FinCEN withdraws proposed rules on unhosted wallets and crypto mixing

What happened

On October 5, 2026, FinCEN, the US Financial Crimes Enforcement Network, announced that it is withdrawing two proposed rules. The announcement appeared in a news release on fincen.gov. Both proposals concerned digital assets.

The first proposal covered recordkeeping, verification, and reporting requirements for certain transactions involving convertible virtual currency (CVC) and unhosted wallets. The second proposed a special measure on CVC mixing as a class of transactions of primary money laundering concern.

FinCEN said it considered the comments submitted in response to the proposals. It described the withdrawals as part of the Trump Administration’s deregulatory agenda and of ongoing efforts to ensure digital asset regulations are fit for purpose.

The release carries no named official quote. It does not say which obligations remain in force. It also does not discuss illicit finance risk in digital assets.

Why it matters

The following is analysis, not a FinCEN statement. A proposed rule creates no obligation, so withdrawing one does not remove duties already in force under the Bank Secrecy Act. No compliance program built to existing rules changes because of this withdrawal.

The practical effect falls on firms that had begun building controls for the proposals. They now face a decision about whether to keep those controls as voluntary risk controls. That is a judgement call for each firm.

The withdrawal also does not change the underlying exposure. Mixers and unhosted wallet counterparties can still present money laundering and sanctions risk in a firm’s own risk assessment. Assessing that risk remains the firm’s job, and FinCEN’s release does not address it. Because the withdrawal reflects policy direction, it could change again.

Practitioner angle

Do not dismantle existing crypto controls on the strength of this announcement. Test your own controls against these questions:

• Which controls did we build, or plan, specifically for these two proposals, and which of them do we keep as risk-based policy?
• Does our own risk assessment still justify unhosted wallet counterparty identification and recordkeeping, given the exposure we actually see?
• Does mixer exposure screening still run, and are its thresholds set by our risk appetite rather than by a draft rule?
• Is wallet address sanctions screening untouched? It is a distinct obligation, and this withdrawal does not alter it.
• Does our horizon scan now mark both proposals as withdrawn, with the October 5, 2026 date and the FinCEN source recorded?
• Who owns the decision to revisit these controls if policy shifts again?

Record the outcome. For each control built for the proposals, document whether it stays, changes, or is retired, and why.