The U.S. Financial Crimes Enforcement Network on October 6 withdrew two proposed rules that would have imposed reporting requirements on crypto mixer transactions and self-custodied wallet transfers. The mixer rule, first proposed in 2023 under Section 311 of the USA PATRIOT Act, would have cost ...
"It's been a hard month for privacy and your right to use crypto. There's a bright spot." — Peter Van Valkenburgh, Executive Director, Coin Center
The U.S. Financial Crimes Enforcement Network on October 6 withdrew two proposed rules that would have imposed reporting requirements on crypto mixer transactions and self-custodied wallet transfers. The mixer rule, first proposed in 2023 under Section 311 of the USA PATRIOT Act, would have cost an estimated 15,000 financial institutions a combined 1.47 million compliance hours annually. The unhosted wallet rule, pending since December 2020, would have required banks and money services businesses to record self-custody wallet transactions above $3,000 and report those exceeding $10,000.
Neither rule ever took effect. Their withdrawal removes a six-year regulatory overhang — but leaves a policy landscape that is, by most measures, more confused than before. The Department of Justice continues to prosecute mixer developers under existing criminal statutes, even as Treasury acknowledges that mixing serves legitimate privacy purposes and the DOJ's own April 2025 memo declares an end to "regulation by prosecution" of digital assets. This report examines what was withdrawn, what remains, and what the contradictions mean for builders, institutions, and users.
Two distinct proposals were scrapped on October 6, both signed by Deputy Director Jimmy L. Kirby.
Proposal 1: International Convertible Virtual Currency Mixing (2023)
FinCEN had proposed designating international crypto mixing as a "class of transactions of primary money laundering concern" under Section 311 of the USA PATRIOT Act. The associated reporting rule would have required financial institutions to report wallet addresses, transaction hashes, IP addresses, and customer identity information whenever they "knew, suspected, or had reason to suspect" a transaction involved mixing within or involving a jurisdiction outside the United States.
The proposal's definition of mixing was broad. It encompassed pooling funds, coordinating transactions with code, splitting transfers, routing through single-use wallets, exchanging between crypto assets, and user-initiated delays. Industry commenters argued this definition could capture routine DeFi activity, cross-chain bridges, and standard privacy features embedded in wallet software.
Proposal 2: Unhosted Wallet Reporting (2020)
First proposed in the final weeks of the first Trump administration in December 2020, this rule would have required banks and money services businesses to maintain records on self-custody wallet transactions exceeding $3,000 and report those exceeding $10,000 to FinCEN, including counterparty details. The rule drew over 7,000 public comments during its initial comment period, the majority opposing it.
FinCEN cited the current Trump administration's "deregulatory agenda and ongoing efforts to ensure digital asset regulations are fit-for-purpose" as the basis for withdrawal. The agency noted that commenters warned the mixer rule "could have a chilling effect on legitimate activity" and would "place a large reporting burden on covered financial institutions."
FinCEN's own regulatory impact analysis quantified what the mixer rule would have imposed. Approximately 15,000 institutions — banks, credit unions, broker-dealers, and money services businesses — would have been required to file mixer-related reports. Each institution would have spent an average of 98 hours per year on compliance, totaling 1.47 million hours annually across the sector.
For context, that figure is roughly equivalent to 735 full-time compliance officers dedicated exclusively to mixer reporting. The cost estimate did not include technology upgrades required to identify mixing activity in real time, which compliance vendors had estimated would run into hundreds of millions of dollars industry-wide.
The unhosted wallet rule's compliance burden was never formally estimated by FinCEN, but the Blockchain Association and the Electronic Frontier Foundation argued during the 2020-2021 comment period that it would have been operationally infeasible for many smaller institutions to implement counterparty identification for self-custody transactions.
The withdrawals do not create a regulatory vacuum. Crypto money transmitters registered with FinCEN retain all existing obligations:
According to Van Valkenburgh at Coin Center, "the underlying statutory authority to create new, similar bad rules remains." Congress has not altered the USA PATRIOT Act provisions that authorized the mixer proposal, meaning a future administration could reinitiate the rulemaking process.
The withdrawal creates a visible tension between two arms of the executive branch.
On April 7, 2025, Deputy Attorney General Todd Blanche issued a memorandum directing federal prosecutors to cease pursuing "litigation or enforcement actions that have the effect of superimposing regulatory frameworks on digital assets." The memo announced the disbandment of the National Cryptocurrency Enforcement Team (NCET) and stated that "virtual currency exchanges, mixing and tumbling services, and offline wallet providers will not be targeted based on bad acts committed by end users" or for "unwitting violations of regulations."
Yet the DOJ's Southern District of New York continues to prosecute Tornado Cash co-founder Roman Storm on money laundering and sanctions conspiracy charges. A jury in August 2025 convicted Storm on one count of conspiring to operate an unlicensed money transmitting business but deadlocked on the more serious charges. Prosecutors sought a retrial for October 2026; U.S. District Judge Katherine Polk Failla pushed it to April 26, 2027, pending Storm's motion for acquittal.
The prosecution proceeds despite three contradictory developments:
The Crypto Council for Innovation described the situation as a "paradox" — one part of the government acknowledges the legitimacy of privacy technology while another part prosecutes its builders.
