US Drops Crypto Wallet Rules: EU Firms Still on the Hook

On October 5, 2026, the US Financial Crimes Enforcement Network published two notices in the Federal Register: it was withdrawing its December 2020 proposed rulemaking on transactions involving convertible virtual currency and digital assets, and its October 2023 proposal to designate cryptocurrency mixing as a primary money laundering concern requiring special measures.

For US-based exchanges and money services businesses, the withdrawal removes two regulatory threats that had hung over the industry for years. The 2020 proposal would have required banks and money services businesses to verify customers, keep records, and file currency transaction reports on transfers above $10,000 to or from unhosted wallets, with recordkeeping requirements down to $3,000. The 2023 proposal would have imposed Bank Secrecy Act special measures on convertible virtual currency mixing services — a move Coin Center and others had attacked on First Amendment grounds.

FinCEN's stated justification leaned on the current administration's deregulatory agenda, and specifically on a July 2025 report from the President's Working Group on Digital Asset Markets. On the mixer rule, the agency acknowledged the concern directly: the proposal "could have a chilling effect on legitimate activity and place a large reporting burden on covered financial institutions."

For compliance teams at US-regulated platforms, this is meaningful. Two specific frameworks they had been planning around no longer exist.

For compliance teams at EU-regulated platforms, it changes nothing.

What FinCEN's Withdrawal Actually Covers

Neither of the withdrawn proposals had been finalized. The 2020 unhosted wallet notice of proposed rulemaking, often called the "midnight rulemaking" because it was published in the final weeks of the Obama administration and revived years later, never cleared the comment period. The 2023 mixer proposal attracted hundreds of comments, including from protocol developers who argued mixing was indistinguishable from standard privacy-preserving transaction batching.

Withdrawing a proposed rule removes the regulatory uncertainty that surrounds it. It does not remove existing law.

FinCEN is explicit on this point in both notices. Existing Bank Secrecy Act requirements — know-your-customer obligations, suspicious activity reporting, transaction monitoring — remain fully in force for every registered money services business and bank that touches virtual assets. OFAC sanctions targeting specific mixer protocols, including the Tornado Cash designations that survived separate legal challenges, are also unaffected.

The practical effect is narrower than the headline. US-regulated exchanges were already subject to AML and KYC obligations under existing rules. The withdrawn proposals would have extended those obligations to cover transactions involving self-hosted wallets specifically and mixing services categorically. Without finalization, those extensions never existed in enforceable form. Withdrawing them ends the possibility of that future extension materializing from these particular rulemakings.

It is also worth noting, as several crypto legal practices have observed, that proposals can be revived. A future administration or FinCEN leadership could restart either rulemaking.

The EU Runs a Different Playbook

The contrast with European regulation is sharp enough to matter even for US-headquartered firms with EU customers.

Transfer of Funds Regulation — Regulation (EU) 2023/1113, applying since 26 December 2024 — imposes travel rule obligations on every crypto-asset transfer, with no minimum threshold. Where the withdrawn US proposal would have applied above $3,000 (recordkeeping) and $10,000 (reporting), the EU rule applies from the first euro.

More directly relevant to the FinCEN comparison: the TFR already has explicit requirements for transfers involving self-hosted wallets. When a CASP's customer withdraws more than €1,000 to a self-hosted wallet, the CASP must verify that the customer actually owns or controls it. The mechanism — a signed message from the private key or a confirmed micro-transaction from the wallet — creates friction the US proposal would have matched but that EU firms already carry.

The detailed breakdown of how these self-hosted wallet checks work in practice is in our analysis of the MiCA Travel Rule obligations for CASPs.

AMLR 2027 — Regulation (EU) 2024/1624, the Anti-Money Laundering Regulation — applies from 10 July 2027. It bans crypto-asset service providers from holding anonymous accounts and from offering services involving privacy-enhancing features, including mixing. That ban covers services the withdrawn US mixer proposal targeted. For EU CASPs, the prohibition is not a future regulatory risk — it is an obligation with a defined implementation date.

AMLA final draft — On 1 October 2026, AMLA published its final draft customer due diligence regulatory technical standards. The standards formalize how CASPs must collect and verify identity data, including attribute-level requirements such as verifying at least one nationality when a customer declares several. The AMLA's supervisory role, which extends to the largest EU CASPs directly, means these standards are enforced rather than advised. A full discussion of AMLA's expanding mandate is in our article on AMLA and direct supervision for crypto.

The table below summarizes where the two regimes currently sit on the areas the FinCEN withdrawal touched.

Area	US (post-withdrawal)	EU (current rules)
Self-hosted wallet KYC	No specific rule (existing BSA rules apply)	TFR requires ownership verification above €1,000
Mixing services	No finalized restriction (OFAC sanctions separate)	AMLR 2027 bans privacy-enhancing services
Travel rule threshold	FATF baseline ($1,000)	No minimum threshold — applies from €0
Anonymous accounts	Prohibited for registered MSBs	Prohibited under AMLR from July 2027
Supervisory model	FinCEN + state regulators	AMLA (direct) + national competent authorities

The AI Threat That Neither Regime Has Fully Answered

A survey published today by Regula, drawn from 850 fraud-prevention and financial-crime decision-makers across six sectors and seven markets, found that 44% of surveyed crypto firms have confirmed AI-assisted or automated activity on the user side of identity checks. The comparable figure across other sectors is 31%.

