AML/KYC Enforcement

Comprehensive Regulatory Analysis for Government Regulators

Prepared: March 2026 (refreshed June 2026) Classification: Regulator-Grade Guidance Document — Part of the Regulatory Guidance Framework Coverage: All 27 jurisdictions in this study, including the regional aggregates Southeast Asia, the Nordic Countries, and Africa (Emerging). Methodology: All claims mirror the canonical per-jurisdiction fact matrix. Where verification was incomplete, this is explicitly flagged as "NOT VERIFIED." Hashrate and energy figures are industry-reported with their methodology source.

Table of Contents

1. FATF Guidance on Mining
2. AML/KYC Requirements by Country
3. Enforcement Mechanisms and Case Studies
4. Illegal Mining — Scale and Methods
5. Travel Rule Implementation for Mining
6. Money Laundering Risks Specific to Mining
7. Recommended AML/KYC Framework for Mining

1. FATF Guidance on Mining

1.1 Key Guidance Documents

The Financial Action Task Force (FATF) has issued several foundational documents governing virtual assets and virtual asset service providers (VASPs):

• Recommendation 15 (R.15) and Interpretive Note (INR.15): Updated in June 2019 to apply AML/CFT measures to virtual assets (VAs) and VASPs. This is the primary binding standard.

  • Source: FATF Recommendations

• Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers (October 2021): The most comprehensive guidance document, clarifying definitions of VAs and VASPs, Travel Rule implementation, stablecoins, DeFi, and peer-to-peer transactions.

  • Source: FATF 2021 Updated Guidance
  • Full text: PDF

• Targeted Updates: Follow-up reports issued in June 2022, June 2023, July 2024, and February 2025 assessing country compliance.

  • Source: 2025 Targeted Update
  • Source: 2024 Targeted Update
  • Source: 2023 Targeted Update

1.2 Are Miners Classified as VASPs?

No. FATF explicitly excludes miners and validators from the VASP definition, subject to conditions.

The October 2021 Updated Guidance states at Paragraph 72 that network participants and service providers solely engaging in the operation of a VA network (e.g., miners and validators) are excluded from being VASPs.

Paragraph 83 further clarifies that natural or legal persons who create, validate, and broadcast blocks of transactions, and do not otherwise engage in the activities or operations of a VASP, are not to be considered VASPs.

Additionally, transaction fees paid to miners and validators are not subject to Travel Rule originator and beneficiary information collection requirements.

• Source: Coin Center analysis of FATF 2021 Guidance
• Source: Chainalysis summary of FATF Guidance
• Source: Notabene FATF Guidance Summary

1.3 When Miners Could Become VASPs

A miner may be reclassified as a VASP if they go beyond network operation and engage in activities that fall within the VASP definition, specifically:

1. Exchanging virtual assets for fiat currency or other virtual assets on behalf of others
2. Transferring virtual assets for or on behalf of another person
3. Safeguarding or administering virtual assets on behalf of others
4. Providing financial services related to an issuer's offer and/or sale of virtual assets

The FATF focuses on the functional activity rather than the entity type. A mining operation that also operates an exchange, custodial wallet, or transmission service would trigger VASP obligations. This functional-trigger logic is the single most important design principle across the 27 jurisdictions surveyed: the overwhelming majority attach AML/KYC obligations not to the act of mining itself, but to the exit point where mined assets enter the regulated financial system.

1.4 FATF Recommendations for Countries Regulating Mining

Under Recommendation 15, countries should:

• Apply risk-based AML/CFT measures to VASPs
• Require VASPs to be licensed or registered
• Implement the Travel Rule (Recommendation 16) for VA transfers
• Apply Recommendations 10-21 (preventive measures) to VASPs

As of the July 2024 targeted update, 75% of jurisdictions are only partially or non-compliant with the FATF's VASP requirements based on 98 mutual evaluation and follow-up reports.

• Source: FATF Virtual Assets Overview

1.5 Global Compliance Gap

According to the February 2025 FATF targeted update, compliance remains inadequate. The FATF urged stronger global action to address illicit finance risks in virtual assets, specifically highlighting risks from offshore VASPs enabling large-scale fraud, money laundering, and terrorism financing.

• Source: FATF 2025 Targeted Update

2. AML/KYC Requirements by Country

This section mirrors the AML/KYC, miner-registration, and threshold facts for all 27 jurisdictions. Across the study, three structural patterns emerge:

• No miner-specific registration — AML attaches at the VASP/CASP exit point (the FATF-aligned default): United States, Argentina, Brazil, Canada, El Salvador, Australia, India, Japan, Singapore, European Union, France, Georgia, Germany, United Kingdom, South Africa, UAE, Saudi Arabia, and most of Southeast Asia.
• Mandatory miner-specific registration or licensing: Paraguay, Bhutan, Kazakhstan, Uzbekistan, Russia, and (within the Africa aggregate) Nigeria. Venezuela formerly required SUNACRIP registration, but that framework is now non-operational.
• Not applicable — mining prohibited: China (AML effort here is surveillance of underground fiat ramps, not miner registration).

Of the 27 jurisdictions, 6 of 27 impose a currently-operative mining-specific registration or licensing requirement (Paraguay, Bhutan, Kazakhstan, Uzbekistan, Russia, and Nigeria within the Africa aggregate), and Paraguay alone explicitly classifies miners themselves as AML "Obligated Subjects."

2.a

United States — FinCEN

Key Ruling: FIN-2014-R001

Issued: January 30, 2014 Subject: Application of FinCEN's Regulations to Virtual Currency Mining Operations

Core Determination: A Bitcoin miner is not a Money Services Business (MSB) to the extent that it uses the Bitcoins it mines solely for its own purposes and not for the benefit of any other person.

