FinCEN Regulatory Updates

Key dates

2020-12-23

FinCEN published the NPRM at 85 FR 83840 proposing additional reporting, recordkeeping, and identity-verification requirements for certain transactions involving unhosted or otherwise covered wallets.

2026-10-06

FinCEN withdrew the NPRM and stated that it would take no further action on that rulemaking.

Suggested considerations

• Compliance teams may wish to remove implementation workstreams, testing scenarios, and policy language that were created solely for the withdrawn NPRM's proposed $3,000 recordkeeping or $10,000 reporting thresholds.
• Firms should consider documenting that the NPRM was never effective and that its withdrawal does not eliminate existing obligations under the Bank Secrecy Act or applicable implementing regulations in 31 CFR parts 1010, 1020, and 1022.
• Banks and MSBs may wish to reassess whether current controls for transfers involving unhosted wallets remain risk-based and supported by documented AML risk assessments, rather than treating the withdrawn proposal's thresholds as mandatory rules.
• Crypto businesses should continue reviewing applicable customer-identification, customer-due-diligence, suspicious-activity-reporting, recordkeeping, transaction-monitoring, and OFAC sanctions requirements independently of this withdrawal.
• Regulatory-monitoring teams may wish to track whether FinCEN or Treasury develops a replacement digital-asset framework, particularly in light of the stated policy objective that digital-asset regulation be fit for purpose.

What changed

FinCEN withdrew the NPRM published at 85 FR 83840 and stated that it will take no further action on that rulemaking. The withdrawn proposal would have required banks and money services businesses to file reports when a transaction involving an unhosted or otherwise covered wallet exceeded $10,000, or multiple such transactions exceeded $10,000 in 24 hours. It also would have required records, counterparty information, and customer identity verification for covered transactions exceeding $3,000.

Key dates

2023-10-23

FinCEN published the proposed section 311 finding and special measure concerning international CVC mixing at 88 FR 72701.

2026-10-06

FinCEN's withdrawal of the finding and proposed rulemaking became effective upon Federal Register publication at 91 FR 63513.

Suggested considerations

• Compliance teams should discontinue implementation work that was undertaken solely for the withdrawn section 311 CVC-mixing proposal, including plans for the proposal-specific data fields, reporting workflows, and enhanced customer records.
• Firms should not interpret the withdrawal as authorization to process illicit mixer activity without controls; they should continue applying existing risk-based AML, sanctions, transaction-monitoring, escalation, and suspicious activity reporting procedures.
• Crypto exchanges and other covered institutions should review whether current transaction-monitoring scenarios appropriately identify mixer exposure and other indicators of money laundering or terrorist financing under existing requirements, without treating all privacy-preserving activity as inherently suspicious.
• Firms may wish to document the withdrawal in their regulatory inventory, rulemaking-impact assessments, and model or procedure change logs, while preserving controls that address independently applicable BSA or sanctions requirements.
• Compliance teams should monitor future FinCEN notices, section 311 actions, enforcement activity, and interpretive guidance because FinCEN expressly reserved the possibility of future measures concerning mixers.
• Legal and compliance functions should reassess any customer, product, or transaction restrictions adopted specifically in anticipation of the proposed rule and determine whether they remain justified by the firm's risk assessment, other legal requirements, or contractual obligations.

What changed

FinCEN withdrew the proposed rule published at 88 FR 72701 and the underlying section 311 finding concerning international CVC mixing. The proposed special measure one regime would have required covered financial institutions to report specified information for transactions they knew, suspected, or had reason to suspect involved international CVC mixing, including CVC type and amount, mixer and wallet information, transaction hashes, transaction dates, IP addresses, customer-identifying information, and a narrative description.

Key dates

2026-08-14

Effective date of FinCEN final rule "Beneficial Ownership Information Reporting Requirement Revision" (91 FR 52508; RIN 1506-AB67), permanently narrowing CTA BOI reporting to foreign reporting companies and codifying exemptions for U.S. persons and domestic reporting companies.

