The U.S. Treasury Department has executed one of the most significant policy reversals in crypto regulatory history. In a 32-page report submitted to Congress under the GENIUS Act on March 9, 2026, the same agency that sanctioned Tornado Cash in 2022 and designated international mixers as money-l...
"As consumers increase their use of digital assets for payments, individuals may want to use mixers to maintain more privacy of their consumer spending habits." — U.S. Department of the Treasury, Report to Congress (March 2026)
The U.S. Treasury Department has executed one of the most significant policy reversals in crypto regulatory history. In a 32-page report submitted to Congress under the GENIUS Act on March 9, 2026, the same agency that sanctioned Tornado Cash in 2022 and designated international mixers as money-laundering hubs in 2023 now formally acknowledges that crypto mixers serve "legitimate financial privacy purposes." The document explicitly states that lawful users may employ mixing services to protect personal wealth information, business payments, and charitable donations from public scrutiny on transparent blockchains.
But this is not a libertarian victory lap. The report simultaneously proposes a "digital asset hold" statute enabling exchanges to freeze suspicious funds without court orders, recommends adding a sixth special measure to the USA PATRIOT Act targeting digital asset transmittals, and calls for Congress to define AML obligations for DeFi protocols. The Treasury is not retreating from oversight — it is upgrading to a precision instrument. And while Washington recalibrates, Brussels is heading in the opposite direction: the EU's Anti-Money Laundering Regulation will ban privacy coins outright from regulated platforms by July 2027. A transatlantic regulatory divergence on financial privacy is now locked in.
The report, titled Innovative Technologies to Counter Illicit Finance Involving Digital Assets, was mandated under Section 9(e) of the GENIUS Act — the federal stablecoin framework President Trump signed into law on July 18, 2025. It represents the government's most comprehensive vision for deploying technology against crypto-enabled money laundering, sanctions evasion, and terrorist financing.
The core thesis is nuanced. Treasury draws a clear distinction between custodial and non-custodial mixers. Custodial services, which must register with FinCEN as money services businesses, can provide identity data, off-chain transaction information, and behavioral patterns to investigators. Critically, the report does not recommend new restrictions on non-custodial mixers and explicitly refrains from finalizing FinCEN's 2023 proposed recordkeeping rule that would have imposed Bank Secrecy Act obligations on unhosted wallet transactions involving mixing services.
The signal is unmistakable: Treasury now formally distinguishes between legitimate privacy technology and illegal applications. Mixers, in this framework, are tools — not crimes.
The velocity of this policy shift is remarkable:
The trajectory reveals an agency forced to adapt. The Fifth Circuit ruling didn't just reverse a sanctions decision — it exposed a fundamental legal limitation in applying traditional financial enforcement frameworks to decentralized, permissionless software. Treasury's new approach is a strategic response: if you cannot sanction the code, regulate the on-ramps.
Rather than prescribing specific tools, Treasury advocates a technology-neutral, risk-based framework built on four pillars:
1. Artificial Intelligence. The report urges financial institutions and crypto-asset service providers to deploy AI for transaction monitoring, pattern recognition, and anomaly detection. Treasury's own data shows DPRK cybercriminals stole at least $2.8 billion in digital assets between January 2024 and September 2025 — including the $1.5 billion Bybit hack in February 2025, the largest crypto heist in history. The sheer volume and sophistication of these laundering chains now exceeds human analytical capacity.
2. Digital Identity Solutions. This is perhaps the most consequential recommendation. Treasury envisions tokenized credentials linked to wallet addresses, portable digital identity solutions shareable across institutions for due diligence, and credential checks executed before transactions are processed. This creates a path toward privacy-preserving compliance: proving you are not on a sanctions list without revealing who you are.
3. Blockchain Monitoring and Analytics. The report endorses the continued use and advancement of on-chain analytics tools from firms like Chainalysis and TRM Labs for tracing illicit fund flows.
4. Application Programming Interfaces (APIs). Treasury calls for standardized data-sharing infrastructure between regulated entities, law enforcement, and blockchain analytics providers.
The framework is significant because it effectively creates a two-tier privacy architecture: compliant privacy for users willing to attach verified credentials to their transactions, and residual risk for those who do not. This is the regulatory architecture for the next decade.
The report's privacy acknowledgment comes packaged with substantial new enforcement proposals:
The Digital Asset Hold Statute. Treasury urges Congress to create a legal safe harbor allowing regulated exchanges and financial institutions to temporarily freeze digital assets suspected of illicit involvement during "brief investigative windows" — without requiring a court order. This would formalize what some exchanges already do informally when flagged by law enforcement, but would provide legal protection for the freezing institution and standardize the process.
