DOJ Reaches Resolutions Totaling $600 Million With Chinese Online Marketplace and US Payment Processor Relating to Sales of Illegal Pharmaceuticals; European Commission Also Imposes €550 Million Fine on Chinese Online Marketplace

On July 1, 2026, the U.S. Department of Justice (DOJ) announced that it had entered into non-prosecution agreements (NPAs) totaling $600 million with Alibaba Group Holding Limited (Alibaba) and a U.S.-based payment processor, AUS Merchant Services Inc. (AUS, subsidiary of the Ant Group and formerly known as Alipay US), relating to allegations that they violated the Federal Food, Drug, and Cosmetic Act (FDCA) by failing to “prevent merchants from selling and importing illegal pharmaceuticals, controlled substances, listed chemicals, and pill presses into the United States through the Alibaba.com and AliExpress.com e‑commerce platforms.”[1] Both Alibaba and AUS admitted to misdemeanor criminal violations of the FDCA, which are strict liability offenses that do not have a mens rea requirement.[2]

Notably, neither company was alleged to have sold prohibited products itself. Rather, both admitted responsibility for compliance program failures that permitted third-party merchants to use their platforms and payment rails to complete unlawful transactions. As Assistant Attorney General Brett A. Shumate stated, “[c]ompanies operating online marketplaces — whether based in the United States or abroad — must implement appropriate safeguards to prevent bad actors from exploiting their platforms. If they fail to do so, the Department will hold them accountable.”[3]

On July 19, 2026, the European Commission separately announced a €550 million ($629 million) fine on AliExpress, Alibaba’s business-to-consumer platform, for failing to diligently assess and mitigate the risks of illegal, unsafe, and counterfeit products on the platform in breach of the company’s obligations under the Digital Services Act (DSA). 

Summary of the DOJ Resolutions

The Alibaba NPA

Alibaba is a Chinese company that operates two of the world’s largest cross-border e-commerce marketplaces: Alibaba.com, a business-to-business platform, and AliExpress.com. The sales at issue, which comprised approximately 80,000 sales worth over $200 million, were made over a period of nine years from January 2016 to December 2024 by international third-party merchants to U.S. buyers. Alibaba “was not an importer of record in connection with the transactions that are the subject of th[e] resolution” and did not “take physical possession of goods.”[4]

Alibaba had compliance policies that restricted the sale of prohibited goods, including prohibitions on the sale and import of pharmaceuticals that were non-compliant with U.S. Food and Drug Administration (FDA) regulations. But DOJ alleged that the company’s implementation of those policies was inadequate and the company “failed to prevent some third-party sellers from circumventing controls and measures.”[5] For example, Alibaba provided merchants and buyers with a private, in-platform messaging service that some merchants used to facilitate unlawful transactions. Merchants and buyers used the messaging service to arrange the transactions and evade U.S. law, without ever posting the goods on Alibaba’s public platform. Alibaba had the ability to monitor the messaging platform and implemented monitoring at certain points, but “generally did not penalize merchants unless they publicly posted prohibited goods on the platform.”[6] Additionally, DOJ found that Alibaba employees raised concerns that the company’s compliance controls were inadequate and failed to prevent the sale and importation of illegal products, but Alibaba did not respond “proactive[ly]” to address these concerns. DOJ noted that, as part of the investigation, federal law enforcement made over 40 undercover purchases on the platforms.

The AUS NPA

AUS is a licensed money services businesses in the United States and is a subsidiary of the Ant Group. Beginning in 2020, AUS offered Alibaba processing and settlement services, which enabled international merchants to accept payments from U.S. buyers. Between January 2020 and December 2023, it accepted U.S.-dollar denominated payments through credit cards and wire transfers through U.S. bank accounts before transmitting the funds offshore for settlement on behalf of U.S. buyers. AUS would receive certain information about the transactions, including the merchant’s and buyer’s identities, as well as a description of the product ordered. The NPA recited the Bank Secrecy Act (BSA)/AML requirements applicable to AUS as a money services business, although the criminal violation cited by DOJ was a misdemeanor violation of the FDCA.

According to the NPA, AUS originally relied on its overseas affiliates to monitor transactions by U.S. buyers involving overseas merchants, but in 2022 AUS began using its own transaction monitoring system. However, the system failed to fully incorporate certain wire-transfer data. As a result, the system “did not always show that some of these wire transfer transactions were funded by payments originating from high-risk jurisdictions or from multiple payors on a single invoice.”[7] At times, AUS failed to prevent the facilitation of payments for the import of products in violation of the FDCA.

Additionally, DOJ noted that AUS failed to remove merchants with identified issues from the platform. Instead, AUS reported the merchants to Alibaba. The NPA describes one instance where AUS investigated and reported a merchant, but the merchant continued to sell prohibited products.

DOJ Penalties, Forfeitures, and Compliance Undertakings

Alibaba agreed to pay a criminal monetary penalty of $125 million and to forfeit $200 million. AUS agreed to pay a criminal monetary penalty of $85 million and to forfeit $190 million. Pursuant to the NPAs, both companies agreed to implement compliance measures and to ongoing compliance monitoring, reporting, and cooperation obligations, but no monitor was imposed on either company.

