Jung Min Lee v. Foris Dax, Inc., et al.

Opinion

JUNG MIN LEE, Case No. 24-cv-06194-WHO

Plaintiff, ORDER ADDRESSING MOTION FOR v. JUDGMENT ON THE PLEADINGS, DISCOVERY DISPUTES, MOTION TO FORIS DAX, INC., et al., STAY, AND MOTIONS TO SEAL Defendants. Re: Dkt. No. 137, 151, 160, 162, 163, 165,

167, 168, 170

Defendant Foris Dax, Inc. (d/b/a and hereinafter “Crypto.com”) moves for judgment on the pleadings on plaintiff Jung Min Lee’s (“Lee”) Unfair Competition Law (“UCL”) claim. Motion for Judgment on the Pleadings (“Mot.”) [Dkt. No. 137]. Lee claims that Crypto.com violated the Bank Secrecy Act (“BSA”) by failing to implement an adequate anti-money laundering (“AML”) program as a registered money services business, making it liable under the UCL for the community property stolen from Lee’s husband by scammers on Crypto.com’s platform. Second Amended Complaint (“SAC”) [Dkt. No. 84] ¶ 38; Opposition to Motion for Judgment on the Pleadings (“Oppo.”) [Dkt. No. 153] at 1–2. While the BSA is a valid predicate statute for the UCL’s unlawful prong, Crypto.com’s alleged AML failures did not cause Lee’s losses. Because the parties’ discovery disputes do not involve evidence that would cure these defects, I deny Lee’s requests for more discovery. Crypto.com’s motion for judgment on the pleadings is GRANTED. Its motion to stay discovery pending resolution of the pending motion is DENIED as moot. This case arises out of an interaction between Lee’s husband, Patz, and unknown scammers’ on Instagram regarding a purported “investment opportunity” in cryptocurrency.1 Mot. at 2. The scammers guided Patz to open an account on Crypto.com and to then withdraw almost a million dollars from his account at First Republic Bank to transfer to his Crypto.com account. Id. at 3. Patz told First Republic Bank and later Crypto.com (in a questionnaire) that the purpose of this withdrawal was an investment. Id. at 3-4; Oppo. at 4-5. Patz then transmitted the withdrawn funds through Crypto.com to the scammers’ wallet address in 13 transactions. Oppo. at 3-4. Lee filed the SAC on May 23, 2025, alleging a range of causes of action against Crypto.com, including several UCL claims. SAC. In my order on September 5, 2025, I dismissed all claims except for the UCL claim predicated on the BSA. Order Granting in Part and Denying in Part Crypto.Com Motion to Dismiss (“Order”) [Dkt. No. 115]. Crypto.com then moved for judgment on the pleadings on the remaining claim. See Mot. Lee opposed the motion and Crypto.com subsequently filed a reply. See generally Oppo.; Reply. I heard oral argument, stating in my tentative that I was inclined to grant the motion. Lee then raised two discovery disputes.2 See Dkt. Nos. 163, 167. Federal Rule of Civil Procedure (“FRCP”) 12(c) provides that “[a]fter the pleadings are closed—but early enough not to delay trial—a party may move for judgment on the pleadings.” Fed. R. Civ. Proc. 12(c). “Dismissal under Rule 12(c) is warranted when, taking the allegations in the complaint as true, the moving party is entitled to judgment as a matter of law.” Daewoo Elecs. Am. Inc. v. Opta Corp., 875 F.3d 1241, 1246 (9th Cir. 2017) (citation omitted). “[M]otions for judgment on the pleadings are functionally identical to Rule 12(b)(6) motions.” Webb v. Trader Joe’s Co., 999 F.3d 1196, 1201 (9th Cir. 2021) (internal quotation marks omitted) (citing United 1 I have previously relayed the facts of this case in detail and presume reader familiarity. See, e.g., 2025 WL 2578239, at *1–2; 2025 WL 1084794, at *1–2.

