DeFi Compliance in 2026: Who Is Actually on the Hook?

Decentralized finance was built on a simple idea: replace the intermediary with code. No bank, no broker, no exchange desk deciding who gets access, just a smart contract that runs the same way for everyone who calls it. Financial regulation was built on the opposite idea. Almost every rule that matters, from the US Bank Secrecy Act to the European Union’s MiCA regime, assumes there is an intermediary in the middle, someone who holds the customer’s money, knows the customer’s name, and can freeze an account when a court says so. DeFi compliance is the collision between those two ideas, and 2026 is the year the collision stopped being theoretical.

In the space of eighteen months, a federal appeals court ruled that immutable smart contracts cannot be sanctioned, a jury convicted a privacy-tool developer of running an unlicensed money business, the Financial Action Task Force published a global test for when a protocol is decentralized enough to escape the rules, and the SEC pivoted from suing DeFi projects to drafting a safe harbor for them. Total value locked across DeFi still measured in the tens of billions of dollars in mid-2026, down sharply from the start of the year, yet the compliance question has never been louder. This guide explains what DeFi compliance actually means, who the rules can reach, and what a compliant protocol looks like when there is no company to send the subpoena to.

The Compliance Problem, Stated Plainly

Financial compliance is a set of duties that attach to a person or a company. An exchange must verify customer identity, screen against sanctions lists, file suspicious-activity reports, and keep records. A broker must report proceeds to the tax authority. A payment firm must be licensed to transmit money. Every one of those duties presumes a legal entity that can be registered, audited, fined, or shut down.

A pure DeFi protocol has none of that by design. An automated market maker is a set of contracts that swap one token for another; a lending market is a pool that anyone can supply to or borrow from according to fixed rules. There is no onboarding form, no compliance officer, no off switch, and often no company at all. So the first question in DeFi compliance is not whether a protocol follows the rules. It is whether there is anyone the rules can attach to in the first place. That is why the entire debate is about the regulatory perimeter, the line between activity the law can reach and activity it cannot, rather than about paperwork.

Regulators have landed on a single organizing principle to draw that line: control. If someone controls a protocol, profits from it, or can change how it works, the rules follow that person. If genuinely no one can, the protocol may sit outside the perimeter, though the funds flowing through it never do. Everything else in this guide is a variation on that theme.

What DeFi Compliance Actually Covers

Compliance is not one obligation but five, and each has a different regulator and a different trigger. Confusing them is the most common mistake in crypto policy coverage, so it is worth separating them cleanly.

• Anti-money-laundering and counter-terrorist-financing. In the United States this sits with the Financial Crimes Enforcement Network (FinCEN) under the Bank Secrecy Act. A business that transmits value must register as a money services business, identify its customers, and report suspicious activity. This is not the SEC’s domain, a distinction that trips up even seasoned commentators.
• Sanctions. The Treasury’s Office of Foreign Assets Control (OFAC) maintains the sanctions lists. Screening addresses against those lists, and never transacting with designated ones, is a strict-liability duty that applies to everyone.
• Securities. The SEC governs whether a token is an investment contract and whether a platform is operating as an unregistered exchange, broker, or clearing agency.
• Commodities and derivatives. The Commodity Futures Trading Commission (CFTC) oversees leverage, perpetual futures, and anything that behaves like a derivative.
• Tax. The Internal Revenue Service (IRS) sets reporting duties, including the Form 1099-DA broker regime for digital-asset sales.

DeFi touches all five surfaces at once. A single lending protocol can raise a securities question (is the governance token a security), an AML question (is the front-end transmitting value), a sanctions question (is a blocked address supplying liquidity), a derivatives question (does the protocol offer leverage), and a tax question (who reports the interest). For the mechanics of the identity and reporting layer specifically, our explainer on how crypto KYC and AML actually work in 2026 walks through onboarding, customer due diligence, and suspicious-activity reporting in detail. This piece is about the harder question underneath it: to whom do any of these duties attach when the service is just code.

The FATF Control-or-Influence Test

The most important single document in DeFi compliance this year is not a law at all. On 21 July 2026 the Financial Action Task Force (FATF), the global standard-setter whose recommendations shape anti-money-laundering law in more than 200 jurisdictions, published a targeted report on the regulatory challenges of decentralized finance. Its core is a test that supervisors everywhere are now adopting: a DeFi arrangement falls within the scope of FATF’s Recommendation 15 wherever a natural or legal person exercises control or sufficient influence over it, even if the arrangement calls itself decentralized.

The report sorts DeFi into three buckets, and the bucket determines the obligation.

To decide which bucket a protocol belongs in, FATF lists indicators of de facto control: concentration of governance tokens, administrative privileges over the smart contracts, the power to push upgrades, the direction in which fees and treasury flows run, and influence over the development team and the front-end infrastructure. In other words, holding the admin keys, collecting the fees, or steering the roadmap can all pull a protocol back inside the perimeter no matter what its marketing says. FATF warned that the decentralized label is often a veneer, because centralized elements frequently persist in practice even where governance looks distributed.

