KUN Group company obtains three Hong Kong SFC licences / CFTC Chair says will take matter to Supreme Court if necessary / FBI warns of DPRK hackers stealing approximately USD 400 million
About 12 min · 6 key developments
01KUN Group company granted Hong Kong SFC Type 1, 4 and 9 licences
On 12 November, a company under KUN Group was formally granted Type 1 (dealing in securities), Type 4 (advising on securities) and Type 9 (asset management) regulated activity licences by Hong Kong's Securities and Futures Commission, following the group's approval-in-principle in September this year. The Type 1 licence's virtual asset dealing permissions allow the group to serve eligible clients through compliant Hong Kong licensed trading platforms; the Type 4 licence covers securities and virtual asset advisory services; and the Type 9 licence supports asset management for professional investors. The group plans to launch tokenised investment product distribution in the first quarter of 2027, initially covering tokenised money market funds, tokenised bond funds and gold-related tokenised products, acting as a distributor subject to the relevant product admission and distribution requirements.
Business implications
With the licences in hand, KUN can operate in Hong Kong as a licensed entity for securities dealing, securities and virtual asset advice, and asset management for professional investors, while its virtual asset dealing must run through compliant licensed platforms and its client base remains bounded by licence conditions. The tokenised product distribution is a preliminary plan for the first quarter of 2027, and whether it proceeds depends on each product meeting admission and distribution requirements, so it is not yet business the group can conduct.
Key points
- Confirm the licensed entity's name and the regulated activities covered by each licence
- Check whether virtual asset services are confined to licensed trading platforms
- Verify the product admission and distribution conditions for tokenised products
02RUSI Flags Crypto Laundering as 'Material Risk' for UK Ahead of FATF Review
The Royal United Services Institute (RUSI) has identified crypto-enabled money laundering as a "material risk" for the UK ahead of the Financial Action Task Force's assessment. FATF assessors are due to visit in June 2027, months before the UK's full crypto rules take effect, leaving the UK to demonstrate that it can enforce against crypto laundering before those rules are in force.
Business implications
RUSI's finding shifts the UK anti-money-laundering debate from rule-writing to enforcement capacity: before the full crypto regime applies, the FATF assessment will test whether UK authorities can identify, investigate and act on crypto laundering cases. For crypto businesses operating in or serving the UK, supervisory scrutiny and enforcement attention may arrive ahead of the formal rules, and existing customer due diligence, transaction monitoring and suspicious activity reporting duties remain the focus of that scrutiny.
Key points
- Confirm whether you fall within the UK AML regime and your current registration or licence status
- Check whether suspicious activity reporting and customer due diligence processes would withstand an enforcement-level review
03CFTC Chair Says Prediction-Market Jurisdiction Fight Could Go to the Supreme Court
Michael Selig, chair of the U.S. Commodity Futures Trading Commission, said in a CNBC interview that the CFTC has exclusive jurisdiction over event contracts, that it will take the related litigation to the Supreme Court if necessary, and that it will block states from suing CFTC-regulated exchanges for unlicensed betting. Turning to the CFTC's proposed crypto regulatory framework, Selig said several major crypto exchanges are already registered with the CFTC because they offer perpetual contracts and other derivatives, and could add spot trading on their platforms once the new rules take effect; some new market entrants that do not want to seek licences in all 50 states have also sought CFTC registration. For exchanges that currently offer no margin, leverage or financing, the framework adopts a voluntary opt-in mechanism. The framework remains at the proposal stage.
Business implications
The dispute turns on whether event contracts fall under exclusive federal jurisdiction or under state betting licences: if the CFTC's position prevails, states will have less room to sue CFTC-registered exchanges for unlicensed betting when they list event contracts; if states prevail in court, the same product would require betting-type approval state by state. The proposed framework ties registration for perpetual contracts and other derivatives to permission for added spot trading, and makes participation voluntary for exchanges without margin or leverage, so coverage depends on an exchange's existing product mix rather than a uniform mandate. Until a court rules on jurisdiction and the f
Key points
- Confirm whether event contracts are CFTC-regulated derivatives
- Check whether your state has sued over event contracts
- Assess whether your products involve margin or leverage
04FBI Warns North Korean Hackers Stole About $400 Million in Crypto via Fake Video Calls
The U.S. Federal Bureau of Investigation has issued a warning that North Korean hackers are carrying out fraud through fake video calls and similar methods. According to the warning, the hackers operate under the name "FaceStealer," using impersonated accounts and recorded webcam footage to conduct attacks, and have stolen approximately $400 million worth of cryptocurrency.
Business implications
The FBI warning points to identity impersonation as the attack vector: hackers use fake accounts and recorded camera footage so that counterparties or employees mistake the caller's identity, then leverage that trust to move funds or assets out. For exchanges, custodians and project teams, seeing a face on a video call is no longer sufficient authorization for large transfers, withdrawals or permission changes, and approval workflows need verification channels independent of the call itself. The warning is a risk alert from a law enforcement agency and does not impose new statutory duties on any specific platform; whether to adjust internal processes depends on each firm's own risk controls.
Key points
- Check whether large transfers and withdrawals rely on video calls for identity confirmation
- Review how impersonated accounts and recorded footage are detected and reported
05Israeli police arrest five over alleged crypto money laundering involving about $5 million
Israeli police arrested five suspects on 10 November on suspicion of cryptocurrency money laundering, fraud and providing financial asset services without a licence, in transactions worth about $5 million. Police suspect the group ran an unlicensed crypto exchange through WhatsApp groups, failed to report the transactions to the Israel Tax Authority, and used fictitious loan agreements to move crypto proceeds directly into bank accounts disguised as loan funds, concealing the money's true origin. Searches of the suspects' homes turned up digital wallets, computers and cash. The investigation is ongoing and police expect to question further suspects.
Business implications
In Israel, operating a crypto exchange falls within licensed financial asset services, so running one without authorisation can itself be a criminal offence, while routing on-chain proceeds through fictitious loan agreements turns banks into unwitting conduits and triggers anti-money-laundering reporting and account freezes. Exchanges and payment firms serving Israeli clients should confirm whether their activity falls inside the licensing perimeter and keep transaction records consistent with tax filings, since reporting gaps are often where investigators begin tracing the money.
Key points
- Confirm whether exchange activity in Israel requires a financial asset services licence
- Verify the source of client funds and the authenticity of loan agreements
- Keep transaction records consistent with tax filings
06Thailand Proposes $148,000 Daily Cap on Certain Stablecoin Transfers to Curb Money Laundering
Draft rules in Thailand would impose a daily cap on certain stablecoin transfers and require that stablecoins move only between accounts or wallets belonging to the same person.
Business implications
The draft targets the transfer stage of stablecoin arrangements: once in force, transfers between accounts or wallets held by different persons would not be permitted, and daily transfer values would be capped, with breaches exposing firms to anti-money-laundering compliance liability rather than a mere product restriction. Issuers, payment providers and wallet operators need to assess whether transfers among their users fall within the "same person" perimeter and adjust deposit, withdrawal and internal transfer designs accordingly; until the rules are adopted and effective, rebuilding systems on the assumption of an existing obligation is not yet warranted.
Key points
- Confirm whether the draft has been adopted and its effective date
- Check the criteria for treating accounts or wallets as belonging to the same person
- Identify which stablecoins and transfer scenarios the daily cap covers