FinCEN on October 5, 2026 withdrew two proposed rules that would have extended Bank Secrecy Act reporting requirements to self-custody wallet transactions and designated international crypto mixing as a primary money laundering concern under the USA PATRIOT Act. Deputy Director Jimmy L. Kirby sig...
"It's been a hard month for privacy and your right to use crypto. There's a bright spot...the underlying statutory authority to create new, similar bad rules remains." — Peter Van Valkenburgh, Executive Director, Coin Center
FinCEN on October 5, 2026 withdrew two proposed rules that would have extended Bank Secrecy Act reporting requirements to self-custody wallet transactions and designated international crypto mixing as a primary money laundering concern under the USA PATRIOT Act. Deputy Director Jimmy L. Kirby signed both notices, which are scheduled for Federal Register publication on October 6. The agency cited a July 2025 White House digital asset report affirming that "the Trump Administration supports the ability of lawful users of digital assets to privately transact on a public blockchain."
The withdrawal closes a regulatory chapter that began in December 2020, when Treasury first proposed the unhosted wallet rule under former Secretary Steven Mnuchin. The second proposal, targeting crypto mixers under Section 311 of the PATRIOT Act, followed in October 2023 during the Biden administration. Combined, the two rules would have required financial institutions to collect counterparty data on wallet transactions above $3,000, report those above $10,000, and file records on transactions routed through mixing protocols — including wallet addresses, transaction hashes, IP addresses, and customer identity data.
This report compares the U.S. approach with the European Union's MiCA framework and FATF Travel Rule implementation, which moved in the opposite direction — eliminating de minimis thresholds and extending reporting requirements to every crypto transfer regardless of size. The divergence creates a two-speed regulatory landscape for the $3 billion global self-custody wallet market and a privacy protocol sector that processed over $5 billion in shielded transactions through Railgun alone since 2021.
Unhosted Wallet Rule (RIN 1506-AB47). Proposed December 2020. Would have required banks and money services businesses (MSBs) to maintain records on customer transactions with self-custody wallets exceeding $3,000 and file Currency Transaction Reports (CTRs) for those above $10,000. Multiple transactions totaling over $10,000 within a 24-hour window would also have triggered reporting. The proposal extended existing Bank Secrecy Act obligations to counterparty identification for non-custodial wallet holders — effectively requiring exchanges to collect names, addresses, and wallet information on individuals who never opened accounts with them.
Treasury's semi-annual regulatory agenda listed this proposal as withdrawn on April 12, 2024, but no formal Federal Register notice was published until October 5, 2026.
Crypto Mixer Rule (RIN 1506-AB64). Proposed October 2023. Would have designated international convertible virtual currency (CVC) mixing as "a class of transactions of primary money laundering concern" under Section 311 of the USA PATRIOT Act. Financial institutions would have been required to report transactions routed through mixing protocols, including wallet addresses, transaction hashes, IP addresses, and customer identity records. The proposal defined mixing broadly enough to potentially encompass standard privacy features in DeFi protocols.
Both proposals attracted thousands of public comments. FinCEN received sustained opposition from Coin Center, the Electronic Frontier Foundation, blockchain developers, and compliance officers who argued the rules were technically unworkable and constitutionally problematic.
Both withdrawal notices reference the July 2025 report from the President's Working Group on Digital Asset Markets. The mixer withdrawal specifically quotes the report's language affirming the administration's support for private blockchain transactions by lawful users.
FinCEN's stated rationale for withdrawing the mixer rule centered on commenters' warnings that the proposal "defined mixing so broadly it could have a chilling effect on legitimate activity and place a large reporting burden on covered financial institutions." The unhosted wallet notice similarly acknowledged implementation concerns — critics had argued that exchanges lacked reliable mechanisms to verify counterparty identities for non-custodial wallets.
The withdrawals also follow a broader policy shift. OFAC removed Tornado Cash from its Specially Designated Nationals (SDN) list on March 21, 2025, after a federal appeals court ruled that immutable smart contracts cannot constitute "property" under sanctions law. The Treasury Department's March 2026 report to Congress acknowledged that crypto mixers "can be used for lawful privacy-protection purposes."
Coin Center called the withdrawals "a significant victory for financial privacy" in an October 5 post by Jason Somensatto, though Executive Director Peter Van Valkenburgh noted that the "underlying statutory authority to create new, similar bad rules remains."
The withdrawal arrives at a moment of recovery for the privacy protocol sector. Research from Cambridge University's Judge Business School, published in 2026, found that mixer-related transactions on Ethereum increased by 50% since their 2023 low — though they still constitute a negligible 0.006% of all Ethereum network transactions.
The market has restructured. Railgun now handles 71% of all mixer transaction volume, up from 13% in 2022. Tornado Cash accounts for approximately 25% of 2025 transactions. Privacy Pools, a newer protocol implementing compliance-friendly proof mechanisms, holds the remaining 5%.
