EXECUTIVE FINDING

On 27 January 2025, Peken Global Limited, a Seychelles-based company operating the cryptocurrency exchange KuCoin, pleaded guilty in Manhattan federal court to operating an unlicensed money-transmitting business.

The company agreed to:

• forfeit $184.5 million
• pay a criminal fine of approximately $112.9 million
• and

exit the United States market for at least two years.

The combined financial consequence exceeded $297 million.

The settlement also fundamentally changed KuCoin’s leadership structure.

Founders Chun Gan, also known as Michael, and Ke Tang, also known as Eric, agreed to step away from KuCoin’s management and operations. Each agreed to forfeit approximately $2.7 million in proceeds associated with KuCoin’s U.S. operations, while federal prosecutors agreed to defer their prosecutions for two years subject to specified conditions.

The numbers matter.

But the most revealing facts are operational.

According to KuCoin’s admissions and court records cited by the Justice Department:

• KuCoin had more than 30 million customers globally
• approximately 1.5 million registered users were located in the United States
• and

KuCoin earned at least approximately $184.5 million in fees from those U.S. users between 2017 and the March 2024 indictment.

Yet until at least July 2023, KuCoin did not require customers to provide identifying information as a condition of using the platform.

DOJ said employees publicly told users that KYC was not mandatory, including users who identified themselves as being in the United States.

Only in August 2023 did KuCoin impose mandatory KYC for new customers and existing customers wishing to continue actively trading. Even then, according to prosecutors, some pre-existing customers could continue withdrawing assets or closing positions without completing the identification process required under U.S. law.

KuCoin also did not register with the Financial Crimes Enforcement Network as a money-transmitting business and did not file the suspicious activity reports required of such businesses.

The result, according to U.S. authorities, was predictable.

Billions of dollars in suspicious transactions and potentially criminal proceeds moved through the platform, including funds associated with:

• darknet markets
• malware
• ransomware

and fraud schemes.

This creates the central question of this dossier:

CAN A FINANCIAL BUSINESS CLAIM TO BE OFFSHORE WHEN ITS CUSTOMERS ARE ONSHORE?

KuCoin’s guilty plea provides the answer.

Corporate domicile is only one part of jurisdiction.

If an exchange deliberately serves customers in a country, earns substantial revenue from them and performs regulated financial functions for them, the law may follow the customer—even when the company’s legal entity sits thousands of miles away.

THE FINDING

The old offshore model depended heavily on physical geography.

A company incorporated in jurisdiction A.

Bank account in jurisdiction B.

Customer in jurisdiction C.

The structure could potentially create distance from regulators in jurisdiction C.

Digital finance changes the equation.

An exchange can serve:

• New York
• Miami
• London
• Dubai
• Johannesburg
• Singapore
• and São Paulo

from the same digital platform.

No physical branch is required.

The result is a new form of regulatory conflict.

The company may say:

We are located in Seychelles.

The regulator may respond:

You are conducting business with our residents.

Those statements can both be true.

That is why the relevant question is no longer simply:

WHERE IS THE COMPANY?

It is:

WHERE IS THE BUSINESS ECONOMICALLY OPERATING?

THE 1.5 MILLION U.S. USERS

Between KuCoin’s founding in 2017 and the March 2024 indictment, approximately 1.5 million registered users located in the United States used the platform, according to DOJ.

This is not incidental contact.

It represents a substantial customer population.

And those users generated at least approximately:

$184.5 MILLION IN FEES

for KuCoin.

That number is particularly important because it shows the U.S. relationship was economically meaningful.

The company did not merely receive occasional accidental U.S. traffic.

American customers generated significant revenue.

FOLLOW THE REVENUE

Jurisdiction can often be clarified by following money.

Ask:

• How many customers came from the country?
• How much volume did they generate?
• How much fee revenue did the company earn?
• Did the company advertise to them?
• Did customer support serve them?
• Did employees know where they were located?
• Did the business create systems specifically addressing their access?

The stronger those connections, the weaker the argument that the market was incidental.

REVENUE IS JURISDICTIONAL EVIDENCE

A digital company may have:

• no branch
• no employees
• no office
• and no physical servers

inside a country.

But if the company earns $184.5 million from residents of that country, the economic relationship is difficult to describe as accidental.

That is the importance of KuCoin.

It demonstrates:

DIGITAL PRESENCE CAN CREATE REAL REGULATORY EXPOSURE.

THE COMPANY

PEKEN GLOBAL LIMITED

DOJ identified Peken Global Limited as the Seychelles-based entity that had operated KuCoin since at least September 2019.

Peken entered the guilty plea on 27 January 2025.

The distinction between:

• KuCoin as a brand/platform
• and
• Peken as the legal operator

is important.

Digital businesses frequently use one commercial identity across multiple legal entities.

The customer sees:

KuCoin.

The investigator must ask:

• Which company signed the customer agreement?
• Which company earned the fee?
• Which company held the licence?
• Which company maintained the bank account?
• Which company employed staff?
• Which company controlled customer assets?

THE ENTITY MAP

A proper crypto investigation should never stop at the brand.

For every legal entity connected to the platform:

• LEGAL NAME
• JURISDICTION
• DIRECTORS
• SHAREHOLDERS
• BENEFICIAL OWNERS
• BANK ACCOUNTS
• REGULATORY LICENCES
• CUSTOMER CONTRACTS
• REVENUE
• EMPLOYEES
• TECHNOLOGY
• INTELLECTUAL PROPERTY
• ASSET CUSTODY

The brand is the marketing layer.

The entities determine legal responsibility.

CHUN GAN

CO-FOUNDER

Chun Gan, also known as Michael, was one of KuCoin’s founders.

He and Ke Tang had been indicted with KuCoin in March 2024 on allegations involving unlicensed money transmission and Bank Secrecy Act violations.

Under the January 2025 resolution, DOJ agreed to defer prosecution against both founders for two years.

Gan also agreed to:

forfeit approximately $2.7 million

and

have no role in KuCoin management or operations.

A deferred prosecution agreement is not the same as a guilty plea.

Kleptik should preserve that distinction.

KE TANG

CO-FOUNDER

Ke Tang, also known as Eric, entered a parallel deferred-prosecution arrangement.

