On October 5, 2026, FinCEN withdrew two proposed rules that would have imposed reporting requirements on crypto mixing and self-hosted wallet transactions above $10,000. The withdrawal formally ended six years of regulatory limbo around crypto privacy enforcement in the United States. Simultaneou...
"The Trump Administration supports the ability of lawful users of digital assets to privately transact on a public blockchain." — FinCEN Deputy Director Jimmy L. Kirby, Federal Register withdrawal notice, October 6, 2026
On October 5, 2026, FinCEN withdrew two proposed rules that would have imposed reporting requirements on crypto mixing and self-hosted wallet transactions above $10,000. The withdrawal formally ended six years of regulatory limbo around crypto privacy enforcement in the United States. Simultaneously, the European Union's Anti-Money Laundering Regulation (AMLR), which takes effect July 1, 2027, will ban EU-regulated crypto-asset service providers from handling anonymity-enhancing coins entirely and require enhanced due diligence on all self-hosted wallet transfers above €1,000.
The two largest regulatory jurisdictions in the world have now taken opposing positions on crypto privacy. The U.S. is deregulating mixing, removing wallet-reporting proposals, and permitting spot ETFs for privacy coins. The EU is banning privacy coins from regulated platforms, standing up a new enforcement authority, and extending Travel Rule requirements across all crypto transfers. The divergence has immediate consequences for capital flows, exchange operations, and the $35 billion privacy coin sector.
FinCEN Deputy Director Jimmy L. Kirby signed two withdrawal notices published in the Federal Register on October 6, 2026. Both proposals had been pending for years without finalization.
Proposal 1: CVC Mixing as Primary Money Laundering Concern (2023)
Originally published in October 2023 under Section 311 of the USA PATRIOT Act, this rule would have designated international convertible virtual currency (CVC) mixing as a "primary money laundering concern." Had it been finalized, covered financial institutions would have been required to report mixing-linked transactions involving foreign jurisdictions, including wallet addresses, transaction hashes, and IP addresses. Identity records on customers involved in flagged transactions would have been mandatory.
FinCEN cited public comments warning that the rule's broad definition of "mixing" could capture legitimate privacy activity. The agency referenced the July 2025 report from the President's Working Group on Digital Asset Markets, which stated: "Lawful users of digital assets may leverage mixers to enable financial privacy when transacting through public blockchains."
Proposal 2: Unhosted Wallet Reporting (2020)
This rule, originally proposed in December 2020 during the final weeks of the first Trump administration, would have required banks and money services businesses to file Currency Transaction Reports on crypto transfers exceeding $10,000 to or from self-hosted wallets. Recordkeeping obligations would have applied to transfers above $3,000. The proposal would have extended the Bank Secrecy Act's existing cash-reporting framework to cover peer-to-peer crypto transactions — a significant expansion of surveillance infrastructure.
FinCEN cited the current administration's "deregulatory agenda" and the concern that reporting requirements would create a "chilling effect on legitimate activity."
Neither proposal had been finalized, so the withdrawals do not change existing Bank Secrecy Act or anti-money-laundering obligations for regulated entities. Covered crypto businesses remain subject to Suspicious Activity Report filing requirements, customer identification programs, and all existing AML controls. FinCEN stated it "will continue to monitor activity involving CVC mixers" and may revisit the issue.
The withdrawals are the latest in a sequence of U.S. policy moves that have, collectively, removed the enforcement overhang from crypto privacy:
November 2024: The Fifth Circuit Court of Appeals ruled unanimously that the Treasury Department exceeded its authority by sanctioning Tornado Cash's immutable smart contracts, holding that the software did not constitute "property" under the International Emergency Economic Powers Act.
March 2025: OFAC removed Tornado Cash from its Specially Designated Nationals list, following the court ruling.
June 2025: The Eleventh Circuit dismissed the Coin Center lawsuit against OFAC as moot, after the sanctions removal.
July 2025: The President's Working Group on Digital Asset Markets published its digital assets report, explicitly acknowledging legitimate uses for crypto mixers.
