In a November 6 letter to the Financial Crimes Enforcement Network (FinCEN), the Treasury bureau that administers the Bank Secrecy Act, and the Office of Foreign Assets Control (OFAC), the Treasury office that administers and enforces economic sanctions, the Bank Policy Institute (BPI) — which represents universal, regional, and major foreign banks operating in the United States — asked the two agencies to designate digital-asset service providers, along with the people who operate or control decentralized finance (DeFi) arrangements, as “financial institutions” under the Bank Secrecy Act, the 1970 law at the center of U.S. anti-money-laundering oversight. The designation BPI seeks would extend that statute's core duties — customer identification, recordkeeping, and suspicious-activity reporting — to firms that today sit outside them.

Three withdrawals in five weeks

The request lands amid a run of regulatory retreats. On October 5, FinCEN withdrew two proposals. The first, issued in December 2020, would have required banks and money services businesses to verify customer identities and keep records when customers transacted with unhosted wallets. The second, from 2023, would have treated international crypto mixing as a class of transactions of primary money-laundering concern under Section 311 of the USA PATRIOT Act. FinCEN tied both withdrawals to the administration's deregulatory agenda.

The third reversal came on November 6, when FinCEN and the Federal Reserve Board pulled the 2020 plan to cut the cross-border recordkeeping and Travel Rule threshold from $3,000 to $250. The Travel Rule is the requirement that institutions moving funds pass originator and beneficiary details along to the next institution handling the transfer. The agencies said more than five years had passed, the crypto industry had changed, and fresh public input would help. The withdrawal takes effect with its Federal Register publication on November 9, leaving the $3,000 trigger in the existing recordkeeping rule in force. Earlier coverage of the abandoned $250 transfer plan details what the lower threshold would have changed.

All three proposals placed the workload on institutions already inside the Bank Secrecy Act. BPI's complaint is that nothing has replaced them. Treasury has not said it intends to place the same information duties directly on crypto intermediaries — which, according to the letter, hold the customer records, wallet data, and transaction details that banks never see.

The case BPI makes, and why it is making it now

BPI builds its request on a single principle: identical activity carrying identical risk should face identical rules. Its members run customer identification, transaction monitoring, and suspicious-activity reporting under close supervisory scrutiny. Funds that leave regulated exchanges, the letter argues, can then move through unhosted wallets, decentralized exchanges, mixers, and cross-chain bridges with little or no anti-money-laundering oversight.

The timing leans on the October 29 theft from Binance. The FBI attributed the attack to North Korea, and BPI cites TRM Labs' estimate that $6.36 billion left the exchange's wallets — the largest crypto theft on record. The letter also cites Chainalysis data showing illicit addresses received $154 billion in 2025, up 162% from a year earlier.

BPI wants the focus on secondary markets, where tokens change hands after issuance. It points to FinCEN and OFAC's April 2026 stablecoin proposal under the GENIUS Act — the federal stablecoin law enacted in 2025 — which separated primary issuance from secondary trading and placed most illicit stablecoin activity in the latter.

Beyond designation, BPI asks Treasury for:

• Targeted legislation — Treasury names each gap its current authority cannot reach and asks Congress for a narrow fix.
• Mixer sanctions power — clear statutory authority to sanction mixers, tumblers, and other blockchain applications used for illicit finance.
• Whole-of-chain sharing — Treasury convenes law enforcement, banks, stablecoin issuers, service providers, and analytics firms.
• Money transmitter parity — bank-level customer due diligence and identification rules for every state-licensed money transmitter.

Where a bank's view of a crypto transfer stops

BPI illustrates the problem with a customer it calls Customer A, who sends $1,000 from a bank into crypto, through a self-hosted wallet and a mixer, and back to the bank. Only some of the parties along that route carry reporting duties.

Customer A's $1,000, hop by hop:

1. Bank to exchange. Visible: the customer's identity and an outgoing payment. Duty: the bank.
2. Purchase and withdrawal. Visible: account data, the buy order, and the withdrawal address. Duty: the exchange.
3. Self-hosted wallet. Visible: an address and amounts on a public ledger, with no name attached. Duty: none for an owner moving their own funds.
4. Mixer. Visible: deposits into and withdrawals from a shared pool, with the link between them broken. Duty: only if a business runs it.
5. Exchange back to bank. Visible: the depositing customer and an incoming payment. Duty: the exchange and the bank, each for its own leg.

