as well. In September 2025 a California man was sentenced to 51 months in prison for laundering the proceeds of a $36.9 million crypto scam, with funds routed through Huione Group. A designation names the hub; individual prosecutions reach the people who used it.

Whack-a-Mole: USDH and the Successor Marketplaces

A ban only works if the target cannot simply reappear under a new name, and this is where the Huione case gets genuinely difficult. Huione’s own stablecoin, USDH, was launched around September 2024 and built to defeat exactly the control that saves most enforcement actions. Unlike Tether’s USDT or Circle’s USDC, whose issuers can freeze or burn tokens on a lawful order, USDH lacked freezing functionality altogether, and Huione advertised its absence of regulatory oversight and its inability to be frozen as features.

That is the freeze-button problem in one product. For most stablecoins, the issuer’s ability to freeze a wallet is the single most reliable enforcement tool in crypto, more reliable than any Travel Rule message; FATF’s March 2026 report on stablecoins urged jurisdictions to require exactly that kind of programmable freeze and deny-list capability. A coin engineered to have no freeze button removes the control point, which is why regulators treat freeze-resistant stablecoins as a category of concern and why the September 2026 FinCEN alert singled out tokens that cannot be seized or frozen. The same tension runs through self-custody and smart-account designs, where the power to freeze or recover funds is deliberately constrained.

The marketplaces played the same game with venues instead of assets. After Elliptic’s research led Telegram to ban Haowang Guarantee, which had processed more than $27 billion in stablecoin transactions, along with a sister marketplace called Xinbi Guarantee, on May 13, 2025, merchants did not disappear; they migrated. A successor called Tudou Guarantee, part-owned by Huione, absorbed much of the traffic and handled more than $12 billion before winding down in January 2026. The June 2026 rule that clarified the definition of Huione Group is best understood in this light: when the target keeps rebranding, the enforcer has to keep tightening the definition of what counts as the target.

The Scam-Center Engine: FinCEN’s $12.7 Billion Alert

Behind the abstractions of correspondent accounts and VASP definitions sits a brutally physical industry. The money Huione laundered was generated in scam compounds across Southeast Asia, where trafficked workers are forced to run “pig-butchering” frauds: long-con schemes in which a stranger builds a relationship online, then lures the victim into a fake crypto investment that drains their savings.

On September 3, 2026, FinCEN put a number on the American share of that industry. Its alert, FIN-2026-Alert005, identified nearly $12.7 billion in suspected digital-asset investment-scam activity, drawn from 33,904 Bank Secrecy Act reports filed between September 2023 and December 2025. The alert named Cambodia, Burma, and Laos as the base of the transnational criminal organizations running the compounds, noted their expansion into other regions, and gave banks 16 red-flag indicators to catch the flows. It arrived alongside a broader US posture that now includes a Justice Department scam-center strike force and an executive order aimed at the compounds.

The North Korea thread ties the fraud economy to the rest of crypto crime. The same laundering rails that clean romance-scam proceeds also move the cryptocurrency that North Korean hackers steal from exchanges and bridges, a pattern that keeps repeating across the industry. Analysts at Chainalysis estimate that illicit addresses received at least $154 billion in 2025 and that stablecoins now account for around 84 percent of illicit crypto value, even as illicit activity stays under one percent of all on-chain volume. Huione was not an outlier in that system; for a while, it was the system’s plumbing.

How FATF and Section 311 Work Together

It would be easy to read the Huione case as proof that FATF is toothless and Section 311 is what matters. That is half right, and the missing half is important. FATF and the US chokepoint are not rivals; they are two ends of the same machine.

FATF supplies the map. Its guidance is where the concepts came from: the VASP definition that made Huione Crypto a regulated category, the offshore-VASP analysis that named the jurisdictional gap, the stablecoin report that flagged freeze-resistance, and the blacklisting of North Korea that turned DPRK links into an automatic aggravating factor. When FinCEN wrote its finding, it was applying categories FATF had spent years defining. A national enforcer that acts without a shared international standard invites accusations of arbitrariness; FATF is what makes a US action legible to banks and governments everywhere else.

National authorities supply the teeth. Section 311, OFAC sanctions, correspondent-banking pressure, and criminal prosecutions are the instruments that actually bite, and they bite at chokepoints: the points where crypto touches the regulated financial system. Giles Thomson, who took over the FATF presidency in July 2026, framed the ongoing threat in terms that describe Huione exactly, warning that “criminal networks continue to abuse virtual assets for illicit purposes and exploit their borderless nature to commit fraud and scams, evade sanctions and launder the proceeds of crime.” FATF states the problem; the chokepoints are where someone does something about it.

The Grey List: FATF’s Softest, Sharpest Tool

For all its limits, FATF’s list is not nothing. It is the mechanism that turns country-level failure into real cost, and it is worth understanding because it is the lever most likely to touch the jurisdictions where the next Huione incubates.

FATF maintains two lists. The blacklist, formally the list of high-risk jurisdictions subject to a call for action, currently names just three countries: Iran, North Korea, and Myanmar. The grey list, jurisdictions under increased monitoring, is longer and more fluid. At its June 2026 plenary in Paris, the last under Mexico’s presidency, FATF added Bosnia and Herzegovina and Iraq and removed Algeria and Namibia, leaving 22 jurisdictions on it.

