Soda Labs

FinCEN

Bank Secrecy Act · the deepest US constraint

Regulator or standard-setterAmericasRestricts anonymity

Anonymity-enhancing assets or unattributed transfers are barred outright, or barred for regulated firms.

What FinCEN actually says

Registration, identity verification and suspicious activity reporting for anyone acting as a money transmitter in crypto all originate here, and none of that has loosened. What has changed is the perimeter around it. The two most aggressive proposals aimed at self-custody were both withdrawn: the 2020 unhosted wallet rule in 2024, and the plan to lower the cross-border transfer threshold to USD 250 in 2025. The 2019 guidance also still distinguishes providing an anonymising service from publishing anonymising software, which matters a great deal to developers. The open question is the 2023 proposal to treat mixing as a class of transactions of primary money laundering concern. Nearly three years on it is neither finalised nor abandoned.

The instruments that matter

31 CFR 1010.410(f)
the travel rule, attaching transmittor name, address, account number and amount to transfers of USD 3,000 or more
FIN-2019-G001, 9 May 2019
consolidated guidance treating exchangers and administrators as money transmitters, while preserving the distinction between an anonymising service provider and an anonymising software provider
Unhosted wallet proposal withdrawn April 2024
and the proposal to cut the cross-border travel rule threshold to USD 250 withdrawn in April 2025
The mixing rule is dormant, not dead
the 2023 proposal to designate convertible virtual currency mixing as a class of transactions of primary money laundering concern drew over 2,200 comments and is now classified a long-term action with final action to be determined

What this means for confidential transactions

Bubble is built for exactly this shape of obligation: amounts and balances live on chain as ciphertexts, computation happens without decryption, and the only disclosure path is an on-chain access list through which an authorized party - an auditor, a supervisor, a counterparty - can request scoped decryption. That is confidentiality from the public, not from the regulator.

Compliant by default.

See how selective disclosure satisfies a supervisor without publishing your book to the world.