FinCEN Kills Two Proposed Surveillance Rules Targeting Self-Custody and Mixers
FinCEN officially withdrew two proposed surveillance rules on October 5, 2026, the 2020 unhosted wallet NPRM and the 2023 CVC mixing Special Measure, killing a six-year threat to self-custody and privacy tool developers.
The Treasury's financial crimes unit just buried the two most aggressive proposed expansions of crypto surveillance ever floated by U.S. regulators.
Key takeaways
- FinCEN withdrew the December 2020 unhosted wallet NPRM (RIN 1506-AB47) and the October 2023 CVC Mixing Special Measure NPRM (RIN 1506-AB64) on October 5, 2026, with formal Federal Register publication scheduled for October 6.
- The withdrawn unhosted wallet rule would have required banks and money services businesses to file reports on transactions with self-custody wallets above $10,000 and keep records on those above $3,000, effectively turning your counterparty into your KYC officer.
- Existing Bank Secrecy Act and AML obligations on exchanges remain in force; OFAC sanctions on specific mixer protocols are a separate matter untouched by today's withdrawal.
The U.S. Treasury's Financial Crimes Enforcement Network announced on October 5, 2026 that it is withdrawing two proposed rules that would have dramatically expanded federal surveillance of self-custody Bitcoin transactions and cryptocurrency mixing. Both withdrawal notices are slated for formal publication in the Federal Register on October 6, 2026, at which point they take effect.
The withdrawal notice states plainly: "FinCEN will take no further action on this NPRM." Both notices cite the July 30, 2025 report from the President's Working Group on Digital Asset Markets, titled "Strengthening American Leadership in Digital Financial Technology", as the basis for the action, describing it as part of the "Trump Administration's ongoing efforts to ensure digital asset regulations are fit-for-purpose."
What Was Actually Killed Here
The first rule, originally proposed in December 2020 under RIN 1506-AB47, would have required banks and money services businesses to file reports on any transaction with an unhosted wallet exceeding $10,000, and keep records on transactions above $3,000. The counterparty in those cases is you: a private individual holding their own keys. Under that framework, every exchange or bank interacting with a cold wallet would have faced a pending obligation to collect identifying information on the wallet's owner, regardless of whether that person was their customer.
The second rule, the CVC Mixing Special Measure proposed in October 2023 under RIN 1506-AB64, invoked Section 311 of the USA PATRIOT Act to designate convertible virtual currency mixing as a "primary money laundering concern." It would have required covered financial institutions to report mixing-linked transactions involving a foreign jurisdiction, including wallet addresses, transaction hashes, and IP addresses.
Both rules are now dead in their current form. The original unhosted wallet NPRM and the original CVC mixing NPRM that established what is being withdrawn are both on the Federal Register.
The Second-Order Effects That Matter
For anyone holding self-custody Bitcoin, the practical impact of the unhosted wallet rule's death is immediate. That $3,000/$10,000 reporting threshold was a sword hanging over every counterparty you transact with onchain. Exchanges, OTC desks, and banks faced a future in which sending funds to or receiving funds from your hardware wallet would trigger compliance obligations on a non-customer. That chilling effect on onchain activity is gone.
The mixer rule withdrawal matters more for developers and privacy tool users. The Section 311 "primary money laundering concern" designation is a blunt instrument: it pressures domestic financial institutions to treat any mixing-adjacent transaction as presumptively illicit, regardless of whether a specific protocol or user has been individually sanctioned. Withdrawing that proposed designation removes a key regulatory pressure vector, even as the broader sanctions landscape around mixer protocols remains a separate fight. The November 2024 Fifth Circuit ruling in Van Loon v. Department of Treasury, which found that immutable smart-contract-based mixers don't qualify as sanctionable "property" under IEEPA, was already undermining the legal scaffolding for the mixer NPRM, and Treasury subsequently delisted Tornado Cash from its SDN list in March 2025. Treasury appears to have concluded the case was unwinnable.
The falsifiable thesis here: this withdrawal reflects a genuine conclusion by the administration that blanket surveillance of the self-custody layer is both technically unenforceable and legally precarious, not just a docket-clearing exercise. The trigger that disproves it is straightforward. If FinCEN re-proposes functionally equivalent rules under new RINs within 12 to 18 months, or if the withdrawn mixer framework resurfaces inside GENIUS Act stablecoin rulemaking, the withdrawal was clearance, not retreat.
What to Watch
The unhosted wallet NPRM spent six years as a zombie: never enacted, never killed, always threatening. Its formal death is a meaningful moment. But "no further action on this NPRM" is not a permanent bar on re-proposal. A future administration, a major mixing-linked theft, or a new statutory trigger from Congress could open a replacement docket. Watch the Federal Register and the GENIUS Act implementation rulemaking for signs that the surveillance architecture is being rebuilt under a different RIN. BSA and AML obligations on exchanges and custodians are fully intact.
Sources
Frequently Asked Questions
Does withdrawing the mixer NPRM mean mixers are now legal in the U.S.?
No. OFAC sanctions on specific protocols remain a separate enforcement matter. FinCEN's withdrawal removes the proposed reporting rule under Section 311 of the USA PATRIOT Act. It does not reverse existing sanctions designations or affect prosecutorial actions against mixer operators.
Can FinCEN or Treasury re-propose these rules in the future?
Yes. Withdrawing an NPRM closes a specific regulatory docket; it does not permanently bar re-proposal. A future administration or a new statutory mandate from Congress could produce replacement rulemaking. The notice language, "no further action on this NPRM," is precise: it applies to the current docket, not the underlying policy space.
What is the President's Working Group on Digital Asset Markets report cited in the withdrawal notices?
Both withdrawal notices reference the July 30, 2025 report from the White House's President's Working Group on Digital Asset Markets, titled "Strengthening American Leadership in Digital Financial Technology," as the basis for the action. That report recommended clearing legacy proposed rules that do not align with the administration's current digital asset framework.
