Fincen scraps crypto mixer rule built to fight ransomware | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware

• Key insight: Fincen withdrew its first-ever proposal to treat an entire class of transactions, international crypto mixing, as a primary money-laundering concern.
• Supporting data: Fincen estimated about 15,000 institutions would have filed the mixer reports, spending a combined 1.47 million hours a year.
• Forward look: Fincen said it will keep monitoring mixers and “may take appropriate steps in the future.”

Overview bullets generated by AI with editorial review.

Processing Content

The Treasury Department’s financial crimes bureau is scrapping a proposed rule that would have made banks report customer transactions tied to foreign cryptocurrency mixers.

Mixers are services that pool and shuffle crypto from many users to hide where any of it came from. The Financial Crimes Enforcement Network, or Fincen, posted a notice Monday withdrawing its October 2023 proposal targeting them.

The proposal was the first time Fincen had used section 311 of the USA Patriot Act, which lets Treasury impose special measures such as extra reporting requirements on money-laundering threats, against a whole class of transactions rather than a specific foreign bank or country.

Fincen had built its case largely on ransomware gangs and North Korean thieves, who use mixers to launder extorted and stolen funds. North Korea uses these laundered funds to support its weapons programs, Treasury reported earlier this year.

Fincen is withdrawing the proposal “as part of the Trump administration’s deregulatory agenda,” according to a Monday press release.

The withdrawal notice cites concerns from commenters that the rule would have had “a chilling effect on legitimate activity” and placed “a large reporting burden on covered financial institutions.”

The notice also concedes that “illicit actors continue to use mixers.”

Fincen’s own analysis of the mixer rule found that certain banks could face the largest added reporting burden. Yet the banking industry barely objected.

Only one bank trade group (the Independent Community Bankers of America, or ICBA, submitted a comment letter, according to American Banker’s review of the comment docket, and it argued that the proposed rule didn’t go far enough.

With the withdrawal, banks keep their existing duty to report suspicious activity, without having to specifically report mixer activity. Treasury’s 2026 National Money Laundering Risk Assessment, published in March, still lists mixers among the tools criminals “commonly use” to hide illicit crypto.

Fincen on Monday also withdrew a December 2020 proposal, from the final weeks of President Donald Trump’s first term, aimed at so-called unhosted wallets, which people hold themselves rather than at an exchange.

Fincen misquotes White House report

Both withdrawal notices point to a July 2025 White House report from the President’s Working Group on Digital Asset Markets, a body Trump created by executive order to set crypto policy.

Illicit actors such as North Korea and ransomware gangs “continue to use mixers to obfuscate and launder funds,” but “lawful users of digital assets may leverage mixers to enable financial privacy when transacting through public blockchains,” according to the report.

The report recommended that Treasury “consider next steps” on the mixer proposal.

In explaining the withdrawal, Fincen’s notice misquotes that White House report as saying, “the Trump Administration supports the ability of lawful users of digital assets to privately transact on a public blockchain,” on page 100.

The supposed quote does not appear on page 100 or anywhere else in the report, nor does it appear in the press release or fact sheet that accompanied the White House report.

A Treasury spokesperson, responding to questions sent to Fincen, did not answer a question about the misquote on the record.

Who would have carried the burden

Under the 2023 proposal, banks and other covered institutions would have filed a report on any crypto transaction they knew or suspected involved foreign mixing.

Each report would have listed the wallet addresses, transaction hashes (the unique identifiers of blockchain transfers), IP addresses and identities of the customers involved, according to the proposal.

The rule would have flipped the default for banks “from determining when a CVC transaction is reportable to determining when it is not reportable,” according to the proposal. (CVC, or convertible virtual currency, is Fincen’s term for crypto.)

About 15,000 institutions would have filed the reports, spending an average of 98 hours a year on them, or 1.47 million hours in total, according to Fincen’s estimate in the proposal.

Fincen expected crypto exchanges and similar firms to face the smallest added burden, because the rule “imposes the least adaptation from current compliance practices and processes” for them, according to the proposal.

The largest added burden would fall on institutions with crypto exposure whose compliance programs weren’t built around crypto, which Fincen said in the proposal “may characterize certain banks.”

Spotting indirect exposure, where a mixer sits several transactions upstream of a customer’s deposit, could require analytics tools costing “in excess of tens of thousands of dollars per license,” according to the proposal.

