DeFi Compliance in 2026: Who Answers for a DAO?

Ask a lawyer who to sue when a DeFi protocol breaks the law, and the honest answer in 2026 is still a shrug. The code runs on its own. The token that governs it sits in thousands of wallets. The people who wrote it may have walked away years ago. And yet the law needs a defendant, a taxpayer, a party that can sign a contract or pay a fine. That gap, between a decentralized autonomous organization and a legal person who answers for it, is where DeFi compliance actually lives.

Three events drew the map. In 2023 a federal court let the Commodity Futures Trading Commission win a judgment against a DAO as though it were a person. In 2024 a California judge suggested a DAO might be something worse: a general partnership in which anyone who voted could be on the hook for what everyone else did. And in 2025 the largest DAO in DeFi, Uniswap, voted to wrap itself in a Wyoming legal shell rather than keep operating as nothing at all.

Bitcoin trades around $78,500 as this is written, per Fortune; total value locked across DeFi sits near $83 billion, according to DefiLlama; and the dollar stablecoins that settle most of it are worth about $293 billion, DefiLlama data show. None of those numbers answers the question that keeps DAO contributors up at night: if the protocol is sued, who pays? This is a guide to that question, and to the corporate forms, court rulings, and agency rulebooks that now shape the answer.

The default legal form of a DAO is the scariest one

Start with what a DAO is when nobody has made it anything. A group of people pool money, decide by token vote, run a shared treasury, and coordinate work. Strip away the blockchain and that description fits an old, unglamorous legal category: the general partnership, the default form the law assigns to any group carrying on a business for profit without filing to become something else. General partnerships have one infamous feature. Every partner is personally liable for the debts and wrongs of the whole, with no shield between the enterprise and their own house and savings.

For years that risk felt theoretical. Then came Samuels v. Lido DAO. On 18 November 2024, US District Judge Vince Chhabria declined to throw out a claim that Lido, one of the largest liquid-staking protocols, was a general partnership whose members could be sued. Lido’s actions, the judge wrote, “are not those of an autonomous software program, they are the actions of an entity run by people,” pointing to governance votes, a treasury, and more than seventy people doing work for it, as Davis Wright Tremaine summarized the ruling. The court let the case proceed against the venture firms Paradigm, Andreessen Horowitz, and Dragonfly on the theory that they had actively participated in governance, CryptoSlate reported.

The scariest line was about scope. The partnership, Chhabria allowed, might be “narrower (for instance, including only the founders) or broader (for instance, including everyone who has voted on a governance proposal or who holds any LDO).” The court did not rule that every token holder is liable; it ruled only that the plaintiff had plausibly alleged a partnership and that active participants could be partners. But the message landed. Miles Jennings, head of policy and general counsel at a16z crypto, reacted the same week: a California judge had “dealt a huge blow to decentralized governance,” because any participation, “even posting in a forum,” might expose members to liability for others. His conclusion became a slogan: “It’s time to DUNA.”

Compliance is not one rulebook; it is five agencies

Before a DAO can decide what shell to wear, it has to know which rules might reach it. In the United States there is no single crypto regulator and no single DeFi statute. Instead, five separate surfaces can attach, each with its own agency, its own trigger, and its own penalty. The most common error, repeated in headlines every week, is to treat the Securities and Exchange Commission as the anti-money-laundering cop. It is not. AML and sanctions belong to the Treasury, through FinCEN and OFAC; the SEC polices securities. A DAO can be clean on one surface and badly exposed on another.

Each of these can reach a DAO without any crypto-specific law on the books, because the underlying statutes (the Commodity Exchange Act, the securities acts, the Bank Secrecy Act, the tax code) predate crypto and already define their targets by conduct, not by technology. That is the thread running through every case below: the label “DAO” is not a category the law recognizes as exempt. What matters is what the group does and who controls it.

The mapping is rarely clean. A lending market that simply matches suppliers and borrowers of capital looks different from a derivatives venue, which is squarely the CFTC’s turf, or a front-end that routes orders, which starts to resemble a broker. A protocol can drift across surfaces as it adds features: turn on leverage and the CFTC takes interest; let users swap one person’s coins for another’s and FinCEN’s money-transmission rules come into view; sell a token to fund the build and the SEC’s Howey analysis wakes up. Compliance for a DAO is therefore not a box ticked once but a map to re-read every time governance ships a new feature.