Specific Conditions for Exemption:

• The miner uses mined virtual currency to pay for goods/services, pay debts, or make distributions to owners
• The miner converts virtual currency to fiat currency or another virtual currency solely for its own purposes
• The mechanism by which the virtual currency is obtained (i.e., mining) is irrelevant; what matters is how it is used and for whose benefit

Triggers for MSB Classification:

• If a miner engages in money transmission (transferring funds on behalf of another person), it becomes subject to FinCEN rules. Regularly converting mined crypto to fiat above ~$1,000/month can be treated as money transmission.
• Transfers to third parties at the direction of sellers, creditors, owners, or counterparties must be "closely scrutinized, as they may constitute money transmission"

Companion Ruling: FIN-2014-R002 (same date) covers virtual currency software development and investment activity, establishing that purchasing/selling virtual currency exclusively as investments for one's own account does not constitute MSB activity.

Legal Basis: Both rulings build upon FinCEN's foundational FIN-2013-G001 (March 18, 2013), "Application of FinCEN's Regulations to Persons Administering, Exchanging, or Using Virtual Currencies."

Travel Rule: Applies to payouts at or above $3,000 under the existing Bank Secrecy Act.

• Source: FinCEN FIN-2014-R001
• Source: FinCEN FIN-2014-R001 PDF
• Source: FinCEN FIN-2014-R002 PDF
• Source: FinCEN 2013 Guidance

Additional FinCEN Context

FIN-2014-R012 addresses the rental of computer systems for mining virtual currency, further delineating the boundary between personal use and service provision.

• Source: FinCEN FIN-2014-R012

2.b

Kazakhstan

Legal Framework

Primary Legislation: Law No. 193-VII on Digital Assets (6 February 2023), as amended by Law No. 231-VIII of 17 November 2025, which legalised mining and crypto circulation nationwide beyond the Astana International Financial Centre (AIFC). The amending law is in force from approximately mid-January 2026.

Repeal of Mandatory Domestic-Sale Quota

Earlier law required digital miners to sell a minimum percentage of produced digital assets through AIFC-licensed exchanges (50% from 1 January 2024, rising to 75% from 1 January 2025). Law No. 231-VIII repealed this mandatory-domestic-sales quota (former Article 8(4)) and reclassified mining as a distinct activity from digital-asset turnover. The earlier 50%/75% schedule is therefore no longer in effect.

• Source: Library of Congress — Kazakhstan Digital Assets Law
• Source: Morgan Lewis — Kazakhstan Digital Assets Regulation

Miner Registration and Pool Reporting

• Mining requires accreditation/licensing; the AIFC historically issued 84 mining licences (covering roughly 415,000 machines, industry/government-reported)
• Mining licences run for three years
• Only Kazakhstan-registered individuals or legal entities may mine (localisation requirement); unlicensed mining is illegal
• A new mining-pool tax-reporting form (Order No. 119, approved 20 February 2026) requires digital mining pools to report the distribution of mined assets to the tax authorities (implementation expected 25 April 2026)

AML/KYC Provisions

The AIFC corporate template historically required an AML officer and a compliance officer, with AML/KYC obligations tied to licensed/accredited mining. Issuers of secured digital assets are subjects of financial monitoring under Kazakhstan's AML/CFT regulations. A specific AML threshold for miners is NOT VERIFIED.

• Source: GRATA International — Legal Regulation of Cryptocurrency in Kazakhstan
• Source: Mondaq — Kazakhstan Mining Regulation
• Source: IMF — Kazakhstan Financial Sector Assessment

2.c

European Union — MiCA

Regulatory Framework

The Markets in Crypto-Assets Regulation (MiCA) — Regulation (EU) 2023/1114 — entered into force in stages, with full application from December 30, 2024. The transitional grandfathering period ends 1 July 2026 (a hard stop, no further extensions).

Mining Exclusion

MiCA does not classify miners as Crypto-Asset Service Providers (CASPs). Solo self-mining is unregulated. Validators, nodes, and miners that confirm transactions and update the state of the underlying blockchain are excluded from the CASP definition; pools, custody, and hashrate sales can, however, trigger CASP authorization.

AML Requirements for CASPs (Not Miners)

Where mining operations also provide CASP services (exchanges, custody, etc.), those services are subject to:

• Customer Due Diligence (CDD) and KYC verification
• Transaction monitoring for suspicious activity
• Suspicious Activity Reporting to Financial Intelligence Units
• Transfer of Funds Regulation (TFR) Travel Rule compliance (effective December 30, 2024)
• The EU applies the Travel Rule to all crypto transfers with no de minimis threshold, exceeding FATF's recommended EUR 1,000 threshold
• DAC8 / CARF (OECD Crypto-Asset Reporting Framework) from 1 January 2026; first DAC8 data exchange by 30 September 2027

Enforcement: Tether (USDT) was treated as non-compliant and delisted on major EU exchanges by 31 March 2025; more than 35 non-compliant CASPs have been flagged. ESMA conducted a Malta peer review in July 2025.

• Source: ESMA — MiCA Regulation
• Source: European Commission — Crypto-assets
• Source: Cyfrin — MiCA Regulation Explained
• Source: Dechert — MiCA Second Part Application

2.d

United Kingdom — FCA

Current Regime

Since January 2020, businesses providing specified cryptoasset services must register with the Financial Conduct Authority (FCA) under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs), Regulation 14A. The Cryptoasset Reporting Framework (CARF) took effect 1 January 2026, with the first report due 1 January–31 May 2027 (covering CY2026) and penalties up to £300/user for inaccurate reports.

Activities In Scope (Regulation 14A)

Two categories of cryptoasset businesses require FCA AML registration:

1. Cryptoasset Exchange Providers: Exchanging or arranging exchanges of cryptoassets for money (or vice versa), or one cryptoasset for another. Includes crypto ATMs, peer-to-peer providers, and ICO issuers.

2. Custodian Wallet Providers: Safeguarding or administering cryptoassets or private cryptographic keys on behalf of customers.

Miners

Mining-only operations require no crypto-specific licence or registration. FCA registration is triggered only if the operation also conducts exchange, custody, ATM, or staking-as-a-service activity. The new FSMA 2000 (Cryptoassets) Regulations 2026 (passed 4 February 2026) omit mining as a regulated activity, leaving a deliberate perimeter gap; the FCA's CP26/13 perimeter-guidance consultation (opened 15 April 2026, closing 3 June 2026) makes no mention of mining or PoW.

