Cambodia Targets Crypto Rules by End of 2026 as Scam Networks Move Beyond Compounds

A regulatory reckoning after the raids

Cambodia aims to adopt a virtual assets law by the end of 2026, with central bank governor Chea Serey acknowledging on November 13 that the country's earlier decision to keep cryptocurrency outside a regulated public market had given criminals room to operate.

The admission comes as financial activity linked to Cambodia's casino industry continues despite sweeping raids. Blockchain analytics firm TRM Labs attributed about $1.07 billion in cryptocurrency receipts to 34 Sihanoukville casinos between January and early September 2026, with nearly two thirds going to casinos tied to networks under sanctions, according to the International Crisis Group.

Chea Serey, governor of the National Bank of Cambodia since 2023, described the earlier policy and its consequences:

Cambodia, at the beginning, has chosen not to regulate it and actually not to allow it to be traded publicly.

That, in a way, has also enabled these bad actors to use the cryptocurrency space to do a lot of activities. So now, this is a lesson learned.

Cambodia's challenge reaches beyond cryptocurrency. Authorities have closed large compounds, frozen assets and deported thousands of foreigners, yet recruiters, managers and financial intermediaries continue to offer services that allow fraud operations to restart in smaller premises or another country.

For people targeted by fake investments, the location of the office matters less than whether authorities can stop the payments. For workers trafficked into those offices, escape brings an immediate need for shelter, documents and a safe journey home.

What Cambodia intends to regulate

The National Bank of Cambodia and the Securities and Exchange Regulator of Cambodia issued a joint statement on September 23 setting out principles for supervising virtual assets and service providers. Virtual assets are digital representations of value, including cryptocurrencies, that people can transfer or trade electronically.

The statement identified issuing, exchanging, trading and safeguarding those assets as regulatory priorities. Safeguarding, often called custody, means holding assets or controlling the digital keys needed to access them on someone else's behalf.

Sou Socheat, director general of the securities regulator, said the government was drafting legislation on digital asset management. Chea Serey subsequently gave the target of adoption by the end of December 2026. The final law's scope, licensing requirements and enforcement arrangements have not been detailed publicly.

Cambodia had already issued warnings in 2018 through its central bank, securities regulator and national police, saying cryptocurrency activities conducted without authorization could be punished under the law. The policy shift is toward a clearer supervisory framework for an industry that continued operating despite restrictions.

The September statement listed fraud, sharp price changes, money laundering, terrorist financing, sanctions and tax evasion, and cybercrime among the risks. It also described possible benefits from regulated activity, including greater financial transparency and wider access to financial services, within Cambodia's digital economy framework for 2021 to 2035 and financial technology policy for 2023 to 2028.

The regulators excluded providers that supply only network infrastructure, such as cloud computing or transaction validation, without directly providing customers with trading, investment or payment services. They also said digital assets are neither legal tender nor guaranteed by the government or central bank. Legal tender means money officially recognized for settling debts.

How much has the crackdown changed?

Senior Minister Chhay Sinarith, who oversees Cambodia's commission against technology enabled scams, told diplomats in August that no online scam compounds remained. His figures covered 624 suspected locations raided between July 2025 and August 20, 2026, nearly 30,000 people detained, 58,266 foreign nationals deported, 27 casino licences revoked or suspended, and 15 officials and police officers arrested.

At a November 6 briefing, authorities gave totals through October 31 of 972 locations targeted, 568 court cases prepared and 5,032 suspects charged and placed in detention before trial. They also reported 23,760 foreigners repatriated, compared with the 58,266 deportations cited in August; the two briefings used different categories without explaining how the totals relate.

Cambodia said it had frozen more than $300 million in bank accounts across the nationwide campaign, alongside property and other assets worth hundreds of millions of dollars. Officials also reported revoking 18 casino licences linked to the Prince Group network and suspending another 10 over the preceding year.

The main steps span more than a year:

• July 2025: Cambodia launched its nationwide campaign against scam compounds.
• April 23, 2026: The United States sanctioned senator Kok An and 28 individuals and entities in his network.
• August 2026: Cambodian officials declared that large scam compounds had been eliminated.
• September 23, 2026: Financial regulators issued their joint virtual assets statement.
• November 6, 2026: Authorities announced further financial freezes, casino licence actions and court cases.
• November 13, 2026: Chea Serey acknowledged shortcomings in cryptocurrency policy and outlined the legislative target.

Empty buildings, active criminal services

International Crisis Group's November 11 Sihanoukville photo essay documented extensive closures in the coastal city's China Town district. Towers that previously housed offices and workers stood empty, while some premises carried court seals.

