Holding a privacy coin is generally not prohibited. The restrictions hit the businesses that deal in it: exchanges, custodians, brokers. In the EU the ban starts on 10 July 2027; in the DIFC (Dubai) it applies already. We go through the rules in the EU, the UAE (United Arab Emirates) and the US and what they mean for listing these coins.
Checked on 21 October 2026. Rules and sources are current as of this date.
What counts as a privacy coin
The law does not name Monero or Zcash. It describes a feature. In Regulation (EU) 2024/1624 (AMLR), anonymity-enhancing coins are crypto-assets with built-in features designed to make crypto-asset transfer information anonymous, either systematically or optionally. So the definition covers not only Monero but any token where anonymity can be switched on as an option.
EU: a ban from 10 July 2027
Article 79(1) AMLR prohibits credit institutions, financial institutions and crypto-asset service providers (CASPs) from keeping anonymous crypto-asset accounts and any account allowing the anonymisation of the account holder or the anonymisation or increased obfuscation of transactions, including through anonymity-enhancing coins.
Who is covered
CASPs: exchanges, custodians, brokers. The ban is addressed to them, not to private holders of coins.
From when
The Regulation applies from 10 July 2027 (Article 90). Until then the AMLR does not apply.
Self-hosted wallets
Recital 160 says the ban does not apply to providers of hardware and software or providers of self-hosted wallets insofar as they do not possess access to or control over those wallets.
UAE: the DIFC prohibits it now
Rule GEN 3A.2.2 of the DFSA (Dubai International Financial Centre regulator) Rulebook prohibits dealing in privacy tokens in or from the DIFC. The rule was made in 2022 and amended in 2024 and 2025.
What is prohibited
Carrying on a financial service relating to a privacy token or involving a privacy device, making or approving a financial promotion, and offering a privacy token to the public.
Funds and derivatives
No managing a fund that invests in a privacy token, acting as its trustee, or dealing in derivatives relating to such a token.
This is a rule of the DIFC regime and the DFSA. The rules of other emirates and free zones differ and must be checked separately.
We will review your situation and propose a solution for your project.
US: the Tornado Cash case
The US has no general ban on privacy coins like the EU’s. The well-known case concerned a mixer, not a coin. OFAC added Tornado Cash to its sanctions list in August 2022.
The court decision
On 26 November 2024 the Fifth Circuit held that Tornado Cash’s immutable smart contracts are not “property” under IEEPA (US International Emergency Economic Powers Act), because they cannot be owned: no one can control, change or remove them.
Delisting
On 21 March 2025 the US Treasury removed the sanctions on Tornado Cash. Its press release cited a review of novel legal and policy issues and said it remains concerned about North Korean hackers and money laundering with digital assets.
The decision concerns a mixer and immutable code. It does not answer how US regulators would treat an exchange that lists Monero. AML (anti-money laundering) and sanctions rules apply to the business as before.
Comparison of approaches
Based on the AMLR text, the DFSA Rulebook and the Fifth Circuit decision.
| EU | DIFC (Dubai) | US | |
|---|---|---|---|
| Source | Regulation 2024/1624, Art. 79 | DFSA Rulebook, GEN 3A.2.2 | Van Loon v. Treasury, 5th Cir. |
| Who is covered | CASPs and financial institutions | Firms in or operating from the DIFC | Sanctions on a mixer (OFAC) |
| What is prohibited | Accounts allowing obfuscated transactions, including via privacy coins | Services, promotions, offers and funds involving privacy tokens | No general ban on coins |
| From when | 10 July 2027 | In force (2022 rule) | Sanctions removed 21 March 2025 |
| Private holders | Not addressed | Not addressed | No ban |
What a business should do
Map your jurisdictions
Check where you are licensed and where your clients are. For the DIFC the ban applies now, for the EU it starts on 10 July 2027.
Start herePlan the delisting
If you list privacy coins, prepare a schedule: client notice period and the process for withdrawing assets.
Check the developer role
The AMLR recital exempts wallet providers without control over client keys. Check that your setup really works that way.
Assuming the ban covers private individuals: Article 79 is addressed to service providers. Going by headlines rather than the text of the law: the Regulation does not name Monero, the test is functional. Mixing up mixers and privacy coins: the Tornado Cash decision does not settle listing questions. Applying the DIFC rule to the whole country.
The law looks not at the name of the coin but at whether a transfer can be traced.The LegalBit team
FAQ
Is Monero banned in the EU?
Holding it is not prohibited. From 10 July 2027 crypto-asset service providers in the EU may not keep accounts allowing obfuscated transactions, including through anonymity-enhancing coins.
Does the ban affect wallets?
Under the AMLR recital the ban does not apply to providers of self-hosted wallets and software developers who have no access to or control over the wallet.
Can Monero be listed in Dubai?
Not in the DIFC: rule GEN 3A.2.2 prohibits financial services relating to privacy tokens. Other emirates have different rules.
Did the Tornado Cash decision legalise privacy coins in the US?
No. The court held that immutable smart contracts are not property under IEEPA. The decision does not concern listing coins.
See also: Travel Rule for Crypto Businesses; What is Know Your Customer (KYC) and why is it essential for cryptocurrency exchanges?. Services: legal services for crypto projects.
This is what we do
How we help projects with this topic:
