TL;DR
- FATF says DeFi arrangements with identifiable controllers should follow anti-money-laundering rules in practice, even when smart contracts and decentralized branding suggest no central operator.
- Nearly 93% of surveyed jurisdictions have never applied the standards, while only 26 of 142 assessed risks and just two licensed platforms so far.
- Countries should target controllers, interfaces, stablecoin issuers, and exchanges, embedding sanctions or KYC controls and considering bans when platforms refuse cooperation entirely.
The Financial Action Task Force has warned that decentralized finance often retains identifiable controllers and should not escape anti-money-laundering oversight simply because transactions occur through smart contracts. Its new report says rules already apply whenever a person maintains control or sufficient influence. The perplexing conclusion is that many protocols described as decentralized may be regulated like ordinary financial businesses, despite interfaces suggesting no central operator exists. FATF divides the sector into controlled platforms, systems centralized in practice with hidden operators, and a genuinely leaderless minority, with only the last category remaining outside its standards globally.
Decentralization Faces a Practical Control Test
Control may appear through upgrade keys, emergency shutdown functions, fee-setting powers, risk parameters, concentrated governance tokens, websites, treasuries, or companies employing core developers. FATF said developers, major token holders, funders, and front-end operators could qualify as regulated service providers when they exercise meaningful authority. A project can therefore look autonomous while its decisive levers remain surprisingly human, making decentralization a factual test rather than a branding claim. Even operating an interface that directs users toward a protocol may be sufficient to trigger licensing and supervision obligations under the watchdog’s framework across increasingly complex governance structures.
Implementation remains remarkably limited. Nearly 93% of surveyed jurisdictions have never applied FATF standards to a qualifying DeFi arrangement, while only 26 of 142 respondents have assessed related risks. Four jurisdictions have licensing rules, and just two have ever registered or licensed a platform. The enforcement gap is almost as striking as the centralization FATF wants governments to uncover, especially because persistent deficiencies can affect countries’ evaluations and contribute to grey-list exposure. The report urges authorities to identify controllers and require compliance rather than treating decentralized finance as an automatic regulatory exception in practice today.
FATF recommends embedding sanctions screening and proof-of-KYC checks into contracts or interfaces, while targeting stablecoin issuers, exchanges, and front ends around genuinely leaderless systems. Platforms refusing cooperation could face territorial bans, and financial institutions may be told to stop serving them. The proposed response moves regulation from protocol labels toward every practical point where influence or liquidity concentrates. The urgency reflects illicit-finance concerns, including two North Korea-linked April attacks totaling more than $570 million, as DeFi value locked reached $86.6 billion and the largest twelve protocols controlled over 60% across a rapidly expanding global market.
