Which Digital Asset Rules Has FinCEN Withdrawn?
On October 5, 2026, the US Financial Crimes Enforcement Network (FinCEN) announced the withdrawal of two proposed rules concerning convertible virtual currencies. The proposals would have introduced specific requirements for financial institutions, covering recordkeeping, verification, and reporting for certain transactions involving unhosted wallets, as well as a special measure targeting virtual currency mixing. FinCEN said it had considered public comments before withdrawing the proposals as part of an effort to make digital asset regulation more fit for purpose.
The first proposal concerned potential recordkeeping, verification, and reporting requirements for financial institutions handling certain transactions involving unhosted wallets. These wallets are controlled by users who manage their own private keys rather than relying on an exchange or custodian. As a result, identifying counterparties, understanding the source of funds, and maintaining supporting records can be more complicated than for transfers between custodial accounts.
The second proposal focused on virtual currency mixing. Mixing services may pool, split, or recombine transactions in ways that make direct tracing between incoming and outgoing funds more difficult. Such techniques can serve privacy-related purposes, but they may also be exploited to obscure the origin or movement of illicit proceeds.
The withdrawal means that these two proposed rules will not proceed in their original form. It does not mean that all anti-money laundering requirements for digital assets have been repealed. Financial institutions and regulated digital asset service providers must continue to assess their obligations under applicable laws, existing rules, and the jurisdictions in which they operate.
Why Do Unhosted Wallets and Mixing Transactions Complicate AML Monitoring?
Unhosted wallets and mixing activity present different challenges for conventional financial crime controls. With an unhosted wallet, a financial institution may not have the same direct access to account-holder information that it has for a custodial account. Although blockchain transactions are publicly recorded, the identity of the person behind an address, the ultimate controller, and the purpose of a transfer may not be immediately apparent.
When funds move through multiple wallets, cross-chain bridges, or mixing services, the transaction trail can become more complex. A single transfer may not provide enough information to assess the overall risk. Analysts may need to examine historical activity, address relationships, fund flows, and information about known high-risk entities to determine whether a transaction warrants further review.
The use of a mixing service alone also does not prove that a transaction is criminal. Compliance teams should avoid drawing definitive conclusions solely from the use of a privacy tool. Instead, they should consider the wider risk context, transaction patterns, and other verifiable information. Unexplained fund movements, interactions with addresses linked to known illicit activity, and unusual patterns of splitting or consolidation may justify additional investigation.
In its July 2026 update on the implementation of virtual asset standards, the Financial Action Task Force (FATF) identified continuing gaps in global implementation. The report highlighted risks involving peer-to-peer transactions through unhosted wallets, stablecoin misuse, and offshore service providers operating without effective regulatory oversight. These concerns show that changes to individual proposals do not remove the continuing challenge of identifying illicit financial activity involving digital assets.
How Should Financial Institutions Adapt Their KYT and Compliance Strategies?
Financial institutions should not interpret the withdrawal of proposed rules as a signal to reduce on-chain monitoring standards. A more reliable approach is to review applicable legal obligations, internal policies, and risk assessment criteria. Legal and compliance teams should distinguish requirements established by current law from provisions that appeared only in withdrawn proposals, then assess how the policy change affects specific business activities.
Operationally, Know Your Transaction (KYT) systems can help identify address risks, trace fund flows, detect unusual transaction patterns, and flag connections to known high-risk addresses. For transactions involving unhosted wallets, institutions can combine these signals with customer risk ratings, transaction values and frequency, counterparty information, and business context. This reduces reliance on any single address label when evaluating risk.
For mixing-related risks, monitoring systems can look for patterns in which funds are rapidly split, consolidated, or transferred through multiple addresses. These findings should be integrated with customer due diligence, sanctions screening, and suspicious activity reporting processes. High-risk indicators should trigger further review rather than being treated as definitive proof of criminal conduct without supporting evidence.
Organizations should also retain records of their risk assessments, investigations, and decisions, and periodically test whether monitoring rules cover emerging transaction patterns. Clear audit trails help demonstrate how an institution identified risk, reached its conclusions, and fulfilled its applicable obligations when regulatory expectations change.
FinCEN's withdrawal of the two proposals reflects an adjustment in the US approach to digital asset regulation, not the disappearance of on-chain financial crime risks. For exchanges, payment providers, and compliance service companies, keeping legal interpretations current, applying risk-based controls, and combining KYT findings with customer due diligence and human investigation remain essential components of an effective AML program.