Chhay Sinarith had also acknowledged that criminal groups were shifting into guesthouses, condominiums, rented houses, vehicles and coffee shops. Smaller operations can spread workers across ordinary residential and commercial premises instead of concentrating them behind one compound wall.

Crisis Group found active advertisements for services useful to those operations: phones sold by the crate, cryptocurrency exchanged for cash, document brokers and software for fake investment platforms. One vendor offered fraud software either for purchase or through an arrangement taking a share of the proceeds.

Sihanoukville's physical infrastructure has already passed from one illicit business to another. Cambodia's 2019 ban on online gambling, followed by the collapse in travel during COVID-19, left buildings available for fraud syndicates. Vacant compounds now leave the city with another large stock of premises seeking occupants.

The industry's workforce estimates vary. Crisis Group put the number held in Cambodian compounds at their peak at about 100,000, while a nongovernmental estimate cited by the U.S. State Department counted at least 150,000 Cambodian and foreign workers across at least 350 compounds. Both descriptions point to a business requiring recruitment, accommodation, security and extensive financial services.

Following money through casinos and banks

The U.S. Treasury's April 23 Kok An sanctions announcement described a network extending through property owners, casino operators, security providers and financial institutions. Treasury alleged that Kok An's Crown Resorts supplied properties used for scams in Poipet, Sihanoukville, Bavet and elsewhere, while his Anco Brothers conglomerate supplied services and personnel.

The action also targeted Rithy Raksmei and K99 Group, as well as businesses associated with Aik Paung and Sai Aung Linn, including Xihu Resort Hotel and Heng Feng Cambodia Bank. U.S. sanctions block covered assets within American jurisdiction and generally prohibit transactions involving those assets by U.S. persons.

Cambodia's central bank revoked Heng Feng Cambodia Bank's licence and placed it into liquidation on August 3. Its notice cited compliance with existing laws and regulations without giving a more specific reason. Liquidation is the process of winding up a business and dealing with its assets and liabilities.

Crisis Group documented that hotels and casino businesses associated with the bank's owners continued operating. TRM Labs attributed $184 million in cryptocurrency receipts to Xihu casino wallets between the April sanctions and early September. Those figures show why supervising one licensed institution addresses only part of a network operating through several kinds of business.

Treasury also described a laundering operation in the United States that moved more than $73 million in victim funds in 2024. At least $1.3 million went to Cambodian bank accounts belonging to Luo Hong, whom Treasury linked to the Bolai casino and scam compound network.

The Congressional Research Service's September 30 scam centers report places these cases within wider American action involving Huione Group, Prince Group and Chen Zhi, including a reported cryptocurrency forfeiture complaint worth $15 billion. A forfeiture complaint asks a court to transfer assets alleged to be connected to crime to the government.

Recruiters carry the business across borders

Cambodian security analyst Moses Ngeth reviewed 4,991 Telegram recruitment advertisements posted between 2023 and 2026 for his study Cutting the Grass, not the Root. Advertisements linked to Cambodia were still appearing in late October, two months after the declaration that compounds had closed.

The jobs ranged from finding potential victims online to managing staff, translating messages and handling money. The common recruitment label "add contact" referred to approaching people who might later be drawn into a scam, with advertised pay reaching $750 a month.

Mina Chiang, founder and director of Humanity Research Consultancy, said experienced workers were advertising the languages they spoke, the markets they had targeted and the teams they had managed. She explained how that experience travels:

Rather than disappearing after a crackdown, experienced managers and workers are actively looking for their next employer, while syndicates continue recruiting for new locations. The knowledge, skills, and management systems move with the people, making the industry highly resilient.

Vietnamese police provided a concrete example in October, charging 88 foreign nationals and one Vietnamese citizen over an operation in Thanh Hoa province. Investigators said the group rented a hotel from June 2026 and transported equipment and data from Cambodia. Police estimated victim losses at 50 billion dong, nearly $2 million.

Authorities said the accused included Chinese nationals, 28 Indians, nine Cambodians, one Malaysian and one Myanmar national. Twenty two had entered Vietnam illegally and 21 lacked passports. Vietnamese investigator Ngo Minh Hieu estimated that a group could establish an operation employing 15 people for less than $4,000 by buying equipment and criminal services already on the market.

Sri Lankan police reported more than 1,000 foreign arrests for alleged cybercrime from January through May 2026. Authorities and researchers linked the increase to syndicates relocating from Cambodia and Myanmar, while recruitment and investigations have traced activity to other parts of Asia and Africa.

