OKX Fined $1.2M in Malta Over AML Failures Despite MiCA Licensing

Cryptocurrency exchange OKX is under fresh scrutiny in Europe after Malta’s Financial Intelligence Analysis Unit (FIAU) fined its European arm, Okcoin Europe, €1.1 million ($1.2 million) for past violations of anti-money laundering laws.

The penalty stems from a 2023 compliance review in which authorities uncovered “serious and systematic” weaknesses in OKX’s AML processes. The FIAU cited shortcomings in the firm’s business risk assessment (BRA), which failed to address threats posed by privacy-focused tools like coin mixers, stablecoins, and activity on decentralized exchanges. Regulators also flagged concerns over exposure to jurisdictions outside of Europe, despite OKX’s stated intent to serve only EU-based users.

Although the FIAU acknowledged that OKX made “major strides” in upgrading its compliance framework over the past 18 months, it said the previous lapses were too severe to overlook.

OKX responded to the ruling without directly addressing the findings. “With this chapter behind us, OKX remains focused on the future — continuing to build a secure, transparent, and compliant platform for our users worldwide,” a representative said.

OKX obtained a Markets in Financial Instruments Directive (MiFID II) license, allowing it to offer derivatives trading across the European Union. The license followed OKX’s preauthorization under the Markets in Crypto-Assets (MiCA) framework earlier this year, which enables it to provide localized services in 28 European Economic Area markets.

While MiFID II applies to financial instruments, including crypto derivatives, MiCA covers crypto-asset service providers that don’t fall under traditional finance regulations.

The regulatory action comes amid broader scrutiny of OKX’s operations. European regulators are reportedly reviewing the firm’s role in laundering $100 million worth of Ether stolen in the Bybit hack earlier this year. OKX denied wrongdoing and dismissed reports of any official investigations as “misinformation.”

The focus is on whether OKX’s Web3 wallet and decentralized finance platform fall under the Markets in Crypto-Assets (MiCA) framework and, if so, whether the exchange could face penalties.

Bybit CEO Ben Zhou claimed that $100 million (40,233 ETH) from the hack had been laundered through OKX’s Web3 proxy, with a portion now untraceable. OKX’s wallet service, which supports 100 blockchains and has over 53 million addresses, could be exempt from MiCA rules if considered fully decentralized. However, regulators in Austria and Croatia argue that OKX’s Web3 service should be subject to EU oversight.