FinCEN Withdraws Crypto Mixing Rule and Self-Hosted Wallet Proposal
The U.S. Treasury's Financial Crimes Enforcement Network has pulled two significant digital asset rulemakings at once: a 2023 proposal to designate international crypto mixing as a primary money laundering concern, and a 2020 proposal to impose identity verification requirements on transactions involving self-hosted wallets. Both notices appeared on the Federal Register's public inspection site on 5 October 2026. Because neither proposal had been finalised, the withdrawals do not alter financial institutions' existing Bank Secrecy Act obligations. But they do reframe the regulatory risk landscape for any firm that touches privacy-preserving technology or non-custodial wallets, and they carry real implications for how crypto accounting software tracks, flags, and documents such transactions.
What FinCEN Actually Proposed and Why It Is Now Walking It Back
The 2023 Mixing Designation
In October 2023 FinCEN invoked Section 311 of the USA PATRIOT Act to label international convertible virtual currency (CVC) mixing a "class of transactions of primary money laundering concern." That was itself a notable first: Section 311 had previously been used only against foreign jurisdictions, foreign financial institutions, or specific account types, never against an entire category of transactions.
The attached proposed rule would have required banks and other covered institutions to file detailed Suspicious Activity Report-style filings on any mixing transaction, capturing wallet addresses, transaction hashes, and IP addresses. The proposed definition of "mixing" was broad enough to sweep in pooling funds, splitting transactions, using single-use wallets, and even allowing user-initiated time delays so that deposits and withdrawals could not be matched by timing alone.
The 2020 Self-Hosted Wallet Rule
The second withdrawal closes a rulemaking that the first Trump administration published in the final weeks before leaving office in early 2021. That proposal would have required banks and money services businesses to verify customer identities and maintain records whenever a counterparty used an unhosted (self-hosted) wallet, or a wallet held at a foreign institution in a FinCEN-designated jurisdiction, for transactions above $3,000. Transactions exceeding $10,000, or multiple transactions aggregating above that threshold within 24 hours, would have triggered a report to FinCEN.
Why FinCEN Changed Course
The agency cited two main reasons. First, commenters argued that the mixing definition was so broad it would chill legitimate privacy-seeking behaviour on public blockchains, and would impose a disproportionate reporting burden on covered financial institutions without a dollar threshold to filter out clearly non-suspicious activity. Second, FinCEN pointed to a July 2025 report from the President's Working Group on Digital Asset Markets, which acknowledged that "lawful users of digital assets may leverage mixers to enable financial privacy when transacting through public blockchains." That report recommended Treasury consider next steps before any rule was finalised, and it appears to have been the decisive internal prompt. A March 2026 Treasury report required by the GENIUS Act also recognised legitimate privacy uses for mixing technology, while separately asking Congress for a "hold law" to allow temporary freezes of suspicious digital assets.
FinCEN was careful to state that it still believes illicit actors use mixers to obstruct law enforcement, and it reserved the right to take future action. The agency said it will continue monitoring CVC mixer activity for signs of illicit finance.
Legal and Regulatory Context
Tornado Cash and the OFAC Precedent
The withdrawals arrive against the backdrop of a separate enforcement retreat. Treasury had already unwound its Office of Foreign Assets Control sanctions against Tornado Cash after an appeals court held that OFAC had exceeded its statutory authority by sanctioning immutable smart contracts. That ruling cast doubt on the legal durability of broad, technology-targeting enforcement tools, and likely informed FinCEN's assessment of the litigation risk it would face if either proposal were finalised.
Coinbase and Coin Center Objections
Coinbase had submitted formal comments arguing that the absence of a dollar threshold in the mixing rule would result in bulk reporting of non-suspicious transactions, effectively penalising ordinary privacy behaviour. Coin Center, the crypto policy advocacy group that challenged both proposals, described the mixing definition as "extraordinarily broad, sweeping in common techniques used by ordinary cryptocurrency users to preserve their privacy," and characterised the wallet rule as creating "a double standard for cryptocurrency transactions" compared with cash equivalents.
What Changes and What Does Not
No Change to Existing BSA Obligations
The most important operational point for compliance teams is that the withdrawals are prospective only. Financial institutions remain subject to every Bank Secrecy Act obligation currently in force: existing SAR filing duties, Customer Identification Program requirements, beneficial ownership rules, and general AML programme standards. A covered institution that receives proceeds traceable to a mixer still has an obligation to file a SAR if it detects suspicious activity under current rules. Pulling a proposed rule is not the same as relaxing a live regulation.
Reduced Prospective Reporting Burden
What disappears is the potential future obligation. Had the mixing rule been finalised, compliance teams would have needed systems capable of identifying mixing transactions automatically, extracting wallet addresses and transaction hashes, and filing structured reports to FinCEN at scale. The self-hosted wallet rule, had it passed, would have required counterparty identity verification workflows for every unhosted-wallet transaction above $3,000. Neither of those buildouts is now required.
Ongoing Monitoring Expectations Remain
FinCEN's statement that it "will continue to monitor activity involving CVC mixers" signals that the agency has not abandoned the policy concern, only the specific regulatory instrument. Firms should treat this as a pause rather than a clearance. Internal AML policies that already flag high-risk mixing indicators should not be relaxed on the strength of this withdrawal.