BPI accepts that blockchain analytics and banks' own filings can rebuild parts of such a chain. It argues that neither replaces reporting from the intermediary that actually dealt with the customer. That argument carries a condition the letter does not dwell on: a reporting duty produces information only where the duty-holder has some. Hops three and four are where that condition gets tested.

How much of that chain U.S. law already reaches

According to the letter, unhosted wallets and mixers sit outside the Bank Secrecy Act entirely. FinCEN's own 2019 guidance on convertible virtual currency draws the line more finely. A person using an unhosted wallet to move their own funds is not a money transmitter. An anonymizing service that accepts customers' crypto and sends it on is one, with registration, compliance program, and reporting duties. A company that only supplies anonymizing software is not.

The same guidance judges decentralized applications by function. Writing the code does not make a developer a money transmitter, but using the application to run a money transmission business for others can.

The real gap in Customer A's chain is therefore narrower than “mixers” as a category. It sits with mixing performed entirely by code that no business operates — and that is where enforcement has already hit a wall. In Van Loon v. Department of the Treasury, decided in November 2024, the Fifth Circuit held that Tornado Cash's immutable smart contracts are not property under the International Emergency Economic Powers Act, so OFAC lacked authority to sanction them. The ruling binds only that circuit, yet it explains why BPI asks Congress, rather than Treasury, for power over mixers.

What “operating or controlling” would have to mean

BPI's phrase for the DeFi side borrows the test the Financial Action Task Force (FATF) — the intergovernmental body that sets global anti-money-laundering standards — applies. FATF's July 2026 targeted report on decentralized finance, which the letter cites, asks whether someone keeps control or sufficient influence over a service even when smart contracts execute the trades.

The indicators are concrete: administrator keys that can pause or alter contracts, authority to push upgrades, and governance votes concentrated in a few hands. An arrangement with any of these has a person a rule can name. A contract deployed without admin keys and never upgraded has nobody to collect identification or file a report — which returns the problem to the hops where Customer A's trail already goes dark.

On their own, FATF standards bind no one in the United States. Turning them into obligations would take a FinCEN rulemaking for activity current law already covers, and legislation for the rest — the two-track route the letter proposes.

The argument for leaving the withdrawals in place

Treasury's own notices supply the opposing case. In withdrawing the mixing measure, FinCEN cited the July 2025 report of the President's Working Group on Digital Asset Markets, which acknowledged that lawful users may turn to mixers for privacy on public blockchains. The agency also said the measure risked chilling legitimate activity and loading covered institutions with reporting.

Crypto policy groups go further. Coin Center, which opposed all three proposals, had warned that the $250 threshold would push ordinary payments into “warrantless financial surveillance.” Ji Hun Kim, chief executive of the Crypto Council for Innovation, said in a statement on X that dropping the threshold change was the right decision because of the burden it would have placed on institutions.

Congress has already rejected one attempt to push reporting into DeFi. In April 2025, it used the Congressional Review Act to repeal an IRS rule that would have treated some decentralized-finance front ends as tax brokers.

BPI's position invites the same scrutiny. Its members carry the compliance costs the letter wants spread across the crypto sector, and the letter separately urges Treasury to remove Bank Secrecy Act requirements that do not produce value. Moving duties outward serves that cost goal as much as the security goal the letter emphasizes.

What users could notice, and the signal to watch

If Treasury adopted BPI's approach, the most visible change could come at front ends run by an identifiable company, which might have to request identification before a wallet connects. Fully immutable protocols with no operator would remain outside that reach unless Congress acted.

Who receives that data is a separate question. FinCEN's Travel Rule guidance treats passing transfer details between institutions as distinct from reporting to the government, and suspicious-activity reports follow their own rules. Designation could also bring crypto intermediaries into Section 314(b) of the USA PATRIOT Act, the safe harbor covered institutions use to share information about suspected money laundering with one another. That channel is the working version of the whole-of-chain sharing BPI wants Treasury to convene.

Two markers will show which way Treasury leans. The first is FinCEN's section of the next semiannual Unified Agenda of federal regulatory actions: an entry for a proposal aimed at digital-asset intermediaries would confirm BPI's ask is moving, while an agenda without one would leave the withdrawals as the policy. The second is whether Treasury asks Congress for authority to sanction mixers — the gap Van Loon exposed.