On October 6, the Trump Administration withdrew a proposed rule that would have required U.S. financial institutions to report transactions involving foreign cryptocurrency mixers within 30 days of detection. Shortly after, Transparency International's U.S. chapter urged FinCEN to reinstate the Biden-era proposal, along with a 2020 proposal targeting crypto transfers to self-hosted wallets.
For your compliance team, this isn't just another regulatory headline. It's a signal that your anti-money laundering (AML) controls need to adapt quickly. Waiting for regulatory clarity could leave your organization vulnerable.
What Changed
The withdrawn rule aimed to close a gap in U.S. anti-money laundering enforcement. Cryptocurrency mixers obscure the source, destination, and amount of crypto transactions by pooling and redistributing funds. This makes them attractive to ransomware operators, sanctions evaders, and others who want to hide their money movements.
U.S. law requires anyone taking custody of customer funds to register with FinCEN and verify customer identities. No U.S. company can legally operate a mixer openly, and those who try covertly face money laundering prosecutions.
However, foreign mixers operate outside U.S. jurisdiction. The proposed rule would have required U.S. financial institutions to flag any transaction they "know, suspect, or have reason to suspect" involved a foreign mixer. With the withdrawal, that reporting obligation is off the table, for now.
The letter from Transparency International highlights a key point: regulatory uncertainty doesn't reduce risk. It just shifts responsibility to your team.
Key Considerations
The regulatory floor just dropped. Without the proposed rule, there's no specific FinCEN requirement to report mixer-related transactions. However, your obligations under the Bank Secrecy Act remain. If a transaction pattern suggests money laundering, you still need to file a Suspicious Activity Report (SAR).
International enforcement is inconsistent. Many jurisdictions are cracking down on mixers, but enforcement varies. Your third-party due diligence process must account for crypto service providers operating in permissive jurisdictions, even if they're not technically mixers.
Technology is outpacing regulations. Mixers are just one obfuscation method. Privacy coins, decentralized exchanges, and layer-two protocols create similar challenges. A compliance program focused on specific technologies will always lag behind the threat.
Advocacy pressure is mounting. The Transparency International letter indicates that civil society groups are pushing for tighter controls. Even if FinCEN doesn't reinstate the rule immediately, expect continued pressure for crypto-related AML requirements.
What This Means for Your Team
Your AML program can't wait for regulatory certainty. The withdrawal creates a gap between potential future requirements and what your current controls detect.
If your institution handles crypto transactions, you're making judgment calls about suspicious activity without clear guidance on mixer-related reporting. This puts pressure on your transaction monitoring systems and your investigators' ability to recognize red flags.
Even if you don't directly handle crypto, you're not off the hook. Your customers and counterparties might be using digital assets in ways that create risk for your institution. Supply chain payments, cross-border transactions, and third-party relationships can all involve crypto without your direct visibility.
The push for reinstating the rule suggests this issue won't disappear. Whether through new rulemaking, enforcement actions, or examination priorities, FinCEN will likely address mixer-related risks. Compliance teams that treat the withdrawal as a green light are setting themselves up for problems.
Action Steps for Your Team
Immediate: Review your SAR filing criteria. Don't wait for a specific mixer rule. If your transaction monitoring system flags patterns consistent with obfuscation, like rapid movement across multiple wallets or transactions routed through known mixer addresses, your investigators need clear guidance on when to escalate. Document your decision framework now.
Within 30 days: Update your third-party risk assessment. If you work with payment processors, exchanges, or other financial service providers, ask explicit questions about their crypto exposure and their controls for detecting mixing activity. Don't accept boilerplate responses. You need to understand whether they have the technical capability to trace transaction origins.
Within 90 days: Audit your transaction monitoring rules. Most monitoring systems were designed before widespread crypto adoption. If your rules focus on traditional wire transfers and ACH patterns, they'll miss crypto-related risks. Work with your technology team to identify whether your system can flag transactions involving known mixer addresses or patterns consistent with obfuscation attempts.
Ongoing: Track FinCEN guidance and enforcement actions. The withdrawal doesn't mean the issue is settled. Monitor FinCEN's examination priorities, enforcement actions against financial institutions, and any new proposed rules. If FinCEN reinstates reporting requirements, you'll need to implement controls quickly.
Strategic: Build flexibility into your compliance program. Technology-specific rules become obsolete quickly. Instead of building controls around "mixers," design your program to detect obfuscation patterns regardless of the specific tool. Train your investigators to recognize when transaction flows don't make economic sense, even if they can't identify the specific method used to obscure the trail.
The regulatory landscape for cryptocurrency will keep shifting. Your compliance program needs to be built on principles that outlast any single rule.