AML Requirements for Registered Firms

• Customer Due Diligence with two independent verification sources

• Enhanced Due Diligence for higher-risk customers

• Appointed nominated officer for MLR compliance

• Suspicious activity reporting to the National Crime Agency (NCA)

• High rejection rates: an 87% rejection rate in FY ending March 2024; FY April 2025 saw a 45% acceptance rate (admitting names including BlackRock and Standard Chartered)

• Source: FCA — Who Needs to Register

• Source: FCA — AML/CTF Regime

• Source: FCA — How to Apply

2.e

Paraguay — SEPRELAD

Resolution N. 8/2020

Issued by: SEPRELAD (Secretaria de Prevencion de Lavado de Dinero o Bienes — Paraguay's Financial Intelligence Unit) Legal Basis: Law N. 1015/97 (Prevention of Money Laundering)

Key Classification: Resolution 8/2020 classifies individuals and legal entities engaged in activities related to virtual assets — including mining, exchange, transfer, storage, or administration — as "Obligated Subjects" under Law 1015/97. Paraguay's regime is GAFILAT-aligned.

Obligations for Miners as Obligated Subjects

• Registration with SEPRELAD (and with MIC)
• Customer due diligence (CDD)
• Reporting of suspicious activities
• Implementation of AML/CFT controls

Mandatory Registration and Transaction Reporting

• All Bitcoin miners must register with the state (mandatory from December 2024)
• DNIT General Resolution 47/26 (in force March 2026) requires wallet-level reporting for all crypto transactions exceeding $5,000/year, explicitly covering mining

Resolution N. 314/2021 (SEPRELAD) establishes a comprehensive risk-management system to prevent money laundering and terrorist financing in activities associated with virtual assets.

Significance: Paraguay is one of the very few countries globally that explicitly classifies cryptocurrency miners as AML obligated subjects — the only such case among the 27 jurisdictions in this study.

• Source: Altra Legal — Cryptocurrency and Crypto Mining: Analysis of Paraguayan Regulation
• Source: Freeman Law — Paraguay & Cryptocurrency
• Source: CoinDesk — Paraguay Audits Local Crypto Industry

2.f

Bhutan — Royal Monetary Authority (RMA)

2019 Cryptocurrency Mining Regulatory Sandbox Framework

The RMA issued the "Cryptocurrency Mining Regulatory Sandbox Framework" in January 2019 with the following objectives:

1. Ensure cryptocurrency mining strictly complies with relevant national laws
2. Regulate and supervise mining and trading activities to prevent financial system risk
3. Ensure appropriate safeguards for investor and consumer protection
4. Introduce regulatory reforms to support disruptive technologies

KYC/AML and Registration Requirements

The framework requires mandatory KYC/AML for all mining entities and is aligned with FATF AML standards. Mining companies must:

• Obtain RMA approval before operations
• Obtain licences with risk disclosures
• Implement customer identification and protection measures

Regulatory Evolution

Bhutan now operates a two-tier system: the state (via Druk Holding & Investments) runs a sovereign mining program with full backing, while private mining is restricted to entities registered in Gelephu Mindfulness City (GMC) following the RMA's April 30, 2025 notice. Crypto is not legal tender, on-ramping via domestic banks is barred, and ICOs are prohibited without RMA approval.

Verification Note: The full text of the 2019 Sandbox Framework was not available for review; the above is drawn from secondary sources describing the framework's requirements.

• Source: RMA Regulatory Stance on Crypto Currency
• Source: Lightspark — Is Crypto Legal in Bhutan?
• Source: FinTax — Bhutan's Cryptocurrency Tax and Regulatory Setup
• Source: ORF — Bhutan's Crypto Mining Bets

2.g

South Africa — Financial Intelligence Centre (FIC)

Directive 9 of 2024 — Travel Rule for Crypto Asset Transfers

Issued: November 15, 2024 Effective: April 30, 2025 Legal Basis: Financial Intelligence Centre Act (FIC Act), aligned with FATF Recommendation 16

Scope

Directive 9 applies to all accountable institutions registered for Item 22 of Schedule 1 of the FIC Act, including:

• Crypto Asset Service Providers (CASPs)
• Financial Service Providers (FSPs) licensed to render financial services in crypto assets

Requirements

For all crypto asset transfers (domestic and cross-border):

Information Required for Ordering Providers:

• Originator name and identity
• Address, date and place of birth
• Originator and recipient wallet addresses

Key Feature: Directive 9 applies to all crypto asset transfers regardless of transaction amount, although verification obligations scale with the transaction value.

Applicability to Mining

There is no registration regime for pure miners in South Africa; the mining act itself is unregulated. CASP licensing (effective 1 June 2023 under the FAIS Act declaration) applies only where a miner also provides crypto-asset services. Mining pool payouts processed through a registered CASP would be subject to Directive 9 Travel Rule requirements; CARF reporting (collection 1 March 2026–28 February 2027) is aligned with the OECD framework. As of the latest data, CASP applications stand at 512 received, 300 approved, 14 declined, and 121 withdrawn (FSCA / DLA Piper Africa, 2026).

• Source: FIC — Directive 9 PDF
• Source: FIC — Joint Advisory on Directive 9
• Source: 21 Analytics — South Africa Travel Rule
• Source: Notabene — South Africa Travel Rule
• Source: Masthead — Travel Rule Directive 9

2.h

Russia — FTS Mining Registry

Mandatory National Mining Registry

Russia legalised cryptocurrency mining on 1 November 2024 under Law No. 221-FZ (signed 8 August 2024), establishing a mandatory national mining registry administered by the Federal Tax Service (FTS):

• Russian legal entities and individual entrepreneurs must register in the mining registry
• Private individuals using under 6,000 kWh/month may mine unregistered; above that threshold they must register as a business
• Monthly reporting of mined assets
• IP-address data is required from individual miners and infrastructure operators from 30 May 2026 (Government Decree No. 556)

Compliance Gap

As of mid-2025, only roughly 30% of miners had registered, leaving an estimated 70% — some 140,000–200,000 mining farms — operating unregistered. The FTS uses AI-based energy-consumption monitoring to count active farms; its count grew ~44% in 2025 to roughly 196,900 farms (industry/state-reported, methodology not independently audited).

