Paxful to Plead Guilty as DOJ, FinCEN Levy $7.5M Over AML Failures and Criminal Use of P2P Bitcoin Platform

The core problem wasn’t just bad actors on a peer‑to‑peer exchange—it was treating “frictionless” onboarding as a growth strategy. Authorities say that choice defined Paxful’s trajectory, and now it defines the penalty.

Paxful Holdings Inc., which shut its P2P Bitcoin marketplace in 2023, agreed to plead guilty to federal charges and pay a $4 million criminal penalty to the Department of Justice, alongside a $3.5 million civil penalty assessed by FinCEN. According to prosecutors, the platform processed about $3 billion in trades between 2017 and 2019, generating over $29 million in revenue while knowingly enabling criminal activity.

The exchange allowed users to swap Bitcoin and other cryptocurrencies for fiat, prepaid cards, and gift cards—rails that fraud rings and cash‑out networks favor. DOJ officials said Paxful profited by moving cryptocurrency for fraudsters, extortionists, money launderers, and prostitution enterprises, and that the company cultivated this clientele by advertising minimal anti‑money‑laundering controls and choosing not to verify customers.

Two data points illustrate intent and impact. First, prosecutors say Paxful facilitated transactions for Backpage, the illegal prostitution classifieds site seized in 2018. From 2015 to 2022, nearly $17 million in Bitcoin allegedly flowed from Paxful to Backpage and similar services, generating at least $2.7 million in profits for the company; internal chatter reportedly celebrated a “Backpage Effect” on growth. Second, the platform processed more than $500 million in suspicious activity that involved sanctioned jurisdictions including Iran, North Korea, and Venezuela. Despite knowledge of criminal conduct, authorities say Paxful failed to file required suspicious activity reports and misrepresented its AML program to third parties.

Paxful pleaded guilty to three conspiracy charges: violating the Travel Act by promoting illegal prostitution, operating an unlicensed money transmitting business, and violating Bank Secrecy Act requirements. While sentencing guidelines pointed to a $112.5 million penalty, the DOJ determined the company could reasonably pay $4 million. FinCEN’s separate $3.5 million assessment reflects willful BSA violations; both agencies credited cooperation and remedial actions after leadership tied to the misconduct was removed. Sentencing is scheduled for February 10, 2026. Co‑founder and former CTO Artur Schaback pleaded guilty in July 2024 in connection with the same scheme.

What matters for crypto operators is how the government built the case: product design and messaging became evidence. Marketing around lax controls, internal celebrations of illicitly driven growth, and persistent SAR failures all cut against any “neutral platform” defense. In P2P markets—where fiat, gift cards, and prepaid rails meet Bitcoin—compliance isn’t a bolt‑on; it’s the product. Identity verification, sanctions screening, behavior‑based monitoring, and a credible SAR program are not optional if you intend to intermediate value, even indirectly. Ignoring those basics may feel like user‑centric design in the short run, but it often turns into legal exposure and a broken business.

There’s also a pragmatic enforcement signal in the “ability‑to‑pay” outcome. Regulators appear focused on deterring the growth‑at‑all‑costs playbook and enforcing remediation, not merely extracting headline fines. For founders, that means incentives are shifting toward compliance‑by‑design: controls that are visible in the UX, transparent policies that match reality, and a data trail that shows you tried to stop bad activity rather than attract it.

Crypto tends to conflate openness with abdication. This case shows the line is narrower than many assume. Access without controls isn’t innovation; it’s an invitation—one that prosecutors will read back to you.