DeFi Compliance in 2026: Follow the Chokepoints

On 20 October 2026, the comment window closed on the first permanent crypto rulebook the U.S. Securities and Exchange Commission has ever proposed. The agency logged roughly 140 submissions on its Regulation of Crypto Assets package, from the largest exchanges to individual holders to decentralized-finance protocols that insist they are nothing more than software, according to a tally of the docket. Almost every one of them was arguing about the same thing: not whether DeFi should follow the rules, but where exactly the rules are supposed to grab hold of something that, by design, has no one standing behind the counter.

That is the whole problem in one sentence. You cannot regulate a smart contract. It is code deployed to an address that often no person can amend, pause, or switch off, and a prosecutor cannot serve a subpoena on a stretch of bytecode. So compliance never really lands on the protocol. It lands on the chokepoints: the small number of mostly centralized points that every DeFi application quietly depends on, the places where decentralized software touches the regulated world. This is a map of those chokepoints as they stand in late 2026, with Bitcoin trading around $81,500, the stablecoin supply near $298 billion, and roughly $90 billion locked across DeFi. If you want to understand where this sits in the wider cycle, our crypto year-end outlook frames the macro backdrop; this piece is about the plumbing underneath it.

The thing you cannot regulate

Start with the phrase itself. “DeFi compliance” is close to a contradiction. Compliance, as every anti-money-laundering rule on the planet is written, assumes an intermediary: a business that knows its customers, screens them against sanctions lists, files suspicious-activity reports, and can freeze an account when a court demands it. Permissionless DeFi was built to delete that party. A Uniswap pool or an Aave market does not onboard you, does not hold your coins, and in its purest form answers to no company at all. There is no counter, so there is no one to put behind it.

Regulators resolved that tension years ago with a single idea that now governs everything: the perimeter is control, not the label. The Financial Action Task Force, the global standard-setter for anti-money-laundering rules, spelled it out in its July 2026 targeted report on decentralised finance. Its test asks whether any natural or legal person exercises control or sufficient influence over an arrangement. If someone does, that someone is treated as a regulated service, no matter how decentralized the marketing says the product is. The report sorts DeFi into three buckets: arrangements with identifiable controllers (full obligations apply), arrangements that are effectively centralized but hide their controllers (still in scope, and supervisors are told to go find them), and the genuinely leaderless (outside the service rules, but residual-risk duties remain).

The gap between theory and practice is enormous. By the FATF’s own count, about 93 percent of surveyed jurisdictions, 132 of 143, had not implemented the standards for qualifying DeFi, and only two of 142 had actually licensed or registered a single DeFi arrangement, per Chainalysis’s reading of the report. In other words, the rule exists, almost no one enforces it directly, and so enforcement has drifted to the edges, to the points where control is easy to find. Those edges are the chokepoints.

Five rulebooks, not one

Before the map, clear up the single most common error in crypto coverage: the idea that “the SEC regulates DeFi.” It does not, at least not on its own. A DeFi protocol can sit inside five different rulebooks at once, each run by a different agency, each triggered by a different activity. The anti-money-laundering and sanctions rules, the ones most people mean when they say compliance, are not the SEC’s at all; they belong to the Treasury, through FinCEN and the Office of Foreign Assets Control. Confusing the securities question (is this token an investment contract?) with the AML question (who screens the money?) is how most explainers go wrong.

The European Union draws the same five lines through different offices: anti-money-laundering through the new Anti-Money-Laundering Regulation and the Frankfurt-based AMLA, sanctions through EU-level designations, market conduct and token rules through the Markets in Crypto-Assets Regulation and national regulators, derivatives under MiFID II, and tax at the member-state level. The agencies change; the five surfaces do not. Keep them straight and the rest of the map makes sense.

Chokepoint one: the on-ramp

The strongest chokepoint is also the most boring one, and it is the one almost every user actually passes through: the place where dollars or euros become crypto. Unless you were paid in stablecoins, your money entered this world through a centralized exchange or a licensed on-ramp, and that business is a fully regulated financial institution. It collected your identity documents, screened you against sanctions lists, watches your transactions, and will hand your records to a court or a tax authority on request. The line between a custodial exchange and a self-custody wallet has blurred in the product design, a shift we traced in how crypto UX converged in 2026, but the legal line has not moved at all. One side knows exactly who you are; the other does not.