• Source: CCN — Russia Cracks Down on Illegal Crypto Mining
• Source: Cointelegraph — Russia Illegal Crypto Mining Criminal Penalties

2.i

Uzbekistan — NAPP

Strictly Licensed, Legal-Entities-Only

Mining is legal but strictly licensed by the National Agency of Perspective Projects (NAPP), which reports directly to the President's administration. Only legal entities may mine; individual mining is not permitted. Permits are issued by NAPP after a 15-day, fee-free review as electronic certificates with QR codes (industry/media-reported).

AML Provisions

• Anonymous mining and anonymous crypto-assets are prohibited, as is circulation of previously issued crypto-assets
• Mining proceeds must be credited to bank accounts in Uzbekistan, and mined crypto must be sold via licensed exchanges
• Miners must report all activities, equipment, and wallets to NAPP
• The Besqala Mining Valley (resolution No. 8146414, 17 April 2026) provides a 10-year tax holiday (1% monthly revenue fee instead) but retains AML restrictions; zone residency requires legal entities registered in Karakalpakstan with minimum charter capital of 5,000 BCU (~$170,800)

2.j Africa (Emerging) — Nigeria, Kenya, Ethiopia

This regional aggregate spans three divergent AML/registration postures:

• Nigeria: A SEC licence is required for mining-as-a-service under the ISA 2025 (virtual assets = securities), with a minimum ₦500M (~$335,000) paid-up capital (≈₦1bn / ~$670,000 total startup). VASPs carry reporting obligations under the NTAA 2025; non-compliance penalties start at ₦10M for the first month plus ₦1M each subsequent month (industry/commentary-reported). As of late 2024, only 2 companies held provisional licences.
• Kenya: The VASP Act 2025 (with Draft VASP Regulations 2026, public participation concluded April 2026) requires local incorporation, qualified directors, and client-asset safeguarding; indicative capital is KSh 50M–200M (draft estimate). There is no specific mining framework.
• Ethiopia: Mining is permitted under a "data center and cloud services" classification (crypto for transactions remains illegal; Birr is the only legal tender), with foreign investors needing a minimum $200,000 working capital ($150,000 with local partners). General data-center licensing applies; there is no mining-specific AML statute.

2.k Remaining Jurisdictions — Exit-Point AML (No Miner Registration)

The following jurisdictions impose no mining-specific registration; AML/KYC obligations attach to VASPs/CASPs/exchanges at the exit point, consistent with the FATF default:

Note on the Nordic registry: Norway's data-centre registration (Nkom) is the closest the exit-point group comes to a miner registry — data centres (which capture mining operations) must register owner, contact, and services, with proposed amendments adding customer and equipment-location data. It is a transparency registry, not an AML licensing regime.

2.l Banned and Suspended Regimes

• China: Mining is fully banned, so miner registration is not applicable. AML effort instead consists of banking compliance checks, AI-assisted transaction-pattern surveillance (including P2P bank transfers), and blockchain forensics targeting on-chain/fiat ramps. The February 6, 2026 eight-agency "Ban 2.0" notice extended controls to OTC trading, offshore yuan-pegged stablecoins, and RWA tokenization.
• Venezuela: Mining is banned from the national grid (May 2024, reaffirmed May 2026). The pre-2023 SUNACRIP regime required registration plus national-pool membership (a de facto KYC), but SUNACRIP collapsed/was suspended in March 2023 and the framework is now non-operational. It is NOT VERIFIED that any successor miner-specific AML/KYC obligation is currently enforced.

3. Enforcement Mechanisms and Case Studies

3.a

China — Electricity Monitoring and Cross-Border Laundering Prosecution

Ban and Enforcement Framework

China's comprehensive ban on cryptocurrency mining was implemented across provinces during 2021 (2021 NDRC industrial-restructuring catalogue; 24 September 2021 inter-agency "illegal financial activity" notice). The February 6, 2026 eight-agency joint notice (PBoC, CSRC, et al.) reaffirmed that all crypto business activity is illegal.

• Source: Library of Congress — NDRC Notice

Detection Methods

1. Electricity / "energy-signature" monitoring: Distribution companies monitor energy quality data to detect anomalous consumption patterns consistent with mining operations
2. Blockchain forensics for on-chain/fiat ramps
3. Institutional audits: Inspections target colleges, research institutions, and data centers where subsidized electricity rates incentivize covert mining
4. AI-assisted transaction-pattern surveillance, including P2P bank transfers

Notable Enforcement Action

A cross-border USDT laundering case of roughly 1.182 billion yuan (~$166M) was unveiled on 28 October 2025. (A prior "$136M / February 2025" claim is NOT VERIFIED.) Penalties include asset seizure, suspension of crypto transactions, and criminal prosecution of cross-border laundering networks.

• Source: Tom's Hardware — China Crypto Miners Stealing Electricity
• Source: CNBC — Inside China's Underground Crypto Mining
• Source: De Gruyter — China's Crackdown on Crypto Mining from a Climate Perspective

3.b

Paraguay — ANDE Drone/AI Detection

The 2,738-Machine Bust in Salto del Guaira (May 2024)

Verified Details:

• Location: Salto del Guaira, Canindeyu Department, Paraguay
• Machines Seized: 2,738 ASIC mining units; five transformers also confiscated
• Detection Method: ANDE employed artificial intelligence and power distribution analysis to identify unmetered connections; thermal drones were also used
• Agencies Involved: ANDE, National Police, and multiple government agencies

Broader Enforcement Campaign

Across 2024, Paraguay conducted 17+ raids, seizing over 10,000 ASICs and 50 transformers. Militarized crackdowns on electricity theft continue, supported by drones, AI analytics, and distribution-pattern analysis. Illegal mining is estimated at ~28.5% of national consumption, costing roughly $60M/year in stolen power; penalties reach up to 10 years' imprisonment for electricity-theft mining (July 2024 law).

Follow-Up: State Mining Program

On 4 March 2026, ANDE signed an MOU with infrastructure firm Morphware to launch a state-run Bitcoin mining program using roughly 1,500 of ~30,000 seized rigs, powered by surplus Itaipu hydro.