Like Gan, Tang agreed:

to relinquish approximately $2.7 million;

and

to leave KuCoin’s management and operations.

DOJ agreed that charges could ultimately be dismissed if the terms of the two-year arrangement were satisfied.

Again:

Peken pleaded guilty.

The founders did not enter equivalent guilty pleas under this resolution.

Their legal status is distinct.

THE ORIGINAL CHARGES

The January 2025 plea followed a March 2024 federal indictment.

At that time, prosecutors accused KuCoin and founders Gan and Tang of conspiring to operate an unlicensed money-transmitting business and conspiring to violate the Bank Secrecy Act.

DOJ alleged the defendants failed to:

• maintain an adequate AML programme
• maintain reasonable procedures to verify customer identities
• and

file suspicious activity reports.

By January 2025, the corporate case had moved from accusation to admission through Peken’s guilty plea.

THE KYC PROBLEM

The most remarkable compliance fact is simple.

Until at least July 2023:

KUCOIN DID NOT REQUIRE CUSTOMERS TO PROVIDE IDENTIFYING INFORMATION.

DOJ said KuCoin personnel repeatedly told users on public social-media channels that KYC was not mandatory—even when responding to users who had identified themselves as being in the United States.

That creates an obvious problem for a financial intermediary.

If you do not know the customer, how do you determine:

• whether the customer is sanctioned?
• whether the customer is using a false identity?
• whether one person controls multiple accounts?
• whether the user is in a prohibited jurisdiction?
• whether transactions match legitimate economic activity?
• whether an account belongs to a criminal organisation?

You cannot perform meaningful customer risk analysis without knowing who the customer is.

KYC AS IDENTITY INFRASTRUCTURE

KYC is frequently criticised as bureaucracy.

Upload passport.

Take selfie.

Provide address.

Wait for verification.

For legitimate users, the friction can feel disproportionate.

But KYC performs a foundational task:

IT CONNECTS FINANCIAL ACTIVITY TO A PERSON.

Without that connection:

Wallet 1.

Wallet 2.

Account A.

Account B.

Transaction 10042.

They remain financial events without reliable identity.

THE ANONYMOUS ACCOUNT PROBLEM

Suppose an exchange allows an unidentified user to:

• deposit cryptocurrency
• trade
• convert assets

and withdraw.

The platform may see enormous detail about the activity.

But it lacks the single most important field:

WHO?

That dramatically weakens:

• sanctions screening
• terrorist-finance controls
• fraud investigation
• tax enforcement
• asset recovery

and criminal attribution.

THE KYC PARADOX

Crypto proponents often argued that blockchain transparency reduces the need for traditional identity controls.

The logic is incomplete.

A blockchain can show:

Wallet A sent 20 BTC to Wallet B.

It may not show:

Wallet A belongs to ransomware operator X.

Wallet B belongs to money mule Y.

That connection often appears only when a regulated intermediary links a wallet to verified identity.

Thus:

BLOCKCHAIN TRANSPARENCY WITHOUT IDENTITY IS TRANSACTION TRANSPARENCY, NOT CUSTOMER TRANSPARENCY.

THE SOCIAL-MEDIA EVIDENCE

DOJ’s description of KuCoin employees telling users publicly that KYC was not mandatory is especially significant.

Why?

Because public statements can establish corporate understanding of how the product actually operates.

The formal policy may say one thing.

Customer support may reveal another.

For investigative purposes, Kleptik should always compare:

• legal terms
• compliance policies
• website FAQs
• social-media responses
• customer-support transcripts

and actual account-opening experience.

PAPER POLICY VERSUS USER EXPERIENCE

A financial company’s real control environment is visible through the customer journey.

• Can a user open an account without identity?
• Can the user deposit?
• Can the user trade?
• Can the user withdraw?
• Can the user increase limits?
• Can the user use derivatives?

The answer to those questions matters more than the existence of a 100-page compliance manual.

THE AUGUST 2023 CHANGE

KuCoin introduced mandatory KYC for new users in August 2023 and for existing customers wishing to continue actively participating in services.

But DOJ said the exchange did not impose the required KYC process on existing customers who used the platform only to:

withdraw assets

or

close positions.

That may sound less significant.

It is not.

Withdrawals are precisely how assets leave the exchange.

THE EXIT-KYC PROBLEM

Suppose an anonymous customer accumulated significant assets before mandatory KYC.

New policy arrives.

The user cannot trade without identification.

But can withdraw.

The result is:

The institution has stopped future trading.

But not necessarily identified the person behind historical activity.

LEGACY CUSTOMERS

Compliance reforms frequently face a difficult problem:

THE LEGACY BOOK

New customers can be subjected to new standards.

What about millions of existing users?

If they are exempted, old risk remains.

If they are required to re-KYC, customer attrition may be substantial.

This creates a commercial conflict.

But risk does not disappear because the user arrived before the policy.

THE LEGACY-KYC TEST

After a major compliance upgrade, ask:

• What percentage of existing customers were re-verified?
• How many refused?
• How much customer value left before verification?
• How many high-risk accounts were frozen?
• How many historical transactions underwent retrospective review?

A new policy addresses tomorrow.

Legacy remediation addresses yesterday.

THE FINCEN PROBLEM

DOJ said KuCoin never registered with FinCEN as a money-transmitting business.

Registration is not merely administrative.

It brings the business into a regulatory architecture requiring:

AML controls;

recordkeeping;

and suspicious-activity reporting.

An unregistered money transmitter may therefore operate without providing financial intelligence expected from regulated peers.

MONEY TRANSMISSION

Crypto exchanges sometimes describe themselves primarily as:

technology platforms;

marketplaces;

or digital-asset businesses.

Regulators increasingly ask a functional question:

What does the business actually do?

If customers:

• deposit value
• exchange value
• and transmit value,

then money-transmission rules may apply regardless of marketing terminology.

This is another recurring Kleptik principle:

FUNCTION OUTRANKS LABEL.

THE SAR PROBLEM

DOJ said KuCoin did not file the required Suspicious Activity Reports.

That creates a missing intelligence problem similar to the TD Bank case—but through a different mechanism.

TD Bank had an inadequate monitoring architecture.

KuCoin, according to the resolution, operated for years without the required reporting framework.

