Washington’s other move on 5 October was a retreat. The Treasury and FinCEN withdrew two unfinished proposals: the 2020 rule that would have required identification and reporting on transfers to unhosted wallets, often discussed around a $3,000 threshold, and the 2023 crypto-mixing rule aimed at anonymity-enhancing services.

FinCEN cited the risk of sweeping up legitimate activity. The 2020 text would have treated a transfer from a regulated institution to a wallet the customer controls as a reporting event, not as a withdrawal. The 2023 mixer proposal would have put anonymity-enhancing services in a special surveillance category, on the theory that the tool itself was the risk. Neither rule was ever finalized. Both sat on the books as drafts the industry had to price in anyway.

Privacy advocates and wallet developers treated the withdrawals as the end of a five-year fight. Self-custody was the target of the first proposal: a wallet with no intermediary, no account, and no party FinCEN could already examine. Mixers were the target of the second: software or a service that breaks the link between sender and receiver. Pulling both drafts means the agency is no longer advancing a rule that makes either one a default reporting trigger.

Compliance teams should not read the withdrawals as a free pass. Existing Bank Secrecy Act duties still apply. Sanctions screening still applies. The GENIUS Act stablecoin regime still applies. A bank or a money transmitter that knows a customer is moving funds to evade a blockade, or that ignores a mixer it already flags as high risk, does not get a new defense because a proposed rule was pulled. What changed is the specific plan to treat self-custody transfers and mixers as reporting events in their own right, at a threshold, without a separate suspicion finding.

That distinction is the one that matters for product design. Wallet developers spent five years building around a rule that might have forced a counterparty identity onto every transfer above a few thousand dollars. Exchanges spent the same years deciding whether to block unhosted withdrawals or to collect the data in advance. The draft is gone. The internal controls built to survive it are not required to go with it, and many will stay, because sanctions and fraud filters do not depend on the withdrawn text.

The same week pointed the other way on custody. The SEC’s roughly 682-page crypto custody proposal moved toward the Federal Register, covering adviser self-custody, state trust-company custodians, and tokenized-fund reporting. Advisers who want to hold tokens themselves, or who want to use a state trust company rather than a qualified custodian from the old list, are getting a formal rule. Funds that issue shares as tokens are getting a reporting regime. That is plumbing, not surveillance of the open wallet.

The net picture is mixed. FinCEN stepped back from preemptive reporting on unhosted transfers and mixers. The SEC moved a custody proposal that would formalize how advisers and tokenized funds hold the same assets. Less default surveillance of the wallet. More paperwork once an adviser, a trust company, or a fund is in the chain. For a user who never touches a regulated intermediary, the withdrawn rules were the threat. For an allocator who does, the custody proposal is the one still moving.