FinCEN Withdraws Unhosted-Wallet and Crypto-Mixer Rules: What AML Teams Should Do Now

TL;DR

• FinCEN withdrew two major crypto proposals: the 2020 unhosted-wallet reporting rule and the 2023 special-measure proposal for international crypto mixing.
• The proposed $3,000 recordkeeping and more-than-$10,000 reporting triggers for certain unhosted-wallet transactions will not take effect through the 2020 proposal.
• This is not an AML free pass. FinCEN explicitly said illicit actors still use mixers and that it will keep monitoring the activity.
• BSA Officers should separate proposal-specific change work from controls supported by existing law, then document every rule retirement or re-scope decision.

FinCEN’s crypto rule withdrawal kills two compliance buildouts that banks and money services businesses have carried on regulatory-change inventories for years. On October 5, the agency announced that it was withdrawing both its unhosted-wallet proposal and its proposed special measure for international convertible virtual currency mixing.

That is meaningful relief. It is not permission to switch off blockchain monitoring.

The practical job now belongs to the BSA Officer, Legal, and the transaction-monitoring team: identify which planned controls existed only because of the proposals, preserve controls that still address real BSA, sanctions, fraud, and illicit-finance risk, and leave an audit trail showing why each decision was made.

What exactly did FinCEN withdraw?

FinCEN’s October 5 release covers two separate regulatory tracks. They should not be collapsed into one vague headline about “crypto deregulation.”

The unhosted-wallet withdrawal notice is unusually direct: FinCEN “will not take any further action on this NPRM.” The original proposal would have applied when a bank or MSB processed certain transactions involving an unhosted wallet or a wallet at a foreign financial institution not subject to the Bank Secrecy Act in a jurisdiction identified by FinCEN.

The proposed thresholds were specific:

• A report to FinCEN for a transaction greater than $10,000, or multiple transactions aggregating to more than $10,000 in 24 hours, when the counterparty used an unhosted or otherwise covered wallet.
• Records and customer identity verification when the transaction was greater than $3,000 and the counterparty used one of those wallets.

Those requirements came from the December 23, 2020 proposed rule, not a final rule. The distinction matters. A product requirement document that says “FinCEN requires a $3,000 unhosted-wallet record” is now doubly wrong: the provision was never final, and the proposal has been withdrawn.

The second notice goes further. FinCEN withdrew both the proposed reporting regime and its finding that international CVC mixing is a class of transactions of primary money laundering concern. The October 6 withdrawal says commenters raised concerns that the proposed definition was too expansive, could chill legitimate activity, and could create a large reporting burden.

That definition covered more than a named commercial mixing service. The 2023 proposal swept in activities such as pooling funds, splitting transfers into independent transactions, using single-use wallets, exchanging between digital assets, and introducing user-directed delays. FinCEN had proposed collecting transaction amounts, asset types, mixer information, wallet addresses, transaction hashes, dates, IP addresses, narratives, and customer identifying data.

For an AML operations team, withdrawal of that data package is a real change. It removes a potential purpose-built reporting stream that would have sat beside existing suspicious activity processes.

What the FinCEN crypto rule withdrawal does not change

The easiest mistake is to translate “proposal withdrawn” into “risk removed.” The notices do not support that conclusion.

FinCEN says in the mixing withdrawal that illicit actors continue to use mixers and other methods to hinder law-enforcement investigations. It also says the agency will continue monitoring the activity for money laundering, terrorist financing, and other illicit finance indicators, and may take future action.

Existing regulatory analysis also remains relevant. FinCEN’s 2019 guidance on convertible virtual currency business models explains how the agency’s existing regulations apply to money transmission involving CVC. Withdrawing two proposals does not erase an institution’s current status or obligations under rules already in force.

For control owners, the dividing line looks like this:

The human wrinkle is ownership. Legal may see a clean rule withdrawal. Financial Crime Operations may see a useful alert that happens to use the proposal’s threshold. Engineering may see permission to delete a costly requirement immediately. Those are three different questions.

The BSA Officer should own the control-risk decision. Legal should confirm the regulatory trigger. Model or analytics owners should quantify the effect of any threshold change. Engineering should not remove production logic until the decision and test plan are approved.

Do not confuse a withdrawn threshold with a useless control

Suppose an MSB created a rule that queues unhosted-wallet transactions above $3,000 for additional review. The legal citation attached to that rule is the 2020 NPRM.

After the withdrawal, the weak response is to delete the rule because “FinCEN canceled it.” The equally weak response is to keep it forever because changing AML rules feels dangerous.

A defensible review asks:

1. What behavior did the rule actually detect? Pull at least the last three to six months of alerts and identify SARs, account restrictions, fraud losses, false positives, and repeat counterparties.
2. Was $3,000 doing useful work? Compare outcomes immediately below and above the threshold. The figure came from a withdrawn proposal; it is not automatically the right risk threshold for your portfolio.
3. What other controls cover the risk? Map sanctions screening, wallet attribution, velocity rules, source-of-funds review, device intelligence, and manual investigations.
4. What happens if the rule is removed? Run a lookback or parallel test before production retirement. Show the estimated alert reduction and which suspicious cases would no longer surface.
5. Who accepts the residual risk? The BSA Officer should sign the control decision, with Legal documenting the change in regulatory status and Internal Audit or independent testing able to reconstruct the rationale.