Even so, banks “are already heavily regulated and typically already feature robust monitoring and compliance programs,” so the impact on them “might still be low,” Fincen said elsewhere in the proposal.

Taken together, banks already had the machinery to file reports at scale, and crypto firms already had the tools to trace funds across blockchains.

Crypto and small banks clash

The proposal drew more than 2,000 public comments, and the loudest complaints about it came from the crypto industry.

The Blockchain Association, a crypto industry trade group, said in its letter that the rule would require financial institutions “to analyze the blockchain history of particular digital assets,” something they are not otherwise required to do.

The Independent Community Bankers of America, or ICBA, argued nearly the opposite. The proposed requirements were “not enough,” and “there are no legitimate uses for CVC mixing,” according to the group’s January 2024 comment letter.

The group has fought crypto firms’ entry into banking on several fronts, most recently suing the Office of the Comptroller of the Currency on Friday over crypto trust charters.

ICBA’s 2024 letter did complain that Fincen should confront “the cryptocurrency industry” rather than add new requirements for community banks.

Still, ICBA is now “disappointed” by the withdrawal, because legitimate uses for mixers “have not been established in the United States, while their illicit finance risks are well documented,” Brian Laverdure, the group’s senior vice president of digital assets and innovation policy, told American Banker on Monday.

The group still wants a ban on dealing with mixers built or used mainly to hide illicit activity. It also wants anti-money-laundering controls on crypto firms that match banks’. Community banks “should not be forced to reconstruct transactions that crypto intermediaries can observe more directly,” Laverdure said.

Mixers remain in use, but criminals are shifting

The 10 largest mixers processed more than $20 billion from January 2011 through August 2022, and about 13% of their deposits came from known illicit activity, according to Fincen’s analysis in the 2023 proposal.

More recent anecdotal evidence aligns with these estimates. Tornado Cash, among the best-known mixers, “facilitated more than $1 billion in illegal transactions,” according to an August 2025 release from federal prosecutors in Manhattan.

Also in 2025, a federal judge sentenced the founders of Samourai Wallet, another mixing service, to prison for transmitting what prosecutors said in a sentencing release was more than $237 million in criminal proceeds. More than $2 billion in bitcoin passed through Samourai’s services overall, according to the release.

(Samourai had co-signed a 2024 comment letter urging Fincen to “withdraw the Mixing Transaction NPRM altogether.”)

Fincen’s December 2025 analysis of ransomware in Bank Secrecy Act filings does not mention mixers. Ransomware actors “overwhelmingly collected payments in unhosted” wallets and “continued to exploit CVC exchanges for money laundering purposes after receiving payment,” according to the analysis.

Ransomware actors’ mixer-related activity fell 37% across 2024 and 2025 while their use of cross-chain bridges, which move crypto between blockchains, grew 66%, according to a January report from TRM Labs, a blockchain analytics firm that sells tracing tools to financial institutions.

Elliptic, another blockchain analytics firm that sells to banks, reached a similar conclusion in a July report for financial institutions: “Cross-chain bridges displaced single-chain mixers as the dominant obfuscation technique.”

Reactions to the withdrawn proposals

The risks behind both withdrawn proposals “are real,” Ari Redbord, chief policy officer at TRM Labs, told American Banker. “Mixers have been used to launder billions for North Korea’s hackers.”

Still, both proposals “were written for an earlier moment,” and tracing tools now let compliance teams “flag exposure to mixers and sanctioned wallets before funds settle,” Redbord said.

Broad reporting mandates “would put heavy costs on lawful users, bury investigators in low-value data, and push activity toward less visible channels,” he said.

For banks, “not much” changes after Fincen’s withdrawal of the proposal, according to Carlton Greene, a partner at the law firm Crowell & Moring and a former chief counsel of Fincen. Transactions involving mixers are still likely to be viewed “as requiring enhanced due diligence,” he said.

Greene told American Banker that he doesn’t see Fincen “saying that the money laundering and sanctions evasion risks it previously has identified with mixers are lower.”

Fincen “will continue to monitor activity involving CVC mixers” for signs of money laundering, terrorist financing and other illicit finance, and “may take appropriate steps in the future,” according to the withdrawal notice.