The downstream result can be similar:

law enforcement loses potential financial intelligence.

WHAT A SAR DOES

A SAR does not state:

This customer is guilty.

It states:

This pattern warrants government attention.

Example:

The exchange may be the only institution capable of linking the crypto address to an identity.

If that exchange does not report, a critical intelligence bridge disappears.

THE MISSING INTELLIGENCE GRAPH

BLOCKCHAIN

contains transaction trail.

↓

EXCHANGE

contains identity.

↓

SAR

connects transaction to law enforcement.

Without the SAR:

Blockchain and identity remain separated.

That separation may delay investigations by years.

BILLIONS IN SUSPICIOUS TRANSACTIONS

DOJ said KuCoin’s failures allowed the platform to be used to transmit billions of dollars in suspicious transactions and potentially criminal proceeds.

The wording matters.

“Suspicious transactions” does not equal “proven criminal proceeds.”

Some activity was potentially criminal.

Some was suspicious.

Those categories should remain separate.

THE ILLEGAL-FINANCE ECOSYSTEM

Authorities identified activity tied to:

• darknet markets
• malware
• ransomware

and fraud.

These categories share a common problem.

Criminal proceeds require conversion.

A ransomware operator may receive crypto.

A darknet vendor may receive crypto.

A fraudster may receive crypto.

But criminals eventually want:

• stablecoins
• other cryptocurrency
• fiat currency
• property
• goods

or bank deposits.

An exchange supplies liquidity.

LIQUIDITY AS INFRASTRUCTURE

A cryptocurrency is valuable to a criminal only if it can be used.

The exchange allows:

• conversion
• diversification
• movement

and withdrawal.

That means exchange access can become as valuable as bank access.

The illicit-finance question is therefore not only:

Who owns the wallet?

It is:

WHERE CAN THE WALLET TURN ITS ASSETS INTO SOMETHING ELSE?

THE DARKNET CONNECTION

Darknet markets generally facilitate illegal commerce using cryptocurrency because of perceived pseudonymity.

But vendors ultimately need to cash out or redistribute proceeds.

Centralised exchanges are natural targets.

A compliant exchange can:

• identify the customer
• analyse source wallet
• flag exposure
• freeze assets
• file SAR

respond to law enforcement.

An exchange without robust identity controls may do far less.

THE RANSOMWARE PROBLEM

Ransomware proceeds frequently arrive in cryptocurrency.

The criminal must then launder or convert the ransom.

The movement can involve:

• wallet hops
• mixers
• chain swaps
• bridges
• exchanges

OTC brokers.

The central exchange is often one of the rare points where investigators can convert:

wallet intelligence

into

identity intelligence.

Weak KYC therefore has consequences beyond the exchange itself.

FRAUD PROCEEDS

The same logic applies to investment scams.

Victim sends money.

Money converted to crypto.

Crypto reaches criminal wallet.

Wallet transfers to exchange.

Criminal converts or withdraws.

If the exchange does not identify the account holder, the investigative chain breaks.

This makes KYC part of victim-recovery infrastructure.

THE OFFSHORE QUESTION

KuCoin’s operator was based in Seychelles.

That is a legitimate international financial jurisdiction and a common domicile for digital-asset entities.

Its location is not itself evidence of wrongdoing.

The issue is what legal strategy followed from that location.

The company served substantial numbers of U.S. customers.

The U.S. government concluded that this brought KuCoin within U.S. money-transmission and AML requirements.

Thus the central conflict was not:

Seychelles versus United States.

It was:

OFFSHORE INCORPORATION VERSUS ONSHORE ECONOMIC ACTIVITY.

JURISDICTION SHOPPING

Companies legitimately choose jurisdictions for:

• licensing
• tax
• corporate law
• capital
• talent

and regulatory environment.

This becomes regulatory arbitrage where the company attempts to obtain:

• customers from jurisdiction A
• while
• avoiding obligations in jurisdiction A
• because

the legal entity sits in jurisdiction B.

KuCoin’s guilty plea demonstrates the risk of this strategy.

THE CUSTOMER-LOCATION TEST

For every digital financial business, investigators should ask:

• Where is the customer’s residence?
• Where is the customer physically accessing the service?
• What ID did the customer provide?
• What bank funds the account?
• What phone number is used?
• What IP addresses appear?
• What payment cards are used?
• What jurisdiction does the company contractually assign?

These data points together create the real geographic profile.

DIGITAL RESIDENCY IS MESSY

One customer may have:

French passport.

Dubai residence.

U.S. phone number.

Cayman company.

Singapore bank account.

London IP address.

Where is the customer?

Compliance systems must distinguish:

• citizenship
• residency
• physical presence
• corporate domicile
• tax residence

and transactional location.

Digital finance does not eliminate geography.

It multiplies it.

THE 30 MILLION CUSTOMER PROBLEM

KuCoin had more than 30 million customers globally by the time of the resolution.

Scale changes compliance.

A weakness affecting:

100 customers

may be manageable manually.

A weakness affecting:

30 million users

becomes systems engineering.

KYC must work at scale.

Sanctions must work at scale.

Transaction monitoring must work at scale.

Alert investigation must work at scale.

COMPLIANCE AS INFRASTRUCTURE

A 30-million-user financial platform cannot treat compliance as:

legal advice;

policy writing;

or customer-support procedure.

It must operate as core technical infrastructure.

Identity database.

Risk engine.

Blockchain analytics.

Sanctions screening.

Transaction monitoring.

Case management.

SAR generation.

Data retention.

Regulator reporting.

The compliance system becomes as fundamental as the trading engine.

THE TRADING ENGINE VERSUS THE COMPLIANCE ENGINE

A crypto exchange typically invests heavily in:

• execution speed
• matching
• liquidity
• uptime
• latency

wallet infrastructure.

The regulatory question is whether equivalent engineering sophistication exists around:

• identity
• sanctions
• fraud
• transaction monitoring

and geographic controls.

If one engine is world-class and the other is rudimentary, the imbalance becomes a governance problem.

THE NO-KYC GROWTH ADVANTAGE

Requiring KYC creates friction.

A customer must:

• submit passport
• provide address
• take selfie

wait for verification.

A competing exchange requiring none of these steps offers faster access.

That can become a commercial advantage.

