Two documents went into the Federal Register this morning, two pages each. Between them they close out five years and nine months of American crypto rulemaking. Neither of them changes anything in law, because neither rule was ever law.
FinCEN has withdrawn the 2020 proposal that would have forced banks and money services businesses to report transfers over $10,000 involving unhosted wallets, and the 2023 finding that international convertible virtual currency mixing is a class of transactions of primary money laundering concern. The first was published on 23 December 2020 and was pending for 2,113 days. The second was published on 23 October 2023 and was pending for 1,079 days. Days in force, between the two of them: zero.
The asked half is whether the withdrawals are good news. Mostly, yes. The unasked half is what those 2,113 days cost, who paid, and why there is no number anywhere for it.
TL;DR
- FinCEN withdrew the unhosted wallet reporting proposal (85 FR 83840) and the CVC mixing finding (88 FR 72701) on 6 October 2026. Neither was ever in force for a single day.
- The unhosted wallet docket drew 8,274 public comments. The withdrawal notice does not contain the word “comment” once. The final comment deadline was 29 March 2021, so the answer arrived 2,017 days later.
- FinCEN’s mixer withdrawal says the expansive definition “could have a chilling effect on legitimate activity”. Three years into the chill, the agency still writes it in the conditional, because nobody ever measured it.
- The withdrawn definition of CVC mixing covered pooling funds from multiple wallets and “using programmatic or algorithmic code to coordinate, manage, or manipulate the structure of a transaction”, with a CVC Mixer defined to include a “function”. A pooled on-chain prize draw satisfies both limbs by construction.
- Deployed code has no proposed state. A contract is binding the moment it is live and not one second before, which is the only property in this story that a reader can check for themselves.
What was actually withdrawn
The first notice (FR Doc 2026-20430, RIN 1506-AB47) kills the rule crypto spent the winter of 2020 arguing about. It would have required banks and MSBs to file a report with FinCEN, including counterparty information, and to verify their own customer’s identity, whenever a counterparty used an unhosted wallet and the transaction exceeded $10,000, or where multiple transactions aggregated above $10,000 in 24 hours. A recordkeeping and identity verification duty kicked in above $3,000. The proposal defined an unhosted wallet as the case “when a financial institution is not required to conduct transactions from the wallet”, and extended the same treatment to wallets held at institutions in foreign jurisdictions FinCEN chose to name.
The withdrawal cites the July 2025 report of the President’s Working Group on Digital Asset Markets, established by Executive Order 14178, and ends with a sentence that is unusually final for an agency: “FinCEN will take no further action on this NPRM.”
The second notice (FR Doc 2026-20429) withdraws both a finding and a proposed rule under section 311 of the USA PATRIOT Act. FinCEN had found that international CVC mixing was a class of transactions of primary money laundering concern, and proposed special measure one: enhanced recordkeeping and reporting whenever a covered financial institution knew, suspected, or had reason to suspect that a transaction involved mixing within or involving a jurisdiction outside the United States.
Its closing paragraph is the one worth reading twice. FinCEN “maintains that illicit actors continue to use mixers”, but the withdrawal “is informed by the concerns from commentors that the expansive definition of CVC mixing in the proposed rule could have a chilling effect on legitimate activity and place a large reporting burden on covered financial institutions”. It then reserves the right to “take appropriate steps in the future”.
One more date matters. On 5 October 2026, the day before both withdrawals, FinCEN published a new finding and proposed rule against companies controlled by the A7 Network, naming them a class of transactions of primary money laundering concern under section 9714 of the Combating Russian Money Laundering Act. Same species of instrument, different target, twenty four hours apart. The machinery did not stop. It re-aimed.
A proposal is enforced by probability, not by law
For 2,113 days, the correct legal answer to “do I have to report transfers to unhosted wallets over $10,000” was no. Not “not yet”. No. There was no obligation, no effective date, no enforcement, and not one word of it ever reached the Code of Federal Regulations.
Nobody built to that answer. Compliance teams built to a different number entirely: the probability that it would be finalised. That number was never published, never consistent between two firms, and moved on things that have nothing to do with wallets, including elections, personnel changes and litigation in unrelated dockets. It was, for five years, the single most load-bearing input into how American institutions handled self-custodied counterparties, and it has no citation.
Look at what our public registers actually record. The CFR records what binds you. The Federal Register records what changed and on what date. Enforcement dockets record what was punished. All three are indexed, dated, permanently addressable and free. Not one of them records what was anticipated. So the entire operative life of this rule, the part that moved real money and real product decisions, happened outside every system built to record regulation, and the only trace it leaves behind is a two page notice saying it is over.
