Privacy Coins in a Regulated World
“Privacy coins” promise cash-like confidentiality in a transparent blockchain world. For builders and investors, they’re both a breakthrough and a regulatory lightning rod. In 2025, global policy has hardened: the FATF Travel Rule is the norm, and the EU’s new AML Regulation (EU) 2024/1624 explicitly targets anonymity-enhancing coins and anonymous accounts rules that apply from July 10, 2027 to most obliged entities.
At the same time, case law shows nuance.
In late 2024, a U.S. appeals court overturned OFAC’s Tornado Cash sanctions on the grounds that immutable smart contracts aren’t “property,” and in March 2025 OFAC formally delisted Tornado Cash big for protocol developers, but not a free pass for mixers or exchanges.
This guide explains how privacy coins fit into today’s compliance landscape, where the hard lines are forming (EU, Travel Rule), and how teams can design controls—KYC on-ramps, wallet screening, and selective disclosure without sacrificing user trust. You’ll leave with a workable playbook: what you can still do, where risk concentrates, and how to future-proof products before 2027.
Main takeaway
Privacy coins aren’t “gone,” but centralized access points (exchanges, custodians, payment processors) face the strictest constraints and those constraints are spreading worldwide.
What exactly counts as a “privacy coin” in law?
Regulators now use precise language. The EU AML Regulation defines “anonymity-enhancing coins” as crypto-assets with built-in features that make transfer information anonymous systematically or optionally. The Regulation prohibits CASPs (crypto-asset service providers) from keeping anonymous crypto-asset accounts or accounts enabling increased obfuscation, including through anonymity-enhancing coins. Application begins July 10, 2027 (with limited later dates for a few entity types).
Implication
Coins like Monero (XMR) or Zcash (in shielded mode) fall into the “anonymity-enhancing” bucket when their privacy features are active. For CASPs operating in the EU, listing/support decisions must account for that definition.
FATF & the Travel Rule: the global baseline
The FATF urges countries to apply AML/CFT rules to VASPs and implement the Travel Rule transmitter/beneficiary information must “travel” with transfers above local thresholds. Many jurisdictions now enforce or are phasing in equivalents for crypto.
Why this matters for privacy coins
CASPs must collect, transmit, and verify originator/beneficiary data even when the asset itself is privacy-preserving.
If a transaction uses mixing or features that materially obscure counterparties, many CASPs treat it as higher risk or outright block it to remain compliant.
Europe: the strictest line (and the 2027 cliff)
What the law says (EU AMLR 2024/1624)
Bans anonymous accounts and accounts enabling increased obfuscation, “including through anonymity-enhancing coins.”
Applies from July 10, 2027 for most entities; some categories from July 10, 2029.
Sits alongside the Transfer of Funds Regulation (ToFR) the EU’s Travel Rule for crypto transfers.
Market signals
Exchanges have already acted. Kraken halted XMR trading in parts of the EU in 2024 (with withdrawals allowed for a period) and announced broader EEA actions. Expect more delistings, geofencing, or constrained modes even before 2027.
Bottom line for EU builders/investors
Products that depend on persistent exchange liquidity for privacy coins will face friction. Native privacy may still be used P2P/self-custody, but CASPs will be limited in supporting it.
United States: strong AML for mixers; nuance on protocols
Policy posture
The U.S. pursues mixing and high-risk obfuscation via FinCEN (proposed special-measures reporting for CVC mixing), while courts added nuance on sanctioning autonomous code. Neither outcome legalizes money laundering; it simply sharpens the who/what regulators can target.
Key legal moment
In Nov 2024, the Fifth Circuit vacated OFAC’s Tornado Cash sanctions; March 2025, OFAC delisted the protocol from the SDN list. These rulings matter for developer liability and protocol governance, but ** exchanges and custodians** still must apply AML/CFT controls and will continue to risk-score privacy-enhanced flows conservatively.
Are privacy coins illegal?
Not broadly. Holding or using privacy coins in self-custody is generally not prohibited in major jurisdictions. What’s tightening is centralized support (listing, custodial services) and obligations at on-/off-ramps. In the EU, CASPs face a prohibition tied to anonymity-enhancing coins and anonymous accounts from July 10, 2027. Other regions increasingly mirror FATF’s baseline.
Design patterns: preserving user privacy without breaking the rules
Segmented asset support
Offer full support for transparent transactions; support shielded features only where compliant (jurisdiction + counterparty). Build geofencing and mode switching based on user KYC and destination risk.
Selective disclosure
Adopt view keys, payment disclosure, or selective audit features where supported (e.g., Zcash view keys) so compliance teams can attest to flows without blanket deanonymization.
Travel Rule orchestration
Use Travel Rule messaging providers that handle P2P data exchange between VASPs and verify self-hosted wallet control when required. Bake this into withdrawal flows to reduce false positives. (FATF continues to push for robust, interoperable implementation.)