Key volume data:
| Metric | Figure | Source | |--------|--------|--------| | Total mixer transactions (2025) | ~32,000 | Cambridge JBS | | Total mixer transactions (2024) | ~21,000 | Cambridge JBS | | Total mixer transactions (2023) | ~16,000 | Cambridge JBS | | Railgun cumulative shielded volume | $5 billion (since 2021) | Railgun protocol data | | Tornado Cash TVL (Dec. 2025) | >$1 billion | On-chain data | | Tornado Cash processed volume (2025) | ~$3.89 billion | Chain analysis |
The Cambridge researchers concluded that sanctions "primarily deterred compliant users while illicit actors adapted" — migrating first to alternative platforms, then to cross-chain bridges and decentralized exchanges. The 2022 OFAC sanctions on Tornado Cash initially reduced daily transactions by 97% on Tornado Classic and 91% on Tornado Nova. Recovery began before the March 2025 delisting, driven primarily by Railgun's growth.
Despite sanctions removal and the FinCEN withdrawal, regulatory risk has not disappeared for mixer operators. In August 2025, a Tornado Cash co-founder was convicted of operating an unlicensed money transmission business, though the jury deadlocked on more serious money laundering charges.
The U.S. withdrawal stands in contrast to the European Union's approach. MiCA (Markets in Crypto-Assets Regulation) became fully enforceable on July 1, 2026, after the transitional period ended with no extension. Self-custody wallets themselves remain outside MiCA's scope — non-custodial wallet providers are not classified as Crypto-Asset Service Providers (CASPs).
However, the EU's Transfer of Funds Regulation (TFR), which implements the FATF Travel Rule within the MiCA framework, takes a more aggressive approach than the withdrawn FinCEN proposals would have:
| Requirement | U.S. (Withdrawn Proposals) | EU (MiCA/TFR) | |------------|---------------------------|----------------| | Reporting threshold | $3,000 recordkeeping / $10,000 reporting | €0 — every transaction | | Self-custody verification | Proposed for >$10,000 | Required for >€1,000 | | Mixer designation | Withdrawn | Not specifically addressed, but AML obligations apply | | Data collected | Wallet addresses, TX hashes, IP, identity | Originator and beneficiary identity for all transfers | | Status | Withdrawn Oct. 2026 | Enforceable July 2026 |
The EU's zero-threshold approach requires licensed platforms to collect and transmit sender and recipient identifying information for every crypto transfer, regardless of size. For transfers to self-hosted wallets above €1,000, the originating platform must also verify that the customer controls the destination wallet.
Globally, 42 countries have operationalized the FATF Travel Rule. According to FATF's own assessment, 78% of member jurisdictions have legal frameworks in place, but only 42% demonstrate effective enforcement capabilities — suggesting a significant gap between policy and practice.
The U.S.-EU divergence creates operational complexity for global platforms. Exchanges serving both markets must maintain two compliance architectures: one respecting the U.S. privacy-permissive stance, another meeting the EU's comprehensive data collection requirements. This bifurcation may accelerate geographic fragmentation in crypto services.
The regulatory decisions affect a substantial and growing market. Global active crypto wallets exceeded 820 million in 2025, according to industry data. Of approximately 400 million global crypto users, an estimated 30 million practice self-custody, and only 10 million do so securely, according to hardware wallet manufacturer Ledger.
The global non-custodial wallet market is valued at approximately $3 billion, growing at a 25% compound annual growth rate. Hardware wallet sales are projected to reach $560 million in 2025, expanding at nearly 30% CAGR. Institutional wallet usage increased 51% year-over-year.
Non-custodial swap volumes rose over 340% year-over-year in early 2026, indicating strong demand for self-custody infrastructure. The Asia-Pacific region leads adoption with approximately 43% share (~350 million) of global crypto wallet users, followed by Europe (~140 million, up 12% year-over-year) and Africa (~75 million, nearly doubling in two years).
The FinCEN withdrawal removes a compliance cost that would have fallen disproportionately on smaller exchanges and MSBs that lacked the infrastructure to verify counterparty identities on non-custodial wallets. For hardware wallet manufacturers and self-custody software providers, the decision eliminates a regulatory overhang that had persisted since December 2020.
The withdrawal does not eliminate the legal basis for future action. FinCEN retains statutory authority under both the Bank Secrecy Act and the PATRIOT Act to propose similar rules. The October 5 notices explicitly state that FinCEN will "continue to track mixer use for illicit finance" and "may take appropriate steps in the future."
Van Valkenburgh's warning that "the underlying statutory authority to create new, similar bad rules remains" reflects a structural reality: administrative withdrawals are policy decisions by the current executive, not legislative changes. A future administration could repropose similar or more restrictive rules through the same notice-and-comment process.
Additional risk vectors include:
The FinCEN withdrawal marks the formal end of a six-year regulatory effort to extend Bank Secrecy Act reporting to self-custody wallets and privacy protocols. The practical effect is the removal of compliance uncertainty for U.S. exchanges and self-custody providers that had operated under threat of potentially unworkable counterparty identification requirements since 2020.
The action does not, however, resolve the global regulatory picture. The U.S. and EU have now adopted opposing frameworks for crypto privacy: one affirming the right to private transactions on public blockchains, the other imposing comprehensive identity disclosure at every transaction level. For the 820 million global wallet users and the platforms that serve them, the operative question is not whether privacy regulation will arrive, but which jurisdiction's model will set the standard.
FinCEN's own language provides the clearest signal: it will "take appropriate steps in the future." The door is not locked.