Thus the critical question is:

DID WEAK KYC HELP GROW THE BUSINESS?

DOJ’s original 2024 indictment expressly alleged that KuCoin flouted AML requirements while growing into one of the world’s largest exchanges.

The January 2025 guilty plea establishes the unlicensed-money-transmission offence and the broader compliance deficiencies acknowledged in the resolution.

FRICTION ARBITRAGE

Kleptik calls this:

FRICTION ARBITRAGE

Exchange A requires:

passport;

proof of address;

source of funds.

Exchange B requires:

email address.

Some customers will choose B because it is easier.

Most may be legitimate.

But high-risk users have an even stronger reason to prefer B.

Weak controls therefore create disproportionate attractiveness to precisely the customers the controls were designed to identify.

ADVERSE SELECTION

Economics has a term for this:

adverse selection.

If a platform differentiates itself by asking fewer questions, it may attract a customer population containing a higher proportion of people who particularly benefit from fewer questions.

The business may unintentionally optimise itself for risk.

THE CRIMINAL-CUSTOMER ACQUISITION LOOP

The same growth loop that makes the exchange commercially successful can amplify illicit-finance exposure.

THE BINANCE PARALLEL

KuCoin’s resolution followed Binance’s historic 2023 guilty plea.

The two cases differ in scope and facts.

But they reveal a common enforcement principle:

A cryptocurrency exchange cannot take economic advantage of U.S. customers while treating U.S. AML obligations as optional.

The pattern suggests increasingly mature regulation of centralised crypto intermediaries.

THE CENTRALISATION PARADOX

Crypto presents itself as decentralised.

Yet users of KuCoin relied upon a centralised company for:

• accounts
• custody
• trade execution
• liquidity
• withdrawals

and identity management.

That company became a chokepoint.

The more centralised the exchange, the stronger the argument that traditional financial controls should apply.

NOT YOUR KEYS, BUT THEIR COMPLIANCE

Centralised exchanges introduce two forms of trust.

Customers trust the exchange with assets.

Governments trust the exchange with controls.

A failure in either direction creates systemic consequences.

Asset failure harms customers.

Compliance failure harms the wider financial system.

THE FOUNDERS’ EXIT

Under the resolution, Chun Gan and Ke Tang agreed to have no role in KuCoin’s future management or operations.

Leadership removal is an important enforcement tool.

Financial penalties change the balance sheet.

Management restrictions change the organisation.

The theory is simple:

If governance contributed to the problem, remediation may require governance change.

FOUNDER CONTROL

Founder-led crypto companies can achieve extraordinary speed.

Decision-making is concentrated.

Product launches quickly.

Markets expand quickly.

But concentration creates a control challenge.

Who can veto the founder?

Who tells leadership:

No U.S. customers.

No anonymous accounts.

No launch until compliance is ready.

No withdrawal until re-verification.

A regulated financial company requires someone with real authority to say no.

THE NEW LEADERSHIP

KuCoin publicly characterised the January 2025 settlement as the beginning of a new chapter focused on compliance and strengthened global operations under new CEO BC Wong.

That is the company’s stated position.

For Kleptik, the question is measurable:

What changed operationally?

New leadership matters only if:

• systems
• incentives
• staffing
• product governance
• and risk appetite

change with it.

REMEDIATION TEST

A credible remediation programme should answer:

KYC

Are all active customers verified?

LEGACY ACCOUNTS

What happened to unverified historical users?

AML

What monitoring scenarios now exist?

SANCTIONS

How are wallet and identity risks integrated?

GEOGRAPHY

How are prohibited jurisdictions identified?

SARs

What suspicious activity is reported?

MANAGEMENT

Who can override controls?

BOARD

How is compliance independently overseen?

PRODUCTS

Is risk approval required before launch?

AUDIT

Are controls independently tested?

THE TWO-YEAR U.S. EXIT

KuCoin agreed to exit the United States market for at least two years.

This is more than a symbolic sanction.

The U.S. represents one of the world’s largest and most valuable digital-asset markets.

Exclusion affects:

• customers
• revenue
• liquidity
• brand
• institutional partnerships

and future licensing strategy.

It makes regulatory access itself an economic asset.

MARKET ACCESS AS A PRIVILEGE

A financial business may view a country as a customer opportunity.

Regulators view entry differently.

Access requires:

• registration
• controls
• capital
• reporting

and accountability.

Thus:

MARKET ACCESS IS NOT SIMPLY A COMMERCIAL RIGHT.

It is permission conditioned on legal compliance.

THE $184.5 MILLION FORFEITURE

Peken agreed to forfeit $184.5 million.

Not coincidentally, DOJ said KuCoin had earned at least approximately $184.5 million in fees from U.S. registered users during the relevant period.

The symmetry is analytically important.

It reflects an enforcement philosophy aimed at removing economic benefit derived from unlawful market access.

DISGORGING THE BUSINESS MODEL

An effective penalty should not permit:

• violate law
• earn $200 million
• pay $50 million fine

keep $150 million.

That can become an economically rational strategy.

Forfeiture seeks to alter the calculation:

• illegal revenue
• minus
• economic benefit removed
• minus
• additional fine
• minus

market exclusion.

Compliance must become cheaper than non-compliance.

THE $112.9 MILLION FINE

In addition to forfeiture, KuCoin agreed to pay approximately $112.9 million as a criminal fine.

Thus the total company financial resolution exceeded:

$297 MILLION

This combines:

removal of economic benefit

with

punitive consequence.

THE FOUNDERS’ $2.7 MILLION EACH

Gan and Tang each agreed to forfeit approximately $2.7 million received as a result of KuCoin’s U.S. operations.

Their prosecution was deferred.

This creates an important status distinction.

A forfeiture arrangement under a deferred prosecution agreement does not convert every allegation in the original indictment into an adjudicated criminal fact against the individual.

Kleptik should state only what the agreement establishes.

CRIMINAL STATUS MATRIX

PEKEN GLOBAL LIMITED

Status: Guilty plea.

CHUN GAN

Status: Deferred prosecution agreement.

KE TANG

Status: Deferred prosecution agreement.

The distinction is not cosmetic.

It determines how allegations can responsibly be written.