2 I address one of these disputes, relating to causation, in Section II of this Order. The other, relating to production issues, is now moot in light of this Order. There was also a request for a stay of the discovery period while the motion for judgment on the pleadings was decided. See Dkt. No. States ex rel. Cafasso v. Gen. Dynamics C4 Sys., Inc., 637 F.3d 1047, 1054 n.4 (9th Cir. 2011)). “[U]nder both rules, ‘a court must determine whether the facts alleged in the complaint, taken as true, entitle the plaintiff to a legal remedy.’” Chavez v. United States, 683 F.3d 1102, 1108 (9th Cir. 2012) (citation omitted). For both motions, dismissal may be based on either the lack of a cognizable legal theory or absence of sufficient facts alleged under a cognizable legal theory. Robertson v. Dean Witter Reynolds, Inc., 749 F. 2d 530, 534 (9th. Cir. 1984) (citation omitted). A plaintiff’s complaint must allege facts to state a claim for relief that is plausible on its face. See Ashcroft v. Iqbal, 556 U.S. 662, 677 (2009). A claim has “facial plausibility” when the party seeking relief “pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. Although the Court must accept as true the well-pled facts in a complaint, conclusory allegations of law and unwarranted inferences will not defeat an otherwise proper Rule 12(b)(6) motion. See Sprewell v. Golden State Warriors, 266 F.3d 979, 988 (9th Cir. 2001). “[A] plaintiff’s obligation to provide the ‘grounds’ of his ‘entitle[ment] to relief’ requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do. Factual allegations must be enough to raise a right to relief above the speculative level.” See Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (citations and footnote omitted). I. Motion for Judgment on the Pleadings California’s UCL prohibits “three varieties of unfair competition – acts or practices which are unlawful, or unfair, or fraudulent.” Cal. Bus. & Prof. Code § 17200; Cel-Tech Comms. Inc. v. L.A. Cellular Tel. Co., 20 Cal. 4th 163, 182 (1999). Each prong of the UCL “provides a separate and distinct theory of liability and an independent basis for relief.” Cappello v. Walmart Inc., 394 F. Supp. 3d 1015, 1018 (N.D. Cal. 2019) (internal quotation marks omitted). Lee’s remaining claim alleges a violation under the UCL’s “unlawful” prong. Oppo. at 1. A plaintiff must establish two elements to prevail under an unlawful prong claim: (i) the defendant engaged in “unlawful conduct” by violating a federal, state, or local statute; and (ii) the defendant’s unlawful Litig., No. C 08-02376 MHP, 2010 WL 3463491, at *6–7 (N.D. Cal. Sept. 1, 2010), aff'd, 464 F. App'x 651 (9th Cir. 2011). A. Bank Secrecy Act The BSA, 31 U.S.C. §§ 5311, et seq. and 12 U.S.C. §§ 1951, et seq., authorizes the Department of the Treasury to impose reporting and other requirements on financial institutions and other businesses to help detect and prevent money laundering. The purpose of the BSA is to: (1) require certain reports or records that are highly useful in— (A) criminal, tax, or regulatory investigations, risk assessments, or proceedings; or (B) intelligence or counterintelligence activities, including analysis, to protect against terrorism; (2) prevent the laundering of money and the financing of terrorism through the establishment by financial institutions of reasonably designed risk-based programs to combat money laundering and the financing of terrorism; [and] (3) facilitate the tracking of money that has been sourced through criminal activity or is intended to promote criminal or terrorist activity[.] 31 U.S.C § 5311. These regulations are enforced by the Financial Crimes Enforcement Network under 31 C.F.R Subpart B, Chapter X. Under these regulations, money services businesses must “develop, implement, and maintain an effective anti-money laundering program . . . reasonably designed to prevent the money services business from being used to facilitate money laundering and the financing of terrorist activities.” 31 C.F.R. § 1022.210(a). Lee plausibly alleges that Crypto.com violated the AML provisions of the BSA and uses these violations as the predicate “unlawful conduct” required for her UCL claim. Crypto.com’s arguments to the contrary lack merit. I have already rejected one of them, that the BSA cannot serve as a predicate offense because the UCL does not confer a private right of action. See Order Granting in Part and Denying in Part Crypto.Com Motion to Dismiss (“Order”) [Dkt. No. 115] at 17. Crypto.com also asserts that the BSA’s reporting requirements generate “no duty of care owed to customers” or other individuals. Repl. at 14–15. Lee’s UCL claim does not require that Crypto.com owed her or any customer a duty of care, however, only that Crypto.com violated the BSA and that