On October 5, 2026, FinCEN announced the withdrawal of two proposed rules affecting digital assets. Effective October 6, the proposed framework for reporting on unhosted wallet transactions and the proposed designation of international cryptocurrency mixing as a primary money laundering concern were both removed from the regulatory pipeline. Neither had ever become final law. Neither had imposed any obligations on financial institutions. And the AML framework that already applied to crypto firms before either proposal was drafted remains fully in place.
The withdrawal is a meaningful regulatory development. But for compliance teams at financial institutions and crypto businesses, the more important question is not what was removed, but what was not.
The Two Proposals and What They Would Have Done
The Unhosted Wallet Rule (2020)
The first proposal, originally published in December 2020 at 85 FR 83840, would have extended Bank Secrecy Act reporting and recordkeeping requirements to transactions involving unhosted or self-custody wallets. Under the proposed rule, banks and money services businesses would have been required to collect and retain customer and counterparty information, verify customer identity when the counterparty used an unhosted wallet, and file reports with FinCEN for transactions above $10,000 where an unhosted wallet was involved. FinCEN stated in the October withdrawal notice that it will take no further action on this rulemaking.
The Crypto Mixing Special Measure (2023)
The second proposal, published in October 2023, would have designated international cryptocurrency mixing as a class of transactions of primary money laundering concern under Section 311 of the USA PATRIOT Act. That designation would have imposed heightened scrutiny, recordkeeping, and potential reporting obligations on financial institutions for transactions connected to mixing services. In withdrawing it, FinCEN cited its concern that the proposed rule's broad definition of CVC mixing could have a chilling effect on legitimate activity and would place a significant reporting burden on covered financial institutions. FinCEN acknowledged that illicit actors continue to use mixers and related tools, and indicated it may consider narrower action in the future.
"FinCEN is withdrawing the proposed rules as part of the Trump Administration's deregulatory agenda and ongoing efforts to ensure digital asset regulations are fit-for-purpose."
FinCEN Press Release, October 5, 2026
What the Withdrawal Does Not Change
Because neither proposal had become a final rule, their withdrawal removes proposed obligations that were never in effect. It does not remove any obligations that were already in effect. The existing AML framework for crypto firms is unchanged.
What Still Applies to Crypto Firms and Financial Institutions
SAR filing obligations — Regulated institutions must still file SARs on suspicious activity involving crypto transactions, including transactions connected to mixers where there are grounds for suspicion. FinCEN's own withdrawal notice acknowledged that illicit actors continue to use mixers.
MSB registration — Crypto exchanges and money services businesses must still register with FinCEN and maintain BSA compliance programs.
The Travel Rule — The $3,000 threshold for collecting and transmitting counterparty information on transfers remains in effect.
FinCEN's 2019 virtual currency guidance (FIN-2019-G001) — This guidance, which established that virtual currency businesses operating as money transmitters are MSBs subject to BSA requirements, is unchanged.
OFAC sanctions screening — The requirement to screen crypto transactions against OFAC's SDN list and other applicable sanctions programs is completely unaffected by this withdrawal.
Customer identification requirements — CIP and CDD obligations for crypto businesses operating as MSBs remain in place under existing rules.
The Regulatory Divergence That Compliance Teams Need to Track
The FinCEN withdrawal is happening against a backdrop of tightening crypto AML requirements in other jurisdictions. That divergence creates practical complexity for institutions operating across borders.
| Jurisdiction | Direction of Travel | Key Development |
|---|---|---|
| United States | Loosening on proposed rules | Mixer and unhosted wallet NPRMs withdrawn. Existing BSA, SAR, and OFAC obligations unchanged. |
| European Union | Tightening | AMLR from July 2027 restricts anonymous crypto transfers. MiCA being reviewed for additional AML gaps including staking, DeFi, and unhosted wallets. |
| United Kingdom | Maintaining current framework | Crypto firms registered with FCA retain existing AML obligations. No equivalent withdrawal of crypto AML proposals. |
For institutions serving customers in both the US and the EU, the US withdrawal does not reduce compliance obligations under EU law. The AMLR's restrictions on anonymous crypto transactions will apply regardless of FinCEN's domestic regulatory direction. Institutions that had been preparing for the proposed US rules may still need equivalent controls for EU compliance.