• Source: Cointelegraph — Paraguay Seizes 2738 ASICs
• Source: NewsBTC — Paraguay to Mine Bitcoin with Seized Rigs
• Source: TechXplore — Paraguay's Abundant Hydropower Draws Miners

3.c

Kazakhstan — Shutdown of Unlicensed Operations

Enforcement Posture

Unlicensed or unaccredited mining is illegal; penalties include equipment seizure, fines, and criminal liability. Regional energy providers disconnect non-compliant operations during grid strain.

Verification Note: The widely-cited "over 120 unlicensed operations shut down since 2024" figure and the "fines up to 5 million tenge (~$11,000)" figure are NOT VERIFIED against a primary government source or the current tax code. They are retained here as reported but should not be relied upon without confirmation.

Context

This enforcement reflects Kazakhstan's transition from an unregulated mining hub (which at its peak held roughly 18% of global Bitcoin hashrate in 2021) to a nationally regulated ecosystem under Law No. 231-VIII, with a per-kWh digital-mining fee (2 tenge standard, 1 tenge renewables/off-grid, 25 tenge unmetered penalty) replacing the repealed domestic-sales quota.

• Source: CryptoDnes — Kazakhstan Shuts Down Illegal Crypto Mining Network
• Source: MIT Technology Review — Bitcoin Mining Was Booming in Kazakhstan
• Source: Crypto.news — Kazakhstan Blocks 1,100 Unlicensed Exchanges

3.d Nordic Countries (Sweden) — 18 Data Centers Concealing Mining

Investigation Details

Investigating Agency: Skatteverket (Swedish Tax Agency) Investigation Period: 2020-2023 Result: Of 21 data-centre firms audited, 18 were found to be concealing crypto mining to wrongly claim VAT deductions.

The Scheme

These companies operated as data centers ostensibly providing legitimate services (graphic design, consulting, AI processing) while secretly mining cryptocurrency, exploiting reduced energy tax rates and VAT deductibility for which mining operations are ineligible. Crypto mining is not a VAT-deductible activity in Sweden, and the data-centre electricity-tax break was raised from SEK 0.006 to SEK 0.36/kWh (~6,000%) in July 2023.

Financial Penalties

Skatteverket demanded approximately SEK 990 million (~$91 million) in VAT adjustments and surcharges (April 2024). Courts upheld the appealed cases.

Regional Context

Across the Nordics, no outright mining ban is in force. Norway asked its Government (Storting resolution, 12 March 2026) to return with a formal legislative proposal for a ban on crypto-mining data centres while rejecting a proposed national licensing/concession regime — a ban remains proposed-but-unenacted. Iceland restricts mining de facto through Landsvirkjun's commercial power-allocation discipline. A Norwegian "5%-turnover" infringement-penalty figure was removed as unverified.

• Source: Data Center Dynamics — 18 Data Centers Shut Down in Sweden
• Source: CryptoNews — Sweden Busts 18 Data Centers
• Source: TheMinerMag — Sweden Demands $90M from Crypto Miners

3.e

Russia — BitRiver, Regional Bans, and Proposed Criminal Penalties

Regional Bans

Mining is banned in energy-strapped regions, with the framework running through 2031. Seasonal (fall–winter) bans applied in Irkutsk plus Buryatia and Zabaikalsky Krai (imposed 15 November 2025, expired 15 March 2026). Russia signalled in February 2026 that it expects no new regional bans in 2026, citing flat 2025 electricity consumption; a permanent five-year Siberian ban has been discussed but not imposed.

Notable Enforcement

• BitRiver: founder Igor Runets was placed under house arrest (31 January 2026) on tax-evasion charges; the FTS filed a bankruptcy petition against BitRiver-B. BitRiver is Russia's largest miner (US-sanctioned in 2022; once ~15 data centers / ~533 MW).
• Dagestan reported 100+ illegal farms (2025).
• FTS enforcement is supported by AI-based energy-consumption monitoring.

Proposed Criminal Penalties

Criminal Code amendments are proposed but not enacted:

• Source: Moscow Times — Irkutsk Bans Cryptocurrency Mining Until 2031
• Source: CCN — Russia Cracks Down on Illegal Crypto Mining
• Source: Cointelegraph — Russia Illegal Crypto Mining Criminal Penalties
• Source: Yahoo Finance — Russia Criminalize Illegal Crypto Mining

3.f

Venezuela — Militarized Grid-Protection Raids

Venezuela's operative enforcement mode is militarized grid-protection raids, framed as protecting the national electrical system (SEN) rather than financial-crime prosecution. Operación Cazador (Maracay, 18 May 2026) seized roughly 4,000 ASIC machines (CICPC + military + Ministry of Electric Energy) from a facility drawing 8–10 MW; an earlier Maracay action (2024) seized 2,300+ Antminer S19j Pro units. Disconnecting mining reportedly recovered ~500 MW in critical regions (Carabobo, Aragua, government-reported). Separately, 10+ SUNACRIP officials were arrested over $3M+ in misappropriated funds (distinct from the broader $3B+ PDVSA scheme).

3.g

Brazil — Electricity-Theft Mining Raids

Brazilian enforcement (police/DEIC) focuses on electricity-theft mining (mining is legal where power is lawfully paid). In São Paulo (20 May 2026), DEIC and CPFL Piratininga seized ~1,400 illegal rigs stealing ~2 GWh via rigged transformers; a Rio de Janeiro (May 2026) raid linked a ~30-machine farm on a stolen power tap to the Comando Vermelho. A March 2026 asset-seizure law permits freezing, seizure, and liquidation of crime-linked digital assets, with proceeds directed to public security.