violation caused Lee harm. See In re Actimmune Mktg. Litig., 2010 WL 3463491, at *6. Crypto.com’s citations to Lusk v. Kellogg (where a judge dismissed a negligence claim premised on the BSA because of “no duty of care”) and similar cases are inapposite as they only pertain to “free-standing” BSA negligence claims rather than the UCL. See Lusk v. Kellogg, No. SACV1100087JVSRNBX, 2011 WL 13225140, at *6 (C.D. Cal. Aug. 10, 2011) (“The Bank Secrecy Act creates neither a private right action nor any parallel duty to a bank customer.”). Finally, Crypto.com characterizes Lee’s loss as the result of theft rather than money laundering. Mot. at 7–8. The distinction between theft and money laundering is irrelevant to this analysis: even if the BSA was not intended to prevent theft, the UCL does not limit the type of harm caused to the interest protected by the predicate statute. See Rose v. Bank of Am., N.A., 57 Cal. 4th 390, 397 (2013) (“. . .by borrowing requirements from other statutes, the UCL does not serve as a mere enforcement mechanism . . . [It uses] other laws only to define what is “unlawful.’”). Lee successfully alleged the first element of an unlawful prong UCL claim. B. Causation The second element of an unlawful prong UCL claim requires “a causal connection between the harm suffered and the unlawful business activity.” Hall v. SeaWorld Ent., Inc., 747 F. App'x 449, 452 (9th Cir. 2018) (citation omitted). Courts have interpreted this causal connection element to require “but-for” causation. See Kwikset Corp. v. Superior Ct., 51 Cal. 4th 310, 326– 27 (2011); Daro v. Superior Ct., 151 Cal. App. 4th 1079, 1099 (2007) (citation modified). To establish but-for causation, the defendant’s conduct must have been a “substantial factor” in the plaintiff’s harm such that the conduct is “recognizable as having an appreciable effect in bringing it about.” Kumaraperu v. Feldsted, 237 Cal. App. 4th 60, 68 (2015) (citation omitted). Crypto.com makes three arguments that Lee has not shown a plausible causal connection between her economic losses and Crypto.com’s BSA violations, two of which have merit. 1. Law of the Case Doctrine Before I get to those arguments, Lee contends that Crypto.com’s arguments have been previously rejected by my prior decisions under the law of the case doctrine. Oppo. at 6–8; see 1 The law of the case doctrine “posits that when a court decides upon a rule of law, that 2 decision should continue to govern the same issues in subsequent stages in the same case.” 3 Arizona v. California, 460 U.S. 605, 618 (1983). An issue “must have been decided explicitly or 4 by necessary implication in the previous disposition” for the law of the case doctrine to apply. 5 United States v. Park Place Assocs., Ltd., 563 F.3d 907, 925 (9th Cir. 2009) (citation omitted). 6 My prior decisions in this case did not address the specific causation required for UCL standing, 7 requiring a distinct and more stringent test than the Article III standing that I assumed Lee had for 8 the purposes of the order. See Order at 5; Kwikset, 51 Cal. 4th 310 at 324. The law of the case 9 doctrine does not apply to the UCL causation issue. 10 2. BSA Compliance & Causal Chain 11 Crypto.com contends that Lee has failed to allege a sufficient causal connection to 12 establish a violation under the UCL. Mot. at 8-13. To establish standing under the UCL, “[t]here 13 must be a causal connection between the harm suffered and the unlawful business activity.” Daro 14 v. Superior Court, 151 Cal. App. 4th 1079, 1099 (2007). The “causal connection is broken when a 15 || complaining party would suffer the same harm whether or not a defendant complied with the law.” a 16 || Jd. 17 Crypto.com argues that the causal connection between “Crypto.com’s alleged regulatory Z 18 || violations and Plaintiff's injuries is clearly broken, as Plaintiff would have suffered the same harm 19 whether or not Crypto.com complied with the law.” Mot. at 12. It also maintains that “[p]roactive 20 theft policing is not the purpose of the BSA,” and that its “obligation under the BSA does not 21 extend to affirmatively investigating bad actors utilizing its platform in an effort to prevent harm 22 to its customers.” Jd. at 12-13. Because of this, Lee could not have alleged that Patz’s injuries 23 would have been prevented by its compliance with the BSA. /d. at 13. 24 Lee counters that the “SAC identifies specific, pre-transmission decision points at which 25 BSA compliance would have broken the causal chain.” Oppo. at 18. They include: 26 Pre-Deposit Wallet Screening. By January 14, 2023, the destination wallet had already interacted with a confirmed-criminal downstream 27 wallet; that downstream wallet had been confirmed criminal since 38 December 2022 (SAC {ff 217-218). ee