The A7 Network Timing Is Worth Noting
In the same week FinCEN withdrew these two proposed crypto AML rules, OFAC designated the A7 Network as a significant transnational criminal organisation used for Russia-linked sanctions evasion and illicit financial activity involving Iran. OFAC specifically identified A7's network of sub-agents as using crypto exchanges to disguise illicit payments as legitimate commercial activity.
That timing illustrates the regulatory approach in practice. The withdrawal of the proposed rules reflects a view that the specific frameworks for mixers and unhosted wallets were too broad or burdensome. It does not reflect a reduced concern about illicit crypto activity. OFAC sanctions enforcement against specific crypto-linked networks is continuing, and financial institutions' obligation to screen against OFAC designations including new ones like A7 remains unchanged.
Three Compliance Implications
Training materials referencing the proposed rules as pending obligations need to be updated.
Both proposals had been pending long enough that some compliance training programs and internal policy documents may reference them as forthcoming requirements. Those references are now out of date. Institutions should update any training content, policy documentation, or risk assessments that describe the unhosted wallet rule or the mixing designation as pending obligations, and confirm that their compliance framework is built on the rules that are currently in effect rather than the ones that were withdrawn.
SAR filing on mixer activity continues under existing obligations.
FinCEN's withdrawal of the mixing special measure does not signal that mixer activity is now low-risk for AML purposes. FinCEN's own notice acknowledged that illicit actors continue to use mixers to frustrate law enforcement investigations. Financial institutions that identify transactions connected to mixing services where there are grounds for suspicion remain obligated to file SARs under existing rules. The withdrawal removes a proposed additional reporting framework, not the SAR obligation that was already there.
Institutions with EU operations need EU-compliant crypto controls regardless of the US withdrawal.
The AMLR's restrictions on anonymous crypto transactions and the MiCA AML framework apply to institutions within EU scope regardless of FinCEN's regulatory direction. For institutions managing compliance programs across both jurisdictions, the appropriate response to the US withdrawal is to confirm that US-facing controls reflect the current BSA framework, while maintaining EU-compliant controls for EU-facing operations. Reducing crypto AML controls based on the US withdrawal could create exposure under EU requirements that remain unchanged.
Frequently Asked Questions
What did FinCEN withdraw on October 5, 2026?
Does FinCEN's withdrawal mean crypto mixers are now legal?
What AML obligations still apply to crypto firms after the withdrawal?
What was the FinCEN unhosted wallet proposed rule?
How does the US crypto AML approach compare to the EU after this withdrawal?
The Sentinel Perspective
The FinCEN withdrawal does not change the two compliance requirements that sit at the core of crypto AML risk management for financial institutions: SAR filing on suspicious activity and OFAC sanctions screening. Both remain fully in effect.
Sentinel's sanctions screening platform supports the OFAC screening obligation that crypto-linked transactions carry regardless of this withdrawal. When OFAC designates entities connected to crypto activity, as it did with the A7 Network the same week FinCEN published its withdrawal notices, those designations need to be reflected in screening programs immediately. Continuous screening that updates in real time against OFAC's SDN list is not a regulatory proposal. It is a standing obligation that the withdrawal changes nothing about.
See How Sentinel Supports OFAC Screening for Digital Asset Transactions
Request a demonstration tailored to your institution's crypto compliance program and sanctions screening requirements.
Official References
- FinCEN Announces Withdrawals of Proposed Digital Asset Related Rules — FinCEN, October 5, 2026
- Requirements for Certain Transactions Involving Convertible Virtual Currency or Digital Assets; Withdrawal — Federal Register, 91 FR 63514, October 6, 2026
- FIN-2019-G001: Application of FinCEN's Regulations to Certain Business Models Involving Convertible Virtual Currencies — FinCEN, May 2019
- Treasury Sanctions A7 Network for Russia-Linked Sanctions Evasion — OFAC, October 2026
Truth Technologies provides AML, KYC, OFAC, and sanctions screening compliance solutions through the Sentinel platform. This post is published for informational purposes only and does not constitute legal advice. All facts are sourced from official FinCEN, Federal Register, and OFAC publications linked above.
