FATF: "Centralized elements" frequently exist in DeFi and should be regulated

Global anti-money laundering agency: Most DeFi are not truly decentralized and should be subject to financial regulation

The Financial Action Task Force (FATF), the world's leading anti-money laundering agency, pointed out in a new report that many projects in decentralized finance (DeFi) are not as decentralized as they appear, and the platform behind it should be regulated like other financial businesses.

In the report, released Tuesday, the FATF said its rules already apply to any DeFi arrangement where there are identifiable persons "in control or have sufficient influence," no matter how decentralized the project claims to be. The Paris-based agency, whose standards are adopted by more than 200 jurisdictions, divides DeFi into three categories: platforms with identifiable controllers; platforms that are effectively centralized but the operators hide their identities; and a minority that truly has no leaders, what it calls "truly decentralized" platforms. Only the last category is not bound by its criteria.

report found that while many DeFi projects claim to be completely decentralized, centralized elements "often persist in practice" through centralized governance tokens, management rights, control of upgrades, and fees and rewards that flow to insiders.

FATF Chairman Giles Thomson said in a statement accompanying the report that the goal is to stop criminals using new technologies to "launder money" while "supporting responsible financial innovation" and emphasized that strong public-private information sharing is at the core of the response.

The report lists signs of controls on and off the chain, including upgrade keys and "kill switch" functions, the power to set fees or risk parameters, centralized voting rights, control of public websites or applications, and corporate entities that hire core developers or hold vaults. If such controls exist, the people behind them (whether developers, large token holders, front-end operators or funders) should be licensed and regulated like any financial company, the FATF said. Even running a front-end that directs users to protocols is enough to constitute a regulatory condition.

In fact, almost no one does this. In a recent FATF survey, nearly 93% of the jurisdictions surveyed had not yet applied relevant standards to any eligible DeFi arrangements, and only 26 of the 142 jurisdictions had evaluated relevant risks. Four countries have licensing rules in their laws, but only two countries have registered or licensed a platform based on this. FATF guidance is not law, but member states are rated based on their level of compliance, and persistent gaps may lead to a country being placed on the regulator's "grey list." The report follows a broader update released by the FATF a few days ago that found that most countries still face difficulties in fully implementing cryptocurrency rules.

The FATF wants countries to close the gap by requiring (or at least encouraging) DeFi projects to have anti-money laundering controls built directly into their smart contracts or interfaces, from sanctions screening to KYC (Know Your Customer) verification before certain functions are run.

For projects that truly lack leaders, the FATF directs regulators to focus on the bottlenecks around them: stablecoin issuers that can freeze tokens, exchanges that handle legal currency deposits and withdrawals, and front-end operators. The report states that if a platform refuses to cooperate, jurisdictions can use it as a last resort and ban it from operating in the area. Banks and exchanges were told to conduct due diligence on any DeFi platform they contacted or stop trading with them.

The report cited extensively how criminals have taken advantage of the field. The report specifically named North Korea, saying that its state-affiliated hackers were behind two attacks in April this year, which together stole more than $570 million: one was when the Solana perpetual contract exchange Drift Protocol was used and lost $285 million. It was completed in just 12 minutes; the other was when KelpDAO was hacked and lost $292 million. These two incidents together accounted for approximately 76% of the total losses from cryptocurrency hacking attacks this year. The report also pointed out that ransomware gangs, professional money laundering networks and investor fraud are heavy users of DeFi mixers, cross-chain bridges and exchange services.

Such crackdowns have been launched elsewhere. This year, U.S. prosecutors sentenced two co-founders of Bitcoin mixer Samourai Wallet to prison and convicted Tornado Cash developer Roman Storm, based on the philosophy the FATF emphasizes here: People who write and run the code can be considered regulated currency businesses.

The report shows that DeFi's total lock-in value has reached $86.6 billion this year, an increase of approximately 85% since 2023, with the top 12 agreements holding more than 60% of this. The report calls on regulators to implement the FATF rulebook rather than leave gaps that could facilitate large-scale illegal financial activity.