The U.S. Treasury Department has published a 32-page report to Congress that may rank among the most consequential policy documents in crypto's regulatory history. Produced under Section 9 of the GENIUS Act — signed into law in July 2025 — the report formally acknowledges that crypto mixing servi...
"Lawful users of digital assets may leverage mixers to enable financial privacy when transacting through public blockchains." — U.S. Department of the Treasury, GENIUS Act Section 9 Congressional Report (March 2026)
The U.S. Treasury Department has published a 32-page report to Congress that may rank among the most consequential policy documents in crypto's regulatory history. Produced under Section 9 of the GENIUS Act — signed into law in July 2025 — the report formally acknowledges that crypto mixing services have legitimate privacy uses, recommends Congress create a "hold law" safe harbor for freezing suspicious digital assets, and urges legislators to define which DeFi actors should face anti-money-laundering obligations.
This is the same Treasury Department that sanctioned Tornado Cash in August 2022 and spent three years treating on-chain privacy tools as synonymous with illicit finance. The pivot is not subtle. It arrives against a backdrop of a privacy coin sector that has surged past $24 billion in market capitalization, a Monero all-time high near $800, and a European Union privacy-token ban scheduled for 2027. The message is clear: Washington is no longer trying to eliminate crypto privacy — it is trying to regulate it into a two-tier system of compliant and non-compliant actors.
For institutional investors, protocol builders, and compliance teams, this report redraws the boundaries of what is permissible on-chain. The implications extend far beyond mixers.
The report — titled under the GENIUS Act's illicit finance and innovation study mandate — was due January 14, 2026. It arrived roughly seven weeks late on March 5, suggesting internal deliberation over its framing. The delay itself is telling: this was not a box-checking exercise.
The document's core finding is that crypto mixers "may lawfully help shield personal, business, and charitable transactions from public view when paired with safeguards such as record-keeping and other compliance measures." This is the first time Treasury has framed mixing as a legitimate financial activity rather than a red flag.
But the report is not a blanket endorsement. It contains three specific legislative recommendations to Congress:
Enact a "hold law" — a digital-asset-specific statute giving financial institutions a safe harbor to temporarily freeze suspicious assets during short investigations. Treasury calls this "particularly useful for countering illicit finance involving permitted payment stablecoins."
Clarify AML/CFT obligations for DeFi — the report asks Congress to define which DeFi actors (front-ends, relayers, liquidity providers, governance token holders) should carry anti-money-laundering responsibilities "based on their roles and attendant risks."
Advance privacy-preserving digital identity tools — a nod toward zero-knowledge proof infrastructure that can verify compliance without exposing user data.
The report explicitly does not finalize or endorse FinCEN's 2023 proposed rulemaking on mixer-related recordkeeping. That proposal, which would have imposed blanket reporting requirements on mixer transactions, appears to be dead.
To understand the weight of this pivot, consider the timeline:
The arc from sanction to safe harbor took 43 months. The legal, judicial, and legislative branches each played a role — the courts constrained OFAC's overreach, Congress mandated the study through the GENIUS Act, and Treasury responded with a framework that implicitly concedes its 2022 approach was too blunt.
The report's most consequential structural idea is the implicit creation of a two-tier system for on-chain privacy:
Tier 1: Compliant privacy. Custodial mixing services and privacy protocols that implement record-keeping, report to FinCEN, and integrate identity verification (potentially via zero-knowledge proofs) would operate under a regulatory safe harbor. Treasury envisions these as legitimate financial infrastructure.
Tier 2: Non-compliant privacy. Fully non-custodial, permissionless mixing protocols — the Tornado Cashes of the world — would remain in a legal gray zone. Treasury stops short of recommending their prohibition, but the "hold law" proposal would give institutions tools to freeze assets that pass through them.
This framework has profound implications for protocol design. Projects like Railgun (approximately $800 million in TVL), Aztec Network ($1.2 billion in TVL), and Nocturne are already building compliant privacy layers that allow selective disclosure to auditors while shielding user data from public view. They are now positioned as the regulatory-preferred architecture for on-chain privacy.
The risk is regulatory capture: if only well-funded, compliance-friendly protocols survive, the permissionless ethos that built crypto's privacy tools may not.