This is why the on-ramp is the chokepoint regulators lean on hardest. It is cheap to supervise (a finite list of licensed firms), it catches the moment of conversion (where illicit value is most exposed), and it already carries the full weight of know-your-customer and the Travel Rule, the requirement that the sending and receiving institutions pass along identifying data about a transfer. The 2023 Binance settlement, which reached more than $4 billion after the exchange admitted it had run for years without a meaningful anti-money-laundering program, is the reference point everyone in the industry now plans around, documented in the Justice Department’s resolution. The message landed: the ramp is where the state has leverage, and it will use it.

For most people, DeFi compliance begins and ends here, whether they realize it or not. The protocols downstream may be permissionless, but the fiat entry and exit are not, and that single bottleneck gives authorities a record of who turned money into tokens in the first place. Everything that follows on-chain is, in principle, traceable back to it.

Chokepoint two: the front-end

Here is the distinction that makes modern DeFi enforcement work. The smart contract cannot be censored, but the website in front of it can be. A protocol is really two things glued together: the on-chain contracts (uncensorable, autonomous) and the off-chain interface (a hosted website, an app, an API, a wallet connector) that lets normal humans use them. That interface is run by an identifiable company on identifiable servers, and a company is something a regulator can reach.

Uniswap Labs is the textbook case. The Uniswap contracts keep trading no matter what, but the Uniswap front-end, working with the analytics firm TRM Labs, screens wallet addresses and blocks hundreds of them tied to sanctions, stolen funds, and ransomware, a practice documented after the 2022 Tornado Cash sanctions. The tokens themselves still exist; the easy door to them does not. After those sanctions, Uniswap, Aave, Balancer, and others restricted flagged addresses within days, not because the protocols changed, but because the interfaces did. If you build a wallet or app that connects to DeFi, you are building a potential chokepoint, which is part of why the plumbing matters so much in smart-account wallets and what you actually own.

Two 2026 developments show the front-end chokepoint being pulled in opposite directions at once. In the United States, Congress used the Congressional Review Act in April 2025 to repeal the IRS DeFi broker rule, so front-ends are no longer forced to file tax forms on their users, and the agency cannot simply reissue it without new legislation. In Europe, the move went the other way: as part of its September 2026 response to the MiCA review, the European Securities and Markets Authority proposed a brand-new licensable category, a “DeFi access service,” aimed squarely at the web interfaces, wallets, and aggregators that provide access to protocols, per the regulator’s published asks. Same chokepoint, two governments, opposite instincts: America loosened the tax grip on the front-end while Europe moved to license it outright.

Chokepoint three: the settlement asset

Even if the protocol is leaderless and you reach it through a neutral interface, compliance can still enter through the money itself. The dollar that moves through almost every DeFi trade is not a public, neutral bearer asset; it is a private liability issued by a company, and that company keeps a switch. Tether and Circle can freeze, seize, and burn their own tokens at specific addresses, and they do it routinely on law-enforcement orders. The settlement asset is a chokepoint hiding in plain sight.

Lawmakers have now written that switch into statute. The GENIUS Act, signed into law in July 2025, requires payment-stablecoin issuers to hold the technical capability to seize, freeze, or burn tokens and to prevent their transfer on a lawful order, per the White House fact sheet; the core rules take effect in January 2027. Europe’s MiCA already bakes the same expectation into its stablecoin regime, and the FATF’s March 2026 stablecoin report urged issuers to embed freeze and deny-list controls directly in their smart contracts and to monitor secondary-market activity. The compliance does not need to reach the DeFi protocol at all; it reaches the asset the protocol settles in.

This chokepoint matters more every year because stablecoins have become the main illicit rail. Chainalysis reported that while illicit activity stayed under 1 percent of all on-chain volume, the absolute figure climbed to about $154 billion, and stablecoins accounted for roughly 84 percent of that illicit value, in its 2026 crime report. The obvious counter-move is a stablecoin no issuer can freeze, and it already exists: the Huione-linked USDH coin was marketed as unfreezable even on a lawful request, which is precisely why the U.S. Treasury cut the group off from the dollar system. A freeze-resistant settlement asset is the one way to slip this chokepoint, and it is also the fastest route onto a sanctions list.

Chokepoint four: the people

When there is no company and no freezable asset, the state reaches for the humans. The last decade of enforcement has been a long argument about which humans around a protocol are fair game, and the answer that has emerged is consistent: liability follows control and profit, not the label on the box.