Survivors need a route home

Thousands of people released or escaping from Cambodian compounds have faced a second emergency: no money, missing documents and limited access to services or transport home. The Congressional Research Service described survivors stranded after the 2026 crackdown, with assistance organizations facing funding constraints.

The danger was evident during the January compound departures, when the Indonesian embassy had received requests for help from 1,440 nationals by January 22. Food, shelter and consular assistance were urgent needs then and remain central to preventing recruitment back into criminal work.

Mark Taylor, an independent consultant who previously worked for USAID in Cambodia, argued that enforcement had concentrated on closing premises and arresting people forced to commit scams while leaving most bosses untouched. Cambodian authorities, in their November briefing, said they were using digital evidence to build cases against ringleaders and working with the FBI and Interpol.

Investigators must establish each person's role and circumstances. The South Korean suspect returns in January involved 73 people linked to alleged fraud against 869 South Koreans, alongside accounts of workers whose passports were seized and who were prevented from leaving.

The Philippines faces similar cases. Its Department of Migrant Workers said 51 Filipinos were detained in Cambodia following scam arrests. Philippine police were also verifying a former official's estimate that 900 to 1,500 Filipinos remained trapped in Myanmar, while pursuing recruiters operating in the Philippines.

The economic damage reaches beyond fraud

Cambodia's tourism ministry recorded 2.46 million arrivals in the first nine months of 2026, down 44% from a year earlier. Chea Serey linked the decline partly to the country's reputation for scams, while the border conflict with Thailand also disrupted travel.

The central bank governor described the effect on regional visitors:

Mostly tourists from the region are not coming here because of this scam reputation,

Cambodia could receive little more than three million visitors during 2026 at the pace described in November, less than half its 2024 total. For hotels, restaurants, transport providers and attractions such as Angkor, fewer arrivals mean fewer customers across businesses far removed from online fraud.

The Congressional Research Service cited an estimate that Cambodia's scam economy in 2024 was worth as much as 40% of formal gross domestic product, the value of goods and services produced in the recognized economy. That scale helps explain why closing compounds also affects landlords, suppliers and local employment.

Victim losses have grown sharply too. The U.S. State Department estimated Americans lost $18.2 billion to Southeast Asian scam centers in 2025, compared with $10 billion in 2024, an increase of 82%. UN estimates put losses across East and Southeast Asia, Australia and New Zealand at roughly $88 billion to $114 billion in 2025.

Why financial intervention must move faster

The Financial Action Task Force, which sets international standards against money laundering, has called for intervention across the entire scam payment chain. Its study Combating End-to-End Illicit Financial Flows linked to Scam Compounds draws on nearly 120 case studies from more than 60 jurisdictions.

The study identifies virtual assets as a major laundering route and describes exchange desks operating inside some compounds. In one case, blockchain analysis followed more than $100 million in victim payments through wallets associated with a single compound to places where the money was converted into cash.

The task force urges authorities to coordinate across borders within 24 to 72 hours of detecting a scam. Faster intervention matters because money can pass through multiple accounts and services before a victim realizes the investment platform is fake.

Indonesia's Anti-Scam Centre offers one practical comparison: between November 2024 and May 2026, it blocked more than 515,000 accounts and returned about $10.9 million. American authorities have also targeted the digital infrastructure, announcing the seizure of 503 fraudulent web domains and a messaging app used to recruit trafficking victims alongside the April sanctions.

A draft East Asia Summit statement prepared for leaders meeting in Manila called for stronger financial and digital systems, shared threat assessments and closer law enforcement cooperation. It also called for responses consistent with human rights. The draft expresses intended commitments, with implementation resting on national authorities.

Cambodia's proposed law would give regulators a clearer framework for supervising virtual asset businesses. Its practical value will depend on whether financial oversight connects with investigations into organizers, rapid cooperation abroad and protection that allows trafficked people to leave the industry safely.

Key Points

• Cambodia aims to adopt a virtual assets law by the end of 2026 after its central bank governor acknowledged earlier regulatory shortcomings.
• Authorities report hundreds of raids, court cases, casino licence actions and more than $300 million frozen in bank accounts.
• Large compound closures have been followed by smaller operations and relocation across borders.
• Cryptocurrency receipts and active criminal services show that financial and technical networks continue operating.
• Trafficking survivors need shelter, documents and safe repatriation to reduce the risk of being recruited again.
• International financial standards call for faster action against payments, recruiters, controllers and organizers, alongside raids on premises.