Key Highlights
- FATF issued its first dedicated report on decentralized finance and AML/CFT risks.
- The framework introduces a “control or sufficient influence” test to determine whether DeFi arrangements fall under FATF standards.
- Protocols with identifiable controllers could be brought under existing rules for virtual asset service providers.
The Financial Action Task Force (FATF) has released a new framework for deciding when decentralized finance (DeFi) protocols should fall under anti-money laundering and counter-terrorist financing (AML/CFT) rules.
According to a Chainalysis report published Monday, the global financial crime watchdog is focusing on whether an individual or entity has “control or sufficient influence” over a DeFi arrangement, rather than relying on how a protocol describes its level of decentralization.
The approach could bring some DeFi protocols under existing regulatory standards if regulators determine that identifiable individuals or entities have meaningful control over their operations.
FATF introduces ‘Control or Influence’ test for DeFi
The FATF’s new framework is centered on its “control or sufficient influence” (COSI) test, which is intended to help jurisdictions determine whether a DeFi arrangement falls within the FATF Standards.
Under the framework, regulators are expected to examine how a protocol operates and whether someone can materially influence its financial services. This could include control over governance, smart-contract upgrades, administrative permissions, protocol fees, treasury assets or other functions that affect how the arrangement operates.
The FATF’s approach means that a protocol’s claim of being decentralized would not, by itself, determine its regulatory status.
Instead, regulators would look at the actual structure and operation of the protocol.
DeFi protocols could fall under existing crypto rules
Where a person or entity is found to exercise sufficient control or influence, the arrangement could be subject to the FATF Standards and potentially treated as a virtual asset service provider (VASP).
The FATF also addresses cases where control exists, but the responsible parties have not yet been identified. In those situations, the organization calls for cooperation among regulators, law enforcement agencies, foreign authorities and blockchain analytics providers to identify the parties exercising control or influence.
A third category covers arrangements where no individual or entity exercises sufficient control or influence.
Such genuinely decentralized arrangements would remain outside the FATF Standards, although the FATF says jurisdictions should still apply risk-based measures to address potential illicit finance risks.
Regulators to examine governance and transaction flows
The framework gives regulators several factors to consider when assessing control. These include the concentration of governance tokens, administrative access to smart contracts, control over protocol upgrades, treasury management and the distribution of fees.
Regulators can also examine transaction patterns and other on-chain activity to determine whether particular wallets or entities have a significant role in operating or influencing a protocol.
The FATF’s approach therefore moves the regulatory assessment away from a simple question of whether a protocol is “centralized” or “decentralized.” Instead, the focus is on who can actually influence the financial services provided through the protocol.
FATF links DeFi rules to wider crypto oversight gaps
The new DeFi framework comes after the FATF raised broader concerns about gaps in global crypto regulation.
Earlier this year, the organization warned that weak oversight of offshore virtual asset service providers could leave gaps that criminals exploit for cross-border fraud, money laundering and other financial crimes.
The FATF said many jurisdictions were still not adequately regulating offshore crypto firms according to the services they provide.
The new DeFi framework extends that regulatory focus to protocols where identifying the responsible parties can be more difficult. Rather than treating decentralization as an automatic exemption, the FATF is asking jurisdictions to determine whether there are individuals or entities exercising meaningful control.
Stablecoins and DeFi also face greater scrutiny
The framework also addresses the growing relationship between stablecoins and DeFi. Stablecoins are widely used in decentralized lending, trading and liquidity markets, making them an important part of the FATF’s assessment of illicit finance risks in the sector.
The FATF recommends that stablecoin arrangements have safeguards that can help manage risks, including mechanisms that may allow tokens to be frozen or burned where appropriate.
Financial institutions dealing with DeFi may also face greater due diligence requirements, particularly where transactions involve higher-risk services or cross-chain infrastructure.
Blockchain analytics could help regulators apply the test
The FATF says jurisdictions should develop the technical capabilities needed to identify and monitor DeFi arrangements. Blockchain analytics can be used to examine wallet relationships, governance activity, transaction flows and other on-chain indicators that may help identify who exercises control or influence.
Chainalysis has also highlighted the role of blockchain data in applying the FATF’s new approach, arguing that on-chain activity can provide evidence of governance concentration, fee flows and links between blockchain addresses. However, the central issue remains the FATF’s regulatory framework rather than any particular analytics provider.
DeFi regulation could become more case-specific
The new framework leaves jurisdictions with significant responsibility for determining how the COSI test should be applied. DeFi protocols can involve developers, foundations, governance-token holders, front-end operators and infrastructure providers across different jurisdictions.
Control can also change over time as projects move from developer-led structures toward community governance. That could make regulatory classification more complicated, particularly where no single party has complete control, but several parties collectively have significant influence.
The FATF’s framework therefore does not create a blanket rule for DeFi. Instead, it gives regulators a method for assessing individual arrangements based on their actual governance and operational structures.
Also Read: UK Prepares a Tokenized Gold Framework to Defend London’s Bullion Dominance