The Tornado Cash cases drew the line. First, a court protected the code: in Van Loon v. Treasury, the Fifth Circuit held in November 2024 that immutable smart contracts are not property that OFAC can sanction, and the Treasury delisted the protocol in March 2025, as CoinDesk reported. Then a court went after the conduct: developer Roman Storm was convicted in August 2025 of conspiring to run an unlicensed money-transmitting business, with the jury hung on the money-laundering and sanctions counts, and his retrial on those two counts is now set for 26 April 2027 before Judge Katherine Polk Failla, carrying a combined maximum of 40 years, per Decrypt. The distinction the Justice Department itself drew is the one to remember. As Matthew Galeotti, then the head of the department’s Criminal Division, put it at an industry event in 2025, “merely writing code without ill intent is not a crime,” a line reported by CoinDesk. Writing the contract is protected; operating a service around it is conduct.

Governance is the other human chokepoint. In CFTC v. Ooki DAO, a federal court entered a default judgment in June 2023 holding that a decentralized autonomous organization was an unincorporated association and a “person” under commodities law, that its governance-token voters were its members, and it imposed a civil penalty of $643,542 and ordered the DAO’s website taken offline, per the CFTC. Token voting, it turns out, can be legal control. The one law that would have drawn these lines by statute rather than case by case, the CLARITY Act with its developer shield in Section 604, failed a Senate cloture vote 49 to 50 on 15 September 2026, as CNBC noted, so for now the people chokepoint is governed by precedent, not legislation.

Chokepoint five: the machine room

The frontier of this fight is one layer deeper than most coverage goes, in the infrastructure that actually orders and delivers transactions. A “decentralized” app leans on a surprising amount of concentrated plumbing: the relays that assemble blocks, the remote-procedure-call providers that relay your transaction to the network, the sequencers that order transactions on Layer 2s, and the oracles that feed in prices. Each is a place where a small number of operators hold real control, which, under the FATF’s control-or-influence test, is exactly what makes something a candidate chokepoint.

Ethereum already ran the experiment, and the result is the most instructive story in DeFi compliance. After the network moved to proof-of-stake in 2022, most validators outsourced block construction through a piece of software called MEV-Boost, which routes blocks through intermediaries called relays. When OFAC sanctioned Tornado Cash on 8 August 2022, several of the busiest relays began filtering out any transaction that touched the sanctioned addresses. These OFAC-compliant relays spread fast: by late 2022, sanctions-screening relays were building the large majority of Ethereum blocks, with some tallies that November putting the compliant share near 80 percent, according to relay-monitoring data. For a few months, it looked as though a U.S. sanctions list had quietly captured the base layer of the second-largest blockchain, even though, as critics stressed, OFAC never actually ordered any relay to censor anything.

Then it reversed, and that reversal is the point. Neutral relays that refused to censor, such as Ultra Sound Relay, Titan, and Aestus, out-competed the screening ones, and validators chasing the best blocks followed the money. By mid-2023 the censoring share had already fallen below 30 percent, and by August 2026, screening relays built only about a quarter of blocks, while neutral relays assembled roughly 70 percent, per the same monitoring. Flashbots, which dominated right after the Merge, was down to about 2.4 percent of blocks. The machine-room chokepoint turned out to be real but leaky: compliance could reach the infrastructure, but market competition dragged it back out, because no law compelled the relays and neutrality was a selling point.

The other machine-room points are less tested but structurally similar. RPC providers like the ones behind popular wallets have geofenced users and dropped certain regions before, and bridges, the connectors that move assets between chains, concentrate both value and control in ways we examined in our bridge-risk playbook. Centralized Layer 2 sequencers can in principle reorder or delay transactions, and a single dominant oracle is a lever too. None of these has been squeezed the way the ramp or the front-end has. But they are the obvious next targets if regulators decide the easy chokepoints are not enough, and the Ethereum relay episode is the warning both sides study: the base layer can be pressured, and it can also push back.

The chokepoint map

Put the five together and DeFi compliance stops looking like a mystery and starts looking like a ladder, running from the point where the state has the firmest grip down to the frontier where its grip is weakest. Each rung has a different controller, a different enforcement lever, and a different escape hatch.

