RU

Huione Group and FinCEN Section 311: What It Means for USDT

By TopAML editorialPublished 5 Nov 20265 min read

In October 2025 FinCEN finalised a rule under section 311 of the USA PATRIOT Act that cuts Cambodia-based Huione Group off from the US financial system. FinCEN found that Huione laundered at least $4 billion in illicit proceeds, including money from North Korean crypto heists and "pig butchering" scams. Much of that activity ran through stablecoins, which is why AML checkers treat USDT with Huione exposure as high risk.

The timeline

  • 1 May 2025. FinCEN announced a finding that Huione Group is of primary money laundering concern and proposed a rule against it.[1] The proposal was published in the Federal Register on 5 May 2025.[2]
  • 14 October 2025. FinCEN announced the final rule.[3] Treasury released it together with OFAC sanctions on a separate Cambodian scam network, Prince Group.[4]
  • 16 October 2025. The final rule was published in the Federal Register. It took effect on 17 November 2025 and is codified at 31 CFR 1010.664.[5]
  • 23 June 2026. FinCEN proposed to extend the rule to H-Pay Service PLC and to any "successor entity" of Huione Group.[6] FinCEN later extended the comment period to 2 August 2026 after a portal outage.[7] As of this post, that amendment is still a proposal.

What Huione Group is

FinCEN describes Huione Group as a financial services conglomerate based in Phnom Penh. The final rule names three components:[5]

  • Haowang Guarantee, formerly Huione Guarantee. It rebranded on 19 October 2024. FinCEN says it ran a Telegram-based marketplace that sold illicit goods and services, in a manner similar to a darknet market but on the open internet.
  • Huione Pay PLC, a payment company. FinCEN says it let customers trade crypto and convert it to and from fiat.
  • Huione Crypto, which runs the Huione Exchange brand and issues the USDH stablecoin.

FinCEN says these entities share crypto infrastructure and act as one. That makes it hard to tell which component handled a given transaction.[5]

What FinCEN found

According to FinCEN, Huione Group received at least $4 billion in illicit proceeds between August 2021 and January 2025. That includes at least $37 million from North Korean cyber heists, at least $36 million from crypto investment scams and about $300 million from other cyber scams.[1][4]

The final rule also says:[5]

  • FinCEN assesses that Huione has no meaningful AML/KYC program, even after the May 2025 proposal.
  • In July 2024 Huione itself told the media its KYC capabilities were "seriously insufficient".
  • In September 2024 Huione launched USDH and advertised it as "unfreezable". FinCEN contrasts this with stablecoin issuers that freeze funds at law enforcement request.
  • In July 2024 one stablecoin issuer froze over $29 million held in a Huione Group wallet.

The USDT on Tron connection

The final rule cites blockchain analysis showing that, between 1 May and 17 June 2025, transactions involving Huione Group wallets amounted to more than $10 billion in Tether on Tron. The same footnote put Ethereum activity at $219 million.[5] In other words, the proposal did not stop the flows. Most of the volume moved as USDT on the Tron network.

FinCEN's September 2026 alert on scam centres explains why. It says professional launderers swap scam USDT from Ethereum to Tron and convert other assets into stablecoins, because stablecoins are easy to use on guarantee marketplaces.[8] For background on the scams that feed this system, see our post on pig butchering scams.

What the rule actually requires

The rule applies to "covered financial institutions". In general that means banks, securities broker-dealers, futures commission merchants and introducing brokers, and mutual funds.[5] These institutions must not open or keep a correspondent account for Huione Group. They must also take reasonable steps not to process transactions for a foreign bank's US correspondent account when the transaction involves Huione Group.[5]

Two points are easy to miss:

  • It is not an OFAC sanctions listing. The October 2025 action against Huione was a FinCEN section 311 rule. On the same day OFAC used sanctions against a different target, Prince Group.[4]
  • It does not directly regulate your wallet. The rule speaks to US financial institutions and correspondent accounts. But exchanges and their banking partners use it as a strong risk signal.

