With AI Scams on the Rise, KuCoin Pins Hopes on ISO/IEC 42001

Conversations engineered to convince victims to send money can now be automated by criminals. In August, TRM Labs reported that criminal adoption of AI rose 40% over the previous year, with scammers embracing the technology more than any other type of offender.

AI is also used by crypto exchanges for fraud detection, market surveillance and the identification of suspicious activity. This sets up a two-sided security problem. The very technology that helps platforms catch threats can also help criminals make those threats bigger and more believable.

That is why ISO/IEC 42001:2023, the international standard for artificial intelligence management systems, matters. KuCoin is among the handful of early digital-asset platforms to hold the credential.

But is this something users should care about? AI is good at many things, yet it may also mark a legitimate transaction as suspicious or respond to a support request with a wrong answer. AI management certifications help ensure an exchange can review such outcomes and correct mistakes.

How AI Is Infiltrating Crypto Crime

TRM's AI-in-Crime Adoption Index gives criminals an AI adoption score of 54 out of 100 for 2026, against 28 in 2024. The index measures the extent of criminal AI use, and scams alone rank as Mature.

🤖 TRM Labs' new AI-in-Crime Adoption Index puts overall AI adoption across crypto crime at 54 out of 100 in 2026, up from 28 in 2024.

So far, scams are the only crime type to reach a Mature level of AI adoption. AI's role in scam reports has grown roughly 13x since 2022, and…

— TRM Labs (@trmlabs) August 24, 2026

TRM also counted 201 crypto hacks in the first half of 2026, more than double the prior year's tally. Just 4% of incidents produced 75% of total losses, and most large breaches came from infrastructure compromises.

That lopsided loss distribution helps explain why access controls remain such a key part of exchange security. AI-powered monitoring is still dependent on the integrity of the systems it observes and of the accounts with permission to alter them.

Where Europe's AI Regulation Stops Short

European regulation does set out some AI oversight requirements, but their scope depends on how a system is employed. The Digital Omnibus on AI went into effect on July 27 and moved obligations for Annex III high-risk systems to December 2, 2027.

Annex III covers credit-scoring systems but specifically excludes financial-fraud detection. That means an exchange's transaction-monitoring software is not automatically subject to the same high-risk rules. A case-by-case assessment based on the specific use is needed.

Additional duties are still in force. Since August 2, AI transparency rules have required providers of systems meant to interact directly with people to inform users that they are dealing with AI, unless it is obvious. Chatbots used for customer service are included.

Voluntary certification offers an exchange a framework within which to supervise its AI. It does not stand in for applicable financial regulation or data-protection obligations.

ISO/IEC 42001 turns these ideas into a management-system framework. The framework demands that companies set up, apply, sustain and steadily upgrade the rules and procedures controlling their AI systems.

The Scope of KuCoin's Certification

KuCoin says the certification spans its AI management system and the organizational functions that support it. Fraud detection and market surveillance are named in the announcement as examples of AI use in digital finance.

“AI is becoming a foundational capability of digital financial infrastructure, but greater capability must be matched by greater responsibility,” BC Wong, chief executive of KuCoin, said in the company's announcement.

The assessment extends the exchange's external assurances to cover AI oversight. SOC 2 Type II reports evaluate controls over a period. Other certifications deal with protecting information or managing privacy, while business-continuity certification focuses on readiness for disruptions.

ISO/IEC 42001 is concerned with how an organization manages AI over its lifetime. Allocating responsibility and monitoring performance are part of that. Auditors are given a set of requirements by the standard when assessing these processes.

A company is expected to define what its AI is intended to do and think through possible impacts on people. It also must have a procedure for reviewing changes, since altering a model after the initial assessment can change how it behaves.

The certification also forms part of KuCoin's broader $2 billion Trust Project, a multi-year program launched in 2025 to strengthen security, compliance, transparency, user protection and operational resilience.

What KuCoin's ISO Badge Implies for What Comes Next

ISO/IEC 42001 certification is no guarantee that any particular model will always reach the right conclusion. The value is in verifying that an organization has built the processes for managing AI systematically.

For users and institutional clients who are evaluating a platform, that invites a set of more practical questions. Who bears responsibility for an AI system? Who can overrule an automated decision? What process is used to review model changes? How are mistakes recorded and corrected? And how can users challenge a decision that affects them?

As crypto platforms evolve from AI-assisted analysis toward greater autonomy, these questions will matter more. Future systems might not just flag suspicious transactions or condense market information; they could launch workflows, manage permissions or take actions on a user's behalf.

In that setting, trusted AI will depend on clearly defined identities, permissions, transaction caps, human-intervention mechanisms and auditable records.