What DeFi told the SEC

Which brings the map back to the docket that just closed. The SEC proposed its Regulation of Crypto Assets package in August 2026 and took comments through 20 October, in the agency’s first attempt at a permanent, rules-based framework rather than enforcement one case at a time. At its heart is Rule 400, a safe harbor that defines when a token stops being tied to an investment contract, plus two exemptions that would let issuers raise up to $75 million without full registration. It is aimed at the securities surface, one rung of the five.

The DeFi comments zeroed in on where the proposal touches the chokepoints. The DeFi Education Fund, whose chief executive and chief legal officer Amanda Tuminelli filed on the deadline, argued that the draft wrongly treats certain decentralized exchanges that collect a protocol fee as digital-asset brokers, even though the software is peer-to-peer and never takes custody of a user’s assets, a position the group set out in its submission. That is the front-end and developer chokepoints in one argument: charging a fee should not, on its own, turn neutral software into a regulated intermediary. Tuminelli has framed the broader stakes bluntly, writing that “if there is one thing we can all agree on, it’s protecting developers from being misclassified and forced into regulatory categories meant for traditional financial intermediaries,” in a public statement during the earlier legislative fight.

The deeper lesson of the comment record is one the map predicts: even a perfect securities rule would not settle DeFi compliance, because securities law is only one of the five surfaces. Rule 400 says nothing about who screens for sanctions, who files suspicious-activity reports, or who freezes a stablecoin. SEC Chair Paul Atkins has pushed the agency toward protecting permissionless access, arguing that the right to self-custody is “a foundational American value that should not disappear when one logs onto the internet,” per The Block. Even granting that in full, the anti-money-laundering and sanctions chokepoints, the ones that do the real squeezing, sit at the Treasury and are untouched by anything the SEC finalizes.

Two ways to dodge the squeeze

Builders who want to stay inside the rules without surrendering the whole premise of DeFi have converged on two opposite escapes, and they sit at the far ends of a spectrum. One makes the chokepoint compliant by design; the other makes it unnecessary.

The first is permissioned DeFi: know everyone. Access is gated to users who have passed identity checks, usually through a whitelist baked into the token standard. Aave’s institutional market Horizon, launched in August 2025, is the flagship; it lets allowlisted institutions post real-world assets as collateral while keeping stablecoin supply open, peaked above $600 million in deposits early in 2026, and sat near $255 million in locked value a year after launch, per Sentora’s tracking. Standards like ERC-3643 embed identity permissions at the token level, and the “DeFi mullet” model, a compliant fintech front with a DeFi back end, powers private-credit platforms such as Maple and Centrifuge. This is where the institutional money actually goes.

The second is the opposite: know no one, but prove the money is clean. Privacy Pools, the design 0xbow launched on Ethereum in March 2025 and built on a 2023 paper co-authored by Vitalik Buterin, lets a user prove their funds are not connected to illicit sources without revealing their identity, using zero-knowledge proofs and “association sets,” as The Block described. It is a genuine attempt at compliance without surveillance, and it is tiny: a few million dollars in deposits and a few thousand users, a rounding error next to permissioned DeFi’s billions. The honest takeaway is that the market has voted. Compliance by whitelist pulls the capital; compliance by cryptography wins the argument and almost none of the volume.

Europe regulates the door, not the code

The European Union reached the same conclusion by a different road, and its wording is almost a thesis statement for the whole chokepoint model. MiCA, the bloc’s crypto rulebook, regulates crypto-asset service providers and token issuers, not autonomous protocols; its Recital 22 explicitly leaves fully decentralized services, with no intermediary, outside the frame. Brussels is not pretending it can write rules for a smart contract. It is writing rules for the people who provide access to one.

That is exactly what the September 2026 MiCA review made concrete. ESMA asked for a new licensable “DeFi access service” covering the interfaces, wallets, and aggregators that front the protocols, for clearer criteria on when an arrangement is decentralized enough to fall outside the rules, and for hard powers to block fraudulent sites and freeze crypto assets, all in its formal response. It is the front-end chokepoint, written into law on purpose. On the money-laundering side, the EU’s Anti-Money-Laundering Regulation applies in full from 10 July 2027 and the new AMLA supervisor is standing up in Frankfurt, bringing the on-ramp and stablecoin chokepoints under a single European roof. The instruments differ from the American ones, but the target is identical: the door, not the code.

Does any of it actually work?

