The Financial Action Task Force published a report Tuesday stating that many decentralized finance platforms retain centralized control and fall under its anti-money-laundering rules wherever identifiable people control them. The report found that centralized elements "frequently persist in practice" through concentrated governance tokens, administrative privileges, control over upgrades, and fees flowing to insiders. Nearly 93% of surveyed jurisdictions have yet to apply the rules to qualifying DeFi arrangements, and just two have ever licensed or registered one, according to the Paris-based body whose standards are used across more than 200 jurisdictions.
FATF Classifies DeFi Into Three Control Categories
The Financial Action Task Force sorts DeFi into three groups: platforms with identifiable controllers, those that are centralized in practice but whose operators stay hidden, and a genuinely leaderless minority it calls truly decentralized. Only the last category escapes its standards. The report lays out on-chain and off-chain signs of control, including upgrade keys and "kill switch" functions, the power to set fees or risk parameters, concentrated voting power, command of the public website or app, and the corporate entities that employ core developers or hold the treasury. Where such control exists, the people behind it, whether developers, large token holders, front-end operators or funders, should be licensed and supervised like any financial firm. Even running a front-end that funnels users to a protocol can be enough to qualify. FATF President Giles Thomson said in a statement accompanying the report that the goal is to stop criminals exploiting new technology to "launder dirty money" while "supporting responsible financial innovation."
Survey Reveals 93% of Jurisdictions Have Not Applied DeFi Standards
Nearly 93% of the jurisdictions that responded to a recent FATF survey have not applied the standards to any qualifying DeFi arrangement, and only 26 out of 142 have assessed the risks at all. Four have licensing rules on the books, while just two have ever used them to register or license a platform. FATF guidance is not law, but members are graded on how closely they follow it, and persistent gaps can help land a country on the watchdog's "grey list." The report comes on the heels of a broader FATF update days earlier that found most countries still struggling to enforce crypto rules across the board.
FATF Recommends Built-In Compliance Controls and Choke Point Regulation
FATF wants countries to close the gap by requiring, or at least encouraging, DeFi projects to build anti-money-laundering controls straight into their smart contracts or interfaces, from sanctions screening to proof-of-KYC checks before certain functions run. For projects that really are leaderless, it steers regulators toward the choke points around them: stablecoin issuers that can freeze tokens, exchanges that handle fiat on- and off-ramps, and front-end operators. Where a platform refuses to cooperate, the report says, a jurisdiction can as a last resort ban it from operating in its territory. Banks and exchanges are told to run due diligence on any DeFi platform they touch, or stop dealing with it.
North Korea-Linked Hackers Stole $570 Million in April Attacks
The report singles out North Korea, whose state-linked hackers it says were behind two April attacks that together drained more than $570 million: the $285 million exploit of Solana perpetuals exchange Drift Protocol, pulled off in just 12 minutes, and a $292 million hack of KelpDAO. Together they made up some 76% of the year's crypto-hacking losses. The report also points to ransomware crews, professional laundering networks, and investor frauds as heavy users of DeFi's mixers, bridges and swaps. U.S. prosecutors this year secured prison terms for the two co-founders of Bitcoin mixer Samourai Wallet and a conviction against Tornado Cash developer Roman Storm. DeFi's total value locked reached $86.6 billion this year, up about 85% since 2023, with the top dozen protocols holding more than 60% of it, per the report.
FAQ
What did the Financial Action Task Force say about DeFi regulation in its Tuesday report?
The Financial Action Task Force published a report Tuesday stating that many DeFi platforms retain centralized control through governance tokens, administrative privileges, and upgrade controls, and therefore fall under its anti-money-laundering rules wherever identifiable people control them.
How many jurisdictions have applied FATF standards to DeFi arrangements?
Nearly 93% of surveyed jurisdictions have not applied the standards to any qualifying DeFi arrangement, and only two jurisdictions have ever licensed or registered a DeFi platform, according to the FATF report.
What attacks did North Korea-linked hackers carry out in April?
North Korea-linked hackers were behind two April attacks that drained more than $570 million: a $285 million exploit of Solana perpetuals exchange Drift Protocol and a $292 million hack of KelpDAO, together making up 76% of the year's crypto-hacking losses.
