Four jurisdictions launched major crypto enforcement actions within a single week in April 2026. The U.S. Department of Justice seized 503 scam websites and restrained $701.9 million in cryptocurrency tied to Southeast Asian fraud operations. The UK Financial Conduct Authority conducted its first...
"Unregistered peer-to-peer crypto traders operating in the U.K. are doing so illegally and pose a financial crime risk. We will use our powers and work with partners to disrupt them." — Steve Smart, Executive Director of Enforcement and Market Oversight, UK Financial Conduct Authority
Four jurisdictions launched major crypto enforcement actions within a single week in April 2026. The U.S. Department of Justice seized 503 scam websites and restrained $701.9 million in cryptocurrency tied to Southeast Asian fraud operations. The UK Financial Conduct Authority conducted its first-ever physical raids on illegal peer-to-peer crypto trading sites across London. South Korea imposed a record $24.6 million fine on Bithumb for 6.65 million AML violations. The European Union has now issued over €540 million in penalties under MiCA as its July 1 enforcement deadline approaches.
These actions are not isolated. They occur against the backdrop of a 162% year-over-year increase in illicit crypto volume to $154 billion in 2025, according to Chainalysis, and the January 2026 activation of the OECD's Crypto-Asset Reporting Framework across 48 countries. The enforcement-to-crime ratio remains stark: global authorities recovered roughly $2.4 billion against $154 billion in illicit flows — approximately $1 for every $64 lost. This report examines how five enforcement regimes are responding to the same problem with different tools, timelines, and philosophies.
Between April 16 and April 24, 2026, the following enforcement actions occurred in rapid succession:
| Date | Jurisdiction | Action | Scale | |------|-------------|--------|-------| | March 16 | South Korea | Bithumb fined for AML violations | $24.6M fine, 6-month partial suspension | | April 22 | United Kingdom | FCA raids 8 P2P trading sites in London | First-ever physical crypto raids | | April 23 | United States | DOJ Scam Center Strike Force announces coordinated actions | 503 domains seized, $701.9M restrained | | April 23 | United States | Treasury sanctions Cambodian Senator Kok An | 29 individuals and entities sanctioned | | Ongoing | European Union | MiCA penalty accumulation ahead of July 1 deadline | €540M+ in penalties issued |
The convergence is not coincidental. All five jurisdictions face the same underlying problem: illicit crypto transaction volume reached $154 billion in 2025, up from $59 billion in 2024, according to Chainalysis's 2026 Crypto Crime Report. Stablecoins accounted for 84% of that illicit volume, mirroring their dominance in legitimate transaction flows.
The DOJ's Scam Center Strike Force, announced in its current form in early 2026, represents the most operationally aggressive U.S. crypto enforcement apparatus to date. The April 23 actions included:
The Treasury Department simultaneously sanctioned Cambodian Senator Kok An and 28 individuals and entities in his network. According to the Treasury's Office of Foreign Assets Control, Kok An's hospitality company Crown Resorts owns properties in Poipet, Sihanoukville, and Bavet that have been converted into compounds for digital asset investment fraud.
The FBI's Operation Level Up, running in parallel, has notified 8,935 victims of cryptocurrency investment fraud as of March 2026. The agency reported that 77% of those victims were unaware they were being scammed, with estimated savings of $562.7 million in funds that would otherwise have been sent to scammers.
Reported losses from crypto investment fraud in the U.S. rose from $3.96 billion in 2023 to $5.8 billion in 2024 and $7.2 billion in 2025, according to the FBI's Internet Crime Complaint Center — a compounding annual growth rate of approximately 35%.
The SEC brought more than 30 crypto-related enforcement actions in 2025, generating $2.6 billion in penalties and restitution. The CFTC's digital asset cases accounted for nearly half of its enforcement docket, producing more than $17 billion in monetary relief.
The FCA's April 22 operation against eight London-based P2P crypto trading sites represented a tactical departure from the digital-first enforcement model used by most regulators. The joint operation with HM Revenue & Customs and the South West Regional Organised Crime Unit involved physical raids, on-site evidence seizure, and the issuance of cease-and-desist notices.
The legal basis is unambiguous: under UK anti-money laundering rules, all P2P crypto traders must register with the FCA. As of April 2026, zero P2P crypto traders or platforms have obtained FCA registration. Every operating P2P service in the UK is, by the regulator's own definition, illegal.