The compliance undertakings require, among other things, that each Alibaba e-commerce platform maintain or establish “effective, risk-based transaction monitoring systems capable of detecting conduct” that violates the Controlled Substances Act (CSA) and the FDCA. These systems must be evaluated “in light of the state of available commercial technology and existing industry practices and standards at the time of assessment.”[8] The NPA also requires Alibaba to “evaluate, periodically reassess, and, where appropriate, apply and expand its respective artificial intelligence-based technologies to prevent the sale and advertisement of products.”[9]

Under its NPA, AUS is required to enhance its BSA/AML program and must provide the government with quarterly reports listing all SARs filed and any credible allegations of FDCA or CSA violations by users of its payment services.[10] With respect to transaction monitoring, the NPA provides that AUS will:

The transaction monitoring program operated by AUS will be adaptive to identified risks, including risks identified internally by AUS, by regulators, and in written findings, including review of publicly available information and law enforcement referrals or inquiries. AUS will continue to ensure the transaction monitoring program is informed by its risk profile and appropriately accounts for the areas of greatest risk, with particular emphasis on higher-risk products, services, customers, and geographies.[11] 

In declining prosecution, DOJ cited the factors under DOJ’s new Corporate Enforcement Policy,[12] including both companies’ cooperation, remediation, absence of criminal history, and acceptance of responsibility.

European Commission Fine Under the Digital Services Act

As noted, on July 19, 2026, the European Commission fined AliExpress €550 million for breaching the Digital Services Act relating to the sale of illegal, unsafe, or counterfeit products.[13] Henna Virkkunen, the EU’s technology commissioner, noted that “[t]he spread of counterfeit clothing, unsafe toys, dangerous cosmetics and other illegal and harmful products is not an unavoidable cost of shopping online” and that “[s]cale is not an excuse; risks must be identified and addressed systematically to ensure consumers can safely shop online.”

The Commission found that AliExpress failed to “diligently assess risks” including by failing to properly evaluate whether it had “sufficient staff to review potentially illegal products” and inadequately assessing “how its recommender and advertising systems exacerbate the spread of illegal products.” The Commission’s testing showed that “many illegal products were recommended or advertised to consumers before they were effectively removed.” The Commission also found that AliExpress failed “to mitigate identified systemic risks,” and that its “system to detect illegal products did not work properly,” as many counterfeit or unsafe products were detected but “remained online for multiple weeks.” The Commission found that AliExpress allowed stores that sold illegal products to remain active on the platform and that its controls could be “easily circumvented” because sellers could mis-categorize products, which the company had insufficient staff and systems to identify. 

The fine reflected several factors, including that failing “to conduct proper risk assessments and to effectively mitigate systemic risks constitute particularly serious infringements of the DSA.”  However, the Commission cited the novelty of the DSA as a mitigating factor. 

Pursuant to the DSA, AliExpress has until October 20, 2026 to submit an action plan to the Commission that will “set out measures to remedy the breach of its obligations to assess and mitigate systemic risks.” The company has stated that is “firmly committed to meeting our obligations” and that it disagreed with the “disproportionate” fine.[14]

Key Takeaways

The DOJ and European Commission actions point to authorities’ heightened focus across jurisdictions on holding e-commerce platforms liable for third-party transactions that involve illegal or counterfeit products.

In the DOJ resolution against Alibaba, the focus was on the sale and importation of illegal pharmaceuticals and counterfeiting equipment, and the legal vehicle DOJ used was the FDCA’s criminal misdemeanor provisions, which rely on a strict liability standard.

Although Alibaba maintained procedures prohibiting the sale of these illegal products, DOJ held the company criminally liable for merchants’ circumvention of these procedures, in part because the company failed to take sufficient action to impose controls on the platforms’ private messaging functionality and to “proactive[ly]” respond to employee concerns that the controls were inadequate. Notably, in describing Alibaba’s required compliance undertakings, DOJ provided that Alibaba must maintain or implement “effective, risk-based transaction monitoring systems” — terminology usually associated with the BSA/AML regime applicable to financial institutions. While DOJ is signaling its expectation of greater compliance measures by e-commerce platforms, DOJ did not provide definitive guidance as to what types or level of compliance measures it considers sufficient. The European Commission’s fine also highlights that companies must be proactive in assessing the adequacy of their compliance programs and must mitigate identified risks systematically.

It is also notable that the compliance undertakings reflected in the Alibaba resolution reference the company’s use of AI to prevent the advertisement and sale of illegal products, further reinforcing this administration’s forward leaning approach to the integration of AI into compliance processes.

The Alibaba resolution follows DOJ’s prior civil resolution with e-Bay in January 2024 for selling pill presses on its platform. In that case, which was resolved for $59 million under the CSA, DOJ alleged that international third parties used the e-Bay marketplace to sell pill-making machines into the United States. DOJ alleged “that hundreds of eBay’s pill press buyers also purchased counterfeit molds, stamps, or dies, allowing them to produce pills that mimicked the products of legitimate pharmaceutical companies, and that many of eBay’s pill press buyers have been successfully prosecuted in connection with trafficking illegal counterfeit pills.”[15] DOJ stated “Fentanyl — pressed into fake pills that look like real prescription medications — is killing Americans. Drug traffickers buy the tools to make fake pills, like pill presses, online. … eBay and other e-commerce platforms must do their part to protect the public.”

The DOJ AUS resolution underscores that DOJ will hold money transmitters liable for activity that results from their partnerships with e-commerce platforms. Here, DOJ held AUS liable for the payments that flowed through its platform even though Alibaba likely had greater visibility into the specific products at issue. Furthermore, the AUS resolution demonstrates that DOJ may pursue theories against a money transmitter separately from BSA/AML charges. While the NPA recited the applicable BSA requirements and described compliance issues (here, failing to incorporate certain information in transaction monitoring) that would normally be cited, at most, in a civil BSA resolution, the DOJ did not bring charges under the BSA and instead relied on the FDCA, demonstrating the wider set of laws money services businesses must consider in developing and enhancing their compliance systems over time.  

The European Commission’s resolution with AliExpress underscores the global nature of this enforcement focus on online marketplaces. Under the novel DSA regime, the Commission can impose significant fines for risk assessment and compliance failures and has demonstrated in this and other actions that it will hold online platforms to high expectations.[16]