When a crypto exchange is fined, you think of trading. Of manipulated prices, of clients who lost money, of a product that was not sound. We collected 91 regulatory decisions, from 20 countries, from 37 different bodies. Together they come to more than six billion dollars. And almost none of them are about trading.
It is about the gate
Read the reasoning behind all those decisions back to back and it says the same thing every time.
Operating without registration. Taking on clients without checking them. Failing to report suspicious transactions. Carrying on in a country after the regulator had said it was not allowed.
That is not trading. That is the gate: who gets in, and who checks whether that is right. The biggest sanction on the entire list — the $4.32 billion Binance paid in November 2023 — was not about one manipulated price. It was about anti-money-laundering rules, sanctions and running a market without a licence.
The same goes for OKX ($504.7 million), KuCoin ($297.4 million) and BitMEX (twice $100 million). Four times the same reason.
That is striking, because it is not what most people are afraid of. And it is exactly why it matters: those checks do not exist to please the regulator, but because they decide who is in the same room as your money.
The Netherlands wrote the same sentence five times
The Dutch chapter is the clearest example, because it is repeated so tediously.
De Nederlandsche Bank fined five exchanges for exactly the same thing: offering crypto services in the Netherlands without the legally required registration. Binance got €3,325,000. Coinbase got precisely the same amount. Crypto.com €2,850,000, later reduced by the court to €2,277,500. Bybit and OKX €2,250,000 each.
Together more than eleven million euros, and the reasoning sets out the same finding five times over: they knew, and they did it anyway.
Then last year came something bigger than all five combined. In November 2025 the Irish central bank imposed €21.46 million on Coinbase, because more than thirty million transactions had never gone through the mandatory check for suspicious activity. Thirty million.
So the Netherlands is not an exception, and not a strict outlier either. It is simply one of the 20 countries where the same thing happened.
Fourteen countries that never called each other
One name stands out. Of the 91 decisions, 21 are against Binance, spread across 14 countries.
Japan, the United Kingdom, the Cayman Islands, Poland, Italy, Hong Kong, Malaysia, Canada, the Netherlands, Australia, Belgium, the United States, India and Brazil.
That is the point. This is not one regulator on a mission. These are 14 bodies that never conferred, on different continents, under different laws, arriving independently at the same conclusion.
The first was Japan, in March 2018. The most recent an Australian judge, in March 2026: A$10 million because more than 85 per cent of 524 Australian clients had been wrongly classified as professional investors. Those clients lost more than twelve million between them.
Eight years, 14 countries, and the reasoning reads as though it had been copied from one another.
Fourteen countries, different laws, no consultation between them — and almost exactly the same conclusion.What happens when you lay 21 decisions about one company side by side.
A warning you have to give three times
There is another signal in the list that is easy to miss: the dates.
The Japanese regulator wrote to Bybit in 2021. And again in 2023. And once more in 2024. Three letters, the same reason.
With Binance it went the same way: a warning in 2018, and the same warning again in 2021. Bitget and MEXC each got two.
A repeated warning means only one thing. The first one changed nothing.
And that lays bare the weakness of the whole system. A warning is not a punishment. It is a regulator telling the public: this firm holds no licence with us, and beyond that there is little we can do. Of the 91 decisions, 32 are that kind of warning. Only 11 are a genuine stop order.
Four exchanges with nothing
At four exchanges we found not a single entry with any regulator at all: Bitvavo, Finst, Backpack and Deribit.
That is a real finding, but it deserves a caveat. Zero does not automatically mean better. It can also mean an exchange is younger, or smaller, or never tried to serve markets where it had no licence.
That last point is in fact the heart of it. All 91 decisions above share one common cause: serving clients in a country where that was not allowed. Anyone who does not do that ends up on no list at all.
So it is not a matter of luck. It is a choice you make in advance.
Pay first, licence afterwards
In two cases the order of events is so plain that it almost looks like a business model.
India fined Binance in June 2024 and Bybit in January 2025 — both for operating in the country without registration. What happened next: they registered after all and carried on.
That is the more common pattern. The fine is then not a punishment after the fact but an entry fee after the fact. You build your market share first in a country where you are not allowed to be, and then pay the bill out of the profit you made in the meantime.
Do the sums for the Netherlands. According to American prosecutors, Binance earned more than one and a half billion dollars from American users in a country where it was not allowed to operate. The Dutch fine was 3.3 million euros.
As long as those two numbers are that far apart, a fine is not a deterrent but a cost of doing business.
What this is not
A warning is not a conviction. A regulator puts a firm on a list because it has no licence, not because anything has been proved. Several firms on this list do now hold a European licence.
Nor do we add the amounts together. American agencies sometimes offset each other’s fines, which means adding them up produces a fantasy figure. The “more than six billion” in the headline is a floor for what has been imposed, not a closed sum.
And we publish only what we could trace back to the authority itself. Of the 91 rows, 88 point directly to a press release, register or decision. We left out about ten claims because no working source could be found for them.
That is duller than a round number. It is verifiable, though.
What this gives you as a user
Not: count the rows under a name and pick the exchange with the fewest.
Instead: check whether the exchange holds a licence in your country. That is what all these decisions are about. A licence in Malta or Lithuania says nothing about Japan, and an exchange licensed in the Netherlands can sit on a blacklist in Australia.
And above all look at the second question, the one that comes back in every file: who can you hold to account when it goes wrong. With a licensed firm that is a regulator with an address. With a firm that only appears on warning lists it is nobody.
Six billion in fines is a big number. But the real story is in the small print beneath it: it was almost never about what happened on the exchange, and almost always about who was let in.
Sources
This piece is based on the 91 decisions we collected for the overview warnings, fines and bans per exchange, where every row cites its own source. The authorities used include DNB and AFM (Netherlands), the Central Bank of Ireland, FCA (United Kingdom), BaFin (Germany), AMF (France), CONSOB (Italy), CNMV (Spain), FSMA (Belgium), KNF (Poland), Finanstilsynet (Norway), MFSA and FIAU (Malta), FSA (Japan), SFC (Hong Kong), Securities Commission (Malaysia), ASIC (Australia), OSC, FINTRAC and the Alberta Securities Commission (Canada), FIU-IND (India), CVM (Brazil), CIMA (Cayman Islands) and, in the United States, DOJ, FinCEN, OFAC, CFTC, SEC, NYDFS and various attorneys general. Amounts are given in the currency in which they were imposed and are not converted or added up by us into a total, because authorities sometimes offset each other’s amounts. Last checked 2 August 2026.