Put it in the language the rest of this blog uses for everything else. A pending proposal is an option, and the regulator holds it for free. There is no premium to pay for keeping it open, no carrying cost, no expiry, and no obligation to exercise. The regulated side is short that option and pays the premium continuously, in legal fees, screening logic, delayed launches and features that were never built. On 6 October 2026 the option expired unexercised. Everyone who wrote the premium keeps paying it until they individually decide to stop, and the firms with the most conservative compliance culture, which is to say the ones that behaved best, will be the slowest to stop.
This is not the commencement gap we wrote about in September, where £72M moved in the interval between a bill passing the Commons and taking effect. That interval was a public countdown with a published end. This one has no clock at all. You cannot be early to a rule with no commencement date and you cannot be late to one. You can only be hedged, indefinitely, against an outcome whose odds you are guessing at.
FinCEN wrote the chill down and left it in the conditional
Read the mixer sentence again: the definition “could have a chilling effect on legitimate activity”.
Could. Three years after publication, in the document that kills the proposal because of that effect, the effect is still described as a possibility. And the tense is defensible, narrowly, as a statement about the rule: the rule never operated, so it never chilled anything by force of law. It is plainly wrong as a statement about the definition, which operated from the morning it was published, on everybody who read it and decided what to ship.
That definition was not vague. It listed six limbs, including pooling or aggregating CVC from multiple persons, wallets, addresses or accounts; using programmatic or algorithmic code to coordinate, manage or manipulate the structure of a transaction; splitting transmittals across a series of independent transactions; creating and using single use addresses; exchanging between types of digital asset; and facilitating user initiated delays in transactional activity. Then it defined a CVC Mixer as “any person, group, service, code, tool, or function that facilitates CVC mixing”. That text was precise enough to design around, and precise enough to abandon plans over, which is exactly what it was used for.
So where is the number? Nobody knows how many privacy features were cut, how many compliance hours were billed against a rule that never existed, how many self-custody withdrawals were declined by institutions hedging a proposal, or how much of that cost was eventually passed to retail. FinCEN is not concealing the figure. The figure was never produced. The one party in this story with subpoena power, a standing economic analysis function and a statutory reporting mandate did not commission a measurement of its own proposal’s effect, and the proposal is now gone, which makes the measurement permanently unavailable.
8,274 comments, 2,017 days, one unanswered docket
The original comment window on the unhosted wallet proposal ran 15 days, from 23 December 2020 to 7 January 2021, across Christmas and New Year. FinCEN reopened it on 15 January 2021, adding 15 days for the reporting requirements and 45 days for the counterparty and recordkeeping provisions, then extended it again on 28 January 2021 to a single deadline of 29 March 2021.
Docket FINCEN-2020-0020 holds 8,274 comments. 808 of them were posted after the final deadline, the last on 8 April 2021. The mixer docket, FINCEN-2023-0016, holds another 2,160. Call it 10,434 submissions across the two, which is a genuinely large public response by the standards of financial regulation.
The mixer withdrawal mentions commenters once. The unhosted wallet withdrawal does not mention them at all: the word “comment” appears zero times in the document. Both notices are signed by the same deputy director on the same day.
This is not a scandal, it is an asymmetry, and the asymmetry is the point. Every comment is timestamped, numbered, attributed, indexed and retrievable by anyone with a browser, forever. The agency’s side of the exchange carries no equivalent record: no interval, no acknowledged count, no statement of which arguments landed. Fairness arguments usually fixate on whether a process has an input channel. This one had an excellent input channel. What it did not have was a clock on the response, and a process with an open input and an unbounded response time is not a conversation, it is a suggestion box with very good metadata.
“Withdrawn” is two different acts here
Unhosted wallets: “FinCEN will take no further action on this NPRM.”
Mixing: FinCEN “will continue to monitor activity involving CVC mixers for indicia of money laundering, terrorist financing, or other illicit finance activity, and may take appropriate steps in the future to mitigate any such activity.”
The first is a release. The second is a parking space. If you are deciding today whether to ship a feature that touches pooling, splitting, delays or single use addresses, those two sentences give opposite guidance, and almost every headline gave them the same verb. The difference between a closed door and an unlocked one is the entire operative content of the news, and it is in neither the summary nor the coverage. It is in the last clause of the second document.
