FinCEN has officially withdrawn two proposals that would have required anti-money laundering reporting for self-hosted crypto wallets and crypto mixers. These proposals faced industry resistance and remained dormant for years. Now, they're off the table.
For your compliance team, this creates a unique challenge. You can't wait for regulatory clarity that might never come. Your organization could already be dealing with crypto through vendor payments, employee reimbursements, or customer transactions. The lack of formal rules doesn't eliminate the risk.
Let's address some common misconceptions about managing crypto-related compliance in this regulatory gap.
Myth 1: Without FinCEN Rules, Crypto Transactions Aren't Your Problem
Reality: Your existing anti-money laundering obligations still apply, even without crypto-specific guidance.
If your organization handles payments, processes transactions, or maintains relationships involving cryptocurrency, you're subject to Bank Secrecy Act requirements. The real question is whether your current controls can detect suspicious activity when transactions are decentralized.
Self-hosted wallets operate outside traditional financial systems. There's no bank to file a Suspicious Activity Report for your counterparty. Mixers intentionally obscure transaction trails. These aren't just theoretical concerns; they're features that create blind spots in your due diligence process.
What to check: Review your vendor onboarding questionnaire. Does it ask how the vendor receives payment? If a supplier requests payment to a wallet address instead of a bank account, does your accounts payable team know what questions to ask?
Myth 2: Industry Resistance Means These Risks Were Overblown
Reality: Pushback against FinCEN's approach doesn't mean the risks have vanished.
Industry groups opposed the proposals due to implementation burdens, privacy concerns, and technical challenges, not because mixers and unhosted wallets don't pose compliance challenges. Mixers sever the link between a cryptocurrency's origin and destination. While useful for privacy, they're also used for layering illicit funds. When a business counterparty uses mixing services, you lose visibility into the source of funds. Your standard "know your customer" checks can't trace the money back.
The regulatory retreat doesn't change this reality. It just means you won't have a standardized reporting framework to rely on.
Myth 3: You Can Build Effective Controls Without Regulatory Guidance
Reality: You can build controls, but you'll need to make risk-based judgments that formal rules would have clarified.
Self-hosted wallets aren't inherently suspicious. Many use them for legitimate reasons, like security and autonomy. But they shift risk. When a traditional financial institution holds assets, it has compliance obligations. When your vendor holds cryptocurrency in a self-hosted wallet, those obligations disappear.
Your internal controls need to account for this shift. Define your organization's risk appetite for crypto transactions. Decide which wallet arrangements you'll accept and which you won't. Establish thresholds for additional due diligence.
This isn't simple, and there's no one-size-fits-all template. A software company paying bug bounty hunters in cryptocurrency faces different risks than a real estate firm accepting crypto for property deposits.
Practical starting point: Draft a decision tree for your finance team. If a transaction involves cryptocurrency, what triggers additional review? Consider factors like transaction size, counterparty history, jurisdiction, and whether mixing services are involved.
Myth 4: Crypto Compliance Is Mainly a Financial Services Problem
Reality: Any organization dealing with digital assets needs a plan for managing associated risks.
You don't need to be a cryptocurrency exchange to face these issues. Consider these scenarios:
Your company sponsors a conference. An attendee wants to pay the registration fee in cryptocurrency. Do you accept it? If so, how?
An employee submits an expense report with a transaction fee for converting cryptocurrency. Your expense policy doesn't mention digital assets. How does the approval chain handle it?
A prospective vendor offers a discount for payment in stablecoin. Your procurement team asks compliance if this is allowed. What's your answer?
These aren't rare cases anymore. They're operational questions that arise when your policies haven't kept up with how people transact.
Myth 5: You Should Wait for the Next Regulatory Proposal Before Acting
Reality: Waiting for regulatory clarity is a risk decision in itself.
FinCEN abandoned these proposals after years of dormancy. This indicates the slow pace of formal rulemaking in this space. Even if new proposals emerge, the process from proposal to final rule to implementation can take years.
Meanwhile, your organization operates now. If you're encountering crypto transactions and haven't established internal controls, you're choosing to accept the risk without mitigation.
The Federal Sentencing Guidelines for Organizations don't require you to predict future regulations. They require you to exercise due diligence to prevent and detect criminal conduct based on identifiable risks. Money laundering through cryptocurrency isn't hypothetical; it's documented.
Your compliance program should reflect that reality, even without prescriptive rules.
What to Do Instead
Start with a risk assessment specific to cryptocurrency exposure. Map where your organization currently encounters or might encounter digital assets. This includes payments, investments, employee transactions, and customer relationships.
For each exposure point, evaluate your existing controls. Can your vendor due diligence process identify when a supplier uses a self-hosted wallet? Does your transaction monitoring system flag cryptocurrency conversions? If an employee expense involves a mixer, would anyone notice?
Then establish clear internal policies. Define what's acceptable, what requires additional approval, and what's prohibited. Make these policies specific enough for your finance and procurement teams to apply without escalating every question.
Document your reasoning. If you choose to accept certain crypto-related transactions, explain why you believe your controls adequately address the risk. If you prohibit others, explain that too. This documentation matters if you need to demonstrate that your compliance program was reasonable given what you knew.
The regulatory landscape for cryptocurrency remains uncertain. That's not an excuse to avoid the issue. It's a reason to think carefully about the risks your organization faces and the controls you need to manage them.