August 2026: The SEC concluded an investigation into Zcash without enforcement action, removing regulatory uncertainty from the largest privacy coin. Grayscale launched the first U.S. spot Zcash ETF (ZCSH) on NYSE Arca on August 25.
October 5, 2026: FinCEN withdrew both privacy-related proposals.
October 6, 2026: Winklevoss Asset Services filed for a second spot Zcash ETF (ticker: WINK) at a 0.25% fee, one-tenth of Grayscale's 2.50%.
The trajectory is clear: from attempted prohibition in 2022-2023 (Tornado Cash sanctions, the mixing NPRM) to active accommodation in 2025-2026 (sanctions removal, ETF approvals, rule withdrawals). The shift reflects a broader reorientation in Washington's crypto posture, where privacy is treated as a feature rather than an indicator of illicit intent.
The European Union is moving in the opposite direction. The Anti-Money Laundering Regulation (AMLR), formally adopted in May 2024, takes effect July 1, 2027 and imposes three constraints that directly conflict with U.S. policy:
1. Anonymity-Enhancing Coin Ban
From July 1, 2027, EU credit institutions, financial institutions, and crypto-asset service providers (CASPs) may not maintain accounts that "allow anonymisation or increased obfuscation of transactions, including through anonymity-enhancing coins." The language effectively forces EU-regulated exchanges to delist tokens such as Monero (XMR), Zcash (ZEC), Dash, and others with built-in privacy features.
The ban does not criminalize personal possession or self-custody of privacy coins. Individuals within the EU can still hold, transact, and mine privacy coins using non-custodial wallets. The prohibition applies to regulated intermediaries — exchanges, custodians, and lending platforms.
2. Self-Hosted Wallet Due Diligence
Under the recast Transfer of Funds Regulation, CASPs must ensure every crypto-asset transfer is accompanied by verified information about both the sender and recipient. For transfers involving self-hosted wallets above €1,000, enhanced due diligence procedures are required. This stands in contrast to the U.S., which just withdrew its $10,000 reporting threshold proposal entirely.
3. AMLA Direct Supervision
The Anti-Money Laundering Authority (AMLA), headquartered in Frankfurt and operational since July 1, 2025, will begin selecting up to 40 high-risk, cross-border entities for direct supervision starting July 1, 2027. CASPs operating in six or more member states and exceeding thresholds of 20,000 customers per member state or €50 million in transaction volume will be candidates for selection. Direct supervision begins January 2028.
The combined effect: a U.S. investor can now buy a spot Zcash ETF on a regulated exchange, while a European exchange must remove Zcash from its platform within nine months.
The privacy coin sector has outperformed every other crypto segment in 2026, driven primarily by U.S. regulatory tailwinds.
| Asset | Price (Oct 6) | Market Cap | YTD Change | 24H Volume | |-------|--------------|------------|------------|------------| | ZEC | $1,366 | $24.1B | +2,496% | $991M | | XMR | $547 | $10.3B | ~+66% | $106M | | Privacy sector total | — | $35.0B | +205% (5-month) | — |
ZEC's rally from $52 to $1,366 in 2026 elevated it from 82nd to 7th by market capitalization. The token is a statistical outlier: only 25 of the 200 largest crypto assets by market cap are positive year-to-date, with a median decline of 55%, according to KuCoin research.
Institutional catalysts are identifiable. Grayscale's ZCSH ETF accumulated $751 million in AUM within six weeks of its August 25 launch, peaking at $979 million in September. DCG executed a $100 million ZEC-to-ZCSH swap on September 8. The Winklevoss filing on October 6 adds a third U.S. issuer to the Zcash ETF field, alongside Grayscale and Bitwise. Winklevoss Capital indicated nonbinding interest in purchasing up to $100 million of shares at launch.
On-chain privacy adoption metrics reinforce the narrative. Shielded transactions reached 59.3% of total Zcash activity in February 2026, up from approximately 30% at the start of 2025. Some 5.15 million ZEC (31% of circulating supply) now sits in shielded pools, up from roughly 8% in early 2025.