The gap between the standard and reality is enormous. By FATF’s own count, the vast majority of surveyed jurisdictions, around 93 percent, had not implemented the standards for qualifying DeFi arrangements, and only two out of 142 had actually licensed or registered one. The same targeted-update process governs the Travel Rule, the cross-border data-sharing duty covered in our guide to FATF crypto guidance and VASPs in 2026. The control test is the framing that all of it now hangs on.

Who Is on the Hook? The Liability Stack

If a duty has to attach to a person, the practical question becomes which person. Enforcement over the past three years has tested every layer of the DeFi stack, and a pattern has emerged: liability follows control and profit, not the decentralization label.

The DAO line is the one that surprises people. In June 2023 the CFTC won a default judgment against the Ooki DAO, and a federal court in California held that a decentralized autonomous organization is an unincorporated association and a person under the Commodity Exchange Act, meaning it can be sued, fined, and ordered to shut down. The agency argued that anyone who voted with the governance token was a member of that association. The judgment imposed a civil penalty of 643,542 dollars and ordered the DAO’s website taken offline. For anyone who assumed that voting in a governance forum was a costless act of participation, the Ooki outcome was a warning that a token vote can also be an act of legal exposure.

The Tornado Cash Trilogy

No case has shaped DeFi compliance more than the fight over Tornado Cash, an Ethereum mixing protocol that lets users break the on-chain link between sender and receiver. It produced three separate lessons.

First, code is not property. In August 2022 OFAC added the Tornado Cash smart contracts to its sanctions list, the first time the government had sanctioned software rather than a person or entity. In November 2024 the Fifth Circuit Court of Appeals ruled in Van Loon v. Treasury that immutable smart contracts are not property under the International Emergency Economic Powers Act, because no one can own, control, or exclude others from them once they are deployed. In March 2025 the Treasury formally delisted Tornado Cash, conceding the point. Autonomous code, the courts said, cannot itself be sanctioned.

Second, running a service around code is still conduct. In August 2025 a Manhattan jury convicted Tornado Cash co-founder Roman Storm of conspiracy to operate an unlicensed money-transmitting business, while deadlocking on the money-laundering and sanctions counts. Prosecutors have asked to retry Storm on the deadlocked charges in October 2026, and the two counts carry a combined maximum exposure of 40 years. The message is uncomfortable for builders: the contracts may be untouchable, but the humans who operate an interface, a relayer, or a fee mechanism around them are not.

Third, the government itself is unsettled on where the line sits. Weeks after the Storm verdict, Matthew Galeotti, the acting head of the Justice Department’s Criminal Division, told an industry audience that ‘merely writing code without ill intent is not a crime,’ a striking public hedge from the same department that had just won a conviction. Advocacy groups including the DeFi Education Fund and Coin Center have filed amicus briefs arguing that prosecuting developers for how third parties later use their software violates due process. The unresolved tension, publishing code versus operating a service, is the central open question of DeFi compliance, and the Storm retrial is where it gets tested next.

Front-Ends Are the Real Choke Point

Here is the practical reality that most compliance actually runs on today. A protocol’s smart contracts may be uncensorable, reachable by anyone who can format a transaction, but the website that ordinary users rely on to reach them is not. That website is hosted by a legal entity, and that entity has to comply.

Uniswap Labs, which builds the most-used interface to the Uniswap protocol, screens wallet addresses against the OFAC list and against addresses tied to stolen funds, ransomware, and other illicit activity, a program it runs with the analytics firm TRM Labs. It also maintains an unsupported-token policy that pulls specific tokens from the interface when a regulator or court makes an adverse finding, when a major regulator alleges fraud, or when someone files an intellectual-property claim. None of that touches the underlying contracts; an address blocked by the front-end can still interact with the protocol directly through another interface or a raw transaction. The censorship happens at the website, not the chain. After OFAC sanctioned Tornado Cash in 2022, several front-ends including Uniswap, Aave, and Balancer restricted flagged addresses within days, a live demonstration of where the pressure point sits.

This is why the choice of interface has become a compliance decision in its own right, and why the design of self-custodial software matters. The move toward smart-account wallets and account abstraction pushes more logic, including potential screening and policy rules, into the wallet layer that sits between the user and the protocol. Compliance, in practice, is migrating to the edges of the system where identifiable operators still exist.

The SEC Pivot: Project Crypto and a DeFi Safe Harbor

For years the dominant US approach to DeFi was enforcement: sue first, articulate the rule later. Under Chair Paul Atkins, who took over the SEC in 2025, the agency has reversed course. Its initiative, branded Project Crypto, aims to write actual rules for on-chain markets rather than police them case by case, and the centerpiece is a proposed innovation exemption, a conditional safe harbor that would let eligible projects issue and operate tokens for a period without full registration while they mature.