THE ORIGINAL INDICTMENT VERSUS THE PLEA

The March 2024 indictment alleged broader Bank Secrecy Act conspiracies involving founders and entities.

The January 2025 corporate guilty plea resolved the company case through one count of operating an unlicensed money-transmitting business, together with the admissions and compliance failures documented in the resolution.

Investigative reporting should not casually treat every count of an earlier indictment as an admitted offence merely because a later plea occurs.

The plea agreement controls the adjudicated status.

THE AML PROGRAMME

DOJ said KuCoin failed to implement an effective AML programme designed to prevent its platform from being used for:

money laundering;

and terrorist financing.

A mature AML programme should include at least:

• customer identification
• risk classification
• transaction monitoring
• sanctions screening
• suspicious-activity investigation
• regulatory reporting
• record retention

and independent testing.

Failure at one layer can weaken all others.

KYC BEFORE TRANSACTION MONITORING

A transaction-monitoring engine may identify:

Account 4938 receives funds from darknet-linked wallet.

But without KYC, investigators may not know:

who owns Account 4938.

Thus strong blockchain analytics cannot compensate fully for absent identity.

This makes KYC the first layer.

THE CUSTOMER RISK PROFILE

A proper account profile might include:

• identity
• residence
• occupation
• expected transaction volume
• source of funds
• source of wealth where appropriate
• wallet exposure
• geographic risk
• product use

and connected accounts.

Without those data, “unusual” behaviour becomes harder to define because the system lacks a baseline.

TRANSACTION MONITORING WITHOUT A BASELINE

Suppose user receives $5 million.

Suspicious?

Maybe.

For institutional crypto trader:

possibly normal.

For student with no disclosed income:

highly unusual.

KYC gives the transaction context.

AML evaluates the behaviour.

The functions are inseparable.

THE SANCTIONS DIMENSION

While the January 2025 KuCoin plea focused principally on unlicensed money transmission and AML/KYC failures, the same identity weakness creates sanctions risk.

A system unable reliably to identify users may struggle to determine whether a customer is:

• sanctioned
• owned by a sanctioned person
• located in a prohibited jurisdiction

or acting through a nominee.

That risk is inherent even where a particular sanctions violation is not part of the plea.

TERRORIST-FINANCING RISK

DOJ specifically described AML and KYC obligations as safeguards intended to prevent exchanges from becoming havens for money laundering and terrorist financing.

This does not mean KuCoin was adjudicated to have knowingly financed terrorism.

It means weak customer identification and reporting infrastructure materially increases that risk.

The distinction is critical.

CRIMINAL USE IS NOT CORPORATE KNOWLEDGE

Every major financial institution is used by criminals.

The relevant legal question is not:

Did criminal proceeds touch the platform?

It is:

Did the institution satisfy its legal obligations to identify, monitor and report risk?

KuCoin’s guilty plea resolves the latter corporate compliance issue.

It does not prove knowing corporate participation in every criminal transaction.

THE DARKNET-TO-EXCHANGE PIPELINE

A generic illicit flow may look like:

The exchange may be the first entity possessing verified identity.

Without KYC, the anonymous chain may remain anonymous.

THE RANSOMWARE-TO-EXCHANGE PIPELINE

The crucial investigative moment is exchange entry.

That is where virtual proceeds can acquire an account holder.

FOLLOW THE FEES

A future Kleptik investigation should determine which categories of high-risk transaction generated exchange revenue.

For each:

• darknet exposure
• ransomware exposure
• fraud exposure
• high-risk geography

anonymous legacy customers.

Calculate:

• trading fees
• withdrawal fees
• margin revenue
• derivatives revenue

and other income.

The economic question is:

HOW MUCH DID WEAK COMPLIANCE EARN?

REVENUE QUALITY

A dollar in trading fees appears the same in an income statement regardless of customer quality.

But economically, revenue differs.

High-risk revenue creates:

• legal liability
• compliance cost
• remediation
• reputational damage

and potential market exclusion.

A sophisticated exchange should measure:

risk-adjusted revenue

rather than gross volume alone.

THE 30-MILLION-USER COMPLIANCE DEBT

Imagine an exchange grows from:

• 1 million users
• to
• 30 million users

while basic KYC is delayed.

When compliance finally becomes mandatory, the company does not merely have a new policy problem.

It has a historical-data problem.

Millions of legacy relationships.

Billions of past transactions.

Old wallets.

Closed accounts.

Withdrawals.

Changed identities.

That is:

COMPLIANCE DEBT

The longer remediation is delayed, the more expensive it becomes.

TECHNICAL DEBT VERSUS COMPLIANCE DEBT

Technology companies understand technical debt.

Build quickly now.

Fix architecture later.

Finance has a parallel.

Grow quickly now.

Fix KYC later.

But compliance debt may carry:

• criminal liability
• fines
• market exit
• founder removal

and years of historical review.

It compounds far more aggressively than software debt.

THE CUSTOMER-ACQUISITION QUESTION

KuCoin’s lack of mandatory KYC may have made the service easier to join than regulated competitors.

That does not mean every customer joined because of anonymity.

Many users may simply have preferred convenience.

But the commercial advantage existed.

The crucial investigation is whether management treated low-friction onboarding as a deliberate growth differentiator.

PUBLIC MARKETING

Future reporting should review:

• KuCoin social-media posts
• help-center articles
• marketing campaigns
• influencer promotions
• customer FAQs
• and archived onboarding flows

to determine how the absence of KYC was presented commercially.

If “no KYC” functioned as a feature, that becomes important context.

THE USER-EXPERIENCE ARCHIVE

Kleptik should preserve historical screenshots showing:

• registration
• deposit limits
• withdrawal limits
• identity requirements
• country restrictions
• and KYC prompts

for each relevant year.

Product design can reveal compliance history more clearly than corporate statements issued after enforcement.

ARCHIVE THE PRODUCT, NOT JUST THE POLICY

Financial investigations increasingly require digital archaeology.

The website seen in 2025 may not show how the service worked in 2021.

Use:

• web archives
• screenshots
• app versions
• support pages
• social-media responses

terms of service.

The historical user journey is evidence.

THE U.S. MARKET EXIT TEST

A two-year exit sounds clear.

Digital enforcement is harder.

