Privacy vs. Regulation: Tornado Cash, Travel Rule, and the Frontier

What you'll learn

• The Core Tension
• The Tornado Cash Saga (2019-2025)
• The FATF Travel Rule and the Global AML Architecture
• Where Things Stand in 2026
• Practical Takeaways
• For Deeper Reading

Key terms

OFAC (Office of Foreign Assets Control)

The U.S. Treasury division responsible for administering and enforcing economic sanctions. Sanctioned Tornado Cash on August 8, 2022; delisted it on March 21, 2025.

IEEPA (International Emergency Economic Powers Act)

The U.S. statute under which OFAC purported to sanction Tornado Cash. The Fifth Circuit's 2024 Van Loon ruling held that immutable smart contracts are not "property" under IEEPA.

SDN List (Specially Designated Nationals)

OFAC's list of sanctioned persons, organizations, and (briefly) protocols. Tornado Cash was added on August 8, 2022 and removed on March 21, 2025.

Van Loon v. Treasury

The November 26, 2024 Fifth Circuit decision unanimously holding that immutable smart contracts (specifically Tornado Cash) are not "property" under IEEPA, reversing the lower court.

FATF (Financial Action Task Force)

The intergovernmental body that sets global AML/CFT standards. Its Recommendation 16 — the Travel Rule — requires regulated institutions to share originator and beneficiary information.

Travel Rule

FATF Recommendation 16, requiring financial institutions to share sender and receiver information for transfers above a threshold ($1,000 USD/EUR standard, $3,000 in the U.S., applied to all crypto transactions in Japan, all CASP-to-CASP in the EU).

6AMLD (Sixth Anti-Money Laundering Directive)

The EU directive applied beginning June 3, 2021 that strengthens AML rules, with a €1,000 vetting threshold for crypto exchanges.

CASP (Crypto-Asset Service Provider)

EU regulatory term for a firm that provides services around crypto-assets. The EU Transfer of Funds Regulation applies the Travel Rule to all CASP-to-CASP transfers.

FinCEN (Financial Crimes Enforcement Network)

The U.S. Treasury bureau responsible for AML rules. Its December 2020 unhosted-wallet rule was officially withdrawn on August 19, 2024.

Unhosted wallet

A wallet under the user's direct control (self-custody), as distinct from a wallet held with a regulated custodian. The withdrawal of the FinCEN unhosted-wallet rule in August 2024 was a major win for self-custody.

AML/CFT

Anti-Money Laundering / Counter-Financing of Terrorism — the international regulatory framework crypto has been integrated into.

Selective disclosure (compliance)

A regulatory-friendly privacy property where users can prove specific compliance facts (e.g., not on a sanctions list) without revealing their full transaction history. Central to the Privacy Pools design.