Curriculum·G403 The Regulatory Map·about 33 min

MiCA and the cross-border reality

By the end of this lesson you can

  • →Explain how BitMEX's offshore registration failed to remove US jurisdiction over its US customers
  • →State that jurisdiction commonly follows the customer, not the company's flag of registration
  • →Describe what MiCA harmonized across the EU and EEA and what it reaches
  • →Map an activity against every jurisdiction whose persons it serves, not only where it is incorporated

Graduate · enrolled learners

This lesson opens with BitMEX, 2020 to 2021.

What happened
BitMEX was a large cryptocurrency derivatives exchange operated through offshore entities, its parent HDR Global Trading registered in the Seychelles, and it treated that offshore structure as if it placed the business outside US regulation while US customers traded on it. In October 2020 the US CFTC charged BitMEX and its founders with operating an unregistered derivatives platform and failing to maintain anti-money-laundering and know-your-customer programs, and the Department of Justice charged the founders with violating the Bank Secrecy Act. In August 2021 the BitMEX entities consented to a 100 million dollar CFTC penalty, up to half of it offset by what they paid FinCEN, and the CFTC order found BitMEX had known from 2014 to 2020 that US customers could and did trade on the platform. The founders pleaded guilty to the Bank Secrecy Act charge in 2022. The founders' position that Americans did not use the platform did not survive the evidence, and the offshore structure protected nothing: because it served US persons, US law reached it regardless of where its entities were incorporated. Registering in the Seychelles did not move the customers, and jurisdiction followed the customers.
The decision point
A company chooses where it incorporates, but it does not thereby choose which laws apply to it, because jurisdiction commonly follows the customer rather than the company's flag: serve a country's persons and you are generally within that country's regulatory reach whatever your registration says. BitMEX is the clean demonstration, an offshore exchange that served US customers and paid 100 million dollars for treating its Seychelles registration as an exit, its founders pleading guilty to a US law. The same principle runs the other way into Europe, where MiCA created one harmonized regime across the EU and EEA: providing crypto-asset services there requires MiCA authorization, and a firm based outside the bloc may serve an EU client only at that client's own exclusive initiative, an exemption ESMA reads very narrowly. So the decision an institution makes is to map its activity against every jurisdiction whose persons it actually serves, not only the one where it is incorporated, because the flag of registration is a choice the firm controls and the reach of a jurisdiction over its own people is not.
Recorded loss
$100,000,000

What you will be able to answer

  • →Why did BitMEX's offshore registration fail?
  • →What does jurisdiction commonly follow?
  • →What did MiCA create?
  • →What decision does the cross-border reality force?

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.

Sources and review

Confidence high·Volatility medium·Reviewed 2026-09-16·Owner unassigned

Contested

The 100 million dollar figure is the CFTC civil penalty, of which up to 50 million dollars could be offset by payments under the concurrent FinCEN assessment, so about 100 million dollars combined; law-firm summaries describe parts of it as suspended on conditions. The founders' separate criminal resolutions carried their own fines (10 million dollars each for Hayes and Delo) and sentences of probation or home detention. The BitMEX operating company itself pleaded guilty to a Bank Secrecy Act count on 10 July 2024 and on 15 January 2025 was fined 100 million dollars; the US Attorney's release says its executives took affirmative steps purportedly designed to exempt it from US law while knowing it served US customers.

In March 2025 the President pardoned Hayes, Delo, Reed and the former employee Gregory Dwyer, and, per BitMEX and a law-firm account, the operating company HDR Global Trading. A pardon removes the punishment; it does not undo the CFTC order's findings about US customers, which is what this lesson uses. The precise extraterritorial reach of any given rule is fact-specific, and BitMEX's US nexus was not only its customers: the US Attorney's release also says it operated through US offices.

MiCA's stablecoin titles applied from 30 June 2024 and the rest from 30 December 2024; existing providers may continue under national transitional regimes until 1 July 2026 at the latest, and the regulation entered into force in the EEA on 24 June 2025. Its detailed technical standards continue to develop; the lesson states its harmonizing purpose and reach, not its full current detail, which should be read against the regulation's text.