The Ooki precedent: a DAO is a person that can lose in court

The case that turned theory into judgment began with a protocol called bZx. In September 2022 the CFTC settled charges against bZeroX and its founders, Tom Bean and Kyle Kistner, for roughly $250,000, including a failure to run the anti-money-laundering program the Bank Secrecy Act requires, the agency announced. The twist was in the timeline. About a year earlier, in August 2021, the founders had handed control of the protocol to a DAO, later renamed Ooki, in what regulators called an attempt to put it beyond the law’s reach, Skadden noted in its analysis. The CFTC then sued the DAO itself as the successor.

On 9 June 2023, US District Judge William Orrick entered a default judgment against Ooki DAO. The court held that the DAO was a “person” and an unincorporated association under the Commodity Exchange Act, that it had run an illegal trading platform and failed its Bank Secrecy Act duties, and it imposed a civil penalty of $643,542 along with permanent trading and registration bans and an order to take the website offline, binding even third-party hosts and domain registrars, the CFTC reported. Ian McGinley, then the agency’s enforcement director, did not hedge: “The founders created the Ooki DAO with an evasive purpose, and with the explicit goal of operating an illegal trading platform without legal accountability.”

Two holdings outlived the fine. First, a DAO can be named, served, and beaten in court as a single defendant; decentralization is not invisibility. Second, because an unincorporated association is made of its members, the CFTC argued that token holders who voted were members, precisely the exposure the Lido ruling would later echo in partnership terms. Liability, in both cases, follows control and participation, not the marketing.

The control test: when governance makes a protocol an operator

The same logic drives the global anti-money-laundering standard. In July 2026 the Financial Action Task Force, the inter-governmental body whose recommendations most countries turn into law, published a targeted report on DeFi built around a single idea it calls control or sufficient influence, the FATF said. Wherever a natural or legal person exercises control or sufficient influence over a DeFi arrangement, that person is a regulated virtual-asset service provider and owes the full AML program. Genuinely leaderless code falls outside the VASP rules, though residual-risk duties remain.

The indicators the FATF lists read like a description of what a DAO does: concentration of governance tokens, administrative keys and upgrade control, the direction of fee and treasury flows, and influence over the development team and the front-end, as Chainalysis read the report. The uncomfortable implication is that the more real a DAO’s governance is, the more it looks like an operator who owes compliance. A vote that moves a treasury or flips a fee switch, the kind of consequential decision Render’s governance has taken on its own network, is evidence of control, not of its absence. The hole is wide: the FATF found that roughly 93 percent of surveyed jurisdictions had not implemented the standards for qualifying DeFi, and just two of 142 had licensed or registered a single DeFi arrangement.

The developer shadow: Tornado Cash and writing code

If governance can be control, what about the people who merely build? The Tornado Cash saga drew the line. In 2024 the Fifth Circuit held that the mixer’s immutable smart contracts were not property that OFAC could sanction, and in March 2025 the Treasury removed it from the list, CoinDesk reported. Code, on its own, proved untouchable. The developer did not. In August 2025 a jury convicted Roman Storm of conspiracy to run an unlicensed money-transmitting business; it hung on the money-laundering and sanctions counts, and prosecutors will retry him on those on 26 April 2027, with up to 40 years at stake, The Block reported.

The distinction regulators now draw is between writing software and operating a service around it. Matthew Galeotti, who leads the Justice Department’s Criminal Division, put it plainly in 2025: “merely writing code without ill intent is not a crime,” he told an industry event. For a DAO the warning cuts both ways. The protocol’s contracts may be as untouchable as Tornado’s. But a governance body that runs the interface, collects the fees, and steers the treasury is doing the operating, and operating is conduct the law can reach.

The securities surface the SEC has flagged since 2017

The oldest of the five surfaces is also the one with a DAO literally in its name. In July 2017 the SEC published its Report of Investigation into “The DAO,” a 2016 Ethereum venture that raised about $150 million in ether before a hack, and concluded that its tokens were investment contracts, and therefore securities, under the Howey test, the agency announced. It declined to bring charges, but the principle stuck: a governance token sold with a reasonable expectation of profit from others’ efforts can be a security, which drags its issuer into registration, disclosure, and dealer rules. That question hangs over every token-launching DAO, from protocol tokens to the on-chain funds that trade them, including experiments like the ai16z DAO and its token.

