FinCEN proposed reporting rules for transfers involving unhosted crypto wallets

On December 18, 2020, the U.S. Financial Crimes Enforcement Network announced a proposed expansion of Bank Secrecy Act reporting and recordkeeping requirements for cryptocurrency transactions involving wallets outside regulated financial institutions.

The proposal targeted banks and money-services businesses handling convertible virtual currency, or CVC, and digital assets possessing legal-tender status. It covered transfers involving what FinCEN called “unhosted wallets”—arrangements in which users controlled their own private keys—as well as wallets maintained by institutions in foreign jurisdictions identified by the agency.

The development mattered because it placed the boundary between regulated exchanges and self-custody at the center of federal anti-money-laundering policy. It was a proposed rule, not an effective regulation on December 18. Owning or using a self-controlled wallet did not become illegal, and the announcement imposed no new event-day filing duty.

What FinCEN proposed

For a covered transaction greater than $10,000, a bank or money-services business would have been required to file a report with FinCEN containing specified information about its customer, the transaction and the counterparty, including the counterparty’s name and physical address. The institution would also verify the identity of its own customer.

Multiple covered transfers involving a customer and counterparty wallets would have been aggregated across a 24-hour period when determining whether value entering or leaving exceeded $10,000. The proposal gave an institution 15 days after a reportable transaction to submit the report.

A separate requirement applied when a covered transaction was greater than $3,000. The institution would have to retain records about the transaction and counterparty and verify its customer’s identity. FinCEN’s December 18 materials compared the two thresholds to existing rules for large cash transactions and funds transfers.

The obligations would have fallen on the regulated bank or money-services business, not directly on every person controlling private keys. Nevertheless, customers could have been asked to supply information about people or entities receiving transfers from an exchange account—or sending assets into one.

Treasury’s case for the rule

Treasury presented the proposal as a national-security and law-enforcement measure. Its event-day FAQ attributed the policy to concerns about ransomware, terrorist financing, cybercrime and other illicit activity conducted through wallets whose controllers could be difficult to identify.

Those were the government’s stated risk findings and policy rationale. They did not establish that every self-controlled wallet was anonymous, that every qualifying transaction was suspicious or that self-custody itself constituted regulated money transmission. The formal proposal recognized that a person using a private key to purchase goods or services on that person’s own behalf was not thereby a money transmitter.

Privacy and implementation questions surfaced immediately

Coin Center, a cryptocurrency policy advocacy organization, published an analysis on December 18 that distinguished the proposal from an outright prohibition on self-custody but criticized its counterparty-information mandate and abbreviated comment process.

The organization argued that collecting a name and physical address could become difficult when a customer transferred assets to a smart contract or participated in an algorithmically matched decentralized exchange. Those were contemporaneous implementation concerns, not proven consequences. The proposal’s ultimate operational effect would have depended on final text, institutional procedures and subsequent guidance.

FinCEN allowed a 15-day comment period. Coin Center contrasted that window with an Administrative Conference of the United States recommendation of at least 30 days for most proposed regulations and 60 days for significant rules. FinCEN justified the shorter period by citing national-security urgency and previous industry engagement.

What December 18 did not settle

The announcement did not finalize the thresholds, establish a government database that day or demonstrate that institutions could reliably identify every blockchain counterparty. It instead opened a regulatory contest over how conventional financial-surveillance rules should operate when one side of a transfer had no account-holding intermediary.

The formal notice appeared in the Federal Register on December 23, 2020, confirming the proposal’s detailed terms and a January 4, 2021 comment deadline. That publication is later documentary confirmation; it does not change the narrower December 18 event: FinCEN had announced and submitted a proposal, not enacted a final rule.