The Sixth Special Measure. Currently, Section 311 of the USA PATRIOT Act gives Treasury five "special measures" it can impose on institutions or jurisdictions deemed to be primary money laundering concerns. The report proposes a sixth measure specifically designed for digital assets: the authority to prohibit or impose conditions on certain digital asset transmittals not tied to a correspondent banking relationship. This would give Treasury a new, crypto-specific enforcement lever that operates outside the traditional banking infrastructure.
DeFi AML Obligations. The report explicitly asks Congress to clarify which DeFi actors — liquidity providers, protocol governance token holders, front-end operators — should fall under existing AML/KYC obligations. Galaxy Digital has described the combined effect of these proposals as potentially "the biggest financial surveillance expansion since the PATRIOT Act."
While the U.S. moves toward a privacy-with-compliance model, the European Union has chosen prohibition. Under Article 79 of the EU's Anti-Money Laundering Regulation (AMLR), credit institutions, financial institutions, and crypto-asset service providers will be prohibited from maintaining anonymous accounts or handling privacy-preserving digital assets like Monero and Zcash starting July 1, 2027.
The contrast is stark:
| Dimension | United States (2026) | European Union (2027) | |---|---|---| | Privacy coins | Legal to hold and trade; no exchange ban | Banned from regulated platforms | | Mixers | Legitimate use acknowledged; custodial services regulated | Likely prohibited under anonymity ban | | Compliance model | Privacy-preserving digital identity + analytics | Full identity verification for transactions >€1,000 | | Enforcement body | FinCEN + OFAC (existing) | EU Anti-Money Laundering Authority (AMLA, new) |
Several exchanges, including Binance and Kraken, have already begun preemptively delisting privacy coins in EU jurisdictions. The European Crypto Initiative has acknowledged the regulations are "essentially final," though a March 2025 European Banking Authority consultation suggested limited negotiability on specific provisions.
For institutional capital, this divergence creates a regulatory arbitrage opportunity. Privacy-focused protocols, projects, and services may increasingly concentrate development and liquidity in U.S.-friendly jurisdictions — a reversal of the 2022-2024 dynamic when the Tornado Cash sanctions drove privacy innovation offshore.
The privacy coin sector has already priced in part of this thesis. The combined privacy coin market capitalization stands at approximately $10.8 billion. Zcash has been the primary beneficiary, surging over 400% since September 2025 as its shielded pool climbed past 4.9 million ZEC and Grayscale's ZCSH trust crossed $123 million in assets under management.
The October 2025 rally was catalyzed when tech investor Naval Ravikant described Zcash as "insurance against Bitcoin," triggering a 60% ZEC price increase within 24 hours and pulling the broader privacy sector up over 35% for the month.
Tornado Cash usage patterns reveal an important insight: CertiK's post-sanctions analysis found that fluctuations in sanctions had negligible influence on illicit actors' use of the platform. The sanctions primarily punished legitimate users while failing to deter criminal laundering chains. This data point, likely available to Treasury analysts, may have contributed to the policy shift.
The economic logic is straightforward. As stablecoins become payment rails — the GENIUS Act was, after all, a stablecoin bill — transaction privacy becomes a consumer protection issue, not merely a cypherpunk ideal. A blockchain that reveals every coffee purchase, salary payment, and medical expense to any observer with an internet connection is fundamentally incompatible with mass consumer adoption.
The Treasury's March 2026 report does not represent a government capitulation to crypto privacy advocates. It represents something more consequential: the institutionalization of financial privacy as a legitimate design requirement within a regulated digital asset framework. The agency that sanctioned Tornado Cash now proposes a world where mixers, digital identity credentials, and AI-powered monitoring coexist — where privacy is permissioned rather than prohibited.
The critical question is execution. A digital asset hold statute without judicial oversight raises due process concerns. A sixth PATRIOT Act special measure targeting crypto transmittals could become a blunt instrument if applied broadly. And privacy-preserving digital identity, while theoretically elegant, requires infrastructure that does not yet exist at scale.
But the direction is clear. The U.S. is betting that the future of financial privacy is not anonymity — it is selective disclosure. And with the EU choosing the opposite path, the next two years will produce a natural experiment in which regulatory philosophy better serves both security and innovation. The $10.8 billion privacy coin market is the first scorecard. The real measure will be whether compliant privacy tools can scale fast enough to protect the hundreds of millions of users that stablecoin payment rails are designed to serve.