FinCEN Withdrew the $10,000 Self-Hosted Wallet Rule After 6 Years. The Exchange Still Logs Every Address You Withdraw To

What Happened

The Financial Crimes Enforcement Network (FinCEN), the Treasury bureau that administers the Bank Secrecy Act, filed 2 notices on Monday, October 5, withdrawing the 2 longest-pending crypto rules on its books. Both were signed by Deputy Director Jimmy L. Kirby and scheduled for Federal Register publication on Tuesday, October 6.

The first withdraws the proposed rule FinCEN issued in December 2020, under Treasury Secretary Steven Mnuchin, that would have required banks and money services businesses, crypto exchanges included, to verify a customer's identity and keep records on any transaction above $3,000 with an unhosted wallet, including the name and physical address of the counterparty, and to file a report with FinCEN on any transaction, or set of transactions within 24 hours, above $10,000.

The notice says FinCEN will take no further action on the proposal.

The second withdraws the finding FinCEN published in October 2023 under section 311 of the USA PATRIOT Act that international convertible virtual currency mixing is a class of transactions of primary money laundering concern, together with the proposed special measure that would have required covered institutions to report transactions they knew or suspected involved mixing, down to wallet addresses, transaction hashes, and IP addresses.

FinCEN says the decision was informed by commenters' concern that the proposal's expansive definition of mixing could have a chilling effect on legitimate activity and place a large reporting burden on institutions. It adds that illicit actors still use mixers, that it will keep monitoring, and that it may take appropriate steps in the future.

Both notices cite the July 30, 2025 report of the President's Working Group on Digital Asset Markets.

The rule that died would have added a report to the file. The file itself, your name beside the address you withdrew to, was opened the day you bought the coins and was never up for withdrawal.

Two Proposals That Never Took Effect

The 2020 rule arrived on December 18 with a 15-day comment period that ran through the holidays, which is why critics called it a midnight rule. More than 7,500 comments came in anyway, and on January 15, 2021, days before the administration changed, FinCEN reopened the docket for 15 more days on the reporting piece and 45 on the rest.

Then nothing happened for nearly 6 years. The proposal sat on Treasury's agenda through 2 administrations as a standing option: never withdrawn, never finalized, always available. The report it would have required was modeled on the currency transaction report banks file for cash, with a field the cash form does not have: the identity and address of whoever was on the other side of the transfer, which, when the other side is the customer's own hardware wallet, the exchange can only take on the customer's word.

The 2023 mixer proposal was the more novel instrument. Section 311 lets Treasury designate a foreign bank, a jurisdiction, or a class of transactions as a primary money laundering concern and impose special measures on the US institutions that touch it. Before October 2023 it had been used against banks and jurisdictions.

Aiming it at a class of transactions was a first, and the definition of mixing covered pooling funds, algorithmically coordinating transactions, splitting transfers, single-use wallets, swapping one asset for another, and delaying transactions. Commenters, about 2,000 of them by the time the period closed in January 2024, argued that this language described Lightning channels and ordinary CoinJoins as readily as a laundering service.

FinCEN's withdrawal notice adopts that argument almost verbatim.

What Is Still Written Down

The skeptic's reading is that nothing changed on Monday, and for the mechanics of a regulated purchase that is correct. 24/7 Wall St. headlined the news as privacy over surveillance and then told readers to check the fine print: the identity check at Coinbase or any other exchange registered as a money services business is a Bank Secrecy Act requirement, not a 2020 proposal, and it stands.

So do the recordkeeping and travel rules at $3,000, which FinCEN's May 2019 guidance applied to crypto transmittals, and the exchange's own ledger, which records the destination address of every withdrawal and keeps it for at least 5 years. The scam-compound alert FinCEN issued on September 3 asked those same institutions to flag the funding pattern of a large self-custody purchase, and the special measure it proposed on October 1 against the A7 Network's front companies shows the bureau is still writing rules.

It is choosing targets differently.

The mixer withdrawal changes even less for the people who run mixers. The section 311 proposal was aimed at what banks and exchanges would have to report, not at operators, and operators have been handled by prosecutors. Samourai Wallet's founders were sentenced to 5 and 4 years in November 2025 for conspiring to run an unlicensed money transmitting business.

Roman Storm of Tornado Cash was convicted on the same charge in August 2025, with a retrial on the laundering and sanctions counts set for April 26, 2027, after the Office of Foreign Assets Control had already delisted the protocol in March 2025. What Monday removed is a reporting trigger at the regulated edge of a mixing transaction.

What it did not remove is the authority. Coin Center's Peter Van Valkenburgh, whose organization fought both proposals from the start, called the withdrawals a win and in the same breath noted that the statutory power to write similar rules remains.

What This Means for You

For a reader who buys bitcoin through a regulated exchange and moves it to a hardware wallet, the practical change is that a report that was never filed will now never be filed. The record that exists is the one you created at the on-ramp: your identity, your bank account, the amount, and the address you withdrew to.

That record does not expire with the proposal. Treat it as permanent and design around it. Receive to a fresh address every time, never reuse one, and keep the wallet that holds long-term coins separate from the wallet that touches exchanges, so that a lookup by your name returns a withdrawal and not a balance sheet.

Self-custody does not erase the purchase. It ends the exchange's control over the coins, which is the point, and the part that died on Monday is a report the exchange would have filed every time you moved more than $10,000 to yourself. The trail that remains is on the chain, readable by the analytics firms every exchange retains, and the Bank Secrecy Act gives FinCEN a request-and-response channel to the institutions that hold your name.

If privacy on the chain matters to you, the tools exist, and the people who built the best-known ones are in prison for how they ran a business, not for publishing code. Use them with that distinction in mind, and with the knowledge that FinCEN wrote into its own withdrawal notice that it may act on mixing again.

The larger point is what kind of thing was withdrawn. A proposed rule is a policy. This one was issued by one administration, left pending by the next, and withdrawn by a third on the strength of a working group report that says lawful users may transact privately. A report can be superseded.

Section 311, the funds transfer rules, and the reporting authority Treasury reached for in 2020 are statutes, and they read the same today as they did on Friday. The private keys in your hands are the only part of this arrangement that does not depend on who runs FinCEN, and they are the only part that never did.

What to Watch

The President's Working Group named 2 proposals for rescission, and 1 is gone. The October 2020 proposal with the Federal Reserve to lower the international funds transfer threshold from $3,000 to $250 and to define convertible virtual currency as money is still pending, and whether FinCEN withdraws it, finalizes it, or leaves it as a standing option will say more about the bureau's direction than Monday did.

FinCEN's line that it may take appropriate steps on mixing is the hook for the next proposal, and a new advisory naming mixing typologies would be the early sign. In Europe, the Transfer of Funds Regulation already requires exchanges to prove a customer controls a self-hosted wallet before transfers above 1,000 euros, and the European Commission's review of further self-hosted wallet measures is the counterpart to watch for divergence.

Judge Katherine Polk Failla's ruling on Roman Storm's acquittal motion comes before the April 2027 retrial. The Treasury and IRS regulations that would switch on the $10,000 digital asset receipt reporting requirement under section 6050I, on hold since January 2024, are the other surveillance trigger nobody has withdrawn.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.