Sihanoukville Casinos: $1 Billion in Crypto Despite OFAC Action
Despite a publicised Cambodian government crackdown and a series of US Treasury sanctions, crypto kept flowing into Sihanoukville's casino sector through most of 2026. Onchain data and field observations published by TRM Labs on 28 October 2026 show that 34 in-person casinos in the city received approximately USD 1.07 billion in crypto between 1 January and 7 September 2026, with OFAC-designated entities continuing to receive hundreds of millions of dollars after their sanction dates. The findings carry direct implications for any compliance team, auditor, or digital asset accounting software stack with exposure to Southeast Asian counterparties.
What the Data Actually Shows
TRM Labs tracked onchain inflows to 34 Sihanoukville casinos it has attributed through wallet clustering and field research. The headline figure, roughly USD 1.07 billion across the January-to-September window, already accounts for the period of Cambodia's most visible enforcement activity.
Inflow trends and the designated entities
Monthly inflows averaged USD 148 million between January and May 2026, then fell to around USD 95 million in July and August. That decline is notable, but it did not stop the flows. Casinos linked to OFAC-designated networks accounted for USD 687 million, or 64% of the total, and their monthly average dropped from roughly USD 100 million to about USD 48 million over the same period.
Critically, the designated entities did not stop receiving funds after the sanction dates. From 23 April through 7 September 2026, entities TRM attributes to the Xihu Resort Hotel received USD 184 million. Huan Hai Bo Lai International Investment Co Ltd received USD 129 million over the same window. A casino connected to Jin Bei Group, designated as part of the broader Prince Group action in October 2025, received USD 9 million after that designation. Huan Hai's 2026 receipts, at USD 264 million, were nearly three times its USD 90 million intake over the same stretch in 2025.
Why USDT on TRON dominates
Of the USD 1.07 billion in 2026 crypto inflows, 99.9% was USDT settled on the TRON network. Every crypto-to-cash exchange TRM observed directly in Sihanoukville also settled in USDT. Low transaction fees, deep regional liquidity, and near-universal adoption across Southeast Asia's informal financial networks explain the preference. This is not a coincidence of routing: USDT on TRON has become the de facto settlement layer for this entire ecosystem.
The OFAC Designations in Context
The US sanctions landscape around Sihanoukville has become increasingly detailed. On 23 April 2026, OFAC designated Senator Kok An and 28 related individuals and entities under the network designation, including Huan Hai Bo Lai International Investment Co Ltd and Xihu Resort Hotel Co Ltd, citing their roles in scam centre operations that defrauded Americans. Treasury's announcement noted that US-based individuals who supported the network laundered more than USD 73 million, and the US Secret Service took action against those individuals in 2024.
That April 2026 action followed OFAC's October 2025 designation of the Prince Group as a transnational criminal organisation, a package that named 146 related targets including Jin Bei Group. The Justice Department launched a related initiative in November 2025. Cambodia's own anti-scam commission announced on 8 September 2026 that it had taken action, a statement that arrived one day after the close of TRM's data window.
The designations are significant legal milestones. They also illustrate a practical limitation: formal designation alone does not interrupt flows when operators can rotate to new wallet addresses within hours and cash out through an informal over-the-counter network that spans convenience stores, hotels, pawnshops, and dedicated exchange counters operating openly across the city.
How the Cash-Out Infrastructure Works
TRM's field observations describe a layered system. At the casino level, USDT is accepted directly at cashier desks, converted to chips, and then to US dollars, with limited apparent customer due diligence. Operators appear more cautious with unfamiliar visitors than before, but the core workflow has not changed.
The wider over-the-counter network
Beyond casino floors, Sihanoukville's commercial street-level infrastructure still functions as a parallel exchange system. Phone shops, supermarkets, pawnshops, hotels, and dedicated exchange counters advertise USDT exchange services, some openly with signage, others by referral only. This distributed cash-out network means that even funds flowing to wallets that are not directly attributed to a designated entity can reach the same beneficial ownership through an intermediate step.
Casino operators also rotate wallet addresses regularly. That rotation shrinks the set of addresses that blockchain intelligence tools can attribute at any given time, and it means that any snapshot of attributed inflows is likely to undercount real activity. TRM explicitly flags this in its own analysis: some of the observed decline in monthly inflows may reflect wallet rotation to addresses not yet attributed, rather than a genuine reduction in economic activity.
AML and Compliance Implications for Firms
The Sihanoukville data is a concrete case study in the limits of list-based compliance. When a firm's transaction monitoring relies primarily on screening against a published set of sanctioned addresses, it will miss activity that flows through freshly rotated wallets, even when those wallets serve the same designated entity. For compliance teams at exchanges, stablecoin issuers, and any digital asset business with Southeast Asian exposure, this demands a rethink of screening logic.
What needs to change in your screening approach
The TRM analysis points to several practical adjustments. First, screening should cover indirect exposure: commercial entities, hotels, exchange counters, and logistics businesses in and around Sihanoukville that interact with designated casinos, not only the casino wallet addresses themselves. Beneficial ownership analysis matters here as much as address matching.
Second, compliance teams should treat USDT flows to informal exchange counters in the region as a risk indicator in their own right. A counterparty that routes significant USDT volume through Southeast Asian OTC desks with no plausible commercial rationale deserves enhanced due diligence regardless of whether any specific wallet has been attributed.