The EU ban creates a structural question: where will European-held privacy coin liquidity migrate? Self-custody is not prohibited. Peer-to-peer and decentralized exchange activity in the EU may increase, but regulated on-ramps and off-ramps will disappear. The practical effect may be to push European privacy coin activity off regulated platforms without reducing overall usage.
The FinCEN withdrawal and the Tornado Cash sanctions reversal align in direction, but the criminal prosecution of Tornado Cash developers continues on a separate track.
Roman Storm, Tornado Cash co-founder, was convicted in August 2025 on one count — conspiracy to operate an unlicensed money-transmitting business (maximum five years). The jury deadlocked on two additional charges: conspiracy to commit money laundering and conspiracy to violate sanctions (each carrying up to 20 years). Prosecutors have sought a retrial, now scheduled for April 26, 2027.
The divergence is significant. The executive branch has removed Tornado Cash from the sanctions list, withdrawn the administrative rule that would have classified mixing as a primary money-laundering concern, and acknowledged legitimate mixer uses. Yet the Department of Justice is pursuing a retrial on the unresolved charges against a mixer developer.
This gap illustrates that the U.S. policy shift is primarily administrative, not legislative. Congress has not passed a law legalizing mixing or establishing a safe harbor for privacy protocol developers. The accommodations can be reversed by a future administration. Existing anti-money-laundering statutes remain available to prosecutors, and FinCEN explicitly preserved its ability to revisit the mixing question.
For exchanges operating across both jurisdictions, the divergence creates immediate compliance complexity.
U.S.-only exchanges (Coinbase, Gemini, Kraken domestically) face a lighter privacy compliance environment. No new reporting obligations for self-hosted wallet transfers. No ban on listing privacy coins. In fact, the market signal is to expand privacy coin offerings — Gemini is positioning as custodian for the WINK Zcash ETF.
EU-regulated exchanges face a July 1, 2027 deadline to remove anonymity-enhancing coins. Platforms with MiCA authorization — a requirement since July 1, 2026, for all CASPs serving EU customers — must build compliance processes for enhanced due diligence on self-hosted wallet transfers above €1,000 and implement the Travel Rule across all crypto transfers.
Multi-jurisdictional exchanges (Binance, Kraken globally, OKX) will likely geo-fence privacy coin access. EU-domiciled users will lose access to ZEC, XMR, and similar assets on regulated platforms. U.S. users may gain expanded access. The operational cost of maintaining parallel product catalogs across regulatory jurisdictions adds overhead but is technically straightforward — exchanges already geo-fence derivatives products, leveraged trading, and specific tokens by jurisdiction.
DeFi protocols are largely unaffected by either regime in the short term. The FinCEN withdrawal did not address decentralized exchanges or cross-chain bridges. The EU AMLR applies to "obliged entities" — CASPs with authorization — not to autonomous smart contracts. However, the Storm retrial and ongoing Semenov indictment signal that developer liability for privacy-enabling code remains an open question regardless of administrative deregulation.
The U.S. and EU have arrived at opposite conclusions about the same technology. Washington has decided that on-chain privacy is a legitimate feature that existing AML frameworks can accommodate without new reporting mandates. Brussels has decided that anonymity-enhancing tools are incompatible with anti-money-laundering supervision and must be excluded from the regulated perimeter.
The capital markets are already responding. Privacy coin institutional products are proliferating in the U.S. while facing a delisting deadline in the EU. The practical effect is regulatory arbitrage at jurisdictional scale: assets that are ETF-eligible in New York will be prohibited on regulated platforms in Frankfurt.
Neither position is permanent. FinCEN preserved its authority to revisit the mixing question. The AMLR's anonymity ban may face legal challenges on proportionality grounds. The Storm retrial could establish precedent that reshapes developer liability for privacy tools regardless of the administrative stance.
What is measurable today: two regulatory frameworks, 180 degrees apart, governing the same $35 billion asset class.