• What constitutes a U.S. customer?
• American citizen abroad?
• U.S. resident?
• U.S. IP address?
• U.S.-incorporated company?
• Foreign company owned by American?
• Employee travelling through New York?

The exchange must translate a legal prohibition into technical rules.

GEO-BLOCKING

Potential controls include:

• IP detection
• VPN detection
• GPS
• residency KYC
• telephone country code
• banking geography
• device analysis
• tax residency

and account behaviour.

No one indicator is perfect.

Effective exclusion requires layered controls.

VPN RISK

A user can mask location.

That means geographic control must recognise:

• VPN infrastructure
• hosting-provider IPs
• unusual login changes
• device patterns

and contradictory KYC.

A paper statement saying “U.S. users prohibited” is insufficient if technical systems allow obvious circumvention.

THE CORPORATE USER PROBLEM

Suppose U.S. resident forms a BVI company and opens an exchange account.

Is the customer:

• BVI?
• or
• U.S.?

The legal answer may depend on beneficial ownership, control and applicable rules.

This is why corporate KYC requires identifying ultimate beneficial owners, not merely the entity’s incorporation certificate.

CORPORATE KYC

For entities, the exchange should understand:

• legal name
• jurisdiction
• business activity
• directors
• shareholders
• ultimate beneficial owners
• control persons
• source of funds
• expected trading

and geographic nexus.

Without UBO analysis, a corporate wrapper can become a location disguise.

THE BENEFICIAL-GEOGRAPHY CONCEPT

Kleptik proposes:

BENEFICIAL GEOGRAPHY

A company’s legal geography is where it is incorporated.

Its beneficial geography is where its controllers, customers and economic activity actually sit.

Digital regulation increasingly follows beneficial geography.

THE INVESTOR LESSON

Retail users often choose exchanges based on:

• fees
• token selection
• liquidity
• ease of use

and withdrawal speed.

Compliance quality rarely appears on the list.

It should.

A weakly regulated exchange can expose users to:

• asset freezes
• market exit
• banking disruption
• jurisdictional uncertainty

and enforcement-related limitations.

Compliance is part of platform risk.

THE EXCHANGE RISK SCORE

Kleptik proposes evaluating crypto exchanges across:

LICENSING

Where regulated?

KYC

Is identity mandatory?

AML

What controls exist?

SANCTIONS

How are users screened?

MARKET SURVEILLANCE

Is manipulation detected?

CUSTODY

Where are assets held?

GOVERNANCE

Who controls the company?

AUDIT

Are financials independently verified?

GEOGRAPHY

Which customers are served?

ENFORCEMENT HISTORY

What regulatory actions exist?

This is more useful than ranking exchanges solely by volume.

THE VOLUME FALLACY

An exchange may be large because users trust it.

Or because access is easy.

Or because fees are low.

Or because geographic restrictions are weak.

Volume alone does not tell investors which.

That is why compliance history should be treated as a platform-quality metric.

THE CRIMINAL-ENFORCEMENT PATTERN

By January 2025, U.S. authorities had obtained major crypto resolutions involving:

Binance;

FTX-related defendants;

and now KuCoin.

The pattern suggests a transition in crypto enforcement.

Regulators were no longer debating whether centralised exchanges resembled financial institutions.

They were enforcing against them as financial infrastructure.

GLOBAL DOES NOT MEAN LAWLESS

The phrase “global exchange” often sounds as though the company operates above national boundaries.

In practice it means:

many national boundaries apply simultaneously.

A global company may face:

• U.S. AML law
• EU AML law
• UAE virtual-asset regulation
• Asian licensing
• sanctions regimes
• consumer law
• tax reporting

and data protection.

Globality increases legal complexity.

It does not eliminate law.

CHRONOLOGY

September 2017

KuCoin is founded.

September 2017–March 2024

According to DOJ, KuCoin serves approximately 1.5 million registered users located in the United States and earns at least approximately $184.5 million in fees from U.S. registered users.

2017–July 2023

KuCoin does not require customers to provide identifying information as a mandatory condition of using the platform, according to DOJ.

August 2023

KuCoin implements mandatory KYC for new customers and certain existing customers who wish to continue actively using its services.

26 March 2024

Federal prosecutors unseal an indictment against KuCoin, Peken Global Limited, PhoenixFin Private Limited, Flashdot Limited, Chun Gan and Ke Tang, alleging unlicensed money transmission and Bank Secrecy Act violations.

March 2024

At the time of indictment, DOJ says KuCoin has grown to more than 30 million customers and processes billions of dollars in daily cryptocurrency volume.

March 2024–January 2025

Criminal proceedings and negotiations continue.

27 January 2025

Peken Global Limited pleads guilty to operating an unlicensed money-transmitting business.

27 January 2025

Peken agrees to:

forfeit $184.5 million;

pay approximately $112.9 million in criminal fines;

and exit the U.S. market for at least two years.

27 January 2025

DOJ agrees to two-year deferred prosecution arrangements concerning founders Chun Gan and Ke Tang.

Both agree to leave KuCoin management and operations and each forfeit approximately $2.7 million.

At the archive date, these arrangements define the operative legal status.

DOCUMENTARY RECORD

DOJ — 27 JANUARY 2025

The Justice Department’s guilty-plea announcement is the principal source for:

• Peken’s plea
• the approximately $297 million penalty and forfeiture
• the two-year U.S. exit
• the 1.5 million U.S. customers
• the $184.5 million U.S. fee revenue
• the absence of mandatory KYC before mid-2023

and the founder deferred-prosecution arrangements.

DOJ — 26 MARCH 2024

The original indictment announcement provides the charging theory that KuCoin and founders Gan and Tang flouted U.S. AML requirements while growing the exchange globally.

KUCOIN — 27 JANUARY 2025

KuCoin publicly characterised the resolution as the beginning of a new period focused on strengthened compliance and global growth under new leadership.

The company stated that charges against its founders would be dismissed upon satisfaction of their respective deferred-prosecution conditions.

WHAT THE AUTHORITIES SAY

Federal prosecutors say KuCoin benefited substantially from the U.S. market while failing for years to maintain controls required of a money-transmitting business.

DOJ specifically cited:

• lack of effective AML
• lack of adequate KYC
• failure to register with FinCEN

and failure to file required suspicious-activity reports.

