On November 6, 2026, the Bank Policy Institute (BPI), representing the nation's leading commercial banking institutions, submitted a formal comment letter to the U.S. Department of the Treasury and the Financial Crimes Enforcement Network (FinCEN). The petition urges federal regulatory authorities to address expanding vulnerabilities across the digital asset ecosystem as the administration undertakes a comprehensive modernization of the Bank Secrecy Act (BSA) anti-money laundering and countering the financing of terrorism (AML/CFT) frameworks. BPI warned that illicit proceeds, funds derived from sanctions evasion, and terrorist financing operations have increasingly migrated from regulated exchanges to unhosted wallets, decentralized exchanges, liquidity pools, mixers, tumblers, and cross-chain bridges that operate with little to no regulatory oversight. Regulatory Arbitrage Widens as Banking Sector Demands Regulatory Parity The core premise articulated in BPI's petition rests on a foundational tenet of modern financial regulation: identical economic activities presenting identical illicit finance risks must be governed by identical regulatory standards. Under the prevailing statutory framework, however, digital asset intermediaries that facilitate the transmission and transfer of virtual currencies do not face the comprehensive compliance obligations imposed on insured depository institutions. This regulatory disparity creates powerful structural incentives for money launderers, terrorist financiers, and hostile foreign actors to exploit the least-regulated pathways within the financial system.
The urgency of closing these structural gaps was underscored by recent unprecedented criminal exploits. On October 29, 2026, state-sponsored North Korean cyber actors executed an unauthorized intrusion against cryptocurrency exchange Binance, siphoning $6.36 billion in digital assets—the largest digital currency theft recorded in history. Furthermore, Chainalysis documented in its 2026 Crypto Crime Report that illicit cryptocurrency addresses received $154 billion across 2025, representing a staggering 162 percent surge year over year. Despite these documented escalations in criminal utilization, digital asset intermediaries facilitating secondary-market transfers remain largely exempt from comprehensive BSA reporting mandates. Fragmented Transaction Visibility Constrains Banking Sector Crime Detection Traditional commercial banks dedicate extensive personnel, technical infrastructure, and capital expenditure to fulfill their statutory responsibilities under the BSA. Institutions maintain rigorous Customer Identification Programs (CIP), Customer Due Diligence (CDD) procedures, automated transaction monitoring systems, and Suspicious Activity Report (SAR) workflows to assist federal law enforcement. Within the digital asset architecture, however, a commercial bank's visibility is structurally confined to fiat currency on-ramps and off-ramps, leaving institutions incapable of reconstructing multi-layered transaction chains.
To illustrate this systemic limitation, BPI outlined a recurring transaction pattern: a customer may transfer $1,000 from a commercial bank account to a regulated cryptocurrency exchange, purchase digital assets, transfer those tokens to a self-hosted wallet, route the funds through a mixer, and ultimately deposit the laundered proceeds back into the banking system through a different exchange. While the initial and terminating entities maintain BSA obligations, the intermediate unhosted wallets, mixing services, and decentralized liquidity pools do not. The depository institution observes only disconnected endpoints, lacking the evidentiary records necessary to decipher intermediate layering transactions. Consequently, the BSA data banks report to law enforcement remains fragmented, depriving national security agencies of continuous transactional intelligence. FinCEN Rule Withdrawals Deepen Gaps Prompting Call for Targeted Action Compounding industry apprehension, FinCEN recently withdrew three regulatory proposals designed to capture transaction data across digital asset channels. These included the December 2020 proposed rulemaking requiring recordkeeping and reporting on convertible virtual currency transactions involving unhosted wallets, the October 2023 proposal under Section 311 of the USA PATRIOT Act designating virtual currency mixing as a class of transactions of primary money laundering concern (withdrawn on October 5, 2026), and the November 6, 2026 withdrawal of amendments lowering the cross-border Recordkeeping and Travel Rule threshold from $3,000 to $250. While these proposals would have placed administrative burdens primarily on banks rather than crypto intermediaries, their withdrawal leaves federal authorities without vital intelligence regarding illicit actors interacting with mixers and private wallets.
To establish a resilient regulatory regime that balances legitimate technological innovation with national security imperatives, BPI presented four comprehensive policy recommendations to the Treasury Department. First, FinCEN and the Office of Foreign Assets Control (OFAC) should ensure that all digital asset service providers (DASPs)—including entities that custody, transfer, exchange, or facilitate customer transactions, as well as persons controlling decentralized finance (DeFi) protocols—are formally designated as "financial institutions" under the Bank Secrecy Act and subjected to commensurate AML/CFT mandates. Second, where administrative statutory authority proves insufficient, Treasury should collaborate with Congress to enact targeted legislative frameworks. Third, following the 2024 Fifth Circuit appellate decision in Van Loon v. Department of the Treasury restricting OFAC's ability to sanction immutable software code under the International Emergency Economic Powers Act (IEEPA), Treasury should secure explicit congressional authority to sanction mixers, tumblers, and obfuscating blockchain protocols. Finally, Treasury should convene a whole-of-chain information-sharing initiative uniting law enforcement, commercial banks, stablecoin issuers, DASPs, and blockchain analytics firms to dismantle sophisticated transnational illicit finance networks.