Wallet screening & heuristics
Flag mixer adjacency and sanctioned exposure using blockchain analytics; add pause-and-review flows rather than blunt bans where legally permissible.
Disclosures & UX
Explain to users when privacy features are limited by law (e.g., “shielded withdrawals unavailable to EU custodial users”). Clear UX reduces support load and reputational risk.
Risk scenarios to plan for
EU CASP operations (2027+)
Supporting anonymity-enhancing coins is incompatible with keeping non-anonymous accounts; plan for delisting, or “transparent-only” modes, or no support at all.Cross-border transfers
Travel Rule mismatches create friction; some corridors will require enhanced due diligence or off-ramps to transparent assets before settlement.Mixing services exposure:
U.S. special-measures proposals increase reporting burdens when mixers are suspected. Expect conservative bank partners.
Case study #1 Exchange “A” in the EU (2025→2027)
Context
Mid-size CASP with XMR order books and EU licenses.Action
In 2024–2025, begins phased delisting of XMR in certain countries; migrates users to transparent assets for exchange-based settlements. Kraken Support+1Outcome
Liquidity migrates P2P; CASP retains licenses and banking by demonstrating AMLR 2024/1624 roadmap.
Case study #2 Fintech wallet “B” in the U.S.
Context
Non-custodial wallet adds selective disclosure for compliance checks with user consent.Action
Flags known CVC mixing exposure in UI, offers opt-in proof packages for counterparties (invoice + view key).Outcome
Bank partners remain comfortable; product supports privacy coins in self-custody while meeting Travel Rule expectations when interacting with VASPs.
Practical compliance checklist (builder/investor ready)
Map jurisdictions where you operate; create asset support matrices (transparent vs. shielded modes).
Document AMLR 2024/1624 stance: how you’ll treat anonymity-enhancing coins by July 10, 2027.
Implement Travel Rule integrations and self-hosted wallet verification where required.
Configure risk-based controls for mixing adjacency; maintain audit trails for escalations.
Communicate user-visible limitations and provide exportable receipts for tax/audit.
Last Words
Privacy coins are not vanishing; they’re being recontextualized. The most forceful changes target centralized access points CASPs, custodians, and payment providers especially in the EU with AMLR 2024/1624 applying from July 10, 2027. Meanwhile, global FATF expectations make Travel Rule implementation table stakes, and U.S. actions focus on mixers while courts narrow who can be sanctioned.
For teams, the winning posture is clear: build selective disclosure, policy-aware UX, and travel-rule-first plumbing. For investors, diligence must examine jurisdictional exposure and exit liquidity assumptions. Implement this now, and privacy coins can still serve real user needs without putting your licenses or your users at risk.
CTA
Want a jurisdiction-by-jurisdiction rollout plan (EU, U.S., APAC) for your product? Request our 2-hour Privacy-by-Design Compliance Workshop and get a tailored matrix for assets, features, and deadlines.
FAQs
Q : Are privacy coins illegal in the EU?
A : Not per se. But from July 10, 2027, CASPs in the EU are banned from keeping anonymous accounts or those enabling increased obfuscation including via anonymity enhancing coins, which effectively blocks centralized support. Self-custody P2P use is not criminalized by this rule.
Q : How do FATF rules affect privacy coins?
A : FATF pushes countries to apply AML/CFT standards to VASPs and implement the Travel Rule. VASPs must capture originator/beneficiary information and may restrict privacy-enhanced flows they cannot verify.
Q : How can I support privacy coins without breaking laws?
A : Use selective disclosure, view keys, geofencing, and Travel Rule messaging. Restrict shielded features where prohibited, and maintain strong KYT and escalation playbooks.
Q : How did the Tornado Cash case change things?
A : A U.S. appeals court overturned OFAC’s sanctions (Nov 2024), and OFAC delisted the protocol in March 2025, narrowing who can be sanctioned. Exchanges still apply AML controls.
Q : How do the EU Transfer of Funds rules apply to privacy coins?
A : They extend “Travel Rule” requirements to crypto transfers, demanding sender/receiver data exchange between CASPs, affecting privacy-enhanced transfers.
Q : How can founders prep for 2027?
A : Run an asset/feature gap analysis, plan delistings or transparent-only modes, and ship Travel Rule + self-hosted wallet verification. Document board-level decisions.
Q : How does the Travel Rule work with self-hosted wallets?
A : Jurisdictions vary. Many require CASPs to verify control of self-hosted wallets beyond certain thresholds; design prompts and proofs in the withdrawal flow.
Q : How can investors assess privacy-coin exposure?
A : Check EU revenue share, exchange liquidity dependencies, and whether the team has built selective disclosure and policy-aware UX. Validate the 2027 plan.