Authorities say these deficiencies allowed billions in suspicious transactions and potentially criminal proceeds to move through the platform.

The Justice Department identified activity linked to darknet markets, malware, ransomware and fraud.

WHAT KUCOIN SAYS

KuCoin described the settlement as a new chapter and emphasised its commitment to stronger compliance and future global operations.

The company said its new leadership would focus on regulatory standards and improved compliance infrastructure.

That position should be included fairly.

A regulatory settlement can establish past failures while a company simultaneously undertakes genuine remediation.

The two propositions are not mutually exclusive.

WHAT THIS DOSSIER DOES NOT ESTABLISH

This dossier does not establish that:

• every KuCoin user who avoided KYC was engaged in wrongdoing
• every U.S. KuCoin customer violated law
• all billions in suspicious transactions were criminal proceeds

KuCoin knowingly facilitated every darknet, ransomware or fraud transaction that touched the platform;

• the Seychelles itself facilitated KuCoin’s violations
• every offshore crypto exchange operates similarly
• every pre-2023 KuCoin employee understood the complete U.S. legal exposure

or the founders personally admitted all allegations originally charged in March 2024.

The legal-status distinction is essential.

Peken pleaded guilty.

Gan and Tang received deferred prosecution agreements.

Those are different procedural outcomes.

RIGHT OF REPLY

Before publication, Kleptik should seek comment from:

• KuCoin
• Peken Global Limited
• Chun Gan and counsel
• Ke Tang and counsel

BC Wong / KuCoin management regarding remediation claims

For any future transaction-specific investigation:

• identified financial institutions
• wallet owners
• blockchain analytics providers
• payment processors
• or
• customers

should be offered a specific opportunity to respond where material criticism is contemplated.

A wallet’s contact with KuCoin does not establish that KuCoin knew the wallet’s ultimate criminal provenance.

UNANSWERED QUESTIONS

The guilty plea resolves the corporate offence.

The deeper operational story remains incomplete.

1. U.S. REVENUE

What percentage of KuCoin’s global revenue came from U.S. customers?

2. U.S. VOLUME

How much trading volume did the 1.5 million U.S. users generate?

3. NO-KYC USER BASE

How many of KuCoin’s 30 million users opened accounts before mandatory KYC?

4. LEGACY CUSTOMERS

How many existing users refused KYC after August 2023?

5. WITHDRAWALS

How much value was withdrawn by unverified legacy users after mandatory KYC began?

6. RETROSPECTIVE REVIEW

Did KuCoin conduct a historical transaction review of anonymous users?

7. SAR GAP

How many transactions would have generated SARs under an effective U.S. programme?

8. DARKNET FLOWS

What portion of identified darknet-market proceeds touched KuCoin?

9. RANSOMWARE

Which known ransomware wallets interacted with KuCoin accounts?

10. FRAUD

How much identified scam-related crypto moved through the exchange?

11. BANKS

Which institutions supplied KuCoin’s fiat infrastructure?

12. OTC

What role did over-the-counter trading desks play in high-risk customer activity?

13. GEOGRAPHIC CONTROLS

How did KuCoin determine where customers were physically located?

14. VPNs

What controls existed to identify location masking?

15. CORPORATE ACCOUNTS

Were U.S.-controlled offshore companies treated as foreign customers?

16. BENEFICIAL OWNERSHIP

How robustly were corporate customers’ ultimate owners identified after the new KYC regime?

17. MANAGEMENT KNOWLEDGE

When did senior management first receive advice that U.S. money-transmission registration was required?

18. FOUNDER GOVERNANCE

How concentrated was operational control in Gan and Tang?

19. REMEDIATION

What specific technological and staffing changes accompanied the new compliance programme?

20. THE CENTRAL QUESTION

How much of KuCoin’s extraordinary global growth occurred because it offered less regulatory friction than more tightly controlled competitors?

That is the business-model question at the centre of the case.

KLEPTIK INTELLIGENCE ASSESSMENT

ASSESSMENT: ESTABLISHED

Peken Global Limited pleaded guilty on 27 January 2025 to operating an unlicensed money-transmitting business in connection with KuCoin’s operations.

ASSESSMENT: ESTABLISHED

Peken agreed to forfeiture of $184.5 million, a criminal fine of approximately $112.9 million, and withdrawal from the U.S. market for at least two years.

ASSESSMENT: ESTABLISHED

Approximately 1.5 million registered KuCoin users were located in the United States, generating at least approximately $184.5 million in fees between 2017 and March 2024.

ASSESSMENT: ESTABLISHED

Until at least July 2023, KuCoin did not require customers generally to provide identifying information, and mandatory KYC was introduced only in August 2023 for new and certain existing users.

ASSESSMENT: ESTABLISHED

KuCoin did not register with FinCEN as a money-transmitting business and did not file required suspicious activity reports during the relevant U.S. period identified by DOJ.

ASSESSMENT: HIGH CONFIDENCE

KuCoin demonstrates that corporate domicile alone is an increasingly weak proxy for regulatory jurisdiction in digital finance.

The scale of its U.S. customer and revenue base materially connected the business to the U.S. market despite its offshore legal structure.

ASSESSMENT: HIGH CONFIDENCE

Absence of mandatory KYC can provide a commercial growth advantage while simultaneously increasing adverse-selection risk by making a platform disproportionately attractive to users who value anonymity.

ASSESSMENT: HIGH CONFIDENCE

A compliance programme imposed after rapid growth must address historical customers and transactions, not merely apply new controls prospectively.

Otherwise the institution retains substantial compliance debt.

ASSESSMENT: MODERATE-TO-HIGH CONFIDENCE

The most important unresolved question is the degree to which KuCoin’s low-friction onboarding contributed economically to its rise into one of the world’s largest exchanges.

DOJ’s original indictment expressly linked weak AML controls with KuCoin’s growth, but a complete answer requires customer-acquisition and revenue data.

THE KLEPTIK VIEW

The internet did not abolish jurisdiction.

It made jurisdiction harder to see.

A traditional bank makes the relationship obvious.

Building.

Sign.

Branch.

Local employees.

Local licence.

A cryptocurrency exchange can reach the same customer through an application downloaded in seconds.

No branch.

No teller.

No office.