Why AML checkers flag Huione exposure

AML tools score where funds came from. Huione exposure can raise a score for several reasons that all come from the official record:

  1. FinCEN has named the group a primary money laundering concern.[5]
  2. Its wallets handled proceeds tied to North Korean actors and scam networks.[1]
  3. Its components share infrastructure, so one component's risk spreads to the others.[5]
  4. FinCEN's alert lists red flags that match this ecosystem. One is heavy use of a stablecoin whose issuer says it cannot be frozen. Another is a payment provider in Cambodia, Burma or Laos that hides its location or corporate structure.[8]

A checker may show this as "scam", "high-risk exchange" or a similar category. See our scam risk category and the USDT TRC-20 network page for how services label Tron flows.

Watch for renaming. FinCEN says Huione Group has used name changes to dodge scrutiny. Huione Guarantee became Haowang Guarantee. Haowang later pointed users to Tudou Guarantee, a marketplace it had bought a stake in. Huione Pay's operations moved to H-Pay.[9] A good checker tracks these successor labels. A weak one may still show an old name, or nothing.

What to do

  1. Check before you accept USDT. Run the sender's address through an AML checker before a P2P or OTC deal. Our guide shows how to check USDT before receiving.
  2. Read the categories. Huione, Haowang, Tudou, H-Pay or a guarantee marketplace in the report is a serious warning, even at a small share.
  3. Be wary of "unfreezable" stablecoins. FinCEN treats heavy use of such tokens as a red flag.[8]
  4. Do not route flagged funds through an exchange to clean them. Deposits can be held, and you will have to explain the source.
  5. Keep records. Save chats, invoices and transaction IDs.
  6. If you were scammed, report it. FinCEN points victims to the FBI's IC3.[8]

If an exchange has already held your deposit, read what to do when an exchange freezes funds. This post is not legal advice. For large amounts with direct Huione exposure, speak to a lawyer.

General information, not legal or financial advice. Rules differ by country and change; check the linked sources.

Sources

  1. FinCEN — FinCEN Finds Cambodia-Based Huione Group to be of Primary Money Laundering Concern, Proposes a Rule to Combat Cyber Scams and Heists (1 May 2025). Checked 4 Nov 2026.
  2. Federal Register (FinCEN) — Special Measure Regarding Huione Group, as a Foreign Financial Institution of Primary Money Laundering Concern (90 FR 18934) (5 May 2025). Checked 4 Nov 2026.
  3. FinCEN — FinCEN Issues Final Rule Severing Huione Group from the U.S. Financial System (14 Oct 2025). Checked 4 Nov 2026.
  4. U.S. Department of the Treasury — U.S. and U.K. Take Largest Action Ever Targeting Cybercriminal Networks in Southeast Asia (14 Oct 2025). Checked 4 Nov 2026.
  5. Federal Register (FinCEN) — Imposition of Special Measure Regarding Huione Group, as a Foreign Financial Institution of Primary Money Laundering Concern (90 FR 48295) (16 Oct 2025). Checked 4 Nov 2026.
  6. FinCEN — FinCEN Proposes to Sever H-Pay Service PLC and Other Huione Group Successor Entities from the U.S. Financial System (23 Jun 2026). Checked 4 Nov 2026.
  7. Federal Register (FinCEN) — Proposed Amendment to the Definition of Huione Group; Extension of Comment Period (91 FR 46761) (24 Jul 2026). Checked 4 Nov 2026.
  8. FinCEN — FinCEN Alert on Money Laundering Activity Associated with Digital Asset Investment Scam Centers (FIN-2026-Alert005) (3 Sept 2026). Checked 4 Nov 2026.
  9. Federal Register (FinCEN) — Definition of Huione Group, a Financial Institution Operating Outside the United States of Primary Money Laundering Concern (91 FR 38340) (25 Jun 2026). Checked 4 Nov 2026.