Crypto Privacy Fight: Banks Want DeFi in the Reporting Net

Key Takeaways

• FinCEN withdrew three crypto data proposals since October
• BPI wants DeFi controllers designated as financial institutions
• $250 threshold scrapped; $3,000 Travel Rule trigger stays
• BPI: banks see only crypto’s fiat endpoints

In a November 6 letter, the Bank Policy Institute, which represents universal, regional and major foreign banks operating in the U.S., asked FinCEN and the Office of Foreign Assets Control to designate digital-asset service providers, and the people who operate or control decentralized finance arrangements, as “financial institutions” under the Bank Secrecy Act.

Three withdrawals in five weeks

The letter answers a run of retreats. On October 5, FinCEN withdrew two proposals. The first, from December 2020, would have required banks and money services businesses to verify identities and keep records when customers transacted with unhosted wallets. The second, from 2023, would have treated international crypto mixing as a class of transactions of primary money-laundering concern under Section 311 of the USA PATRIOT Act. FinCEN tied both withdrawals to the administration’s deregulatory agenda.

The third retreat came on November 6, when FinCEN and the Federal Reserve Board pulled the 2020 plan to cut the cross-border recordkeeping and Travel Rule threshold from $3,000 to $250. The agencies said more than five years had passed, the crypto industry had changed and fresh public input would help. The withdrawal notice takes effect with its Federal Register publication on November 9, leaving the $3,000 trigger in the existing recordkeeping rule in force. Coindoo’s report on the abandoned $250 transfer plan covers what the lower threshold would have changed.

All three proposals put the work on institutions already inside the Bank Secrecy Act. BPI’s complaint is that nothing has replaced them. Treasury has not said it intends to place the same information duties directly on crypto intermediaries, which, according to the letter, hold the customer records, wallet data and transaction details that banks never see.

The case BPI makes, and why it is making it now

BPI builds its request on one principle: identical activity carrying identical risk should face identical rules. Its members run customer identification, transaction monitoring and suspicious-activity reporting under close examination. Meanwhile, the letter argues, funds that leave regulated exchanges can move through unhosted wallets, decentralized exchanges, mixers and cross-chain bridges with little or no anti-money-laundering oversight.

The timing leans on the October 29 theft from Binance. The FBI attributed the attack to North Korea, and BPI cites TRM Labs’ estimate that $6.36 billion left the exchange’s wallets, the largest crypto theft on record. The letter also cites Chainalysis data showing illicit addresses received $154 billion in 2025, up 162% from a year earlier.

BPI wants the focus on secondary markets, where tokens change hands after issuance. It points to FinCEN and OFAC’s April 2026 stablecoin proposal under the GENIUS Act, which separated primary issuance from secondary trading and placed most illicit stablecoin activity in the latter.

Beyond designation, BPI asks Treasury for:

Targeted legislation

Treasury names each gap its current authority cannot reach and asks Congress for a narrow fix.

Mixer sanctions power

Clear statutory authority to sanction mixers, tumblers and other blockchain applications used for illicit finance.

Whole-of-chain sharing

Treasury convenes law enforcement, banks, stablecoin issuers, service providers and analytics firms.

Money transmitter parity

Bank-level customer due diligence and identification rules for every state-licensed money transmitter.

Where a bank’s view of a crypto transfer stops

BPI illustrates the problem with a customer it calls Customer A, who sends $1,000 from a bank into crypto, through a self-hosted wallet and a mixer, and back to the bank. Only some of the parties along that route carry reporting duties.

Customer A’s $1,000, hop by hop

1. 1. Bank to exchange
   Visible: the customer’s identity and an outgoing payment. Duty: the bank.
2. 2. Purchase and withdrawal
   Visible: account data, the buy order and the withdrawal address. Duty: the exchange.
3. 3. Self-hosted wallet
   Visible: an address and amounts on a public ledger, with no name attached. Duty: none for an owner moving their own funds.
4. 4. Mixer
   Visible: deposits into and withdrawals from a shared pool, with the link between them broken. Duty: only if a business runs it.
5. 5. Exchange back to bank
   Visible: the depositing customer and an incoming payment. Duty: the exchange and the bank, each for its own leg.