Despite the policy shift, the criminal justice system has produced a series of convictions and sentences that remain in force:
| Case | Outcome | Sentence | Date | |------|---------|----------|------| | Bitcoin Fog (Roman Sterlingov) | Convicted on money laundering conspiracy, unlicensed money transmission | 150 months (12.5 years) | Conviction upheld on appeal, Sept. 25, 2026 | | Samourai Wallet (Keonne Rodriguez) | Guilty plea to unlicensed money transmission conspiracy | 60 months (5 years), $250K fine | Sentenced Nov. 6, 2025 | | Samourai Wallet (William Lonergan Hill) | Guilty plea to unlicensed money transmission conspiracy | 48 months (4 years), $250K fine | Sentenced Nov. 19, 2025 | | Tornado Cash (Roman Storm) | Convicted on 1 count; hung jury on 2 counts | Retrial set for April 2027 | Partial verdict Aug. 2025 | | Tornado Cash (Roman Semenov) | Remains on OFAC SDN list | N/A | Protocol delisted March 2025; developer not delisted |
Samourai Wallet's operators pleaded guilty after prosecutors alleged the service processed over $237 million in criminal proceeds tied to drug trafficking, darknet marketplaces, fraud, and child exploitation material. Rodriguez and Hill agreed to forfeit just under $238 million combined.
Bitcoin Fog processed approximately 1.2 million bitcoin over its decade of operation, valued at roughly $400 million at the time of the transactions. The D.C. Circuit upheld Sterlingov's conviction on September 25, 2026, rejecting his jurisdictional challenge.
A notable wrinkle: during the Samourai Wallet prosecution, FinCEN internally communicated that because Samourai never took custody of user funds, it "likely did not qualify as a money services business." Defense attorneys for Storm have cited this communication. The DOJ has countered by citing the Bitcoin Fog appellate ruling as precedent supporting prosecution of non-custodial services.
The regulatory environment has reshaped the market for privacy-preserving crypto assets. As of 2026:
Monero (XMR): Delisted from 73 centralized exchanges, up from 51 in 2023. Remaining major venues include KuCoin, MEXC, Kraken (outside the European Economic Area), Gate.io, and TradeOgre. Monero's always-on privacy model, which offers no transparent transaction option, has made it incompatible with most compliance frameworks.
Zcash (ZEC): Remains listed on Coinbase and Robinhood. The SEC closed its investigation into the Zcash Foundation on January 14, 2026, with no enforcement action. Its optional privacy model — transactions can be either shielded or transparent — provides regulated entities a mechanism for selective disclosure.
EU regulation: Regulation (EU) 2024/1624, taking effect July 10, 2027, bars regulated crypto-asset service providers from offering accounts or services that anonymize transactions. This will force EU exchanges to delist or restrict privacy coins entirely, regardless of whether they offer optional transparency.
The geographic fragmentation is accelerating. U.S. policy is moving toward permitting privacy tools while EU regulation is moving to prohibit them, creating a bifurcated market for privacy-preserving assets.
Total inflows to crypto mixers across all blockchains peaked above $3 billion per quarter through 2021, fell to approximately $1 billion per quarter during 2023-2024, and climbed back toward $2.7 billion per quarter in 2025, according to chain analytics data.
Tornado Cash processed approximately $3.89 billion in 2025 despite the OFAC sanctions that were in effect until March of that year. After delisting, Tornado Cash's share of total mixing activity recovered to over 40% by Q4 2025, up from 16% when sanctions were imposed in August 2022. As of mid-2026, the protocol holds over $1 billion in total value locked.
Wasabi Wallet led mixers by value received in 2026 year-to-date, with Tornado Cash remaining the second-largest overall and the largest on Ethereum-based networks, processing between $10 million and $80 million in weekly inflows.
FinCEN withdrew both its 2023 crypto mixer reporting rule and its 2020 unhosted wallet rule on October 6, 2026. Neither had ever taken effect. The agency cited a combined compliance burden of 1.47 million hours annually for 15,000 institutions.
The DOJ continues prosecuting mixer developers under existing criminal statutes, with Sterlingov's 12.5-year sentence upheld on appeal in September 2026 and Storm's retrial set for April 2027.
The executive branch is sending contradictory signals. Treasury acknowledges legitimate uses for mixing. The DOJ Blanche memo says mixer services should not be targeted for end-user behavior. Yet SDNY prosecutors press forward with Storm's case.
The statutory authority to re-propose these rules remains intact. Congress has not amended the USA PATRIOT Act provisions underlying the mixer rule. A future administration could restart the rulemaking process.
Privacy coin markets continue fragmenting geographically. Monero has been delisted from 73 exchanges. Zcash retains access to U.S. platforms. EU regulations effective July 2027 will further restrict privacy-preserving assets in Europe.
Mixer volumes have recovered to pre-sanction levels, with total quarterly inflows approaching $2.7 billion by 2025 — suggesting that enforcement actions have had limited long-term impact on aggregate demand for transaction privacy.
The FinCEN withdrawal removes two rules that never applied but that cast a long shadow over institutional engagement with privacy-preserving technology. For banks and money services businesses, the practical change is minimal: existing SAR obligations remain, and the statutory hooks for future rulemaking are untouched.
The larger significance lies in what the withdrawal reveals about the state of U.S. crypto policy. Two agencies within the same administration hold functionally opposite positions on whether building a mixer constitutes legitimate software development or criminal facilitation. The DOJ's Blanche memo says one thing; SDNY's courtroom filings say another. The April 2027 Storm retrial will test whether that contradiction is sustainable.
For protocol builders and compliance teams, the operative question is not what the current rules say but which arm of the government will define the next set of rules — and when. Van Valkenburgh's warning remains the most durable takeaway: the authority to create "new, similar bad rules" has not been revoked. It has merely been shelved.