Summary
The Financial Action Task Force (FATF) said in a report dated July 22 that effective decision-making authority remains concentrated across much of the decentralized finance (DeFi) ecosystem, and that individuals or entities exercising such authority should be licensed and supervised like other financial operators. FATF argued its standards extend to DeFi arrangements where controllers are clearly identifiable, as well as to "hidden" operators where systems are nominally decentralized but functionally centralized in practice.
The watchdog's substance-over-label test centers on whether identifiable persons or entities retain influence over a DeFi arrangement — capturing founders, developers, front-end operators, treasury signers, or governance actors who exercise ongoing control. Holding governance tokens alone may not remove accountability if a party can still direct how the service functions. The report also noted limited national progress: only 26 of 142 jurisdictions surveyed have assessed DeFi-related risks.
While FATF guidance does not carry the force of law, the organization said persistent shortcomings can weigh on a jurisdiction's standing and contribute to placement on its grey list. The position signals that a project's "decentralized" branding will not by itself keep it outside anti-money-laundering rules.
Key Facts
- FATF report (July 22): most DeFi has identifiable or de facto controllers who should be licensed and supervised.
- Test: whether identifiable persons/entities retain influence (founders, devs, front-end operators, treasury signers, governance actors); holding governance tokens alone may not remove accountability.
- Extends to "hidden" operators — nominally decentralized but functionally centralized.
- Only 26 of 142 jurisdictions surveyed have assessed DeFi-related risks.
- FATF guidance is non-binding but can drive jurisdictional rulemaking and grey-list pressure.
- VASP classification brings AML supervision, customer due diligence, reporting, sanctions screening.
- Likely regulatory chokepoints: front ends, funders, token governance participants.
- Banks/exchanges may limit exposure to platforms failing due diligence.
Why It Matters
FATF's framing reframes the DeFi regulation debate from "is it decentralized enough to be unregulated?" to "who actually controls it?" By targeting reachable chokepoints — front ends, funders, governance participants — the report gives national supervisors a practical template for bringing DeFi inside the AML perimeter without needing to regulate smart-contract code itself.
The grey-list leverage is the enforcement mechanism: jurisdictions that fail to translate FATF standards into local licensing regimes risk standing consequences, which in turn pushes banks and exchanges to de-risk their exposure to non-compliant DeFi venues. For protocol teams, the practical consequence is that genuine operational decentralization — or compliance — becomes a precondition for preserving institutional access.