compliant transaction-monitoring system that cross-referenced destination wallets against commercially available blockchain- analytics data and available sanctions lists would have flagged the association before any funds ever left Crypto.com’s custody. (SAC ¶ 386). Travel Rule. The January 23, 2023 transfer crossed the Travel Rule’s $3,000 threshold. 31 C.F.R. § 1010.410(f). The destination was unhosted; no counterparty existed to provide beneficiary information. A BSA-compliant Crypto.com would have attempted to comply with the Travel Rule, escalated to enhanced due diligence and halted all transfers. (SAC ¶¶90, 220-224, 233.)

Post-Scam-Tag Screening. On January 25, 2023, while Crypto.com was actively transmitting Plaintiff’s funds, public scam tags were published on the destination wallet. (SAC ¶216.) A BSA-compliant AML program integrating blockchain analytics with transaction monitoring would have triggered an alert on the first transaction after January 25, and every subsequent transfer would have been flagged, held, and not executed. (SAC ¶226.)

The February 20 Whitelisting3 Dialogue. On February 20, 2023, Patz attempted to register a new wallet as a whitelisted address. During Crypto.com’s purported compliance questionnaire, Patz’s answers exhibited the indicia of elder financial exploitation and investment- fraud schemes that FinCEN had identified in its June 2022 EFE Advisory and that FinCEN later memorialized in its September 2023 Pig-Butchering Alert. (SAC ¶¶72-78, 184-189.) Under Crypto.com’s own prior protocol (the 24-hour hold it had eliminated) the whitelist registration process alone would have triggered an automatic hold and compliance review. (SAC ¶83.) Instead, Crypto.com ignored FinCEN guidance, failed to perform enhanced due diligence, and proceeded with the transfers. (SAC ¶¶184, 191.) Id. at 18–19. Lee contends that Crypto.com’s assertions are a double-edged sword. Id. at 19. “If Crypto.com did not know, its ignorance is the negligent failure to implement an effective AML program that the BSA itself penalizes.” Id. “If Crypto.com did know or was willfully blind,” Lee asserts that the “transmissions independently violated 18 U.S.C. § 1960(b)(1)(C), which categorically prohibits the transmissions of funds ‘known to the defendant to have been derived from a criminal offense or are intended to be used to promote or support unlawful activity.’” Id. (quoting 18 U.S.C. § 1960(b)(1)(C)). Lee concludes that the “causal mechanism’s outcome is identical regardless.” Id. at 20. While Lee describes several opportunities for Crypto.com to have intervened to prevent the cryptocurrency theft, she does not cite any statutory or regulatory provision requiring Crypto.com to take such action and invokes only language of general purpose in support of these claims. See 31 C.F.R. § 1022.210 (“Each money services business . . . shall develop, implement, and maintain an effective anti-money laundering program . . . that is reasonably designed to prevent the money services business from being used to facilitate money laundering”). The Travel Rule requires only that money transmitters send information about specified transactions to recipient financial institutions; compliance with the rule would not have required Crypto.com to halt the suspect transactions, only pass along the required information. 