Treat any threshold in this article as a legal-history marker, not a recommended calibration. A fintech with retail remittances, a bank offering institutional custody, and an exchange serving active traders should not have identical scenarios merely because all three touch digital assets.

This is also why the withdrawal should feed the AML risk assessment, not replace it. Products, customer types, geographies, transaction paths, and exposure to illicit-finance typologies still determine inherent risk and control design.

A 30-day change plan for BSA and crypto compliance teams

Days 1–5: Freeze assumptions, not operations

Owner: Regulatory Change or Compliance Advisory

• Open one change record covering both notices, with separate sub-items for the unhosted-wallet NPRM and mixing proposal.
• Link the FinCEN release, Federal Register withdrawals, original proposals, and any internal legal memos.
• Search policies, procedures, customer disclosures, tickets, model documentation, training, and vendor requirements for “unhosted wallet,” “covered wallet,” “CVC mixing,” “$3,000,” “$10,000,” “85 FR 83840,” and “88 FR 72701.”
• Tell Product and Engineering not to delete rules until the inventory and impact review are complete.

Evidence artifact: a regulatory-change record with requirement-level citations, affected systems, named owners, and decision due dates.

Days 6–15: Split legal requirements from risk controls

Owners: Legal, BSA Officer, Transaction Monitoring, Sanctions

For each affected control, label its basis:

• withdrawn proposal;
• existing BSA rule or guidance;
• sanctions obligation;
• fraud-loss control;
• institution-specific risk appetite; or
• contractual commitment to a bank partner or customer.

This prevents accidental control collapse. One scenario may support several objectives even if its original regulatory-change ticket cited only the NPRM.

If the institution serves customers that send funds to unhosted wallets or interact with mixers, review adjacent controls. FinCEN’s recent illicit-finance work still points compliance teams toward network behavior rather than labels alone. The site’s breakdown of FinCEN’s scam-center alert shows why off-platform wallet movement, rapid asset conversion, and customer contact context can matter together.

Evidence artifact: a control-to-authority matrix showing what stays, what changes, and the rationale.

Days 16–25: Test every proposed retirement

Owners: AML Analytics, Model Risk Management, Financial Crime Operations

Use a change-control sample rather than intuition:

• replay the affected scenario against historical transactions;
• compare alerts and escalations before and after the proposed change;
• identify whether sanctions or high-risk wallet exposure would be lost;
• review cases just below and above any revised threshold;
• document data-quality limitations; and
• obtain BSA Officer approval before deployment.

If blockchain analytics vendors implemented special tags or reports for the proposals, ask whether those features will be deprecated. Keep exportable evidence of current configurations. Vendor release notes are not a substitute for the institution’s own impact assessment.

Evidence artifact: test results with alert counts, case outcomes, lost-detection analysis, and signed approval.

Days 26–30: Close the loop

Owners: BSA Officer, Compliance Training, Issues Management

• Update policies and procedures that state the proposals as requirements.
• Correct frontline and investigator training.
• Notify the board or risk committee if the proposals were in a formal regulatory roadmap or funded program.
• Close obsolete implementation items only after independent challenge confirms the decision.
• Schedule a 90-day check for new FinCEN activity. The agency left the door open to future action on mixer risk.

This final step matters because regulatory inventories rot quietly. A withdrawn proposal can remain in a policy for years, while a useful control gets deleted in a sprint because no one separated its legal basis from its operational value.

The practitioner takeaway

The FinCEN crypto rule withdrawal is a significant policy reversal: two proposed reporting regimes are gone, including one built around detailed wallet, transaction, and customer data. That should reduce future compliance burden.

But the clean answer is not “leave everything” or “delete everything.” It is controlled re-scoping.

By Monday morning, the BSA Officer should be able to answer three questions: Which requirements existed only because of these proposals? Which controls still detect a risk the institution actually has? What evidence proves that every retirement decision was tested and approved?

If those answers are scattered across Jira, counsel emails, and a vendor configuration screen, use the Issues Management Tracker & Template to assign the decisions, evidence, testing, and closure approvals in one place.

Frequently asked questions

What did FinCEN withdraw in October 2026?

FinCEN withdrew the 2020 unhosted-wallet NPRM and the 2023 finding and proposal concerning international CVC mixing. The first would have imposed specified reports, records, and customer verification on banks and MSBs. The second would have imposed enhanced reporting and recordkeeping under a USA PATRIOT Act Section 311 special measure.

Does this make unhosted-wallet transactions exempt from the BSA?

No. It means these two proposed regimes will not become final in their proposed form. Existing obligations that independently apply to the institution and activity remain in place.

Should crypto mixer alerts be disabled?

Not without a documented review. FinCEN expressly said illicit actors continue using mixers and that the agency will keep monitoring the risk. Test whether each alert detects suspicious behavior, sanctions exposure, or institution-specific risk before changing it.

What should happen to the proposed $3,000 and $10,000 thresholds?

Remove any claim that they are final legal requirements under the withdrawn NPRM. Then review historical alert outcomes and adjacent controls before changing production rules. Keep a signed rationale and test evidence.

When are the withdrawals effective?

The notices were filed for public inspection on October 5, 2026 and scheduled for publication on October 6. Each notice states that withdrawal is effective upon Federal Register publication.