The report includes original Treasury analysis that provides the most detailed government data yet on how mixing intersects with stablecoins and cross-chain bridges:
The laundering playbook is now well-documented: steal assets → mix through a privacy protocol → swap output into stablecoins via a bridge → convert to fiat. Treasury's data suggests that bridges — not mixers — are the weakest compliance link in the chain, a finding that may redirect regulatory attention.
The policy shift arrives during a historic rally in privacy-focused assets. The privacy coin sector surpassed $24 billion in total market capitalization in early 2026, driven by several converging forces:
But the rally's fragility is structural. Monero's price has proven violently cyclical — the January high-to-trough drawdown exceeded 60%. Zcash's institutional promise evaporated with its development team. And the EU's Anti-Money Laundering Regulation (AMLR), expected to prohibit privacy-token exchange listings before 2027, hangs over the entire sector.
Senior research analyst Jake Kennis of Nansen notes that capital is now flowing beyond simple privacy coins: "Capital is flowing to projects like Railgun, Nocturne, Zama, Aleo, and Nillion, targeting compliant privacy for tokenization, payments, trade finance, and custody rather than just the most liquid privacy coins. There is a large playing field here for this sector and a path to grow."
The Treasury report's recommendation to "advance privacy-preserving digital identity tools" is a direct signal to the zero-knowledge proof (ZKP) ecosystem. In 2026, ZKP infrastructure has graduated from experimental Web3 projects to foundational enterprise technology:
The economic value proposition is clear: ZKP infrastructure enables institutions to use public, low-cost blockchain rails while meeting compliance obligations. This is not privacy for privacy's sake — it is privacy as a prerequisite for institutional adoption. Without it, the tokenization of trillions in real-world assets cannot proceed on public chains, because no bank will place client positions on a ledger that competitors can read.
Treasury has formally acknowledged crypto mixers as legitimate privacy tools — a 180-degree reversal from its 2022 Tornado Cash sanctions. The GENIUS Act Section 9 report recommends a regulatory framework rather than prohibition.
A two-tier privacy system is emerging. Compliant privacy protocols with record-keeping and selective disclosure capabilities will operate under safe harbor; fully permissionless mixers will face friction from the proposed "hold law."
Bridges, not mixers, are the primary compliance gap. Treasury's data shows $1.6 billion in mixed funds flowed into bridges, with $900 million concentrated in a single venue linked to North Korean laundering.
The privacy coin boom is real but fragile. A $24 billion sector driven by Monero's all-time high and EU tax reporting rules faces existential risk from the EU's 2027 privacy-token exchange ban.
Zero-knowledge proof infrastructure is the institutional winner. The Treasury's endorsement of "privacy-preserving digital identity tools" validates projects building compliant privacy for tokenization, custody, and settlement.
The Roman Storm case remains unresolved. A split verdict and pending appeal mean developer liability for privacy tools is still legally undefined — a risk factor for every protocol builder in the space.
The Treasury's March 2026 report marks the end of Washington's war on crypto privacy and the beginning of its regulation. The distinction matters enormously. A prohibition stance — exemplified by the 2022 Tornado Cash sanctions — pushed privacy innovation offshore, criminalized legitimate use cases, and was ultimately overturned by the courts. The new approach accepts that financial privacy on transparent blockchains is a design requirement, not a criminal act.
But this is not a victory for cypherpunks. The two-tier framework favors well-capitalized, compliance-ready protocols over permissionless tools. The "hold law" proposal would create a new mechanism for freezing assets that interact with non-compliant mixers. And the recommendation to define AML obligations for DeFi actors could subject front-end operators, relayers, and even governance participants to reporting requirements.
The economic winners are already becoming visible: zero-knowledge infrastructure providers, compliant privacy protocols, and institutional custody platforms that can offer shielded settlement on public chains. The losers will be protocols that cannot — or choose not to — build compliance bridges to the traditional financial system.
Privacy in crypto was never going to remain unregulated. The question was always whether regulation would be a ban or a framework. Treasury has now answered: it is a framework. The next question is whether the framework will preserve enough permissionless space for the technology to remain meaningful — or whether "compliant privacy" becomes an oxymoron.