A map of where the rules land is not the same as proof that they stop crime, and the evidence here is genuinely mixed. On one side, blockchains are a permanent, public ledger, and the forensic firms built on them, Chainalysis, Elliptic, and TRM, have helped trace and recover stolen funds that in the cash economy would have vanished. Illicit activity remains under 1 percent of all on-chain volume even as the absolute number rose, which supporters read as a system that is mostly clean and increasingly watched.

On the other side sits a hard cost-benefit question. Peter Van Valkenburgh of the think tank Coin Center argues that the existing anti-money-laundering regime “does remarkably little to prevent illicit finance” while imposing heavy costs, pointing to industry compliance spending above $26 billion a year in the United States and United Nations estimates that law enforcement seizes a fraction of a percent of criminal proceeds, in his essay Tear Down This Walled Garden. The chokepoint model is good at catching the honest and the careless, who use the regulated ramp, the hosted front-end, and the freezable stablecoin. The determined adversary routes around all three, which is why the same Chainalysis data shows value flowing to sanctioned entities surging and freeze-resistant tools gaining ground. Compliance has not stopped the flow so much as pushed it to the edges of the map, into exactly the leaderless, freeze-proof, infrastructure-level corners the chokepoint model struggles to reach.

The winter that redraws the map

The comment window that just closed is the first of several deadlines that will reshape the chokepoints between now and spring. No single law is coming after the CLARITY Act’s failure, but a stack of rules, reviews, and a retrial will do the work piece by piece, and each one tightens or loosens a specific rung of the ladder. The FATF opens its October plenary in Paris this week, the first under the United Kingdom’s presidency, with DeFi and stablecoins on the table, per the body’s schedule.

Two of these are easy to confuse and worth keeping apart. The Regulation of Crypto Assets package, the one whose comments closed on 20 October, is about token offerings and the securities surface. A separate SEC proposal on how investment advisers and funds may custody crypto, including when they can self-custody, is a different document with its own comment window running into early December. Different rung, different clock.

The practical takeaways fall out of the map. If you build a protocol, assume that control plus profit, admin keys, upgrade rights, a fee switch you alone flip, is what converts your software into a regulated service; the cleaner you want to stay, the less of that you can hold. If you run a front-end, screening is now the price of hosting a website, and in Europe a license may soon be too. If you are a user, the uncomfortable truth is that the on-ramp already knows who you are, moving to self-custody does not erase that record, and the stablecoin in your wallet can be frozen by its issuer on a court order; choosing a hardware setup, as our Ledger, Trezor, and Tangem comparison covers, changes who holds your keys, not whether the ramp behind you kept a file. Decentralization is a spectrum, and so is compliance; where you sit on one decides where you sit on the other.

Frequently Asked Questions

Is DeFi regulated in 2026?

Mostly indirectly. Regulators rarely license a DeFi protocol itself, since you cannot supervise autonomous code, but they regulate the chokepoints it depends on: the fiat on-ramp, the hosted front-end, the stablecoin issuer, and the people with control over it. The rule attaches wherever someone exercises control, not to the word decentralized.

Can regulators shut down a DeFi protocol?

They usually cannot remove the on-chain contracts, which is why courts held that OFAC could not sanction Tornado Cash’s immutable code. What they can do is pressure the front-end to block addresses, cut off the fiat on-ramp, and have a stablecoin issuer freeze funds, which together can make a protocol very hard to use even if it keeps running.

Do I need to pass KYC to use DeFi?

Not usually at the protocol level; connecting a self-custody wallet to a permissionless pool rarely asks for identity. But the exchange or on-ramp where you bought crypto did verify you, so your activity is traceable back to that point, and permissioned DeFi platforms require full identity checks before you can take part.

Who is liable if a DeFi protocol is used for crime?

Liability follows control and profit, not the label. U.S. cases have reached developers who operated a service (Roman Storm), decentralized organizations and their governance-token voters (the Ooki DAO), and front-end operators. Simply writing or publishing code, without operating a service around it, has so far been treated as protected.

Can stablecoins used in DeFi be frozen?

Yes. The issuers of USDT and USDC can freeze, seize, or burn their tokens at specific addresses on a lawful order, and they do so routinely. The GENIUS Act requires payment-stablecoin issuers to keep that technical capability, so the settlement asset is one of the most reliable compliance chokepoints in all of DeFi.

Anneke de Vries is HOGE Wire’s regulation correspondent, covering crypto policy, enforcement, and the mechanics of compliance across the United States and European Union.