BitMEX’s $100M KYC Lesson, and the Pardon That Followed

An exchange you could join with an email address

For most of the past decade, the fastest way to understand know-your-customer rules in crypto was to look at an exchange that ignored them. BitMEX, once the largest Bitcoin derivatives venue in the world, let a new user open an account and trade with leverage using nothing more than an email address. No passport. No selfie. No proof of address. That single design choice, the absence of an identity check, is the cleanest definition of what KYC is: everything BitMEX chose not to do.

Bitcoin is trading around $82,000 as this piece publishes, after a hotter-than-expected US inflation print pushed the Federal Reserve further from rate cuts and knocked risk assets lower, with a total market value near $1.64 trillion, per CoinGecko. The price models argue endlessly about where it goes next. The rulebook that governs how your money gets into and out of that market is far less glamorous and far more settled, and BitMEX is the case that settled much of it.

In 2021 the exchange paid $100 million to US regulators. Its three founders pleaded guilty to a federal crime in 2022. The corporate entity pleaded guilty in 2024 and was fined another $100 million in January 2025. Then, in March 2025, President Donald Trump pardoned the founders and the company. Seven months later he pardoned Changpeng Zhao, the founder of Binance. The rules BitMEX broke are still on the books, heavier than ever. This piece works through what those rules actually require, why BitMEX became the template for every offshore enforcement case that followed, and what it means that the people who built the template have now been forgiven.

KYC and AML are not the same thing

People use the two terms interchangeably. They are not the same. Anti-money-laundering (AML) is the umbrella: the body of law and the internal controls that financial firms must run so their platforms are not used to wash criminal proceeds. Know-your-customer (KYC) is one component inside that umbrella, the part that establishes who a customer actually is.

In the United States the architecture rests on the Bank Secrecy Act of 1970. A regulated firm has to run five things, often called the five pillars:

• a designated compliance officer;
• written internal controls and policies;
• ongoing employee training;
• independent testing or audit of the program;
• risk-based customer due diligence that identifies the beneficial owners behind an account (the fifth pillar, added by a 2016 rule).

Layered on top is a mental model of how laundering works in three stages: placement (getting dirty money into the system), layering (moving it through enough hops to obscure the trail), and integration (bringing it back out looking clean). Crypto is weakest, from a launderer’s point of view, at the layering stage, because a public blockchain records every hop. KYC is where a customer meets all of this. It is the onboarding gate. BitMEX built an exchange with no gate.

The regulator is FinCEN, not the SEC

Here is the single most common mistake in crypto-compliance coverage, including on crypto-native sites: the belief that the Securities and Exchange Commission runs AML. It does not.

US AML authority sits with the Financial Crimes Enforcement Network (FinCEN), a bureau of the Treasury Department, and with the Office of Foreign Assets Control (OFAC), also inside Treasury, which administers sanctions. A crypto exchange that serves US customers is a money services business (MSB) and must register with FinCEN, maintain an AML program, and file reports. The SEC’s role is the securities question, whether a given token is an investment contract, and the Commodity Futures Trading Commission (CFTC) oversees derivatives. When BitMEX was charged, the securities label never came up. The charge was failing to run an AML program under the Bank Secrecy Act, enforced by the Department of Justice and FinCEN, with a parallel CFTC action for offering unlicensed leveraged products to Americans.

Keep that straight and the rest of the regime makes sense. KYC and AML are a Treasury matter, run through the banking rulebook, not the securities one. It is a distinction that decides which agency writes the rules, which court hears the case, and what a founder is actually accused of.

What BitMEX actually did, and did not do

BitMEX launched in 2014, built by Arthur Hayes, a former Hong Kong equity-derivatives trader, with co-founders Benjamin Delo and Samuel Reed. The operating company, HDR Global Trading Limited, was incorporated in the Seychelles. On paper it was an offshore business serving a global clientele. In practice, US prosecutors said, it actively solicited and served American traders while structuring itself to sit outside American law.

The onboarding was the tell. To trade, a customer supplied an email address. That was the identity check. There was no document capture, no liveness test, no sanctions screening at sign-up. BitMEX grew into the largest crypto-derivatives platform of its era on that frictionless model, and the lack of friction was not an oversight; it was the product. An exchange that asks nothing is an exchange anyone can use, including the people a bank would turn away.

Prosecutors also surfaced a line that followed Hayes for years. In a 2020 charging document, the government alleged that in 2019 Hayes had bragged the Seychelles was a friendlier home for BitMEX because it cost less to bribe officials there, just “a coconut,” than it would cost to bribe regulators in the United States. The remark became shorthand for the whole case, though it is worth being fair about it. The judge who later handled the matter, John G. Koeltl, barred the comment from any trial, saying Hayes had spoken “in a plainly jocular fashion” and that there was no evidence any bribe was paid. The coconut was a joke. The missing AML program was not.