Suggested considerations

• Compliance teams at foreign reporting companies should review the revised 31 CFR 1010.380 definition of "reporting company" and confirm that their entity meets the narrowed criteria (foreign formation plus registration to do business in a U.S. State or Tribal jurisdiction), updating BOI reporting inventories and scoping accordingly.
• Foreign reporting companies should update BOI reporting procedures to ensure that reports capture beneficial owners who are non-U.S. persons while excluding U.S. person beneficial owners, including revising data collection forms, internal instructions, and system logic to avoid collecting or transmitting U.S. person BOI under the CTA framework.
• Firms involved in foreign pooled investment vehicles registered in the United States may wish to revise governance and reporting processes so that BOI reports for such vehicles identify only the individual exercising substantial control (or greatest authority over strategic management) who is not a U.S. person, and cease including U.S. controllers where they qualify as U.S. persons.
• Corporate secretarial and entity management functions should update CTA/BOI scoping matrices to remove domestic corporations, LLCs, and similar entities from BOI reporting obligations and to reflect that only qualifying foreign entities remain in scope, while maintaining awareness of other AML and KYC obligations that may still apply independently of the CTA.
• Onboarding and registration workflows for foreign entities should be reviewed so that BOI reporting triggers, timelines, and responsibilities are aligned with the final rule’s foreign-only scope, including any remaining deadlines tied to registration dates, and that staff understand that U.S. person company applicant information is no longer required for CTA reporting.
• Firms maintaining records of U.S. person beneficial owners and company applicants for CTA purposes may wish to reassess retention policies, ensuring that any continued collection or storage of such data is for other legal or risk-management purposes rather than CTA compliance, and that privacy notices and data minimization practices reflect the updated regulatory position.
• Compliance teams should revise CTA-related policies, procedures, and training materials to incorporate the exemptions for U.S. persons holding FinCEN IDs, clarifying that these individuals are no longer required to update or correct BOI previously provided to obtain the identifier, and documenting any residual obligations under other BSA or AML rules.
• Banks, broker-dealers, and other AML-regulated firms should consider the impact of reduced BOI availability for U.S. persons on their own customer due diligence, beneficial ownership, and risk assessment frameworks, and evaluate whether internal KYC standards or other regulatory requirements (such as customer due diligence rules) necessitate separate collection of U.S. person ownership information irrespective of FinCEN’s CTA exemptions.

What changed

The definition and scope of "reporting company" under 31 CFR 1010.380, as implemented under 31 U.S.C. 5336, are now permanently narrowed so that entities previously defined as domestic reporting companies are exempt from BOI reporting requirements, including initial, updated, and corrected BOI reports. Foreign reporting companies remain subject to BOI reporting, but the rule confirms that they are exempt from reporting beneficial ownership information for any U.S. person beneficial owners; those U.S.

Key dates

2026-08-11

Effective date of the Geographic Targeting Order

2027-02-06 Deadline

Order period ends after 180 days unless renewed

Suggested considerations

• Compliance teams may wish to identify all branches, subsidiaries, and offices in Hennepin and Ramsey Counties and map which payment flows meet the Order’s definition of a Covered Transaction.
• Firms may wish to update transaction-monitoring and customer due diligence workflows to capture the additional data elements required for bank or money transmitter reports, including beneficiary or recipient contact details and government-benefits-related funding questions.
• Operational teams may wish to confirm readiness to submit reports through the FI Portal and to generate the required CSV files using the Minnesota Fraud GTO template and naming convention.
• Records-management teams may wish to set a retention control ensuring all reports and related compliance records are preserved for five years from the last day the Order is effective.
• Banks and money transmitters may wish to review whether any existing BSA or sanctions screening processes can be leveraged to identify covered international transfers meeting the $3,000 threshold.
• Compliance teams may wish to test month-end reporting processes so filings occur by the end of the month following the month in which each Covered Transaction took place.

What changed

The Order creates a temporary, geographically targeted recordkeeping and reporting regime under 31 CFR Part 1010 for covered institutions in Hennepin and Ramsey Counties. A “Covered Business” is any bank under 31 CFR 1010.100(d) or money transmitter under 31 CFR 1010.100(ff)(5) with a branch, subsidiary, or office in the covered area.

Key dates

2026-06-25

FinCEN published the underlying NPRM to amend the Huione Group definition

2026-06-25

Electronic comment filing became unavailable due to a portal issue

2026-06-30

Portal issue period ended after six days of blocked electronic filing

2026-07-22

FinCEN dated the comment-period extension notice

2026-07-24

Federal Register publication of the extension notice at 91 FR 46761

2026-08-02 Deadline

Extended deadline for written comments on the NPRM

Suggested considerations

• Consider whether to submit comments on the NPRM by the extended deadline of 2026-08-02.
• Review customer, correspondent, and payment relationships for any exposure to Huione Group, H-Pay Service PLC, or entities that may be treated as successor entities if the proposal is finalized.
• Assess whether internal screening, escalation, and due diligence procedures would need updates if FinCEN finalizes the expanded definition.
• Monitor FinCEN’s final action on the NPRM and any resulting special-measures scope changes under 31 CFR 1010.

What changed

This publication does not impose a new final obligation; it extends the public comment deadline for an existing NPRM. The underlying proposal would amend FinCEN’s definition of Huione Group, a financial institution operating outside the United States of primary money laundering concern, to include H-Pay Service PLC and to add a defined term for “successor entity.” The extension was granted because a technological issue with the comment portal prevented electronic filing from June 25 through June 30, 2026.