EU slaps AliExpress with record $625M DSA fine for counterfeit and safety failures

The European Commission just delivered a very blunt message to AliExpress: under the EU's Digital Services Act, “we’re working on it” is not an excuse when counterfeit and unsafe products keep slipping through. Yesterday, the EU slapped AliExpress with the largest fine yet under the DSA, exceeding $625 million. The size matters because it changes what boards and compliance teams treat as the real downside of platform enforcement failures, not just the paper downside.

In the EC’s own framing, AliExpress failed to “diligently assess and mitigate risks relating to the sale of illegal, unsafe, or counterfeit products on its e-commerce platform.” That is the core finding. It was not only a risk assessment problem. The Commission also said AliExpress did not staff teams dedicated to removing counterfeit and dangerous items, and that the platform made it easier for bad actors to evade detection. In other words, the issue was both operational and design-level: not enough people to catch and remove, and not enough friction to prevent repeat offenders.

To understand why this lands like a financial shockwave, you have to know what the DSA is trying to do. The Digital Services Act is meant to shift large online marketplaces from a reactive posture to a proactive one. It pushes platforms to identify systemic risks, build processes to reduce them, and prove that their mitigation is real, not aspirational. When the Commission can cite both missing staffing and weak evasion resistance, it is basically saying: you did not just fail in isolated cases, you failed the system you were supposed to run.

This particular fine also highlights a regulatory shift executives should clock quickly. The EU is not just punishing outcomes like “counterfeits existed.” It is explicitly focused on diligence and mitigation. The EC alleges AliExpress did not “diligently assess” the relevant risks. That word matters. Regulators generally prefer standards that are hard to game, because outcomes can be obscured by fraud complexity, listing volumes, and actor sophistication. Diligence, meanwhile, points to governance: do you have the right resources, do you run the right monitoring, and do your tools make it difficult for bad actors to stay hidden.

The operational details in the Commission’s account make the second-order implications pretty clear for boards. The press release states AliExpress failed to staff teams dedicated to removing counterfeit and dangerous items. That is a direct hit on resourcing, and resourcing is a budget item most boards control. It also says AliExpress made it easy for bad actors to evade detection. That suggests platform design and enforcement engineering, not just policy documents. When a regulator ties a multi hundred million dollar penalty to both staffing and evasive behavior, it effectively widens the liability surface for executive accountability. Compliance is no longer only legal. It becomes product, trust and safety, and engineering.

There is also a capital and risk-modeling angle here. A record DSA fine means the enforcement bar has teeth, and that influences how companies price regulatory risk. If you are a CFO or board member at a marketplace, you have to think in terms of “regulatory exposure per failure mode,” not just “fine events.” The Commission’s approach signals that if a platform cannot demonstrate it has built mitigation systems that work, the penalty may escalate to the level of a major financial line item. That forces more rigorous investment tradeoffs, because under-investing in counterfeits and unsafe products enforcement is now plausibly a nine-figure mistake.

For peers, this is the part to absorb fast. The DSA is rolling across the EU, and this is the kind of headline that regulators will cite as precedent. Companies operating similar marketplaces should assume that enforcement scrutiny will converge on the same themes: do you assess risks tied to illegal, unsafe, or counterfeit goods; do you have dedicated teams that can remove them; and do your detection and controls resist evasion attempts. When the Commission can point to evasion being “easy,” it is also hinting that improved detection alone may not be enough if the system can be gamed quickly.

Bottom line: the European Commission’s fine for AliExpress exceeding $625 million is not just a big number. It is a roadmap for what the EU will consider a failure under the DSA: weak diligence, insufficient staffing, and enforcement systems that allow bad actors to slip past. If you lead a platform business, this should sharpen how you think about trust and safety as a measurable operating system, because regulators are clearly treating it like one.