DeFi

No major regulatory framework has created a comprehensive DeFi-specific regime. Instead, regulators have adopted a functional approach: where a DeFi protocol has an identifiable operator, owner, or controlling person, that person may acquire regulated obligations regardless of the protocol's technical architecture. The EU's MiCAR Recital 22 states that services provided in a 'fully decentralised manner without any intermediary' fall outside its scope — but most DeFi protocols do not satisfy this test in practice.

The FATF's 2021 updated guidance on VASPs takes a similar approach: DeFi protocols with an identifiable owner or operator are VASPs and must comply with FATF AML/CFT standards. The threshold question — whether a protocol has a controlling person — is a fact-specific legal analysis. DAOs present a particular challenge: governance token holders who collectively control protocol parameters may constitute the 'persons' who trigger regulatory obligations, even without a formal legal entity.

Programmable compliance is an emerging concept in DeFi regulation — the embedding of compliance logic (sanctions screening, transfer restrictions, AML flags) into smart contracts at the protocol layer. Several jurisdictions have begun to require or encourage this approach, particularly for stablecoin infrastructure, as a practical mechanism for making permissionless protocols compatible with regulated obligations.