Evidence seized during the raids is feeding into ongoing criminal investigations, according to the FCA. Consumers transacting with unregistered traders have no access to the Financial Ombudsman Service or compensation schemes.
The timing positions this action as a precursor to the UK's broader regulatory framework for crypto, scheduled for completion by October 2027. The licensing window is expected to open in September 2026. The FCA appears to be establishing enforcement precedent before the formal licensing regime begins — signaling to the market that operating without registration will carry real-world consequences, not just regulatory letters.
This contrasts with the U.S. model, which relies on digital infrastructure seizures (domains, crypto wallets, Telegram channels) rather than physical premises raids. The UK approach reflects the specific nature of London's P2P trading market, which operates through physical storefronts and cash-intensive models that resemble traditional money service businesses.
The Markets in Crypto-Assets Regulation has generated over €540 million in penalties since enforcement began. The fine structure escalates based on violation severity:
The critical date is July 1, 2026, when all MiCA transitional periods across EU member states expire. After this date, any crypto-asset service provider operating without authorization must implement an orderly wind-down plan. ESMA has warned that last-minute authorization applications will face heightened scrutiny and that national regulators will enforce against firms continuing to operate without approval.
Beyond monetary penalties, EU authorities have deployed license revocations, criminal liability referrals, and executive sanctions. The EU has also adopted sanctions packages explicitly targeting Russian crypto providers, including the ruble-backed stablecoin A7A5, which accounted for $93.3 billion in direct transaction volume according to leaked internal communications analyzed by Chainalysis.
The MiCA framework's distinguishing feature is its comprehensive scope: it covers issuance, custody, trading, and transfer of crypto assets under a single regulatory umbrella. No other jurisdiction has attempted enforcement at this breadth. Whether the €540 million in penalties reflects effective deterrence or merely the cost of doing business remains an open question — the data is not yet mature enough to determine which.
South Korea's Financial Intelligence Unit fined Bithumb 36.8 billion won ($24.6 million) in March 2026 — the country's largest penalty ever imposed on a virtual asset exchange. The fine stems from 6.65 million discrete violations:
The penalty included a six-month partial suspension (affecting only new user registrations) and a reprimand for Bithumb's CEO. The exchange's reporting officer was suspended for six months.
The violations emerged from on-site inspections of South Korea's five largest exchanges — Upbit, Bithumb, Coinone, Korbit, and Gopax — conducted between 2024 and 2025. Coinone was separately fined $3.5 million with a three-month suspension. The Bithumb fine slightly exceeded a 35.2 billion won penalty imposed on Upbit in 2025.
South Korea's model is distinguished by its granularity: inspectors counted individual transaction-level violations rather than issuing aggregate findings. The resulting penalty figures are precise but enormous, and they signal a regulatory posture that treats each missed KYC check or unblocked transaction as a separate infraction.
Singapore's Monetary Authority of Singapore set a hard deadline of June 30, 2025, for all digital token service providers to obtain licensing under the Financial Services and Markets Act, including firms serving only overseas customers. After this date, unlicensed operation carries fines up to SGD 250,000 and imprisonment up to three years.
Key compliance requirements enforced by MAS include:
Singapore's approach is license-first, enforce-second: the regulatory framework was established before enforcement began, giving firms clear requirements and timelines. This contrasts with the UK's raid-first approach and the EU's penalty-accumulation model.
MAS has announced draft stablecoin legislation for 2026, alongside tokenized government bill trials using wholesale CBDC and expanded cross-border tokenization infrastructure. The city-state is attempting to maintain its position as a regulated crypto hub while increasing enforcement intensity.
On January 1, 2026, the OECD's Crypto-Asset Reporting Framework activated across 48 jurisdictions. CARF requires crypto-asset service providers — including trading platforms, custody services, and wallet operators — to report user transaction data (disposals, swaps, and asset transfers) to tax authorities.
The data exchange timeline is staggered:
| Phase | Date | Jurisdictions | |-------|------|--------------| | Phase 1 | January 2026 | All 27 EU member states, Channel Islands, Brazil, Cayman Islands (48 total) | | Phase 2 | 2028 | Australia, Canada, Hong Kong, Singapore, Switzerland, Thailand, UAE | | Phase 3 | 2029 | United States |
Notably absent: Argentina, El Salvador, Georgia, India, and Vietnam have not committed to CARF participation.