31 C.F.R. § 1010.410(f); IRM 4.26.9.13.6 (November 12, 2019) (IRS manual stating Travel Rule requires only information transmission). Lee’s remaining arguments lack any basis in statute and regulation; they do not show that BSA compliance would have prevented Lee’s losses. As Crypto.com could have acted fully in compliance with the BSA and still allowed the money to be transmitted to the scammers, Crypto.com’s BSA violations cannot have caused Lee’s harm. 3. Substantial Factor/RICO Cases Crypto.com second successful argument is that its purported failure to comply with the BSA cannot constitute a “substantial factor” in Lee’s losses and accordingly cannot establish a claim under the UCL. Mot. at 13–15. “[A] substantial factor in causing harm is a factor that a reasonable person would consider to have contributed to the harm. It must be more than a remote or trivial factor.” Troyk v. Farmers Grp., Inc., 171 Cal. App. 4th 1305, 1349 n.33 (2009). Crypto.com relies on a bevy of cases it believes supports its position. The ones that have dealt with this issue in the Racketeer Influenced and Corrupt Organizations (“RICO”) Act context are instructive. For example, in Reca v. Flashdot Ltd., plaintiffs alleged that “unknown hackers collectively stole millions of dollars’ worth of cryptocurrency from their digital wallets,” but ultimately chose to sue the entities and individuals operating the cryptocurrency platform rather than the bad actors. No. 1:24-cv-6316-GHW, 2026 WL 82702, at *1 (S.D.N.Y. Jan. 12, 2026). On the question of proximate causation, the court noted that plaintiffs’: “(1) injuries would not exist absent the bad actors’ initial theft of their cryptocurrency; (2) theory would require that the follow’ from Defendants’ alleged predicate acts.” Id. at *7. It also noted that numerous courts in the Second Circuit “held that concealment of the underlying illegal activity cannot be the proximate cause of a plaintiff’s injury because the plaintiff would have suffered the same injury from the underlying illegal activity regardless of whether the concealment occurred.” Id. (quoting Empire Merchants, LLC v. Reliable Churchill LLP, No. 16 Civ. 5226, 2017 WL 5559030 (E.D.N.Y. Mar. 16, 2017), aff’d 902 F.3d 112 (2d Cir. 2018). Finally, the court recognized that plaintiffs failed to allege that defendants were the but-for cause of their alleged injury, noting that the “but-for cause of [her] alleged loss of the ability to track their cryptocurrency [was] the bad actors’ theft in the first instance,” not the actions of defendants. Id. at *8–9. Similarly, in Licht v. Binance Holdings Ltd., the court considered a similar “pig butchering” scheme, wherein “scammers lure victims . . . [by] convinc[ing] [them] to invest money in supposedly safe and lucrative opportunities,” then disappear with the money. Civ. No. 24-10447-NMG, 2025 WL 625303, at *1 (D. Mass. Feb. 5, 2025). Plaintiffs sued two cryptocurrency companies after they were the victims of pig butchering schemes organized by unknown third parties. Id. Plaintiffs recognized that “[d]efendants were not themselves the ‘butcherers.’” Id. Instead, plaintiffs’ theory of causation was that defendants made it “easier for the scammers to launder plaintiffs’ cryptocurrency and cash it out.” Id. at *17. “If [defendants] had registered with FinCEN,” plaintiffs argued, “it would have been required to comply with the BSA,” which it believes would have required defendants to flag the scammers’ transactions as suspicious, freeze their accounts, and allow law enforcement to seize the cryptocurrency. Id. The court rejected plaintiffs’ theory, noting:

The cause of plaintiffs’ injury was a set of actions (pig butchering schemes) entirely distinct from the operation of Binance as an unlicensed, unregistered MTB (defrauding the United States), and even entirely distinct from putative money laundering. That Binance and Zhao, allegedly with the assistance of BAM, failed to comply with United States laws and, therefore, Binance.com offered a more convenient “cash out” point did not mean that the scammers necessarily would target plaintiffs, and plaintiffs’ inability to recover the stolen cryptocurrency because it was converted to fiat currency may have resulted from other, independent factors. Id. at 39. And in Watt v. OKCoin USA Inc., the plaintiffs alleged that defendant cryptocurrency companies “enabled . . . thieves to launder their cryptocurrency and render it untraceable.” No. 25-cv-00368-JSW, 2026 WL 880154, at *1 (N.D. Cal. Mar. 31, 2026) (White, J.). The Hon. Jeffrey S. White held that plaintiffs did not adequately plead their RICO claims, holding that “the proximate cause of an injury is a substantial factor in the sequence of responsible causation,” and “[s]ome direct relationship between the injury asserted and the injurious conduct is necessary.” Id. at *6 (quoting Oki Semiconductor Co. v. Wells Fargo Bank, Nat. Ass’n, 298 F.3d 768, 773 (9th Cir. 2002)). Applying this standard, Judge White reasoned that the proximate cause of plaintiffs’ injury here was analogous to that in Oki, and that the “proximate cause of Plaintiffs’ injury was not crypto laundering; it was theft.” Id. Lee attempts to distinguish the RICO line of cases in two ways. First, she highlights that the RICO statute requires a “strenuous direct-causation standard” as compared to the UCL’s “substantial factor” framework. Oppo. at 10; see Holmes v. Secs. Inv. Prot. Corp., 503 U.S. 258, 268 (1992) (RICO plaintiffs must “show[] that the defendant’s violation not only was a ‘but for’ cause of his injury, but was the proximate cause as well,” meaning “some direct relation between the injury asserted and the injurious conduct alleged.”). She maintains that “[n]o California court has ever applied that standard to a UCL claim,” and that the two standards “yield divergent outcomes in practice.” Id. at 11. In a similar vein, Lee contends that she would not have suffered any loss “had Crypto.com complied with the BSA, because a BSA-compliant Crypto.com would not have transmitted Plaintiff’s property to criminals in the first place.” Id. at 10. She states: Crypto.com was not downstream of any prior loss because there was no prior loss. Crypto.com was the exclusive on-ramp and off-ramp of the fraud itself: it took lawful custody of Plaintiff’s community- property funds from the Patz and Lee family’s bank account, converted to cryptocurrency, held those funds on its platform in its custody, and then transmitted the property in a single step to the criminals. The instant Crypto.com made each transfer off its platform—and only at that instant—the funds were lost forever. There was no intervening custodian, no antecedent theft, no need to allege downstream concealment. The act and the harm are one and the same; the fraud scheme culminated in Crypto.com’s money transmission itself. The causal chain is one link long, and Crypto.com is at both ends of it. Under California’s substantial-factor test, that is more than necessary to show causation, and it defeats Crypto.com’s speculative Id. at 12. Lee relies heavily on City & County of San Francisco v. Purdue Pharma L.P., 491 F. Supp. 3d 610 (N.D. Cal. 2020), to distinguish causation under the UCL and RICO statutes. There, the Hon. Charles R. Breyer dismissed RICO claims against a drug manufacturer for lack of proximate cause connecting them to the opioid crisis but sustained a UCL unlawful-prong claim based on controlled substance regulations. Id. at 654–58, 684–86. Lee argues that the “doctrinal point from Purdue Pharma is fatal to Crypto.com’s Motion: a federal regulatory regime designed to prevent harm before it occurs may serve as a UCL predicate even where the same conduct might fail RICO’s narrower direct-causation requirement.” Oppo. at 11. While there are different causation theories under the UCL and RICO statutes, the Reca, Licht, and Watt courts all rested their conclusions on but-for causation, a standard that Lee acknowledges controls. Reca, 2026 WL 82702, at *8–9; Licht, 2025 WL 625303, at *38–39; Watt, 2026 WL 880154, at *6–8; see Oppo. at 9 (“The California UCL’s Proposition 64 amendment requires that a private plaintiff have ‘lost money or property as a result of’ the unfair competition, a standard that California’s Supreme Court has construed as imposing simple ‘but for’ causation.”). Those courts recognized in their opinions that but-for causation was not met. See id. Lee’s causation argument also fails under the logic of Reca, Licht, and Watt. Oki Semiconductor Co. is also helpful. There, a Ninth Circuit panel held that a bank employee’s participation in money laundering to hide previously stolen property was not a “substantial factor” in the plaintiff’s losses because the employee provided only indirect support for the earlier theft. 298 F.3d 768, 774 (9th Cir. 2002). Lee attempts to distinguish Oki by pointing out that “Oki addressed post-theft laundering of already-stolen proceeds through a bank account, a scenario where the theft had already been completed independently of the bank’s conduct.” Oppo. at 12. Lee argues that in her case, “the theft was Crypto.com’s money transmission itself.” Id. Crypto.com’s decision to transfer Patz’s funds to the scammers could still constitute a “substantial factor” in her loss of money, as the theft had not yet occurred when Crypto.com intervened. Id. 1 than “indirect[] ... support” for the underlying crime. 298 F.3d at 774. Lee has not done that. 2 Oki Semiconductor and the RICO cases show the difficulty in holding a platform like Crypto.com 3 liable under a “substantial factor” theory where the plaintiff's losses were more directly 4 attributable to the actions of third parties. Crypto.com had no “actual knowledge” of the 5 underlying crime. Order at 12. Nor does Lee allege that Crypto.com’s allegedly deficient AML 6 practices were more severe or pervasive than those held not to be a substantial factor in the RICO 7 context. And, as explained below, the scammers’ and Patz’s conduct minimize Crypto.com’s 8 causal role. These factors obscure and diminish Crypto.com’s causal link to the theft and do not 9 support a “substantial factor” finding in this case.* 10 || I. | DISCOVERY DISPUTES 11 While this motion was pending, the parties filed a joint discovery dispute involving the a 12 || production of certain records that Lee argues show proof of liability and causation. Dkt. No. 167.