The lists also show the limits. Myanmar is both blacklisted by FATF and one of the countries named by FinCEN as a base for scam compounds; the blacklist did not stop the compounds. Cambodia, home to Huione, is on neither list. The grey list is a slow, consensus-driven pressure valve applied to governments, not a switch that reaches a single company in real time. It is the softest of tools and, applied patiently to a whole economy, sometimes the sharpest FATF has.

Europe’s Harder Law, America’s Sharper Chokepoint

FATF standards land differently on the two sides of the Atlantic, and the contrast explains a lot about why the Huione action looked the way it did. The United States enforces anti-money-laundering rules through a patchwork of powerful instruments rather than a single crypto statute. Congress has not passed a comprehensive market-structure law; the CLARITY Act stalled in the Senate in September 2026, leaving regulators to act through designations, sanctions, and the Bank Secrecy Act rather than new legislation. Section 311 is a product of that world: sharp, unilateral, and aimed at chokepoints.

The European Union is building the opposite: dense, codified law. Its Anti-Money-Laundering Regulation, its Transfer of Funds Regulation, which applies the Travel Rule to crypto with no minimum threshold, and a new supervisor, the Anti-Money-Laundering Authority in Frankfurt, translate FATF’s standards into directly binding rules. The EU’s markets-focused regime, MiCA, licenses crypto firms but is explicitly not an anti-money-laundering law; those obligations sit in the AML package instead, a distinction that trips up even sophisticated readers. A European Huione would face a licensing and supervisory wall before it ever reached a Section 311 problem.

Both systems ultimately rest on the same FATF foundation, and both share the same weak point: the moment value moves outside a regulated intermediary, into an unhosted wallet or an unfreezable coin, the rulebook runs out of gripping surface. That is the frontier Huione exploited, and it is the frontier the next case will be fought on.

What It Means for Ordinary Crypto Users

Most people reading this will never touch a laundering marketplace, but the Huione response reaches them anyway, because enforcement works through the platforms they use. Expect exchanges to screen deposits and withdrawals harder, to flag or freeze funds with any traceable link to sanctioned or designated entities, and to ask more questions about the origin of large stablecoin transfers. The compliance chokepoint, in practice, is the exchange account, and increasingly the deposit address itself.

A few practical points follow. Coins from an issuer that advertises that it cannot freeze funds are not a safe haven; they are a red flag, and a growing number of venues will simply refuse them. Funds that pass through a mixer or a flagged marketplace can be quarantined long after the fact, because blockchain history is permanent and analytics keep improving. And the powers that make a designation possible, correspondent-banking cutoffs and issuer freezes, are the same powers that can, in rare cases, catch an innocent user in a broad net; the remedy there is documentation, not avoidance.

The larger takeaway is about where the rules actually live. FATF guidance is the source code of crypto compliance, but it runs on national hardware: FinCEN findings, OFAC lists, court sentences, and the correspondent accounts that connect everything to the dollar. Huione is the case that makes the architecture visible. The standards described the threat for years; it took a chokepoint to answer it.

Frequently Asked Questions

What is FATF and does it have any enforcement power?

FATF, the Financial Action Task Force, is the intergovernmental body that sets the global standards on money laundering and terrorist financing through its 40 Recommendations. It has no power to fine, arrest, or freeze assets. Its only leverage is grading countries through mutual evaluations and placing them on its grey or black lists, which raises the cost of doing business with those jurisdictions. Actual enforcement is left to national authorities.

What was Huione Group and what did it do?

Huione Group was a Cambodian conglomerate that US investigators say functioned as a one-stop shop for cybercrime. It ran a payment company, a crypto exchange, and an online marketplace whose top merchants sold money-laundering services. FinCEN found it laundered at least $4 billion between 2021 and 2025, while Elliptic traced about $134 billion in total flows across its platforms. It also issued USDH, a stablecoin advertised as impossible to freeze.

What is Section 311 and why is it so powerful?

Section 311 of the USA PATRIOT Act lets the US Treasury designate a foreign firm or jurisdiction a primary money laundering concern and cut it off from US correspondent accounts. Because almost all dollar transactions clear through US banks, losing correspondent access effectively severs the target from the global financial system. It is unilateral and aimed at a specific institution, which is why it reached Huione where FATF’s country-level tools could not.

Why couldn’t FATF stop Huione directly?

FATF sets standards for governments, not companies, so only Cambodia could have licensed and sanctioned Huione. FATF’s main tool, the grey list, actually removed Cambodia in February 2023 for improving its regime, even as Huione kept growing. FATF grades laws and institutions on a slow, consensus-driven cycle, which is not built to reach a single fast-moving company. Stopping Huione required a national authority acting at a financial chokepoint.

How does the Huione case affect ordinary crypto users?

Enforcement reaches users through the platforms they use, so exchanges are screening deposits and withdrawals more aggressively and may freeze funds linked to designated entities. Stablecoins marketed as unfreezable are treated as red flags rather than safe havens, and funds routed through flagged marketplaces or mixers can be quarantined long afterward. The practical defense is keeping records of where your funds came from.

Anneke de Vries covers regulation and compliance for HOGE Wire.