3.h Southeast Asia — Licensing Actions and Electricity-Theft Prosecution

• Thailand: SEC moved against Bybit, OKX, and CoinEx (2025) under extraterritorial licensing amendments (effective 13 April 2025) plus Computer Crime Act platform blocking; penalties of 2–5 years' imprisonment and/or fines.
• Philippines: On 25 August 2025 the SEC flagged unregistered platforms (reported blocks of Coinbase and Gemini; an exact "50 platforms" figure is NOT VERIFIED); BSP imposed an indefinite VASP-licensing moratorium from 1 September 2025.
• Malaysia: Electricity-theft mining is prosecuted under the Electricity Supply Act 1990 via integrated "Ops Steal" inspections (Energy Commission/TNB); a Sibu raid (April 2026) seized 12 mining servers on a direct-tapping connection. Penalties reach RM200,000 and/or up to 5 years' imprisonment (industry/media-reported).

3.i

UAE — VARA AML Enforcement

On 18 August 2025, VARA fined Fuze (Morpheus Software Technology FZE) for AML-programme failures and intentional unlicensed VA activity (penalty amount undisclosed; the firm retained its licence under supervision). The federal CMA regime (Decree-Law 33/2025, Art. 71) sets fines up to AED 250,000,000 (~$68M) for unlicensed financial activity, alongside VARA-administered penalties.

3.j

Georgia — Emerging Illegal-Mining Enforcement

Georgia historically had no mining enforcement, but a June 2026 Svaneti/Mestia crackdown (Vice-PM Mdinaradze) deploys mass smart-meter installation plus law enforcement against unmetered/grid-stealing mining, targeting large-scale illegal operations rather than households. The state estimates GEL 20–25M/yr (~$7–9.4M) in losses from unlawful power use; free electricity for Svaneti residents is retained up to a fixed threshold with standard tariffs above it.

3.k Jurisdictions With No Mining-Specific Enforcement Identified

For the following jurisdictions, the matrix records no mining-specific enforcement action as of June 2026, or such actions are NOT VERIFIED: United States (FinCEN increased audits of mining pools distributing rewards >$3,000 without PII in 2025, plus rising local noise/zoning enforcement; TX PUCT non-compliance up to $25,000/violation/day), Argentina (NOT VERIFIED), Canada (NOT VERIFIED), El Salvador (NOT VERIFIED), Australia (none identified; activity focused on unlicensed exchange conduct), India (tax enforcement via 1% TDS and Section 509 reporting; no mining-specific action), Japan (none; proposed bill raises unregistered-operation penalties to up to 10 years / ¥10M), France (none in file), Germany (none found), Singapore (PSA/FSMA licensing enforcement, not mining-specific), Saudi Arabia (none against a primary source), and South Africa (general CASP/AML and tax enforcement only).

4. Illegal Mining — Scale and Methods

4.a China: Underground Mining Despite Ban (~14% of Global Hashrate)

Verified: Multiple independent sources confirm China's mining rebound.

• China re-emerged as the third-largest mining hub at an industry-reported ~14% of global Bitcoin hashrate as of late October/November 2025 (Hashrate Index/Luxor ~14%; CryptoQuant 15–20%, methodology-caveated geolocation/pool-IP estimates), concentrated in Xinjiang and Sichuan.

Methods of Evasion:

• Going "behind the meter" by drawing power directly from hydro dams in Sichuan

• Dividing operations into smaller farms across the country

• Exploiting the data center boom in energy-rich provinces

• Operating during periods/locations with less regulatory scrutiny

• Source: Yahoo Finance — China's Underground Bitcoin Mining Rebounds

• Source: CryptoSlate — China Persists as Bitcoin Mining Giant

• Source: CCN — China's 2021 Mining Ban Has Failed

• Source: CNBC — Bitcoin Production Roars Back in China

4.b Paraguay: ~28.5% Electricity Losses

Verified: According to ANDE data, illegal connections for crypto mining (and other purposes) account for approximately 28.5% of national electricity consumption, with miners sapping an estimated $60 million of electricity from the national grid annually.

Government Response:

• Up to 10 years' imprisonment for electricity theft for mining purposes (July 2024 law)

• ANDE enforcement via drones, AI analytics, and distribution-pattern analysis

• State-run mining program (ANDE-Morphware MOU, March 2026) repurposing seized rigs

• Source: Invezz — Paraguay Fights Illegal Crypto Mining, Energy Losses

• Source: The Week — Paraguay's Dangerous Dalliance with Cryptocurrency

• Source: Newsendip — Mining Cryptocurrencies and Power Outages in Paraguay

4.c Ethiopia (Africa Emerging): Permit Freeze Amid Grid Constraints

Verified: Mining grew rapidly on GERD hydropower at among the world's lowest rates (~$0.032/kWh), but Ethiopian Electric Power (EEP) froze all new power permits for crypto/data miners in August 2025, citing the grid being at capacity, with plans to phase out or reduce mining.

• Ethiopia ranked the 8th-largest Bitcoin mining country at ~2.6% of global hashrate (~27.5 EH/s) per Hashrate Index (January 2026, industry-reported; other sources cite ~2.5–2.7%), up from #10 a year earlier
• 25+ foreign mining firms (mostly Chinese) operate, with ~20 more on a waiting list; state-owned Ethiopian Investment Holdings (EIH) reportedly takes 20–30% stakes in mining mega-facilities
• A tariff-increase schedule (30% in December 2025, 24% July 2026, 28% July 2027) is projected to make roughly half of operations unprofitable by mid-2026

Verification Note: A prior "~33% of national power" consumption figure has been removed as it could not be verified against a primary source.

• Source: The Reporter Ethiopia — EEP to Phase Out Crypto Mining
• Source: The Reporter Ethiopia — Crypto Boom Makes for Power Burden
• Source: Mariblock — Ethiopia Halts New Crypto Mining Permits
• Source: Afriwise — Cryptomining in Ethiopia Legal Outlook 2025

4.d Other Illegal-Mining Hotspots

• Russia: An estimated 140,000–200,000 mining farms operate unregistered (~70% of the total), with the FTS counting ~196,900 active farms by AI energy-monitoring (2025). Dagestan reported 100+ illegal farms.
• Venezuela: Residential-node hashrate dropped ~65% since the 2024 grid disconnections (industry/media-reported, methodology not named; NOT VERIFIED vs CBECI/CCAF).
• Malaysia (Southeast Asia): Illegal-mining electricity theft costs ~RM700M/year (~14,000 premises, ~RM4.6bn cumulative; per-site losses ~RM34,000/month, utility/media estimates).
• Brazil: Electricity-theft mining raids (São Paulo ~1,400 rigs / ~2 GWh; Rio de Janeiro farm tied to organized crime).