Accounting and Reporting Implications
For Accounting Firms and CFOs Using Crypto Accounting Software
The withdrawal reduces immediate compliance infrastructure cost for clients operating exchange or MSB businesses, but it introduces a subtler challenge for advisory work. Clients may now ask whether they can transact through privacy protocols without triggering reporting obligations. The honest answer is: existing SAR duties still apply if the firm has knowledge or reason to suspect illicit activity, and the risk calculus around mixer-linked transactions has not changed materially from a practical AML perspective.
From a financial reporting standpoint, firms using crypto accounting software to classify and categorise digital asset flows still need to capture the economic substance of mixer-adjacent transactions. Where a transaction route obscures counterparty identity, the classification and fair-value measurement may be straightforward, but the disclosure narrative in financial statements or notes should reflect any elevated counterparty risk identified during the AML review. The FASB's ongoing work on digital asset accounting standards does not address mixer transactions directly, but the general requirement for management to assess and disclose material risks remains intact.
For audit purposes, the withdrawal does not diminish auditors' responsibilities under existing AU-C or PCAOB standards to consider the risk of material misstatement arising from illicit fund flows. If a client's transaction history includes mixing activity, auditors should still consider whether that exposure requires disclosure or affects going-concern assessments.
For Individual Filers and Small Businesses
Individual taxpayers who have used privacy wallets or coin-mixing services have always had a tax reporting obligation regardless of the regulatory status of the underlying AML rule. The IRS requires every taxable disposition of digital assets to be reported, and the use of a mixer does not exempt a transaction from capital gains or ordinary income treatment. The withdrawal of FinCEN's designation does not affect the IRS's ability to seek transaction data through summons or John Doe summons, and it does not affect the Form 8300 obligation for cash-equivalent transactions above $10,000.
If you've used a mixing service and are unsure whether any transactions remain unreported, this is the moment to review your records, not to assume that regulatory retreat means tax relief.
What Firms Should Do Now
Immediate Steps
Compliance officers and their advisers should take three near-term actions. First, update internal policy documents to remove any references to the 2023 FinCEN mixing proposal or the 2020 wallet rule as anticipated obligations, replacing them with a note that both rulemakings have been withdrawn. Second, brief relevant business lines, particularly those touching DeFi, privacy protocols, or cross-border payments, that existing SAR and KYC obligations are unchanged and that FinCEN has reserved the right to act again. Third, review any gap analyses or technology procurement decisions that were conditioned on the proposed rules taking effect; those analyses may now require revision.
Longer-Term Posture
The administration's framing of this withdrawal as part of efforts to ensure digital asset regulations are "fit-for-purpose" suggests that replacement guidance is plausible, potentially in a more targeted form that includes a dollar threshold or a narrower definition of reportable mixing. Firms that invested in transaction monitoring capable of identifying mixer-linked flows should retain those capabilities. The appetite for enforcement around illicit use of mixers has not gone away; only the specific regulatory vehicle has.
For firms evaluating crypto accounting software or digital asset accounting software, the practical implication is that robust transaction tagging and counterparty classification remain important even without a formal mixing-specific reporting mandate. Software that can flag high-risk transaction patterns and link them to existing SAR workflows will continue to provide value as FinCEN's approach evolves.
Those tracking parallel AML developments, including Japan's sanctions against Garantex and what they mean for international crypto compliance programmes, should factor this FinCEN withdrawal into a broader picture of shifting enforcement priorities across jurisdictions. Separately, firms concerned about the boundary between privacy technology and illicit finance may also want to revisit the nine questions to ask any on-chain risk provider before selecting or renewing AML screening tools.
Frequently Asked Questions
Does the withdrawal mean mixing transactions are now legal under US law?
Not exactly. The withdrawal removes a proposed additional layer of FinCEN reporting, but it does not legalise any conduct that was already prohibited. OFAC sanctions and existing SAR obligations still apply to mixer transactions that involve sanctioned parties or suspicious activity. The legal status of specific mixing services depends on facts and circumstances, not on this regulatory action alone.
Are banks still required to monitor for mixing activity?
Yes. The Bank Secrecy Act's general AML programme requirements, SAR obligations, and Customer Identification Program rules remain in force. The withdrawal only removes a proposed rule that would have added a new, specific reporting category for mixing. Banks and MSBs should treat mixer-linked transactions with the same risk-based scrutiny they applied before the withdrawal.
What does this mean for my crypto bookkeeping software or workflow?
Your existing transaction classification and AML flagging processes remain as important as before. The withdrawal reduces one potential future compliance burden, but robust digital asset accounting software should still be able to tag mixer-adjacent transactions, link them to counterparty risk assessments, and feed that data into SAR workflows when warranted. Any gap analysis that assumed the mixing rule would take effect should be updated.
Does this affect IRS reporting for individuals who used mixers?
No. The IRS's requirement to report every taxable digital asset transaction is entirely separate from FinCEN's AML rulemaking. Using a mixer does not remove a transaction from the scope of capital gains reporting, and this withdrawal has no effect on the IRS's enforcement tools, including summons authority.
Could FinCEN reintroduce a mixing rule in the future?
Yes, and the agency said so explicitly. FinCEN stated it will continue monitoring CVC mixer activity and may take steps to address illicit finance risks in the future. The withdrawal ends the current rulemaking proceedings; it does not preclude a new, potentially more targeted proposal under a different administration or in response to new enforcement data.
Source: The Block