FATF says many DeFi projects still have controllers regulators can target

The Financial Action Task Force says many DeFi platforms still have people pulling key levers, which means regulators should treat those operators like crypto financial firms. For everyday crypto users, that could translate into more identity checks, compliance screens and pressure on apps that have marketed themselves as outside traditional oversight.

In a report published Tuesday, the Paris-based anti-money-laundering watchdog said its standards apply when a decentralized finance arrangement has an identifiable person with “control or sufficient influence.” DeFi, short for decentralized finance, refers to blockchain-based financial apps that let users trade, borrow, lend or earn yield through software rather than a bank or broker.

FATF said the label a project uses does not settle the question. The group said centralized features “frequently persist in practice,” including concentrated governance tokens, admin powers, control over software upgrades and fees or rewards that benefit insiders.

How FATF sorts DeFi

The watchdog divided DeFi arrangements into three buckets: platforms with identifiable controllers, projects that function with centralized control while operators remain hidden, and a smaller set it considers genuinely leaderless. FATF said only the last category falls outside its standards.

Where control exists, FATF said countries should identify the people or entities behind it and regulate them as virtual asset service providers. A virtual asset service provider, or VASP, is a crypto business that faces anti-money-laundering and counter-terrorist financing duties, such as customer checks and transaction monitoring.

The report pointed to several signs that someone may have meaningful control. Those include upgrade keys, which can change a protocol’s code; emergency shutoff functions; authority to set fees or risk limits; concentrated voting power; control of the public website or app; and corporate entities that employ core developers or hold a project treasury.

FATF said developers, major token holders, front-end operators and funders can fall within the rules if they have enough control or influence. A front end is the website or app that ordinary users see when they interact with blockchain code.

FATF President Giles Thomson said in a statement that the goal is to stop criminals from using new technology to “launder dirty money” while “supporting responsible financial innovation.” He also called public-private information sharing a key part of the response.

Most countries have not applied the rules

The report found enforcement remains limited. FATF said nearly 93% of surveyed jurisdictions have not applied its standards to any qualifying DeFi arrangement. Out of 142 jurisdictions, 26 have assessed the risks, four have licensing rules in place and two have registered or licensed a DeFi platform.

FATF standards are not laws by themselves. The group’s members, however, are evaluated on how closely they follow them, and ongoing weaknesses can contribute to a country being placed on FATF’s grey list.

The watchdog urged countries to require or encourage DeFi projects to build anti-money-laundering controls into smart contracts or user interfaces. Smart contracts are blockchain programs that execute transactions automatically when preset conditions are met.

Those controls could include sanctions screening and proof-of-KYC checks before certain functions run, according to FATF. KYC, or know your customer, refers to identity verification used by financial firms to assess who is using their services.

FATF also said countries should consider banning platforms that refuse to cooperate as a last resort. The recommendation adds to a broader FATF update released days earlier that said many countries are still struggling to enforce crypto rules more broadly.

This story draws on original reporting from Decrypt.