FinCEN Withdraws Two Crypto AML Rule Proposals in October 2026: What Still Applies?

On October 5, 2026, FinCEN announced that it was withdrawing two digital-asset proposals:

• The December 2020 unhosted wallet proposal. This would have imposed new reporting, recordkeeping and verification requirements on certain transactions with unhosted or "otherwise covered" wallets.
• The October 2023 Section 311 proposal on international convertible virtual currency (CVC) mixing.

Both withdrawals were published in the Federal Register on October 6, 2026, and took effect that day.

Neither proposal had become a final rule, so no binding obligation was repealed. What ended were additional requirements that crypto businesses, banks and money services businesses (MSBs) had been expecting since 2020 and 2023.

For anyone tracking FinCEN crypto rules in 2026, the practical question is narrower: which existing Bank Secrecy Act (BSA) and sanctions obligations still apply to your business, and does anything in your policies need correcting?

What happened on October 5–6, 2026?

The announcement explains the decision. The Federal Register notices are the legal acts, and both state an effective date of October 6, 2026. FinCEN ties the withdrawals to its aim of keeping digital-asset rules "fit-for-purpose", citing the July 2025 report of the President's Working Group on Digital Asset Markets.

The two withdrawn proposals compared

Two details matter:

• The mixing finding itself was withdrawn, not only the proposed rule. International CVC mixing is no longer designated a class of transactions of primary money laundering concern.
• Section 311 remains in force. The withdrawal does not affect FinCEN's broader Section 311 authority. The notice says illicit actors still use mixers, that FinCEN "will continue to monitor" mixer activity, and that it "may take appropriate steps in the future".

The notice also records commenters' concern that the 2023 definition of mixing, which covered any activity that obscures the source, destination or amount of CVC "regardless of the type of protocol or service used", could chill legitimate privacy-preserving activity.

What the withdrawals do not change

For a business that is an MSB, or another covered financial institution, the core requirements below continue to apply. Each depends on the firm's actual activity.

Strengthening any of these is the work of the BSA/AML compliance program itself. The withdrawals do not create a new program requirement.

Which crypto businesses still have FinCEN obligations?

Classification depends on what a business does, not what it calls itself. FinCEN's 2019 CVC guidance (FIN-2019-G001) builds on its 2013 guidance. Both remain in place. Together they distinguish users from money transmitters based on the facts and circumstances.

These outcomes are illustrative. A change in custody, key control or fund flows can change the result.

Unhosted wallets: what compliance teams should still do

The proposed counterparty reports and records never became binding, and they will not take effect through the withdrawn proposal. Existing recordkeeping, SAR, Travel Rule and OFAC requirements were not repealed. Self-hosted transfers are neither presumed low-risk nor presumed suspicious. Under existing rules, a covered intermediary still:

• verifies its own customer under its AML program
• keeps the records its covered transmittals require
• monitors for suspicious activity

It is not legally required to identify the owner of every unhosted counterparty wallet. That was part of the withdrawn proposal. A firm may still choose to understand the relationship between its customer and a destination wallet where risk warrants it.

Hypothetical scenario: withdrawal to a self-hosted wallet. A U.S. custodial exchange processes a verified customer's $12,000 withdrawal to a self-hosted wallet.

• Facts: The customer has a 2-year history. The amount is consistent with past activity. The address has no known sanctions exposure.
• Applicable obligations: AML program controls, any recordkeeping required for the transfer, OFAC screening, and SAR assessment. No special transaction report arises from the withdrawn 2020 proposal. A SAR may still be required if the conditions in 31 CFR 1022.320 are met.
• More evidence, if risk indicators appear: Whether the customer controls the address, the address's onward exposure, and any change in behavior.
• Escalation: Investigator review if the transfer is unusual for the customer, with the outcome documented.
• What cannot be concluded automatically: That the wallet is suspicious because it is unhosted, or that the transfer is reportable because of its size.

Crypto mixers: what changes and what remains risky

The withdrawn special measure would have created a report for covered mixing transactions, separate from a SAR. That mixing-specific report never took effect and will not take effect. This is not an exemption from reporting: suspicious-activity reporting and sanctions obligations apply exactly as before.

Four situations need to be kept apart:

• Privacy use. Privacy-preserving tools can be lawful.
• Obfuscation indicators. Layering, rapid movement through mixers, or activity that doesn't fit the customer's profile can be red flags for SAR purposes.
• Sanctions exposure. Dealings with blocked persons or property, including designated addresses, are governed by OFAC rules, whatever FinCEN does on AML.
• Enhanced review. Mixer exposure combined with other risk factors warrants investigation, not automatic rejection.

Hypothetical scenario: an inbound deposit with mixer exposure. An exchange receives a deposit, and its analytics tool links part of the funds to a mixing service two hops back.

• Facts: The customer is a long-standing retail user. The exposure is indirect and partial.
• Applicable obligations: OFAC screening of the addresses and service involved, and SAR assessment under 31 CFR 1022.320.
• More evidence: The customer's explanation, the source of funds, the timing, the amount relative to the customer's profile, and any direct sanctions nexus.
• Escalation: File a SAR where the facts give reason to suspect illicit activity. Follow OFAC blocking and reporting where sanctioned property is involved.
• What cannot be concluded automatically: That on-chain proximity proves criminal activity, or that the absence of a FinCEN mixing rule removes the risk.

OFAC's Sanctions Compliance Guidance for the Virtual Currency Industry explains that sanctions obligations apply to virtual currency in the same way as to traditional value transfers. Designation status changes over time, so check current OFAC lists rather than relying on old examples.

The $3,000 and $10,000 threshold trap

The withdrawn 2020 proposal would have attached new reporting at $10,000 and new recordkeeping at $3,000 to transactions with unhosted or otherwise covered wallets. Those triggers never became binding. Separate rules with similar numbers still apply.

Recordkeeping (31 CFR 1010.410(e)). Nonbank financial institutions must keep records for transmittals of funds of $3,000 or more:

• As the transmittor's institution: the transmittor's name and address, the amount, the execution date, payment instructions, and the recipient's institution and recipient details, as received.
• As an intermediary or recipient institution: a record of the transmittal order.
• For non-established customers: additional identification steps.
• Exceptions: certain transmittals between banks, broker-dealers and government entities.

Travel Rule (31 CFR 1010.410(f)). For the same $3,000 threshold, the transmittor's institution must send the required information to the next institution, and an intermediary must pass on what it receives. FinCEN's funds travel Q&A stresses that institutions must understand their role in each chain. The 2019 CVC guidance applies these rules to CVC transmittals by money transmitters.

A withdrawal to a self-hosted wallet needs a fact-specific analysis. Where there is no recipient financial institution, there may be no next institution to send Travel Rule information to. That does not automatically remove the sending institution's own recordkeeping duties for a covered transmittal. Not every self-hosted transfer requires information to be sent onward.

SARs (31 CFR 1022.320). For MSBs, the reporting rule generally applies at $2,000 or more where the reporting criteria are met. This is a suspicion-based test, not a value trigger.

Currency transaction reports (31 CFR 1010.311). These apply to financial institutions, other than casinos, for transactions in currency above $10,000. Currency means coin and paper money, defined at 31 CFR 1010.100(m). The MSB rule at 31 CFR 1022.310 cross-refers to these requirements. A crypto transfer does not need a CTR just because its value exceeds $10,000. A cash transaction at a crypto kiosk may need one where the conditions are met.

Should crypto businesses change their AML policies?

Correcting an inaccurate legal reference is different from removing a control. A firm can keep stricter internal safeguards than the law requires, provided its documents describe them accurately.

FATF guidance is also not U.S. law. Our analysis of FATF's 2026 stablecoin and unhosted wallet report covers those international expectations separately.

Practical compliance checklist

• Confirm the BSA classification of each product and entity
• File copies of both October 6, 2026 withdrawal notices with your regulatory change log
• Search policies, procedures and training for references to the withdrawn proposals
• Map which flows count as transmittals of funds under 31 CFR 1010.410
• Review SAR decision criteria for wallet and mixer alerts
• Confirm that unhosted wallet handling is risk-based and documented
• Test mixing-related investigation logic on sample cases
• Confirm that OFAC screening and blocking procedures are separate and current
• Update training where staff were taught the withdrawn rules
• Record management approval and evidence of implementation

Other digital-asset rulemakings, including work under the GENIUS Act, are separate. They have their own status and are not affected by these withdrawals.

When an independent crypto AML review makes sense

Not every business needs to rewrite its program. A focused review is useful when:

• policies were built around the withdrawn proposals
• wallet risk ratings no longer match documented procedures
• investigators cannot consistently explain monitoring alerts
• the business is launching a new crypto transmission feature
• banking partners ask for evidence that controls work
• responsibilities are unclear across affiliated entities

The level of help can vary:

• Targeted enhancement fixes specific documents or controls.
• A gap assessment compares the whole program with current requirements.
• An independent review tests whether the program works in practice.

Frequently asked questions

Do we need to change records created under the old assumptions?

No regulation requires deleting or rewriting records simply because the proposals were withdrawn. Records kept under existing BSA rules must still be retained for the required period. Extra counterparty data collected voluntarily should be handled under the firm's retention and privacy policies, and any internal records describing the proposals as law should be corrected going forward.

If your crypto business needs to separate withdrawn proposals from current BSA obligations, correct outdated policies or assess wallet and transaction monitoring controls, ComplyFactor's U.S. crypto AML compliance services can support a targeted review and remediation plan.