The 2026 SEC is friendlier to the technology but has not erased the surface. Chair Paul Atkins has made “Project Crypto” the agency’s banner and, in August 2026, proposed a Regulation Crypto Assets framework whose Rule 400 would offer an investment-contract safe harbor; its public comment period closed on 20 October 2026, per the SEC. Atkins has also called self-custody “a foundational American value,” The Block reported. What the agency has not done is turn any of this into a statute. The CLARITY Act, which would have written the SEC and CFTC split into law and added a developer shield, failed a Senate cloture vote 49 to 50 on 15 September 2026, CoinDesk reported. For now the securities answer for DAOs is rule and proposal, not law.

The enforcer that won Ooki has stepped back

Here is the paradox that defines DAO compliance in 2026. The CFTC that beat Ooki is now the CFTC least likely to bring the next such case. Under Chair Mike Selig, confirmed at the end of 2025, the agency folded into a joint “Project Crypto” effort with the SEC in January 2026 and began drafting rules rather than complaints, Morrison Foerster noted. Selig has said the agency will explore “clear and unambiguous safe harbors for software developers,” including possible exemptions for non-custodial wallets and DeFi protocols, and has signaled an end to regulation-by-enforcement, CoinDesk reported.

That retreat does not repeal the Ooki judgment; it leaves it on the shelf as good law the government has chosen not to wield. And liability an agency declines to press does not evaporate. It migrates. The Lido case was not brought by the CFTC or the SEC; it was a private lawsuit by an individual plaintiff. As federal enforcers pull back, the live risk to DAO participants in 2026 is less a regulator’s subpoena than a class-action plaintiff’s theory that the people who governed a protocol are partners who owe its debts. That is the risk a corporate shell is built to contain.

So DAOs reached for a corporate shell

A legal wrapper is simply a recognized entity that sits around a DAO, giving it what an unincorporated group lacks: the ability to cap its members’ liability, hold property, open accounts, sign contracts with service providers, and file tax returns. For most of crypto’s history that shell was an offshore foundation, usually in the Cayman Islands or Switzerland, paired with a separate operating company. a16z crypto has argued that model is ending, calling the current moment “the end of the foundation era” in favor of structures purpose-built for DAOs, in a widely read post. The choice of wrapper is now one of the most consequential compliance decisions a DeFi project makes.

The onshore answer: Wyoming’s DUNA

Wyoming, which gave DAOs their first US LLC statute in 2021, went further in 2024. Governor Mark Gordon signed the Decentralized Unincorporated Nonprofit Association Act, or DUNA, on 7 March 2024, and it took effect on 1 July, CryptoSlate records. The act adapts Wyoming’s existing nonprofit-association law to distributed ledgers. A DUNA needs at least 100 members sharing a common purpose, may govern itself through smart contracts, and, crucially, provides that a member cannot be held liable for the association’s obligations merely by being a member. It gives a DAO legal capacity without forcing it to appoint a board or move offshore.

That combination is why a16z’s Jennings calls a wrapper a “strategic imperative” and the DUNA one of the best options available for US projects, in his public case for the structure. The model is spreading: Alabama has enacted its own DUNA act, and other states are studying the template. The onshore pitch is simple. A protocol that wants to stay close to US users, pay US contributors, and argue its token is not a security can do so inside a recognized American entity rather than as a partnership of strangers. The catch, as tax advisers warn, is that a nonprofit association is not automatically tax-exempt; a DUNA still has to sort out its own filing obligations.

A wrapper is only half the strategy. The other half is governance minimization, the deliberate shrinking of what token holders actually decide, so that an on-chain vote cannot be read as day-to-day control of a business. The two moves pull against each other: a DUNA gives a DAO enough legal substance to sign a lease and file a return, while minimization tries to keep that substance from looking like an operator under the FATF control test. Lean too far toward active governance and the partnership and VASP risks grow; strip governance down to nothing and the wrapper starts to look like a shell with no one home. Most serious projects now treat the balance between the two as a standing design question, not a one-time filing.