The charges, and the template they set

The enforcement arrived in stages, and the sequence matters, because every later offshore case followed the same arc.

In October 2020, the DOJ and the CFTC moved together. The criminal charge against Hayes, Delo, Reed, and BitMEX’s first head of business development, Gregory Dwyer, was conspiracy to violate and violation of the Bank Secrecy Act: willfully failing to establish, implement, and maintain an adequate AML program, including a KYC program, from 2015 through 2020. In August 2021, BitMEX settled the civil side, agreeing to pay $100 million to the CFTC and FinCEN, split evenly between the two.

In 2022 the founders pleaded guilty one by one and were sentenced to probation rather than prison. Hayes received two years’ probation including six months of home confinement; Delo got 30 months’ probation; Reed 18 months; each of the three paid a $10 million criminal fine, and Dwyer later took a shorter term and a smaller fine. Judge Koeltl, sentencing Hayes, said he wanted to treat him as an individual rather than as an example for other offshore exchanges. The irony is that BitMEX became exactly that example anyway.

The corporate case closed last. In July 2024, HDR Global Trading pleaded guilty to a single Bank Secrecy Act violation. Then US Attorney for the Southern District of New York Damian Williams said the company “opened itself up as a vehicle for large-scale money laundering and sanctions evasion schemes, posing a serious threat to the integrity of the financial system.” In January 2025 a judge sentenced the company to a further $100 million fine and two years of probation; prosecutors had asked for $417 million. Add it up and BitMEX and its principals were on the hook for roughly $120 million in criminal fines and $100 million in civil penalties, all built on one missing system.

What a compliant exchange is supposed to do

Strip the drama away and BitMEX is a checklist of everything a regulated exchange does at onboarding. A compliant venue runs a Customer Identification Program: it collects a legal name, a date of birth, an address, and a government identifier, then verifies them against a document and, increasingly, a live selfie matched to that document. This is the step BitMEX replaced with an inbox.

From there it layers on more. It screens the customer against sanctions lists (OFAC’s Specially Designated Nationals list and its global equivalents) and against politically-exposed-person and adverse-media databases. It assigns a risk score. Low-risk customers get standard due diligence; higher-risk ones (large volumes, high-risk jurisdictions, opaque ownership) get enhanced due diligence, which means more documentation and senior sign-off. And it does not stop at the door: it monitors transactions for the life of the account, looking for patterns that do not fit the customer it onboarded.

A modern compliance stack buys most of this from identity vendors (Sumsub, Jumio, Onfido, Persona) and from blockchain-analytics firms (Chainalysis, Elliptic, TRM Labs) that score on-chain activity and flag addresses linked to theft, sanctions, or mixers. None of it is cheap, and none of it is optional for a licensed firm. BitMEX ran none of it for years. That is the whole offense, stated plainly: not a hack, not a theft, but the deliberate absence of a system every competitor was required to build.

SARs, CTRs, and the paperwork of suspicion

The part of AML that outsiders never see is the reporting. When a regulated firm spots activity it cannot explain, it files a Suspicious Activity Report (SAR) with FinCEN, generally within 30 days, for anything suspicious at or above $2,000 at a money services business. It files a Currency Transaction Report (CTR) for cash transactions over $10,000. It keeps the records for five years. And it is a crime to tell the customer a report was filed; that is called tipping off.

This reporting duty is where the Binance case, which came after BitMEX, drew blood. Binance processed more than 100,000 transactions that touched terrorist groups, ransomware operators, and sanctioned jurisdictions, and filed exactly zero SARs. BitMEX’s failure was upstream of that: with no KYC, it often did not know enough about a customer to have anything to report in the first place. You cannot file a suspicion about an email address. The two cases are the same failure at different depths, which is why the table of obligations below reads like a list of everything the offshore exchanges skipped.

BitMEX was the template; Binance, OKX, and KuCoin followed

What makes BitMEX worth a full teardown is that the DOJ used it as a model. The same legal theory, an offshore exchange soliciting US users without an AML program, produced the three largest crypto-AML cases in history in rapid succession.

Binance came first and biggest. In November 2023 it agreed to a resolution of more than $4.3 billion (a $3.4 billion FinCEN penalty, the largest in that agency’s history at the time, plus a $968 million OFAC settlement), with CZ pleading guilty to a Bank Secrecy Act violation and stepping down as chief executive. Attorney General Merrick Garland’s line has become the motto of the whole enforcement era: “Using new technology to break the law does not make you a disruptor. It makes you a criminal.”

