- Previous fines include €4 million for Kraken and €2.85 million for Crypto.com.
- OKX was also fined €1.1 million in Malta in April 2025.
- A $504 million settlement in the United States keeps OKX under supervision until 2027.
The Dutch central bank’s decision to fine OKX €2.25 million is more than a regulatory warning — it reflects how European authorities are applying rules retrospectively and enforcing compliance for past conduct.
The sanction targets services offered without registration between July 2023 and August 2024, the period when the Markets in Crypto-Assets regulation (MiCA) came into force. By penalizing earlier activity, regulators are making it clear that crypto exchanges remain accountable for past practices even after securing authorization under the new European framework.
Past conduct remains under scrutiny
Since 2020, the Netherlands has required crypto service providers to register under anti-money-laundering rules. OKX, which operated without the required registration during the relevant period, was found to be in breach. The Dutch central bank (DNB) emphasized that such violations will not be tolerated.
Authorities in the Netherlands have taken similar action against other large exchanges. Kraken paid €4 million and Crypto.com €2.85 million for offering unregistered services. These penalties, including the latest fine against OKX, underline a consistent approach: enforcement may be applied retroactively, and regulators will not overlook earlier violations as the industry adapts to new rules.
Global penalties highlight compliance gaps
OKX has faced enforcement in multiple jurisdictions. In April 2025, Malta fined OKX’s European arm €1.1 million for anti-money-laundering deficiencies identified two years earlier. The company subsequently secured MiCA approval after reforming its compliance systems.
Earlier in 2025, OKX agreed to a $504 million settlement in the United States, acknowledging it had operated an unlicensed money-transmitting business and processed illicit transactions. As part of that settlement, OKX remains subject to heightened oversight through 2027, including the appointment of an independent compliance monitor.
Collectively, these actions show a clear pattern: regulators are examining historical operations and expecting current, robust compliance. For exchanges, this can mean fines and oversight surfacing years after the original misconduct, prolonging uncertainty and imposing long-term remediation obligations.
The Dutch case framed as a legacy matter
OKX, legally registered as Aux Cayes Fintech Co., described the Netherlands enforcement as a “legacy matter” and said it had already addressed the issues. The company moved Dutch customers to its MiCA-licensed European entity and emphasized that the enforcement did not affect client assets.
The DNB’s fine was smaller than some penalties levied against other exchanges, and the regulator acknowledged OKX’s cooperation. Nonetheless, the action reinforces a wider trend: exchanges cannot simply comply going forward while ignoring past noncompliance.
An era of European enforcement under MiCA
The timing of the Netherlands decision is notable. With MiCA now in force across the European Union, exchanges must register, follow stricter reporting rules, and meet more rigorous anti-money-laundering checks. Even when firms obtain licenses, regulators continue to investigate and hold them accountable for prior breaches.
This signals the end of a “operate first, register later” mindset. Firms are learning that historical activities carry ongoing risk once new regulatory frameworks are implemented. The Dutch approach also suggests other European regulators may replicate this scrutiny, reviewing past operations while enforcing current rules.
For crypto exchanges, the message is clear: compliance is not only a present requirement but a continuing obligation that reaches back to previous conduct. Firms should expect regulators to pursue enforcement actions for legacy issues and to impose remediation, fines, or supervisory measures to ensure adherence to both current and past regulatory standards.