Uniswap wrapped itself: the DUNI vote

The theory became practice in September 2025, when Uniswap governance voted to create a DUNA for itself. The entity, nicknamed DUNI, passed with roughly 53 million votes in favor and none against, making Uniswap the largest DAO to adopt the structure, the Uniswap Foundation announced. The wrapper does not change the protocol, the UNI token, or the mechanics of governance; it gives the DAO a legal body that can retain service providers, sign contracts, and meet tax and regulatory obligations, and the proposal set aside $16.5 million in UNI for legal reserves and tax settlements, The Block reported.

The business reason was blunt. The Foundation told The Block the wrapper would clear the path to finally switch on protocol fees, routing revenue to the DAO. That is the moment a protocol stops looking like neutral software and starts looking like an enterprise with income, the same shift that makes a revenue-sharing design like Hyperliquid’s buyback flywheel a governance and tax question as much as a market one. A DAO that collects money needs somewhere for the money to live, someone to account for it, and a liability shield around the people who voted to turn the switch. A wrapper is all three at once.

The offshore answer: Marshall Islands and Cayman

Not every DAO wants a US entity, especially one whose token might draw SEC attention. For globally distributed projects the two dominant offshore shells are the Marshall Islands DAO LLC and the Cayman Islands foundation company, MIDAO’s own comparison notes. The Marshall Islands passed a DAO Act in 2022 that lets a DAO register as an LLC, track membership through tokens, operate without managers, and treat smart-contract votes as the formal governance layer. It was built for DAOs from the ground up and runs, by MIDAO’s July 2026 pricing, roughly $3,000 to $9,500 depending on project size.

The Cayman foundation company is the older and pricier option, upward of $18,500 to set up, and was adapted from ordinary company law rather than designed for crypto. Its appeal is that a foundation has no owners at all, which suits a token issuer that wants an orphan entity holding the protocol with nobody to point to as a controlling shareholder. The trade-off against the onshore DUNA is the familiar one: distance from US enforcement and US tax, bought at the price of distance from US users and the optics of an offshore structure when a regulator asks who is really in charge. Those optics matter, because the FATF’s control test looks through form to substance.

What a wrapper does not fix

A shell caps the liability of members; it does not make the entity compliant. Ooki was an unincorporated association, a recognized form, and it still lost, because the problem was the conduct (running an illegal trading venue and skipping AML), not the absence of a legal body. A wrapped DAO that acts like a money transmitter still owes a Bank Secrecy Act program; a wrapped DAO whose token is a security still owes the securities rules; a wrapped DAO with income still owes tax. The wrapper decides who is personally on the hook, not whether the rules apply.

Two control points sit outside the wrapper entirely. The first is the front-end, the website and app most users touch. Contracts may be uncensorable, but a hosted interface is a legal actor, which is why Uniswap’s front-end screens wallets against OFAC and illicit-address lists through TRM Labs, The Block reported. The second is the settlement asset. Most DeFi value moves in dollar stablecoins, and from 18 January 2027 the GENIUS Act requires every permitted US issuer to keep the technical ability to “seize, freeze, burn, or prevent the transfer” of its coins on a lawful order, the White House fact sheet states. Compliance can reach even a leaderless protocol through the money it runs on, however the DAO is wrapped.

Whether any of this actually stops crime is a separate argument. Illicit transactions are still under 1 percent of on-chain volume even as the absolute total climbs, and stablecoins now carry the large majority of it, Chainalysis estimates. Peter Van Valkenburgh of Coin Center argues the whole apparatus “does remarkably little to prevent illicit finance” while imposing heavy costs, in the group’s critique of the regime. The scams the system is meant to catch keep migrating to channels it cannot, from sanctioned mixers to the social-engineering playbooks documented in crypto’s Telegram and Discord phishing networks.

Europe regulates the access point, not the association

The United States argues about who the defendant is; Europe argues about where the gate is. The EU’s Markets in Crypto-Assets regulation deliberately leaves fully decentralized protocols outside its scope, regulating the service providers and issuers around them instead. But in its 30 September 2026 response to the MiCA review, the European Securities and Markets Authority asked for a new licensed category covering firms that provide access to DeFi, the web interfaces, wallets, and aggregators users actually touch, and warned against “decentralisation washing,” the dressing up of a controlled service as a leaderless protocol, ESMA set out.