No physical vault.

The customer sends crypto.

The exchange earns fees.

The commercial relationship is real even when the physical relationship is not.

KuCoin’s case demonstrates why regulators increasingly look through the screen.

Approximately 1.5 million U.S. users.

At least $184.5 million in U.S.-related fee revenue.

Thirty million customers globally.

And until mid-2023, no general requirement that customers provide basic identifying information.

That combination exposes the central tension in crypto’s first generation.

The industry often treated borderlessness and anonymity as product advantages.

Governments increasingly treat them as financial-infrastructure risks.

The distinction matters because an exchange is not simply a message board where strangers meet.

It holds assets.

Matches trades.

Converts value.

Processes withdrawals.

Provides liquidity.

Connects wallets.

And, when properly controlled, connects financial activity to verified identity.

That last function is what makes the exchange valuable to law enforcement.

A blockchain may show exactly where cryptocurrency moved.

But the exchange can potentially answer the harder question:

WHO MOVED IT?

Without KYC, that intelligence bridge disappears.

Without suspicious activity reporting, information that does exist may never reach government.

Without registration, the institution may sit outside the reporting architecture designed to protect the financial system.

And when that institution has 30 million customers, the problem is no longer philosophical.

It is industrial.

KuCoin’s guilty plea also exposes a weakness in the traditional offshore concept.

Incorporating somewhere else does not make the customers somewhere else.

The company can be Seychelles-based.

The user can still be sitting in Manhattan.

The fee can still be earned from Manhattan.

The service can still be supplied to Manhattan.

The regulator can therefore ask the most commercially relevant question:

WHOSE MARKET DID YOU MONETISE?

That is the future of digital jurisdiction.

Not the address on the certificate of incorporation.

Not the location printed in the terms of service.

Not the nationality of the founder.

The money.

The users.

The service.

The economic reality.

The crypto industry calls itself global.

That does not mean no country’s law applies.

It means many countries’ laws may apply at once.

And the larger the platform grows, the harder it becomes to argue that millions of customers in a regulated market somehow arrived by accident.

KuCoin’s lesson is therefore larger than KuCoin.

OFFSHORE IS A CORPORATE ADDRESS.

IT IS NOT A FORCE FIELD.

And for any digital financial company seeking to operate globally, one rule is becoming unavoidable:

FOLLOW THE CUSTOMER, AND YOU WILL EVENTUALLY FIND THE REGULATOR.

KLEPTIK METHODOLOGY

This dossier is dated 27 January 2025 and is intentionally fixed to the legal and evidentiary position existing on that date.

Later regulatory actions, litigation, licence changes or subsequent developments are not retrospectively inserted into the historical narrative.

The principal evidentiary sources are:

the United States Attorney’s Office for the Southern District of New York’s 27 January 2025 guilty-plea record;

the March 2024 federal charging record;

and

KuCoin’s contemporaneous public statement concerning the resolution.

Kleptik distinguishes between:

• corporate guilty pleas
• deferred prosecution agreements
• original indictment allegations
• government descriptions of suspicious transactions
• potentially criminal proceeds
• and

established criminal proceeds.

These categories must not be conflated.

The phrase “billions of dollars in suspicious transactions and potentially criminal proceeds” is attributed to the Justice Department and should not be rewritten as “billions in criminal money” without transaction-specific proof.

For exchange analysis, Kleptik examines both:

LEGAL STRUCTURE

and

ECONOMIC PRESENCE.

Economic presence may include:

• customer residence
• IP geography
• banking relationships
• marketing
• customer-support interaction
• local revenue
• payment rails

and beneficial ownership of corporate users.

For KYC analysis, Kleptik should reconstruct the historical user journey rather than rely only on current policies.

Evidence should include:

• archived account-opening screens
• terms of service
• support pages
• social-media responses
• withdrawal limits
• identity requirements

and product restrictions.

For wallet analysis, attribution must use confidence labels and wherever possible be corroborated by:

• exchange records
• court records
• law-enforcement evidence

or multiple reliable blockchain datasets.

A wallet’s interaction with a darknet-linked address does not by itself establish criminal knowledge or criminal ownership.

For legacy-user analysis, Kleptik should distinguish:

• customers allowed to trade
• customers restricted to withdrawal
• customers frozen
• customers re-verified

and customers exited.

For regulatory-jurisdiction analysis, offshore incorporation should not be treated as inherently suspicious.

The relevant question is whether the legal structure accurately reflected where business activity occurred.

Any company, founder, financial institution, customer or service provider facing material criticism beyond the adjudicated corporate record should receive a detailed opportunity to respond.

EVIDENTIARY LABELS

ESTABLISHED — CORPORATE GUILTY PLEA
Conduct admitted by Peken Global Limited in federal court.

DEFERRED PROSECUTION
Charges conditionally deferred against an individual; not equivalent to conviction or guilty plea.

ORIGINAL INDICTMENT ALLEGATION
Claim contained in the March 2024 indictment and not automatically converted into admitted conduct by the later corporate plea.

SUSPICIOUS TRANSACTION
Activity warranting scrutiny; not synonymous with proven criminal proceeds.

POTENTIALLY CRIMINAL PROCEEDS
Government terminology describing funds that may derive from criminal activity but require transaction-specific proof.

KYC GAP
Customer activity occurring without sufficient verified identity.

LEGACY-CUSTOMER RISK
Historical customer relationship predating strengthened compliance controls.

JURISDICTIONAL NEXUS
Economic, customer or operational connection potentially subjecting a foreign entity to domestic regulation.

KLEPTIK VERIFIED
Fact independently corroborated through primary records.

KLEPTIK ASSESSMENT
Analytical conclusion derived from identified evidence.

INVESTIGATIVE LEAD
Matter requiring further transaction-level, corporate or regulatory verification.

UNVERIFIED
Information not sufficiently corroborated for factual publication.

DOCUMENT STATUS

KLTK-2025-013

Subject: KuCoin / Peken Global Limited / AML, KYC and U.S. Market Access
Archive date: 27 January 2025
Status at archive date: Corporate guilty plea entered; founder prosecutions deferred; U.S. market exit required
Historical treatment: Fixed to report date

© KLEPTIK — Investigations into Power, Money and the Systems Designed to Hide Both