BPI accepts that blockchain analytics and banks’ own filings can rebuild parts of such a chain. It argues that neither replaces reporting from the intermediary that actually dealt with the customer. That argument carries a condition the letter does not dwell on: a reporting duty produces information only where the duty-holder has some. Hops three and four are where that condition gets tested.

How much of that chain U.S. law already reaches

The letter says unhosted wallets and mixers carry no Bank Secrecy Act obligations. FinCEN’s own 2019 guidance on convertible virtual currency draws the line more finely. A person using an unhosted wallet to move their own funds is not a money transmitter. An anonymizing service that accepts customers’ crypto and sends it on is one, with registration, compliance program and reporting duties. A company that only supplies anonymizing software is not.

The same guidance judges decentralized applications by function. Writing the code does not make a developer a money transmitter, but using the application to run a money transmission business for others can.

The real gap in Customer A’s chain is therefore narrower than “mixers” as a category. It sits with mixing performed entirely by code that no business operates, and that is where enforcement has already hit a wall. In Van Loon v. Department of the Treasury, decided in November 2024, the Fifth Circuit held that Tornado Cash’s immutable smart contracts are not property under the International Emergency Economic Powers Act, so OFAC lacked authority to sanction them. The ruling binds only that circuit, yet it explains why BPI asks Congress, rather than Treasury, for power over mixers.

What “operating or controlling” would have to mean

BPI’s phrase for the DeFi side borrows the test the Financial Action Task Force applies. FATF’s July 2026 targeted report on decentralized finance, which the letter cites, asks whether someone keeps control or sufficient influence over a service even when smart contracts execute the trades.

The indicators are concrete: administrator keys that can pause or alter contracts, authority to push upgrades, and governance votes concentrated in a few hands. An arrangement with any of these has a person a rule can name. A contract deployed without admin keys and never upgraded has nobody to collect identification or file a report, which returns the problem to the hops where Customer A’s trail already goes dark.

FATF standards bind no one in the United States on their own. Turning them into obligations would take a FinCEN rulemaking for activity current law already covers and legislation for the rest, the two-track route the letter proposes.

The argument for leaving the withdrawals in place

Treasury’s own notices supply the opposing case. In withdrawing the mixing measure, FinCEN cited the July 2025 report of the President’s Working Group on Digital Asset Markets, which acknowledged that lawful users may turn to mixers for privacy on public blockchains. The agency also said the measure risked chilling legitimate activity and loading covered institutions with reporting.

Crypto policy groups go further. Coin Center, which opposed all three proposals, had warned that the $250 threshold would push ordinary payments into “warrantless financial surveillance.” Ji Hun Kim, chief executive of the Crypto Council for Innovation, said in a statement on X that dropping the threshold change was the right decision because of the burden it would have placed on institutions.

Congress has already rejected one attempt to push reporting into DeFi. In April 2025, it used the Congressional Review Act to repeal an IRS rule that would have treated some decentralized-finance front ends as tax brokers.

BPI’s position deserves the same scrutiny. Its members carry the compliance costs the letter wants spread across the crypto sector, and the letter separately urges Treasury to remove Bank Secrecy Act requirements that do not produce value. Moving duties outward serves that cost goal as much as the security goal the letter emphasizes.

What users could notice, and the signal to watch

If Treasury adopted BPI’s approach, the most visible change could come at front ends run by an identifiable company, which might have to request identification before a wallet connects. Fully immutable protocols with no operator would remain outside that reach unless Congress acted.

Who receives that data is a separate question. FinCEN’s Travel Rule guidance treats passing transfer details between institutions as distinct from reporting to the government, and suspicious-activity reports follow their own rules. Designation could also bring crypto intermediaries into Section 314(b) of the USA PATRIOT Act, the safe harbor covered institutions use to share information about suspected money laundering with one another. That channel is the working version of the whole-of-chain sharing BPI wants Treasury to convene.

Two markers will show which way Treasury leans. The first is FinCEN’s section of the next semiannual Unified Agenda of federal regulatory actions: an entry for a proposal aimed at digital-asset intermediaries would confirm BPI’s ask is moving, while an agenda without one would leave the withdrawals as the policy. The second is whether Treasury asks Congress for authority to sanction mixers, the gap Van Loon exposed.