On October 19, FinCEN announced its determination that transactions with foreign operating crypto-mixers, a service that obfuscates the source and destination of transactions on a public blockchain, are of “Primary Money Laundering Concern.” Additionally, FinCEN’s notice of proposed rulemaking (“NPRM”) proposes that U.S. financial institutions report certain information to FinCEN on transactions with mixers involving a foreign jurisdiction. FinCEN’s NPRM has both immediate and long-term impacts for U.S. cryptocurrency businesses, decentralized finance (“De-Fi”) protocols, and foreign-based cryptocurrency service providers. These businesses have 90 days from the date of publication to provide FinCEN with comments on the proposed rule that the Bureau must consider prior to it becoming a final rule.

U.S. financial institutions should take steps now to understand the immediate impact of FinCEN’s action, and the anticipated additional reporting obligations that will be imposed if, as expected, the rule becomes final. Specifically, affected financial institutions and entities should consider:

• The determination that mixers are of primary money laundering concern is immediately effective and regulated institutions must mitigate their exposure to such transactions, including through filing SARs.
• The breadth of the definitions in FinCEN’s proposed rule will likely result in the reporting of transactions beyond traditional traditional crypto-mixers, foreign financial institutions, and De-Fi protocols providing legitimate services.
• Once finalized, or subject to temporary order, U.S. financial institutions will need to:

• develop policies and procedures to identify reportable transactions (including modifying blockchain analytics rules to cover the breadth of “mixing services”);
• collect requested information (recognizing that FinCEN may expect institutions to collect such information as part of a “risk-based AML program”); and
• report such information to FinCEN (understanding that any reporting schema or technology requirements have yet to be communicated).

FinCEN’s 311 Authority and Recent Issuance

Section 311 of the USA Patriot Act authorizes FinCEN to designate a class of transactions involving a foreign jurisdiction as a primary money laundering concern and subsequently requiring U.S. financial institutions to conduct additional recordkeeping and reporting regarding such transactions. While FinCEN must implement these requirements through notice and comment rulemaking, in certain situations, FinCEN can immediately require such recordkeeping or reporting through a temporary (120 days) order.

FinCEN proposed a regulation that would require U.S. financial institutions to report to FinCEN transactions with CVC Mixers involving a non-U.S. jurisdiction. “CVC Mixer” is a new term defined in the proposed rule that appears to be broader than activities the industry considers as mixing services. In its previous use of such reporting requirements, FinCEN has also issued immediately effective temporary orders to U.S. financial institutions requiring them to begin reporting while the proposed rule was pending. While FinCEN has not publically issued such orders at this time, the Bureau could issue such orders at any point during the notice and comment period, including through confidential letters to covered financial institutions.

Coverage of the Rule

Although the proposed rule will require all U.S. financial institutions to make certain reports to FinCEN, practically the rule will primarily cover banks, state-chartered trusts, money transmitters, broker-dealers, and futures commission merchants that conduct transactions directly on a blockchain. The proposed rule’s definitions of CVC Mixer and CVC Mixing Service are drafted very broadly and will likely include blockchain activity previously unassociated with crypto-mixers. For example, in addition to typical “mixing” services, FinCEN’s proposal would cover “persons, groups, services, codes, tools, and functions” that facilitate exchanging between different types of CVC or using pools or programmatic code to coordinate and manage transactions. While the definitions exempt reporting insofar as these services are provided by banks, broker-dealers, or money services businesses, these broad definitions will likely require U.S. financial institutions to report transactions involving De-Fi protocols, including those that facilitate bridging between blockchains, smart-contract non-custodial CVC exchanges, and, potentially, bitcoin lightning network transactions when there is a foreign jurisdictional nexus. Additionally, the proposed regulations only exempt exchanging between types of CVC or other digital assets when conducted by U.S. regulated institutions but, by its language, does not exempt reporting if a foreign regulated financial institution provides such services.

U.S. financial institutions will be expected to report multiple data fields to FinCEN regarding the transaction, if available to the institution, including the amount and type of CVC; name and wallet address of the CVC Mixer; relevant IP addresses and timestamps; and a narrative regarding the transaction including insight into its customer activity. Additionally, financial institutions must report to FinCEN customer information including: name, date of birth, address, and identification number. Notably, a financial institution that reports a transaction under the proposal is still obligated to report such transactions in a SAR.

Possibilities for Administrative Challenge

The breadth of FinCEN’s proposed rule has opened the door for potential regulatory challenges under the Administrative Procedure Act. In particular, FinCEN’s proposed rule relies on a limited set of examples involving only a handful of countries to support requiring reporting for a transaction that involves any foreign jurisdiction. As the effectiveness of a jurisdiction’s AML regime was a key component of previous 311 actions, FinCEN’s proposal may lack a sufficient factual basis to apply to all foreign jurisdictions across the board, including foreign jurisdictions that, according to the Financial Action Task Force, have a stronger AML regime than the United States.

Similarly, FinCEN’s proposed rule focuses on the illicit activity threats of traditional mixing services but its broad definitions of CVC Mixer and CVC Mixing Services will likely extend to De-Fi protocols and foreign virtual asset service providers that are used for legitimate means. As the legitimate use of the class of transaction is a factor in implementing a 311 action, FinCEN’s proposed rule may also lack a factual basis to support such broad definitions.

Conclusion and Comment

Across the board, U.S. regulatory agencies have been increasing their focus on financial institutions with AML deficiencies. In particular, the existence of AML deficiencies, including increased exposure to illicit activity, has been a common factor when U.S. regulators have sought to expand their jurisdiction to novel products and technologies. FinCEN’s rule is another example of the importance the U.S. government places on implementing AML controls.

FinCEN’s rule is not yet finalized and the reporting obligations are not immediately effective. Financial institutions affected by FinCEN’s NPRM have 90 days after its official publication in the Federal Register to submit their comments to FinCEN on the proposal. With the potential impact of the proposal, affected institutions and entities should consider submitting public comments regarding the breadth and burden of the proposed rule. However, as discussed above, FinCEN’s determination that transactions with mixing services are of primary money laundering concern does have immediate impacts on U.S. financial institutions’ obligations to comply with the BSA and file SARs.