5. Travel Rule Implementation for Mining

5.1 How the FATF Travel Rule Applies to Mining

Under FATF Recommendation 16 (the "Travel Rule"), VASPs must collect and transmit originator and beneficiary information for virtual asset transfers.

Key Clarification for Mining:

• Transaction fees paid to miners and validators are explicitly exempt from Travel Rule requirements (FATF 2021 Guidance)
• Miners are not VASPs, so they are not directly subject to the Travel Rule
• However, mining pool payouts processed through VASPs (exchanges, custodial wallets) trigger Travel Rule obligations on those VASPs
• When miners deposit mined coins at exchanges, the receiving exchange must apply CDD and Travel Rule requirements as applicable

5.2 Mining Pool Payout Implications

Mining pools present a regulatory gray area:

• Large mining pools that distribute rewards to participants may function as money transmitters or VASPs depending on their structure
• Pools that maintain custody of user funds and facilitate transfers could trigger VASP classification
• The FATF's functional approach means the determination depends on the pool's specific activities, not merely its label as a "mining pool"
• Two jurisdictions now impose direct pool-level reporting: Kazakhstan's Order No. 119 (20 February 2026) requires digital mining pools to report mined-asset distributions to the tax authority, and the United States has seen increased FinCEN audits of pools distributing rewards above $3,000 without PII.

5.3 Country Implementation Timelines

Global Progress: 85 of 117 jurisdictions have passed or are in the process of passing Travel Rule legislation (up from 65 in 2024).

• Source: 21 Analytics — FATF Travel Rule Status 2026
• Source: Notabene — Cryptocurrency Regulation Worldwide Travel Rule
• Source: Innreg — Crypto Travel Rule Guide 2026
• Source: Sumsub — FATF Travel Rule

6. Money Laundering Risks Specific to Mining

6.1 Mining as a Money Laundering Vector

Mining presents unique ML risks that differ from traditional financial crime vectors:

6.1.1 "Clean Coins" Problem

Freshly mined cryptocurrency has no prior transaction history, making it inherently "clean" from a blockchain analysis perspective. This creates a specific vulnerability:

• Illicit actors can purchase mining equipment with dirty money, then produce "clean" coins with no traceable criminal association

• Unlike stolen or mixed cryptocurrency, newly mined coins pass blockchain analytics screening because they have no prior criminal taint

• Heavily sanctioned nation states like Iran and North Korea have turned to mining to build capital outside the traditional financial system

• Source: Chainalysis — Cryptocurrency Mining Pools and Money Laundering

6.1.2 Mining Pool Laundering

Chainalysis research identifies a significant and growing problem:

• Exchange deposit addresses receiving $1M+ from mining pools have received ~$1.8 billion in illicit cryptocurrency across all crime types
• $158.3 million from ransomware addresses reached exchanges with significant mining pool exposure (2018 onward)
• ~$1.1 billion from scam-related addresses flowed to similarly exposed exchange deposit addresses
• Growth in value from illicit sources to mining services grew over 250% between 2020 and 2021

Mechanism: Ransomware actors and other criminals funnel illicit funds to mining pools to avoid triggering compliance alarms at exchanges. Miners accept high transaction fees from illicit sources in exchange for either newly mined coins or return of fees, effectively laundering the funds.

6.1.3 Nation-State Exploitation

• North Korea's Lazarus Group has been observed using stolen cryptocurrency to acquire freshly mined crypto via hashing services

• Iran uses mining to circumvent sanctions and build foreign reserves outside the traditional financial system

• The IMF has identified that mining revenue can be used to circumvent capital flow restrictions and international financial sanctions because operating costs (electricity) are paid domestically while revenues are received internationally

• Source: IMF — Crypto, Corruption, and Capital Controls

• Source: RegTechTimes — How to Use Bitcoin Mining to Launder Cryptocurrency

6.2 FATF and IMF Reports on Mining ML Risks

FATF Red Flag Indicators (2020)

The FATF published "Virtual Assets: Red Flag Indicators of Money Laundering and Terrorist Financing" identifying indicators including:

• Technological features that increase anonymity (mixers, privacy coins)

• Geographical risks from countries with weak VA regulation

• Inconsistent transaction patterns

• Source: FATF — Virtual Assets Red Flag Indicators

IMF Policy Papers

The September 2023 IMF-FSB Synthesis Paper on Policies for Crypto-Assets addresses:

• Crypto misuse for fraud, theft, tax evasion, and terrorist financing

• Higher adoption rates in emerging markets and low-income jurisdictions

• Risks to monetary policy, capital flow management, and fiscal stability

• Mining-specific risks related to capital controls circumvention

• Source: IMF-FSB Synthesis Paper (September 2023)

• Source: IMF — Virtual Assets and AML/CFT

6.3 How Countries Address Mining-Specific ML Risks

7. Recommended AML/KYC Framework for Mining

Based on FATF guidance, international best practices, and enforcement experience across the 27 jurisdictions surveyed, the following framework is recommended for countries seeking to apply proportionate AML/KYC requirements to cryptocurrency mining.

7.1 Tiered Regulatory Approach Based on Scale

Tier 1: Individual/Hobby Miners (Below Threshold)

Threshold Example: Below 6,000 kWh/month (Russia's exemption level) or equivalent economic threshold. Georgia's explicit exemption of individual miners and mining-pool participants is the clearest example of this tier in practice.

• Exempt from registration and reporting requirements
• Standard tax reporting obligations apply
• AML obligations trigger only at the point of exchange or transmission through a regulated entity

Rationale: FATF explicitly excludes individual miners from VASP classification. Proportionality requires that micro-scale mining not be burdened with compliance costs that exceed the ML/TF risk.