13 Lee contends that “Crypto.com detected this scam enterprise before Mr. Patz’s first transfer,” as

15 ” Td. at 1. 16

fd. When Patz reported the scam, 6 18 Crypto.com ensured that its “responsible team took the needed steps on [their] side to prevent ee 19 more people falling victim to this fraud scheme.” Jd. 20 ee

23 Lee maintains that these records are “direct evidence of both violation and causation,” as 24 “[mJaking fraud-induced payments when ignoring the presence of a fraud enterprise in one’s 25 payment system is a direct AML failure and a BSA violation.” Jd. (citing United States v. W. 26 27 4 Each of Crypto.com’s arguments just discussed is dispositive of the UCL unlawful prong claim because Lee cannot allege causation. As a result, it is unnecessary to address Crypto.com’s final 2g || argument that the scammers’ actions in sending and inducing the stolen cryptocurrency are superseding causes of Lee’s losses and preclude Crypto.com’s causal liability. Mot. at 16-17.

1 Union Co., NO. 1:17-cr-00011 (M.D. Pa. 2017)). She accordingly requested that Crypto.com 2 produce “customers’ transaction histories, reports, imvestigation files, and communications” on 3 June 2, 2026. Jd. She contends that Crypto.com produced native spreadsheets that “blanked or 4 redacted all the non-private wallet-address, deposit-address, and transaction-hash columns.” Jd. at 5 2. Redacting these “public blockchain identifiers,” she argues, “obscure[s] what Crypto.com knew 6 and when.” Jd. 7 At the parties’ meet-and-confer, Lee says that she asked “‘what these spreadsheets are and 8 how the population was complied,” but Crypto.com has failed to comply beyond stating that they 9 were “kept in the ordinary course of business.” Jd. She performed her own analysis of the

L |) ee 2. She requests that I order 12 Crypto.com to produce this information. /d. at 3. 13 Crypto.com responds by arguing that this dispute is a “distraction from the dispositive 14 issues before the Court and a last-ditch attempt to avoid dismissal.” Jd. In its view, “Plaintiff's 15 || submission both distorts and overstates the significance of what the production demonstrates and a 16 || rests on baseless assumptions, which Crypto.com has explained to Plaintiff’s counsel.” Jd. at 4. 17 || “Despite those discussions, Plaintiff has proceeded to treat context dependent data as definitive Z 18 || proof of liability and causation, absent any true understanding of the particulars of the 19 production.” Jd. 20 I agree with Crypto.com’s response. “[T]he presence of a wallet, transaction, or address in 21 a dataset [does not] establish that Crypto.com flagged or treated that item as scam-related.” The 22 documents cited do not establish that Crypto.com “identified, flagged or recognized specific 23 transactions as scam-related,” and “[t]here is no evidence of any vendor flags on the wallets to 24 which Patz directly transmitted funds that were known to Crypto.com at the time.” Jd. And even 25 if I accept Lee’s characterizations of the documents, they would not be material to the causation 26 issues discussed in this Order because the BSA does not impose liability for failing to prevent the 27 type of harm alleged; discovery into other customers’ transactions would not alter that legal 28 analysis.