The withdrawn definition reads onto a prize pool
Here is the part that is specific to on-chain gaming, and it is not a stretch.
A raffle contract takes convertible virtual currency from many addresses, pools it at one address, holds it for a defined period, and then a programme decides which single address it leaves to. That is limb one of the withdrawn definition, pooling or aggregating CVC from multiple persons, wallets, addresses or accounts. It is also limb two, using programmatic or algorithmic code to coordinate or manage the structure of a transaction. And the proposal did not define a mixer as a business, a service or an operator. It defined it as “any person, group, service, code, tool, or function”. A function.
Be precise about who the duty fell on, because it matters. The obligation ran to covered financial institutions, banks and MSBs, when they knew or suspected a transaction involved mixing. Nothing in the proposal would have ordered a smart contract to do anything, and nothing in it made running a raffle unlawful. The weight lands one hop downstream, on the exchange where a winner deposits a prize whose immediate on-chain history is a pooled contract funded by hundreds of strangers. That is the transaction an institution’s screening system has to classify, under a definition written entirely in terms of technique.
And technique is the problem. Pooling value from many parties and letting code decide where it goes is how you obscure a trail. It is also how you make a prize worth winning, how an escrow works, how a liquidity pool works and how a staking contract works. You cannot separate those by inspecting the transaction graph, because on the graph they are identical. You separate them by reading the rules the contract enforces, which is precisely the work that a reporting threshold exists to avoid doing. The definition was withdrawn, so this is now a hypothetical. The institutions that spent three years building screening logic against it did not get their three years back, and their logic did not uninstall itself this morning.
We have been here before from the other direction, when Irish rules turned a player’s winnings into a source of funds question. That is about the player proving where money came from. This is about the payout path being classified by its shape, before anyone asks the player anything at all.
What we can actually say about Satoshie
The claim here is narrow, and it is not a compliance claim.
Satoshie runs on Base. The contract is deployed before entries open. The Chainlink VRF coordinator address is written into the deployed code, in public, before anyone stakes anything. The proof is verified on-chain before the callback is allowed to act. The winner is computed in that callback and the payout settles in the same transaction. ticketsMinted is readable before you buy, and there is no admin key over a draw in flight.
The property that is relevant to this story is simply that a deployed contract has no proposed state. It is not probably binding for 2,113 days and then quietly withdrawn. Either the rules are live and readable at the address, or the draw has not opened. There is no interval during which a rational player should be hedging against what our rules might become, because the hedge and the certainty cost the same thing: one call to a public endpoint, which is the same way we check our own numbers.
That cuts both ways and we should say so. Immutable code cannot be withdrawn either. If we ship a bad rule, there is no two page notice that makes it stop applying.
The honest limits
First, we are not standing outside this. Only the draw is on-chain. The front end, the geo-blocking, the payment paths and the terms all sit in the ordinary world, and they respond to proposals exactly like everyone else’s do. Had we been a US bank in 2021, we would have hedged the same way, and we would have been right to.
Second, a chilling effect is not proof that the proposal was wrong. FinCEN still maintains that illicit actors use mixers, and that is true. Nothing here argues that the agency should not have proposed anything. The argument is about measurement: if your own withdrawal notice concedes the proposal chilled lawful activity, the size of that chill was a knowable fact and you had five years to find out.
Third, we have never had to comply with any of this, which makes our position cheap. An argument that gets stronger when somebody else’s rulebook gets worse is not an argument about us. The thing we can defend is narrow and checkable, and as with the SEC’s custody proposal, a guarantee that depends on what a third party decides next quarter was never a guarantee.
Three questions worth asking
- Which rules are you complying with right now that have never been in force, and what would it cost you to stop complying with them tomorrow?
- When a proposal is withdrawn, what in your product actually changes back? If the answer is nothing, the proposal was not the thing governing you, your reading of it was.
- For any guarantee you give a player: is it binding now, or is it binding once somebody finishes deciding?
The photograph at the top of this post is frost closing in on a window at night. There is still a clear patch in the middle, and through it you can see the street, the traffic lights, a car. The frost is real whether or not anyone owns a thermometer. FinCEN has now written down, in the Federal Register, that the window was cold. Nobody will ever know by how much, or how much of the view went.
Satoshie builds provably fair raffles and coinflip on Base, with Chainlink VRF proofs verified on-chain before any winner is chosen. Every draw is checkable by a stranger who never played. See how it works.
📷 Photo by Mark Ashford on Unsplash