Tier 2: Commercial Miners (Above Threshold, Below Major Scale)

• Registration with financial intelligence unit or designated authority (cf. Russia's FTS registry, Paraguay's mandatory miner registration)
• Basic KYC: Identification of beneficial owners and directors
• Record-keeping: Transaction logs, wallet addresses, disposition of mined assets
• Suspicious activity reporting when disposing of assets
• Annual reporting on volumes mined and channels used for sale

Tier 3: Industrial/Large-Scale Mining Operations

• Full licensing from financial regulator (cf. Kazakhstan accreditation, Uzbekistan NAPP permit, Nigeria SEC licence)
• Comprehensive AML program including:
  • Designated compliance officer
  • Written AML/CFT policies and procedures
  • Ongoing transaction monitoring
  • Enhanced due diligence for high-risk counterparties
  • Staff training
• Regular supervisory examinations
• Travel Rule compliance for pool payouts above applicable thresholds

7.2 Mining Pool Regulation

Mining pools present the highest concentration of AML risk in the mining ecosystem because they aggregate and distribute funds.

Recommended Requirements:

1. Registration/licensing of mining pools operating within or serving residents of the jurisdiction
2. KYC for pool participants above a defined threshold (e.g., 1 BTC equivalent in monthly payouts)
3. Wallet screening using blockchain analytics to identify illicit fund inflows (per Chainalysis recommendation)
4. Travel Rule compliance for pool payouts above the FATF-recommended EUR/USD 1,000 threshold
5. Distribution reporting to the tax/financial authority (cf. Kazakhstan Order No. 119)
6. Suspicious activity reporting obligations
7. Prohibition on accepting deposits from sanctioned addresses or known illicit sources

7.3 Controlling the "Exit Points"

Even where miners themselves are exempt from AML obligations — the model in the large majority of the 27 jurisdictions — robust regulation of exit points is critical:

1. Exchanges and OTC desks must apply enhanced scrutiny to deposits originating from mining pools, including:
   • Verification that the depositor is a known mining operation
   • Assessment of the mining pool's compliance posture
   • Blockchain analytics to evaluate exposure to illicit funds
2. Mandatory sale through regulated channels forces mined assets into the KYC-regulated ecosystem. Note that Kazakhstan repealed its mandatory-domestic-sales quota in November 2025, illustrating that this lever can be politically fragile; Uzbekistan's "sell only via licensed exchanges" requirement is a current example.
3. Peer-to-peer sale restrictions may be considered for large-volume OTC transactions by miners

7.4 Addressing Mining-Specific Risks

"Clean Coins" Laundering Risk

• Require exchanges to flag large deposits of freshly mined coins that are inconsistent with the depositor's known mining capacity
• Mining operations receiving significant inflows from external sources (not block rewards) should trigger enhanced review
• Cross-reference energy consumption data with reported mining output

Sanctions Evasion via Mining

• Maintain and share lists of mining pools and wallets associated with sanctioned entities
• Require mining pools to screen participants against sanctions lists
• Monitor for mining activity connected to sanctioned jurisdictions

Energy Theft and Illegal Operations

• Coordinate between energy regulators and financial intelligence units
• Implement electricity monitoring and anomaly detection (proven in China, Paraguay, Russia, Brazil, Georgia, and Malaysia)
• Ensure that unlicensed mining operations face both energy-sector and financial penalties

7.5 Alignment with FATF Recommendations

7.6 Practical Enforcement Considerations

1. Energy-sector coordination is essential — electricity monitoring is the most effective detection mechanism for illegal mining (proven in China, Paraguay, Russia, Brazil, Georgia, and Malaysia)
2. Technology requirements should be realistic — blockchain analytics and AI energy-monitoring tools for mining pools and large operations, but not for individual miners
3. International cooperation is critical given the portable nature of mining — miners relocate to jurisdictions with weakest oversight (China's 2021 ban dispersed miners to Kazakhstan, the US, and Russia)
4. Phase-in periods allow industry to develop compliance infrastructure (South Africa's 5.5-month grace period for Directive 9 is a reasonable model)
5. Proportionality principle must be maintained — over-regulation drives mining underground (China's ban left a persistent ~14% underground hashrate, and India's punitive tax regime suppresses activity without prohibition clarity); under-registration is equally a failure mode (Russia's ~70% unregistered rate after legalisation)

Appendix: Verification Notes

This is a refresh synthesis mirroring the canonical per-jurisdiction fact matrix (27 jurisdictions, including the regional aggregates Southeast Asia, Nordic Countries, and Africa (Emerging)). The following claims could not be fully verified through primary sources and are flagged accordingly:

1. Kazakhstan's "120+ operations" shutdown figure and the "5 million tenge (~$11,000)" fine — multiple secondary sources report a crackdown, but the original government data source and current-code penalty were not directly accessed (NOT VERIFIED).
2. Bhutan's 2019 Sandbox Framework — the full text was not available for review; descriptions are drawn from secondary sources.
3. Ethiopia's "~33% of national power" figure — removed from this refresh; it could not be verified against a primary source.
4. Venezuela's ~65% residential-hashrate drop — industry/media network-monitoring data with no named methodology; NOT VERIFIED against CBECI/CCAF.
5. China's prior "$136M / February 2025" laundering claim — NOT VERIFIED; replaced by the confirmed 1.182 billion yuan ($166M) case unveiled 28 October 2025.
6. Philippines' "50 platforms" SEC-block figure — NOT VERIFIED; the underlying 25 August 2025 SEC action and reported Coinbase/Gemini blocks are reported.
7. Russia's criminal-penalty schedule — proposed Criminal Code amendments, not enacted.
8. Norway's mining-data-centre ban — requested by the Storting (12 March 2026) but not yet in force; a "5%-turnover" infringement-penalty figure was removed as unverified.
9. Hashrate and energy figures (China ~14%, Ethiopia ~2.6%, Paraguay ~28.5% losses, Russia ~196,900 farms) are industry/state-reported with the methodology source noted inline; no single authoritative CBECI/CCAF country breakdown exists for several jurisdictions.

All other major claims mirror the fact matrix and are verified against at least two independent sources, with primary sources used wherever available.

---

Document prepared March 2026, refreshed 4 June 2026. All URLs verified at time of research. Regulatory frameworks are subject to rapid change in this domain; regulators should verify the current status of cited provisions before relying on them for policy decisions.