Third, attributed address lists should be treated as dynamic baselines rather than stable blocklists. Operators can and do migrate to new wallets quickly, which means that a clean screen today carries less assurance than it would in a more static environment. Transaction monitoring systems need to be configured to flag behavioural patterns, not just known addresses.
For firms building or reviewing their digital asset accounting software and bookkeeping workflows, the Sihanoukville case reinforces a point that regulators have made repeatedly: the ledger entry is only as reliable as the counterparty screening that preceded it. An exchange transaction with an unattributed Cambodian OTC desk that later turns out to be linked to a designated entity will expose the firm to potential OFAC liability, regardless of whether it appeared clean at the time of booking. Robust crypto bookkeeping software should be integrated with live sanctions data feeds so that the accounting record and the compliance record stay in sync.
The broader stablecoin AML picture is also relevant context here. Our earlier coverage of Senate scrutiny of Tether payments and stablecoin AML obligations highlights how US policymakers are increasingly focused on the role of dollar-pegged stablecoins in illicit finance. The Sihanoukville data, with its near-total reliance on USDT, will almost certainly feed into those discussions.
Accounting and Audit Considerations
For accounting firms and CFOs who service or audit digital asset businesses with Asia-Pacific exposure, the implications go beyond compliance policy.
Transaction classification and documentation
Any inflow or outflow that touches a counterparty in the Sihanoukville ecosystem, even indirectly, may need to be reclassified pending sanctions review. If a firm has booked revenue or settlement receipts from a counterparty that is subsequently identified as linked to a designated entity, the accounting treatment needs to be revisited: the asset may need to be written off, reported to OFAC, or blocked, depending on the specific facts and the timing of the designation.
Auditors reviewing clients with USDT settlement activity in Southeast Asia should request granular counterparty documentation at the wallet level, not just entity-level representations. Given the wallet rotation behaviour documented in the TRM report, entity-level due diligence is not sufficient on its own. The audit workpaper should capture the date of each screening check and the specific address sets screened, precisely because the attribution landscape changes.
For a broader view of how law enforcement is tracing and seizing crypto connected to organised crime networks, the parallel example of how Italian authorities traced and seized crypto tied to organised crime offers useful context on the investigative techniques being deployed globally.
Disclosure obligations
US-regulated entities that discover potential OFAC exposure must consider voluntary self-disclosure obligations and the potential need to block and report transactions. The window between a designation date and the discovery of linked transactions is increasingly compressed as OFAC's enforcement pace accelerates. Firms relying on periodic, rather than real-time, sanctions screening are carrying a gap that the Sihanoukville timeline makes visible: three casino entities received more than USD 320 million after their designation dates before the data window closed.
What to Watch Next
TRM has stated it continues to track Sihanoukville casinos and cash-out services as they adapt. Several variables will determine how the situation develops. Cambodia's willingness to enforce against casino operators who have political connections, not just the compounds themselves, will shape whether the broader casino sector contracts further. OFAC's next designation cycle, if it extends to additional casino entities or OTC operators, will test whether the market responds by pausing or simply rotating faster.
For stablecoin issuers specifically, the concentration of 99.9% of flows in USDT on TRON raises a question about issuer-level freezing capacity. Tether has demonstrated the technical ability to freeze addresses in response to law enforcement requests, but the Sihanoukville data suggests that a sufficiently distributed OTC network can continue to function even when specific addresses are frozen, by migrating to fresh ones before attribution catches up.
Compliance teams should follow updates from OFAC's Cambodia-related designation pages and the Justice Department's ongoing initiative, and should ensure that their digital asset accounting software pipelines are configured to ingest address updates as they are published rather than on a scheduled batch basis.
Frequently Asked Questions
Which entities were designated by OFAC in connection with Sihanoukville casinos?
On 23 April 2026, OFAC designated Senator Kok An and 28 related individuals and entities, including Huan Hai Bo Lai International Investment Co Ltd and Xihu Resort Hotel Co Ltd, for their roles in scam centre operations. In October 2025, OFAC had separately designated the Prince Group as a transnational criminal organisation, along with 146 related targets including Jin Bei Group.
How much crypto did these designated entities receive after the sanction dates?
According to TRM Labs data covering 23 April through 7 September 2026, entities attributed to the Xihu casino received USD 184 million and entities attributed to Huan Hai received USD 129 million after the April 2026 designation. A Jin Bei Group-linked casino received USD 9 million after the October 2025 Prince Group designation.
Why is USDT on TRON the dominant asset in these flows?
USDT on TRON offers low transaction fees, deep liquidity, and very wide adoption across Southeast Asia's informal financial networks. TRM observed that 99.9% of 2026 crypto inflows to Sihanoukville casinos used USDT on TRON, and every crypto-to-cash exchange it monitored in the city settled in USDT.
Why does wallet rotation undermine standard sanctions screening?
Casino operators frequently move to new wallet addresses, which means that a screened address today may no longer be the active receiving address tomorrow. Compliance systems that rely on a static list of attributed or sanctioned addresses will miss transactions routed through newly created wallets serving the same beneficial owner. TRM notes that its own figures likely undercount real activity for this reason.
What should accounting and compliance teams do now?
Teams should expand screening to cover indirect exposure, including commercial entities, hotels, and exchange operators linked to Sihanoukville, rather than relying only on direct address matches. Transaction monitoring should flag behavioural patterns associated with informal USDT OTC flows. Accounting records should capture the date and scope of each sanctions screening check, and firms should ensure their crypto bookkeeping software ingests live OFAC address updates rather than relying on periodic batch imports.
Source: TRM Labs