On October 5, 2026, the U.S. Financial Crimes Enforcement Network (FinCEN) announced the withdrawal of two proposed rules concerning convertible virtual currencies. One proposal would have introduced recordkeeping, verification, and reporting requirements for certain transactions involving convertible virtual currencies and unhosted wallets. The other would have imposed a special measure relating to virtual currency mixing. FinCEN said it had considered public comments before withdrawing both proposals as part of the administration’s deregulatory agenda and its efforts to ensure digital asset regulations were fit for purpose.
The decision means these proposals will no longer proceed as originally contemplated. It does not, however, establish that all anti-money laundering obligations for digital asset businesses have been eliminated. Service providers must continue to follow applicable requirements based on their regulatory status, activities, and jurisdictions, including relevant customer due diligence, suspicious activity reporting, and sanctions compliance obligations. For exchanges, custodians, and payment providers, the policy change also creates an opportunity to review how risk controls can remain effective as regulatory expectations evolve.
What Digital Asset Rules Did FinCEN Withdraw?
FinCEN's October 5 announcement covered two previously proposed rules. The first concerned certain transactions involving convertible virtual currency or digital assets and unhosted wallets. It would have required covered financial institutions to follow specified recordkeeping, verification, and reporting procedures. The second proposal concerned virtual currency mixing and sought to apply a special measure to transactions associated with that activity as a category of money laundering concern.
An unhosted wallet is generally controlled by the user rather than a third-party custodian. Mixing services may pool, split, or redistribute assets in ways that make direct observation of fund flows more difficult. These technical characteristics do not, by themselves, prove that a user has engaged in illegal activity. Risk assessments still require consideration of the transaction, service model, and other available evidence.
FinCEN stated that the withdrawals followed its consideration of public comments and formed part of a broader change in the administration's approach to digital asset regulation. Businesses should distinguish proposed rules from requirements already in force. Withdrawing a proposal does not automatically remove other legal obligations that apply to financial institutions, nor does it mean every transaction involving an unhosted wallet or mixing service no longer warrants review.
Compliance teams should first examine the formal notices, existing regulations, and applicable guidance to determine which requirements have changed and which remain in effect. Internal procedures should be adjusted only after the relevant legal obligations have been established, rather than by automatically lowering the risk classification of all related transactions.
Why Unhosted Wallets and Mixing Activity Still Matter for KYT
Know Your Transaction (KYT) analyzes blockchain records, address relationships, and transaction paths to identify activity that may require further investigation. Even when a proposed rule is withdrawn, service providers may still need to monitor transactions associated with fraud, theft, sanctioned entities, or other high-risk activity under applicable law and their own risk-based controls.
For example, a customer may deposit assets into an exchange from a self-hosted wallet. The use of an unhosted wallet is not inherently suspicious. However, if the funds previously passed through an address associated with known high-risk activity, or appear connected to confirmed illicit proceeds, the exchange may need to conduct additional checks. Similarly, rapid transfers through multiple addresses or transaction patterns that significantly differ from a customer's expected activity can provide grounds for further review rather than an immediate conclusion of wrongdoing.
Transactions involving mixing services can be more difficult to analyze because the flow of funds may no longer follow a straightforward one-to-one transfer pattern. Compliance teams can assess available blockchain data alongside customer information, transaction context, and other lawfully obtained evidence. Transparency and analytical coverage also vary between blockchain networks, so monitoring systems should clearly communicate their data limitations.
KYT does not replace customer identification, sanctions-list screening, or legally required reporting. Its role is to add transaction-level context, helping compliance staff identify anomalies, understand fund movements, and prioritize investigations. Alerts should be assessed through reasonable review procedures; a single address label or automated score should not be treated as conclusive proof of illegal conduct.
Maintaining Effective AML Controls as Regulations Change
When regulatory policy changes, businesses must avoid two opposite mistakes: continuing to treat a withdrawn proposal as an existing legal obligation, or assuming that withdrawal means the underlying risks can be ignored. Effective compliance programs should be grounded in current law and updated according to the organization's business model and risk exposure.
First, firms should conduct a regulatory gap assessment covering applicable customer due diligence, transaction recordkeeping, suspicious activity reporting, and sanctions screening requirements. Businesses operating across borders should also identify differences between jurisdictions instead of applying one country's policy changes indiscriminately to other markets.
Second, providers should maintain KYT rules proportionate to their risk exposure. Monitoring can examine connections to high-risk addresses, unusual fund-flow patterns, frequent transfers within short periods, and deviations from a customer's established transaction behavior. For high-risk alerts, firms should preserve the triggering indicators, associated transactions, investigation steps, review findings, and final disposition to support internal audits and regulatory examinations.
Finally, monitoring performance should be assessed regularly. Alert quality, coverage, and investigation outcomes should be reviewed whenever regulations, threat intelligence, or business processes change. Overly broad rules can create excessive false positives, while poorly designed or excessively narrow controls may miss important risks. Continuous testing, human review, and complete audit records help maintain effective risk detection without unnecessary operational costs.
FinCEN's decision to withdraw two proposed rules reflects a change in specific regulatory proposals, not a blanket rejection of digital asset risk controls. Digital asset businesses should continue to focus on understanding current legal requirements, assessing transaction risks proportionately, and using KYT to provide traceable and explainable blockchain evidence for their AML programs.