This has been a blockbuster week for cryptocurrency enforcement actions in the United States against cryptocurrency exchanges. To cover just two of the major developments that occurred in the past week, two co-founders of a cryptocurrency exchange, BitMEX, Arthur Hayes and Benjamin Delo, pled guilty to violating the Bank Secrecy Act (the BSA) by failing to implement and maintain an anti-money laundering (AML) program. Shortly thereafter, the court overseeing the BitMEX prosecution denied a motion to dismiss the indictment against Samuel Reed, a third co-founder of BitMEX.

This alert breaks down the decision in detail below, but for the busy reader, here are key takeaways from this decision:

• If a cryptocurrency exchange lists digital assets that require registration with the U.S. Securities and Exchange Commission (SEC), that does not preclude the possibility that the exchange may also need to register with the Commodity Futures Trading Commission (CFTC).
• The registration categories of the Commodity Exchange Act are not exclusive, and the fact that an exchange meets the qualifications to register under one category does not relieve the exchange of the obligation to register under all other applicable categories as well.
• The strictures of U.S. law cannot be safely avoided by implementing a geoblock if an exchange allows U.S. users to evade that geoblock by using a VPN or through other mechanisms known to the exchange.
• U.S. users known to exchange management must be actively and regularly removed by an exchange that wishes to avoid having to comply with U.S. laws and regulations.
• Where an exchange knowingly allows at least some U.S. users to access its platform, it should anticipate that it will be required to comply with U.S. laws and regulations.
• The failure to register with the CFTC and follow AML requirements, where required, can result in up to five years imprisonment, and the Department of Justice has signaled through the BitMEX indictment its willingness to enforce such penalties.

The indictment charges the three co-founders with violating the BSA in connection with their operation of BitMEX. The indictment alleged that BitMEX was required to register as a futures commission merchant with the CFTC under the Commodity Exchange Act (CEA), 7 U.S.C. § 1. As a required CEA registrant, the indictment alleges that BitMEX was subject to the requirements of the BSA, particularly the requirement to implement and maintain an AML program. Such programs require, among other things, collecting identifying know your customer information from every customer and reporting suspicious transactions. According to the indictment, BitMEX failed to comply with these AML obligations.

Reed had moved to dismiss the indictment, arguing that he lacked fair notice that the failure to register with the CFTC was unlawful. The defense argued that, among other things, he lacked fair notice that any cryptocurrencies listed on BitMEX qualify as commodities under the CEA. The court rejected that argument, observing that BitMEX operated as a trading platform that solicited and accepted orders for trades in futures contracts and other derivatives products tied to the value of Bitcoin and other cryptocurrencies. The court reasoned that the CEA defines commodities broadly to include “all other goods and articles” after listing a number of common examples, such as corn and grains. The court further observed that cryptocurrencies share a “core characteristic” with other commodities in which derivatives are traded, “namely, that they are ‘exchanged in a market for a uniform quality and value.’” The court also noted that several courts have previously held that cryptocurrencies, including Bitcoin, qualify as commodities. Finally, and of particular significance, the court held that even those cryptocurrencies that qualify as “investment contract” securities may also be regulated as commodities under the CEA.

The court also rejected the argument that BitMEX did not have fair notice that it had to register as a Futures Commission Merchant (FCM) under the CEA because BitMEX offered features that also could have triggered registration under other categories of the CEA. It reasoned that the CEA registration categories are not exclusive, such that an obligation to register under one category does not prevent an entity from also having a duty to register under other applicable categories.

The court further rejected Reed’s argument that BitMEX did not have to comply with the BSA because it had withdrawn from the U.S. market in 2015 and did not know it had U.S. customers thereafter. Reed had argued that BitMEX had withdrawn from the U.S. market in 2015 by implementing an internet protocol (IP) address check designed to block U.S. customers (known as a geoblock). The court rejected this argument, noting that the indictment alleged that BitMEX knew that it served U.S. customers after 2015, and specifically observed that the indictment alleged that the geoblock only applied on one single occasion for each customer, such that each customer could access the platform from the United States if on a prior log-in attempt, they had shown a non-U.S. IP address. The court also observed that according to the indictment, the defendants and BitMEX allowed U.S. customers to circumvent the IP check in other ways to access the platform, such as through VPNs or logging in anonymously through the Tor network, and that the defendants knew that this occurred.

Nor was the court persuaded by a lack of fair notice based on the fact that there was no prior precedent precisely on point, reasoning that the statutory definition of an FCM under the CEA and the requirements of the BSA were sufficiently clear that Reed had fair notice that his actions violated the law.

As a further notable aspect of this case, the indictment asserts that “[a]s a result of its failure to implement AML and KYC programs, BitMEX made itself available as a vehicle for money laundering and sanctions violations.” In the wake of the most recent U.S. sanctions imposed against Russian oligarchs and entities, and the Treasury Department regulations published yesterday banning U.S. persons from providing support to such sanctioned individuals and entities, including through digital assets, this decision takes on additional and immediate importance.

The BitMEX decision is thus a significant one for all cryptocurrency exchanges that operate in the United States. Most importantly, it serves as a caution to all such exchanges that they should engage in a careful evaluation of their registration obligations under the CEA and U.S. securities laws, as well as their potential obligations to comply with the BSA’s AML requirements.