CARF represents a structural shift from enforcement-after-the-fact to surveillance-by-design. When Phase 2 and Phase 3 jurisdictions join, the framework will cover the majority of global crypto transaction volume. The United States' 2029 entry date leaves a three-year window during which U.S.-based crypto service providers face different reporting requirements than their European counterparts — a gap that may influence where crypto businesses domicile.
The total number of countries with enacted or proposed crypto-specific legislation has reached 68, a 62% increase in two years, according to a compilation by NFT Plazas. Over 92% of global jurisdictions have tightened crypto rules in some form.
The most significant data point in global crypto enforcement is the gap between illicit volume and recovery. Chainalysis reported $154 billion in illicit cryptocurrency volume in 2025. Global enforcement authorities recovered approximately $2.4 billion in the same period — a recovery ratio of roughly 1.6%.
The four largest illicit crypto categories in 2025:
| Category | Volume | YoY Change | |----------|--------|------------| | Sanctions evasion | $104B | +694% | | Scams and fraud | ~$17B | +24% | | Stolen funds (hacks) | $3.4B | +31% | | Ransomware payments | ~$820M | Variable |
DPRK-linked hackers alone accounted for $2 billion in stolen funds, including the $1.5 billion Bybit exploit — the largest single digital heist in crypto history.
The sanctions evasion figure is dominated by Russia's A7A5 ruble-backed token ($93.3 billion in direct volume). Removing this single outlier would reduce total illicit volume to approximately $60 billion — still representing a 2% recovery rate against the remaining categories.
Global penalties for AML, sanctions, and customer due diligence violations totaled $3.8 billion in 2025, an 18% decline from $4.6 billion in 2024, according to Kroll. This decline occurred despite rising illicit volume — suggesting that enforcement agencies are seizing more crypto but collecting less in regulatory fines.
Enforcement is converging on AML as the common thread. All five jurisdictions — the U.S., UK, EU, South Korea, and Singapore — are primarily targeting anti-money laundering failures rather than securities violations or token classification disputes. AML has become the jurisdictionally neutral enforcement tool.
Physical enforcement is back. The FCA's London raids signal that regulators are willing to deploy traditional law enforcement tactics against crypto operations. This is new. Prior enforcement was overwhelmingly digital (domain seizures, wallet freezes, exchange subpoenas).
The recovery gap remains enormous. At 1.6% recovery against $154 billion in illicit flows, enforcement is not keeping pace with the growth of crypto-facilitated crime. The ratio has not meaningfully improved despite increased enforcement budgets and headcount.
CARF changes the information architecture. Forty-eight countries now collect crypto transaction data by default. When the U.S. joins in 2029, the majority of global crypto volume will be subject to automatic tax authority reporting. This shifts enforcement from reactive investigation to proactive surveillance.
The MiCA July 1 deadline will be a stress test. With €540 million in penalties already issued and transitional periods expiring, the EU faces a binary outcome: either unlicensed operators exit the market or enforcement agencies face a credibility test.
Stablecoins remain the enforcement focal point. At 84% of illicit transaction volume, stablecoins are the instrument of choice for both legitimate and illicit flows. Enforcement strategies that do not address stablecoin-specific risks are structurally incomplete.
The week of April 21–24, 2026, demonstrated that global crypto enforcement has entered a new phase — not in rhetoric, but in operational tempo. Four major jurisdictions executed enforcement actions simultaneously, using different tools (domain seizures, physical raids, exchange fines, licensing deadlines) against the same underlying problem: a $154 billion illicit crypto economy that grows faster than enforcement can contain it.
The economic question is not whether enforcement will increase — every data point indicates it will. The question is whether the enforcement-to-crime ratio can improve from its current 1.6%. CARF's activation across 48 countries suggests that the information infrastructure is being built. Whether it translates into higher recovery rates will become measurable by 2028, when cross-border data exchange begins.
For market participants, the implication is clear: compliance costs are no longer optional overhead. They are the price of continued operation. Sixty-eight countries have enacted or proposed crypto-specific legislation. The regulatory perimeter is closing. The firms that survive the next 18 months will be the ones that treated compliance as infrastructure, not as a cost to be minimized.