Skip to main content
Important: We do not provide financial advice or custody funds. All transactions occur on third-party platforms.
CryptoBipto
Log in

Privacy vs. Regulation: Tornado Cash, Travel Rule, and the Frontier

Examine the legal and regulatory landscape: the Tornado Cash saga, the FATF Travel Rule, exchange delistings, the Van Loon ruling, and where things stand in 2026.

16 min · advanced · part of Privacy in Crypto

The Core Tension

The fight over financial privacy in cryptocurrency is, at root, a fight about what kind of digital money society wants. On one side stands the cypherpunk argument: financial privacy is a fundamental right, indispensable to free societies, and the technology that protects it is morally and legally analogous to encryption, which is itself a constitutionally protected form of speech in the United States and most democracies. On the other side stands the AML/CFT consensus: governments have a legitimate interest in preventing money laundering, terrorist financing, and sanctions evasion, and the post-9/11 international financial architecture has been built on the assumption that financial intermediaries can be conscripted to surveil their users. Neither side is being unreasonable. Both have evidence and arguments on their side. The cypherpunks can point to the Canadian trucker freezes, China's social credit scoring, and the long history of financial surveillance being used to suppress dissent. The AML community can point to ransomware payments, North Korean hacks like the Lazarus Group's billion-dollar thefts, and the use of mixers to launder the proceeds of human trafficking and child exploitation. The question is not which side is right in the abstract; it is what set of compromises will produce the best outcomes in the specific institutional landscape we have. The defining case study of the 2022-2026 period — the period during which the legal status of privacy tools was litigated in earnest for the first time — is Tornado Cash.

Also in this lesson

  • The Tornado Cash Saga (2019-2025)
  • The FATF Travel Rule and the Global AML Architecture
  • Where Things Stand in 2026
  • Practical Takeaways
  • For Deeper Reading

Key terms

OFAC (Office of Foreign Assets Control)
The U.S. Treasury division responsible for administering and enforcing economic sanctions. Sanctioned Tornado Cash on August 8, 2022; delisted it on March 21, 2025.
IEEPA (International Emergency Economic Powers Act)
The U.S. statute under which OFAC purported to sanction Tornado Cash. The Fifth Circuit's 2024 Van Loon ruling held that immutable smart contracts are not "property" under IEEPA.
SDN List (Specially Designated Nationals)
OFAC's list of sanctioned persons, organizations, and (briefly) protocols. Tornado Cash was added on August 8, 2022 and removed on March 21, 2025.
Van Loon v. Treasury
The November 26, 2024 Fifth Circuit decision unanimously holding that immutable smart contracts (specifically Tornado Cash) are not "property" under IEEPA, reversing the lower court.
FATF (Financial Action Task Force)
The intergovernmental body that sets global AML/CFT standards. Its Recommendation 16 — the Travel Rule — requires regulated institutions to share originator and beneficiary information.
Travel Rule
FATF Recommendation 16, requiring financial institutions to share sender and receiver information for transfers above a threshold ($1,000 USD/EUR standard, $3,000 in the U.S., applied to all crypto transactions in Japan, all CASP-to-CASP in the EU).
6AMLD (Sixth Anti-Money Laundering Directive)
The EU directive applied beginning June 3, 2021 that strengthens AML rules, with a €1,000 vetting threshold for crypto exchanges.
CASP (Crypto-Asset Service Provider)
EU regulatory term for a firm that provides services around crypto-assets. The EU Transfer of Funds Regulation applies the Travel Rule to all CASP-to-CASP transfers.
FinCEN (Financial Crimes Enforcement Network)
The U.S. Treasury bureau responsible for AML rules. Its December 2020 unhosted-wallet rule was officially withdrawn on August 19, 2024.
Unhosted wallet
A wallet under the user's direct control (self-custody), as distinct from a wallet held with a regulated custodian. The withdrawal of the FinCEN unhosted-wallet rule in August 2024 was a major win for self-custody.
AML/CFT
Anti-Money Laundering / Counter-Financing of Terrorism — the international regulatory framework crypto has been integrated into.
Selective disclosure (compliance)
A regulatory-friendly privacy property where users can prove specific compliance facts (e.g., not on a sanctions list) without revealing their full transaction history. Central to the Privacy Pools design.

Continue this lesson — 5 more sections in the CryptoBipto app.

Open lesson

Educational only — not financial advice.