Which Proposed Rules Did FinCEN Withdraw?
On October 5, 2026, the Financial Crimes Enforcement Network (FinCEN) announced the withdrawal of two proposed rules relating to digital assets. One proposal concerned recordkeeping, verification, and reporting requirements for certain transactions involving convertible virtual currencies and unhosted wallets. The other proposed a special measure concerning international cryptocurrency mixing.
FinCEN said it had considered public comments before withdrawing the proposals. Among the concerns raised was that a broad definition of mixing could chill legitimate privacy-related activity. The action concerns proposed rules; it does not mean that all existing anti-money laundering requirements have been repealed or that crypto transactions are no longer subject to oversight.
The distinction between a proposal and an effective legal obligation is important for compliance teams. A proposed rule should not be treated as a universally binding requirement before it takes effect. At the same time, existing laws, sanctions requirements, suspicious activity reporting obligations, and other applicable controls must be assessed independently.
Why Are Self-Hosted Wallets and Mixing Services Difficult to Regulate?
A self-hosted wallet allows an individual to control private keys without relying on a centralized platform to hold the assets. This can support financial autonomy, but it may also limit the information immediately available to a financial institution about a counterparty, the purpose of a transfer, or the relationship between addresses.
Mixing services can make transaction paths more complex by pooling, splitting, or redistributing funds. However, the use of a privacy-enhancing technology does not automatically prove criminal conduct. Compliance analysis must distinguish legitimate privacy needs from activity supported by evidence of money laundering, sanctions evasion, or other unlawful behavior.
This creates a regulatory challenge. Authorities need tools that help detect and investigate financial crime, while rules should avoid definitions so broad that legitimate users and lawful technical activity are automatically treated as suspicious.
How Should Platforms Maintain Risk Monitoring?
The withdrawal of the proposals does not eliminate the need for exchanges and other covered institutions to assess customer and transaction risk. Depending on the applicable laws and their risk profiles, firms should continue customer due diligence, sanctions screening, unusual-transaction monitoring, and escalation of suspicious activity.
For transfers involving self-hosted wallets, a platform may seek reasonable information about the transaction's purpose and context according to its risk-based procedures. It can also review on-chain fund flows, address relationships, and historical behavior. KYT tools can help identify interactions with high-risk addresses or complex movement patterns, but alerts require contextual review and should not be treated as conclusive proof of wrongdoing.
Firms should update internal rulebooks to distinguish current legal requirements from withdrawn proposals and from controls adopted voluntarily under internal risk policies. This helps avoid both under-compliance and the mistaken presentation of proposed requirements as binding law.
FinCEN's decision reflects the continuing tension between financial-crime prevention and legitimate privacy interests. For digital asset firms, the prudent approach is not to wait for the next regulatory announcement, but to maintain monitoring that is risk-based, evidence-led, and grounded in the laws that actually apply.