The pattern being described is not AI agents managing accounts on behalf of authorized users — that is a separate compliance challenge covered in our analysis of agentic KYC and AI in compliance workflows. The pattern in the Regula data is adversarial: automated tooling being used to submit identity documents, pass liveness checks, or navigate onboarding flows on behalf of synthetic or stolen identities.

The relevance to the FinCEN withdrawal is indirect but real. The proposed unhosted wallet rule and the mixer rule were both designed, in part, to interpose identity checkpoints at moments of high fraud risk. Removing them from the table in the US — even as proposals — reduces the future surface area for those checkpoints. Meanwhile the automation of identity fraud is accelerating in the segment those rules were meant to govern.

Crypto has higher exposure than most sectors for a structural reason: the combination of irreversible settlement, pseudonymous infrastructure, and on-chain liquidity creates payoff conditions that reward investment in sophisticated fraud tooling. When FinCEN withdraws oversight proposals, it removes one potential friction point. It does not remove the underlying incentive.

EU CASPs should not read the US withdrawal as validation of a lighter approach. The post-MiCA enforcement landscape has shown that national supervisors in France, Germany, and the Netherlands have pursued enforcement actions against platforms with structural KYC deficiencies. The FATF's July 2026 report on stablecoin money laundering — which found 84% of illicit crypto flows now running through stablecoins — underscores that the underlying risk environment is not softening. That report's findings are set out in our piece on FATF's stablecoin findings and what CASPs must do.

What EU CASPs Should Do Now

The FinCEN withdrawal warrants attention but does not trigger action for EU-regulated platforms. The checklist that matters is the one already in progress:

Travel Rule infrastructure. The TFR has been in force since December 2024. CASPs that have not completed technical integration with a recognized messaging protocol — TRISA, OpenVASP, or an equivalent — are already non-compliant, not merely at risk.

Self-hosted wallet verification. The ownership verification requirement for withdrawals above €1,000 is live and being enforced. CASPs that have not built a compliant workflow — cryptographic attestation or micro-transaction confirmation — need to close that gap now.

AMLR preparation. July 2027 is less than nine months away. Platforms offering any mixing-adjacent feature, privacy coin trading with enhanced anonymity, or anonymous account-equivalent functionality should be auditing their product against the AMLR prohibition today, not at implementation time.

AI fraud detection. The Regula survey's finding that 44% of crypto firms see AI-assisted identity attempts means liveness detection, document forensics, and behavioral signals at onboarding are no longer optional layers. They are the first line of defense against a threat that is already confirmed, not merely anticipated.

The Joinble AI agents for compliance are built specifically for the event-driven, continuous monitoring model that AMLR and the broader EU supervisory regime now require. Static onboarding checks cannot meet obligations that are defined in terms of ongoing relationships and real-time risk.

---

FAQ

Does FinCEN's withdrawal affect EU crypto firms? No. EU CASPs operate under the Transfer of Funds Regulation, MiCA, and the forthcoming AMLR. These are EU regulations with no dependency on US rulemaking. FinCEN's withdrawal removes proposed US requirements that were never finalized and did not apply to EU-regulated entities.

What is the TFR's rule on self-hosted wallets? Regulation (EU) 2023/1113 requires CASPs to verify that a customer owns or controls a self-hosted wallet before processing transfers above €1,000 to it. Below €1,000, the transaction can proceed but the CASP must retain records. This rule has applied since 26 December 2024.

When does AMLR's mixing ban take effect? Regulation (EU) 2024/1624 applies from 10 July 2027. It explicitly prohibits CASPs from maintaining anonymous accounts or providing services with privacy-enhancing features. CASPs should complete product audits and implement required changes before that date.

What did FinCEN actually withdraw? Two proposed rulemakings: a December 2020 NPRM that would have imposed identity verification and reporting requirements on transfers involving self-hosted wallets, and an October 2023 proposal to designate convertible virtual currency mixing as a primary money laundering concern. Neither had been finalized into binding rules.

Can FinCEN revive these proposals? Yes. Withdrawing a proposed rule does not bar a future rulemaking on the same subject. A future FinCEN leadership could initiate a new proposal on either area at any time, including restarting these specific NPRMs under a new administration.

What is the Regula crypto identity survey finding? A Regula survey released on October 8, 2026, covering 850 fraud-prevention and financial-crime decision-makers, found that 44% of crypto firms had confirmed AI-assisted or automated activity on the user side of identity checks. This is 13 percentage points higher than the cross-sector average of 31%, indicating disproportionate fraud pressure in the crypto segment.