The United States Treasury is taking aim at a different part of the online fraud business. On 9 September, its Office of Foreign Assets Control (OFAC) designates Xinbi Guarantee as a significant transnational criminal organisation. Xinbi does not run scams itself. According to Treasury, it runs an online marketplace that connects scam centre operators with the people who sell them financial services, technology and other support.
The action matters because it targets the service layer of the scam economy rather than individual fraud groups. Treasury says the platform has processed the equivalent of more than $24 billion in digital assets and conventional currency since around 2022, mostly in Southeast Asia. The United Kingdom is the first country to sanction Xinbi, acting in March. The US move now brings the two countries into line.
What regulators say Xinbi does
Treasury describes Xinbi as a central point in a wider criminal network. Scam operators use the marketplace to buy goods and services, and the platform offers escrow, a system that holds payment until both sides complete a deal. Treasury also states that North Korean hackers and several already sanctioned groups, including entities in the Prince Group network, have reportedly used the platform.
The UK government gives a similar account. When the Foreign, Commonwealth and Development Office (FCDO) sanctions Xinbi on 26 March, it says the marketplace sells stolen personal data that fraudsters use to find victims, as well as satellite internet equipment used to contact them. The FCDO's stated aim is to cut the platform off from the legitimate cryptocurrency system.
The US action goes further than the platform. OFAC also designates two technology firms it says support Xinbi's core operations. Anwen Technology, based in Cambodia, develops the XinbiPay wallet, also known as NewPay. SafeW Technology, based in Singapore, develops SafeW, an encrypted messaging app. Treasury says Xinbi begins moving its merchant and money laundering networks to SafeW around June 2025, as law enforcement attention grows.
A coordinated enforcement action
The sanctions do not stand alone. Treasury works with the Department of Justice's Scam Center Strike Force, which seizes infrastructure and digital asset wallets used by Xinbi on the same day. The Justice Department reports that about $52 million in cryptocurrency linked to scam money laundering is restrained in a single day. That brings the total restrained by the Strike Force to about $938 million.
The action also builds on a clear record. OFAC sanctions the Prince Group network in October 2025 and again in June 2026. In October 2025, Treasury's Financial Crimes Enforcement Network (FinCEN) also issues a final rule against Huione Group, a Cambodian financial conglomerate. Treasury now says that after the Huione action, cybercriminals move their activity to Xinbi, which offers very similar services to many of the same customers.
What the designation means for firms
The legal effect of a US designation is wide. All property and interests in property of the three designated parties that are in the United States, or held by US persons, are now blocked and must be reported to OFAC. Any company owned 50 per cent or more by these parties is also blocked. US persons are generally banned from any transaction involving them.
The rules also reach beyond the United States. Treasury states that non-US persons are prohibited from causing US persons to breach sanctions, whether knowingly or not. OFAC can impose civil penalties on a strict liability basis, which means a firm can be fined even without intent to break the rules.
For UK businesses, the practical point is alignment. Xinbi is already on the UK sanctions list, so UK firms are already prohibited from dealing with it. The US action also names the two technology developers, which the UK's March designations do not include. Exchanges, payment firms and banks that screen customers against both lists now have more names to check.
Outlook
The Xinbi case shows how enforcement against online fraud is changing. Instead of focusing only on the groups that contact victims, regulators in London and Washington are now targeting the marketplaces, wallets and messaging tools those groups rely on. Treasury links the action to a US executive order of 6 March 2026, which directs agencies to use every available tool against foreign criminal networks targeting Americans.
The authorities' own records also show the limits of this approach. Treasury's account of activity moving from Huione to Xinbi, and then from Xinbi to SafeW, shows how quickly these networks adapt. The next test is whether the new designations, together with the seized wallets, disrupt the marketplace in a lasting way. Firms in the payments and cryptocurrency sectors should expect more actions of this kind, and should expect regulators to look closely at the services, not only the scams.