In addition, it does not appear that the parties adequately met and conferred prior to the submission of the letter, the discovery requests are not proportional to the needs of the case and are overly burdensome. For all of those reasons, I deny Lee’s requests in the joint letter. The parties have filed a number of sealing requests. “Historically, courts have recognized a ‘general right to inspect and copy public records and documents, including judicial records and documents.’” Kamakana v. City & Cnty. of Honolulu, 447 F.3d 1172, 1178 (9th Cir. 2006) (quoting Nixon v. Warner Commc’ns, Inc., 435 U.S. 589, 597 & n.7 (1978)). Documents and information that are “more than tangentially related to the merits of a case” may only be sealed if there are “compelling reasons” to do so. Ctr. of Auto Safety v. Chrysler Grp., LLC, 809 F.3d 1092, 1101–02 (9th Cir. 2016). Plaintiff first provisionally filed under seal portions of her opposition covered by the Stipulated Protective Order as containing or referring to information designated as “Confidential” or “Highly Confidential – Attorneys’ Eyes Only.” See Dkt. No. 151 at 1. Crypto.com responded and narrowed its requests. See Dkt. No. 156. Crypto.com’s revised request is GRANTED. Each of the portions identified by Crypto.com contain information commercially sensitive to Crypto.com and relate to its internal processes and procedures regarding fraud detection and prevention strategies. Public disclosure could cause competitive harm, and district courts within the circuit have recognized that financial institutions’ “internal investigative processes and procedures in addressing fraud constitute compelling reasons that support sealing those documents in order to prevent and combat future fraud.” See In re Bank of Am. Cal. Unemployment Benefits Litig., No. 21MD2992-GPC(MSB), 2024 WL 4820704, at *4 (S.D. Cal. Nov. 12, 2024) (citing Soria v. U.S. Bank N.A., No. SACV 17-00603-CJC(KESx), 2019 WL 8167925, at *4 (C.D. Cal. Apr. 25, 2019)). Plaintiff also provisionally filed under seal her opposition to Crypto.com’s motion to stay discovery and the parties’ joint discovery dispute statement filed on June 12, 2026. See Dkt. No. 165. Crypto.com filed a declaration in support of the request to seal. See Dkt. No. 166. stay. See Dkt. No. 168. Because the information requested to be sealed supports Crypto.com’s motion to stay, which is not a dispositive motion, the “good cause” standard applies. See Kamakana v. City & Cnty. of Honolulu, 447 F.3d 1172, 1180 (9th Cir. 2006) (“A ‘good cause’ showing under Rule 26(c) will suffice to keep sealed records attached to non-dispositive motions.”). Crypto.com argues that the portions identified in its filings “reflect sensitive, non- public information, including internal alert classifications and dispositions, summaries of Crypto.com’s fraud-prevention policies and procedures, investigative case tracking systems, and third party consumer transactional data, communications, account activity, and associated identifiers.” Dkt. No. 168 at ¶ 6. The information requested to be sealed in both filings is GRANTED as Crypto.com has identified sufficient business-related reasons to seal the information under the good cause standard. Plaintiff finally provisionally filed under seal Exhibits 4–8 of the parties’ June 22, 2026 discovery dispute. See Dkt. No. 170. Crypto.com filed its declaration in support on June 29, 2026. See Dkt. No. 172. There, it noted that it is “evaluating whether certain portions may be de- designated as confidential,” but requests that the exhibits remain under seal in the meantime. Id. ¶ 7. It also argues that “legitimate private or public interests warrant sealing” under the “good cause” standard, as the discovery responses “reflect sensitive, non-public information, including summaries of Crypto.com’s fraud-prevention policies and procedures, investigative case tracking systems, and third party customer transactional data, communications, account activity, and associated identifiers.” Id. ¶ 11. The information requested to be sealed is GRANTED, subject to the de-designations determined by Crypto.com: it has identified sufficient business-related reasons to seal the information under the good cause standard. For the reasons described above, the motion for judgment on the pleadings is GRANTED. This is the fourth Order I have entered relating to the pleadings in this case (see Dkt. Nos. 59, 79, and 115) in the two years this case has been pending, and further amendment is not warranted. ] Judgment shall be entered in accordance with this Order.° 3 Dated: August 19, 2026 4 . 5 . Orrick 6 United States District Judge 7 8 9 10 1] a 12

13 14

15 16

Z 18 19 20 21 22 23 24 25 26 27 \Is This order renders moot the parties’ joint stipulations to modify the pretrial schedule, see Dkt. No. 176, and request to enlarge the time for Foris Dax to file a motion to retain confidentiality 28 designations, see Dkt. No. 179.