Then came the Seychelles-and-offshore cousins. OKX, through its operating entity, pleaded guilty in February 2025 to running an unlicensed money-transmitting business and agreed to pay more than $504 million, after years of letting US customers trade with thin or no verification. KuCoin, in January 2025, pleaded guilty and agreed to more than $297 million plus a two-year exit from the US market. Each is a variation on the same original: build offshore, skip the gate, take American money, pay later. BitMEX was the first to run the play and the first to be caught, which is why it, more than any single case, defines what the rules are by showing what happens when they are absent.

The pardons: March, then October

Here is the 2026 twist that makes the BitMEX story more than a history lesson. In March 2025, President Trump pardoned Hayes, Delo, Reed, and Dwyer, along with HDR Global Trading, for the Bank Secrecy Act violations they had already pleaded guilty to. In October 2025 he pardoned CZ, who had served four months in prison in 2024. By then the administration had already dropped its civil case against Kraken and shelved its investigation of Binance, and OFAC had delisted the Tornado Cash mixer in March 2025. The enforcement wave that BitMEX kicked off was being wound back, case by case, from the top.

The reaction split along familiar lines. Senator Elizabeth Warren called the CZ pardon “corruption on stilts,” pointing to the Trump family’s own crypto ventures and their reported ties to Binance. Supporters framed the pardons as the overdue end of a campaign they saw as regulation-by-prosecution.

What a pardon does and does not do matters here, and it is routinely misread. A pardon forgives the individuals and lifts the conviction’s consequences; it does not repeal the Bank Secrecy Act, claw back the $100 million BitMEX had already paid, or tell the next exchange it can skip KYC. The statutes BitMEX broke are unchanged, and in Europe they are getting stricter. What the pardons signal is a shift in the executive branch’s appetite to prosecute, not a change in the law a compliance officer has to follow on Monday morning. The gap between those two things, the law on the books and the will to enforce it, is the real story of crypto AML in 2026.

Does the KYC regime actually work?

This is the uncomfortable question underneath the whole debate, and BitMEX cuts both ways on it.

For the prosecution: a blockchain is the best evidence a financial investigator has ever had. Every transaction is permanent and public, which is why analytics firms can trace stolen funds across chains years after a hack. Chainalysis estimates that illicit addresses received at least $154 billion in 2025, a 162% jump driven by sanctioned entities, yet that is still under 1% of all on-chain volume. KYC at the exchange edge is the hinge that connects a pseudonymous address to a real person at the moment of cash-out, and that link is what turns a trace into an arrest.

For the defense: Coin Center’s Peter Van Valkenburgh argues the regime “does remarkably little” to prevent illicit finance while imposing heavy costs and privacy burdens, noting that US AML compliance runs north of $26 billion a year and that only a fraction of 1% of criminal funds is ever seized or frozen. And the money has moved. Stablecoins now carry about 84% of illicit transaction value, per the same Chainalysis report, because they settle wallet-to-wallet without an exchange in the middle. The gate works only where there is a gate, and value has learned to route around it.

The data you hand over is a honeypot

There is a cost to KYC that falls on honest users, and it is not abstract. Every exchange that verifies you now holds a file with your name, address, government ID, and face. That file is a target.

In May 2025 Coinbase disclosed that bribed overseas support contractors had copied the personal data of roughly 69,461 customers, about 1% of its base, including government-ID images. The attackers demanded a $20 million ransom; chief executive Brian Armstrong refused and offered the same $20 million as a bounty for information instead, with remediation later estimated at $180 million to $400 million. The irony is sharp: the KYC data collected to fight crime became the crime. It is the same structural problem that makes cross-chain bridges such rich targets. Concentrate enough value, or enough identity, in one place and you have built a honeypot, whether the vault holds coins or passports.

This is why the frontier of compliance is reusable, privacy-preserving identity: verify once with a trusted issuer, then prove a single fact to an exchange (over 18, not sanctioned, already verified) using a zero-knowledge proof, without handing the underlying documents over again and again. The technology is real and shipping in pilots; the regulators have not yet blessed it as a standalone substitute for collecting and holding the file. Until they do, every KYC’d user is trusting an exchange’s security team as much as its order book.

The US rulebook in 2026: the stablecoin turn

The live edge of US AML is no longer the exchange; it is the stablecoin. The GENIUS Act, signed in July 2025, created the first federal framework for payment stablecoins and treats their issuers as financial institutions under the Bank Secrecy Act. In April 2026, FinCEN and OFAC jointly proposed rules spelling out the AML and sanctions obligations for permitted stablecoin issuers, the first time federal law has explicitly required a category of firm to run a formal sanctions-compliance program. The broader GENIUS framework takes effect in January 2027.