The contrast is instructive for American DAOs. Europe is not trying to decide whether a token vote makes you a partner; it is identifying the choke points (access, settlement, marketing) and licensing those. The two systems converge on the same insight from opposite directions: you cannot regulate immutable code, so you regulate the humans and companies with control over how people reach it. A DUNA solves the US partnership problem. It does nothing about a European regulator who decides the DAO’s front-end is a licensable access service.

What it means for builders, voters, and users

For builders, the lesson of 2024 and 2025 is to wrap early and wrap deliberately. Choose between an onshore DUNA and an offshore LLC or foundation based on where your users and contributors are and what your token is; minimize the unilateral control (admin keys, upgrade rights, fee switches) that turns governance into operation under the FATF test; and screen the front-end you host. A wrapper chosen after a lawsuit lands is worth far less than one chosen before.

For governance participants, the uncomfortable truth is that voting is not free. Active participation is exactly what the Lido court said could make someone a partner and what the CFTC said made Ooki’s voters members. A legal wrapper is the main thing standing between a governance vote and personal liability for a protocol’s debts, which is why the question “is this DAO wrapped?” belongs on every delegate’s checklist. For users, the reminders are older but unchanged: a wrapped DAO is not a bank, a legal shell is not deposit insurance, and the stablecoin you hold can be frozen by its issuer no matter how decentralized the protocol around it claims to be. The friction that protects you, from verifying a contract address to the deliberate guardrails some teams now build into wallets, is the point, not a flaw, as the case for friction in wallet design argues.

DeFi compliance in 2026 is not one rulebook waiting to be followed. It is a question of form. The protocol can be as decentralized as its founders like, but the moment it has a treasury, a fee, a front-end, and a vote, the law wants to know who answers for it. A DAO that has not chosen its answer has still chosen one: the partnership, with everyone on the hook. The projects that understood that are the ones now wearing a shell.

Frequently Asked Questions

Can a DAO be sued or held liable?

Yes. In 2023 a US court entered a default judgment against Ooki DAO as a “person” and unincorporated association under the Commodity Exchange Act, imposing a $643,542 penalty and ordering its website offline. A 2024 California ruling in Samuels v. Lido DAO went further, allowing a claim that a DAO is a general partnership whose active participants, including some investors, could be personally liable. Decentralization is not legal invisibility.

What is a DUNA and why do DAOs use one?

A DUNA is a Decentralized Unincorporated Nonprofit Association, a legal wrapper Wyoming created in 2024 (Alabama has since followed). It gives a DAO legal capacity to hold property, sign contracts, and file taxes while providing that members are not liable for the association’s obligations merely by being members. Uniswap adopted one, called DUNI, in September 2025, becoming the largest DAO to do so.

Does wrapping a DAO in a legal entity make it compliant?

No. A wrapper caps who is personally liable; it does not switch off the rules. A wrapped DAO that acts as a money transmitter still owes a Bank Secrecy Act program, one whose token is a security still owes securities rules, and one with income still owes tax. Ooki was a recognized unincorporated association and still lost, because the issue was its conduct, not the lack of an entity.

Which US agency regulates DeFi and DAOs?

There is no single one. The SEC handles securities, the CFTC handles commodities and derivatives, FinCEN and OFAC at the Treasury handle anti-money-laundering and sanctions, and the IRS handles tax. The common mistake is treating the SEC as the AML regulator; it is not. In 2026 the SEC and CFTC are writing crypto rules jointly under “Project Crypto” rather than bringing new enforcement cases.

Are DAO governance token holders personally liable for the protocol?

Potentially, if they actively participate. The Lido ruling suggested a general partnership could include everyone who voted on a proposal, though the court stressed it had not finally decided that token holders are liable. Legal wrappers such as a DUNA or an LLC exist precisely to cap that exposure, which is why active governance without a wrapper is now seen as a real personal risk.

Anneke de Vries covers crypto regulation and policy for HOGE Wire.