FinCEN Withdraws Two Proposed Crypto AML Rules

Announced just recently, the withdrawals cover proposed requirements for transactions involving convertible virtual currency (CVC) and unhosted wallets, as well as a separate proposal targeting CVC mixing.

FinCEN said it considered public comments and is withdrawing the proposals as part of the Trump Administration’s deregulatory agenda and its efforts to ensure digital-asset regulations are “fit-for-purpose.”

What rules has FinCEN withdrawn?

The first one was proposed way back in December 2020. It would have required banks and money services businesses (MSBs) to collect, verify and report certain information relating to CVC or digital assets involving unhosted wallets or certain foreign-hosted wallets.

The proposal required reporting and customer identity verification for transactions above $10,000. It also proposed recordkeeping and verification requirements for certain transactions above $3,000.

The second withdrawal is a 2023 proposal on CVC mixing. FinCEN had proposed treating international CVC mixing as a class of transactions of primary money laundering concern and introducing additional recordkeeping and reporting requirements.

The proposed reporting framework would have captured information such as transaction amounts, wallet addresses, transaction hashes, dates, IP addresses and information about the CVC mixer involved.

Why did FinCEN withdraw the proposals?

FinCEN said the withdrawal of the mixer proposal was influenced partly by concerns that its broad definition of CVC mixing could affect legitimate activity, bother domestic consumers, and would bring a reporting burden for financial institutions.

The agency also made clear that it still views mixers as a potential illicit-finance risk. FinCEN said it will continue monitoring CVC mixer activity for signs of money laundering, terrorist financing and other illicit activity and may take action in the future.

These withdrawals remove proposed rules that had not become final requirements. They do not mean that existing AML obligations for regulated financial institutions or digital-asset businesses have been eliminated.

What does this mean for compliance teams?

Digital-asset compliance teams and firms should continue to assess risks associated with:

• Unhosted and self-custody wallets
• Transactions involving crypto mixers or privacy-enhancing services
• Unusual movement of digital assets between wallets
• Rapid transfers through multiple addresses
• Transactions involving high-risk jurisdictions or counterparties
• Patterns that may indicate attempts to obscure the source or destination of funds

The development also highlights the importance of keeping AML programs flexible as digital-asset regulation continues to evolve.

For financial institutions and crypto businesses, compliance teams should distinguish between requirements that are currently in force and proposals that have been withdrawn, while continuing to use a risk-based approach to identify potentially fraudulent activity.