The through-line from BitMEX is direct. BitMEX put the onboarding gate on the exchange, and when that gate was missing, the DOJ had its case. GENIUS puts a control point on the settlement asset itself, because that is where the value now moves, and stablecoins have grown into a market of roughly $307 billion, per CoinGecko. Even in a lighter-touch enforcement climate, the rulebook is expanding, not shrinking; the pardons and the new rules are moving in opposite directions at the same time. How a stablecoin holds its peg is a separate engineering problem; who can freeze it, and under what AML duty, is the regulatory one, and 2027 is when that question gets its federal answer.

Europe draws a harder line

Europe went further, and in the opposite political direction from Washington. The EU’s Anti-Money-Laundering Regulation (AMLR) takes full effect on 10 July 2027 and will ban anonymous crypto accounts and privacy-enhancing coins outright, alongside a 10,000 euro cap on large cash payments. The EU’s Transfer of Funds Regulation (TFR), the European Travel Rule, has applied since December 2024 with no minimum threshold, so identifying information must accompany every crypto transfer between regulated firms. And a new Anti-Money-Laundering Authority (AMLA), based in Frankfurt, will directly supervise up to 40 of the highest-risk firms from 2028.

One point confuses even professionals: MiCA, the EU’s headline crypto law, is not the AML regime. MiCA governs licensing and market conduct; AML lives separately in AMLR, the TFR, and AMLA. A firm can hold a MiCA license and still fail its AML duties. Under European rules as they now stand, BitMEX would not have survived its first week; the email-only account is precisely what the AMLR is written to forbid. The table below sets the two blocs side by side.

What it means for you

For an ordinary user, three things follow from the BitMEX story.

First, exchange KYC is permanent, and the pardons do not change that. If a platform in 2026 lets you trade size with only an email address, that is not a feature; it is a flashing sign that it is unlicensed and that your funds and your data sit outside any protection. The frictionless model is exactly what got BitMEX fined, and a presidential pardon of its founders does nothing to make the model legal again.

Second, the gate stops at the exchange door. Self-custody is not KYC’d, and moving assets to a hardware wallet you control remains legal and, in Europe, explicitly protected for peer-to-peer transfers. AML attaches to intermediaries, the exchanges and custodians in the middle, not to the act of holding your own keys.

Third, your identity file is only as safe as the exchange holding it. Prefer venues that minimize what they retain, that support reusable verification, and that have a real security track record. The Coinbase breach showed that the honeypot risk is real even at the largest and most compliant firms, and the file they hold on you does not get safer because the law went quiet.

BitMEX taught the industry what KYC is by refusing to do it, then paid roughly $200 million across civil and criminal penalties to make the lesson stick. A pardon can forgive the people who ran it. It cannot un-teach the lesson, and it cannot repeal the statute that is still sitting there, waiting for the next exchange that decides an email address is enough.

Frequently Asked Questions

What is the difference between KYC and AML?

AML (anti-money-laundering) is the full set of laws and controls a financial firm uses to stop criminal money from flowing through it. KYC (know-your-customer) is one piece of AML: verifying who a customer is at onboarding and monitoring them over time. Every KYC check is part of AML, but AML also covers reporting, sanctions screening, and internal audits.

Why was BitMEX fined if it was based in the Seychelles?

Because it solicited and served US customers, and US law applies to a business that reaches American users no matter where it is incorporated. Prosecutors charged BitMEX with violating the Bank Secrecy Act by failing to run an AML and KYC program while taking US traders, and the company and its founders pleaded guilty.

Does the SEC regulate crypto KYC and AML?

No. US AML authority rests with FinCEN and OFAC, both part of the Treasury Department, under the Bank Secrecy Act. Crypto exchanges are money services businesses that register with FinCEN. The SEC handles the securities question and the CFTC handles derivatives; neither one runs the AML regime.

Did the Trump pardons make crypto KYC rules go away?

No. The 2025 pardons forgave the BitMEX founders and CZ of Binance for crimes they had already been convicted of. They did not repeal the Bank Secrecy Act or any AML requirement. Exchanges serving US or EU customers must still run full KYC and AML programs, and the EU’s rules get stricter in 2027.

Can I still use crypto without KYC in 2026?

Self-custody and peer-to-peer transfers between wallets you control are not subject to KYC, and in the EU they are explicitly protected. But any regulated exchange or custodian that converts crypto to cash will require full identity verification, and platforms that skip it are operating illegally in the US and EU.

Anneke de Vries covers regulation and compliance for HOGE Wire.