FinCEN withdraws 2020 unhosted wallet and crypto mixer rules

FinCEN has pulled two proposed crypto rules that privacy advocates fought for years. The Treasury bureau dropped its 2020 plan to track transfers to self-held wallets and a 2023 move to brand crypto mixing a money laundering threat. Both notices publish October 6.

The withdrawal notices carry the signature of Jimmy L. Kirby, FinCEN's deputy director, and were filed on October 5 at 8:45 am, according to Federal Register documents. Neither rule was ever finalized. So nothing changes for banks or exchanges today.

What the 2020 unhosted wallet rule would have required

FinCEN first published the unhosted wallet proposal on December 23, 2020. It targeted wallets a person controls directly, rather than through a bank or exchange. That setup is known as self-custody. Think of a hardware device in a drawer, not an account on a trading app. The proposal landed in the final weeks of the first Trump administration and then sat unfinished for nearly six years.

Under the plan, a bank or money services business would have had to report any customer transfer above $10,000 to such a wallet, or several transfers adding up to more than $10,000 in a single day. For transfers above $3,000, the firm would have had to keep records and verify the customer's identity, along with details about the counterparty. Critics said that would push basic privacy tools out of reach for ordinary users. It never became law.

Why FinCEN dropped the mixer proposal

The second notice ends a 2023 proposal that would have labeled international crypto mixing a "primary money laundering concern" under Section 311 of the USA PATRIOT Act. That law lets Treasury impose special measures on a class of transactions it sees as a laundering risk, up to cutting them off from the US banking system. Mixers pool many users' coins together to blur who sent what. Some people use them to hide stolen funds. Others use them for ordinary privacy.

FinCEN's 2023 plan would have required financial institutions to report wallet addresses, transaction hashes and IP addresses tied to suspected mixing. The agency said it reconsidered after reading public comments. It wrote that the proposal could have "a chilling effect on legitimate activity and place a large reporting burden on covered financial institutions."

A deregulatory turn, with limits

In the unhosted wallet notice, FinCEN tied both moves to a wider policy shift. It said the withdrawal flows from the Trump administration's work to make digital asset rules "fit-for-purpose," citing a July 2025 report by the President's Working Group on Digital Asset Markets created under Executive Order 14178. Treasury declined to comment.

Privacy groups reacted with relief mixed with caution. Peter Van Valkenburgh, executive director of the advocacy group Coin Center, called the mixer definition "extraordinarily broad, sweeping in common techniques used by ordinary cryptocurrency users to preserve their privacy." He welcomed the reversal as a bright spot after "a hard month for privacy and your right to use crypto." He added a warning. The power to write similar rules, he said, has not gone anywhere.

Opposition to both plans ran deep. Exchanges and developer groups filed comments arguing the rules would have treated self-custody and privacy software as suspicious by default. Coinbase was among the firms that pushed back. The fights dragged on for years without a final rule in either case.

What to watch

These withdrawals remove a threat, not a protection. Because neither rule was finalized, no legal shield for self-custody or mixing takes their place. A later FinCEN, under a different administration, could revive either idea using the same Section 311 and Bank Secrecy Act powers. The statute still stands.

Treasury is also not stepping back everywhere. In the same week, it sanctioned a network accused of moving billions through a ruble-backed stablecoin, and days earlier it targeted a crypto fundraising operation linked to Hamas. The message is narrower than a blanket retreat. Rulemaking that swept in everyday users is out. Targeted action against named bad actors stays.