The contours reported so far include a startup tier allowing raises up to 5 million dollars over several years and a broader exemption up to 75 million dollars with simplified disclosures instead of a traditional S-1 filing, with eligibility open to DeFi protocols, stablecoin issuers, and real-world-asset tokenizers. The SEC’s regulatory agenda slots the rulemaking, sometimes called Regulation Crypto, for a mid-2026 introduction, with any final rule likely arriving late in the year at the earliest.

The tone shift matters as much as the mechanics. At a June 2025 roundtable pointedly titled DeFi and the American Spirit, Atkins argued that the right to self-custody is ‘a foundational American value that should not disappear when one logs onto the internet,’ and directed staff to consider fresh guidance for DeFi activity. Alongside the rhetoric, the agency dropped or wound down a string of investigations and cases against exchanges and DeFi front-ends that had defined the previous era. Compliance risk did not vanish, but the SEC stopped treating every protocol as a presumptive defendant.

The Legislative Map: CLARITY, GENIUS, and the Broker Rule

Rules from an agency can be undone by the next agency. Durable DeFi compliance depends on legislation, and three pieces define the current US landscape.

The CLARITY Act is the big one, a market-structure bill that would divide oversight between the SEC and the CFTC and, crucially, write a statutory test for when a blockchain system is decentralized enough to escape intermediary rules. DeFi is one of the reasons the bill has stalled: senators have struggled to agree on how to define the responsibilities of developers, users, and interfaces without either criminalizing open-source work or opening a loophole. The Senate left for its August recess without a final vote, but Majority Leader John Thune filed cloture to tee up a vote for 15 September, keeping a 2026 passage narrowly alive.

The GENIUS Act, signed in July 2025, matters to DeFi in a way that is easy to miss. It regulates payment stablecoins, requiring one-to-one reserves, Bank Secrecy Act compliance, and the technical ability to freeze or burn tokens on lawful order. Because dollar stablecoins are the settlement layer for the overwhelming majority of DeFi activity, GENIUS injects compliance into DeFi through the money itself: the assets moving through permissionless pools now carry issuer-level obligations and freeze functions with them. Finally, the repeal of the IRS DeFi broker rule in April 2025, passed under the Congressional Review Act, was the first time Congress affirmatively decided that a non-custodial front-end is not a broker, and it barred the IRS from issuing a similar rule without new legislation.

Permissioned DeFi: Compliance by Whitelist

If open protocols are hard to regulate, one answer is to build closed ones. Permissioned DeFi keeps the on-chain plumbing, the automated markets, the transparent settlement, the composability, but puts a KYC gate in front of it so only vetted participants can enter. It is the fastest-growing compliance pattern for institutions.

Aave pioneered the model with Aave Arc, a permissioned version of its lending pools where a whitelister, originally the custody firm Fireblocks, verifies every participant before they can supply or borrow. The current flagship is Aave Horizon, launched in August 2025, which pairs permissioned real-world-asset collateral with permissionless stablecoin liquidity and grew into the hundreds of millions of dollars in deposits within its first year, with institutional partners including Circle, Ripple, Franklin Templeton, and VanEck. Similar KYC-gated venues run under names like Maple, Clearpool, and Centrifuge.

Industry insiders call the emerging architecture the DeFi mullet: a regulated, familiar fintech interface in the front and permissionless DeFi rails in the back. The user sees a compliant app; the settlement happens on-chain. The trade-off is philosophical as much as technical. Permissioned DeFi solves the compliance problem precisely by rebuilding the gatekeeper that DeFi set out to remove, and it reintroduces the counterparty and custody risks that on-chain credit was supposed to make transparent. Readers weighing those risks should start with our risk map for on-chain credit, which covers where losses actually come from in lending markets, permissioned or not.

Privacy Pools: Compliance Without Surveillance

The other frontier runs in the opposite direction: keep DeFi open and private, but make privacy provably clean. The flagship is Privacy Pools, launched on Ethereum mainnet in March 2025 by the team at 0xbow and based on a 2023 research paper co-authored by Ethereum’s Vitalik Buterin on reconciling on-chain privacy with regulatory compliance.

The mechanism is a clever inversion of a mixer. Users deposit into a shared pool and later withdraw using a zero-knowledge proof, but the proof does more than hide the link between deposit and withdrawal; it also demonstrates that the funds belong to an association set of deposits that excludes known illicit sources. In plain terms, a user can prove that their money is not part of a hack or a sanctioned wallet without revealing which specific deposit is theirs. Honest users cluster together and cryptographically distance themselves from criminal funds; a mixer that only ever offered blanket anonymity offered no such distinction. Buterin himself routed a transaction through the system to demonstrate it, and the protocol has since expanded to multiple assets.

The open question is who curates the association set and on what authority, and whether operating a compliant privacy system still counts as money transmission, the exact charge that convicted Roman Storm. Privacy Pools is a technical answer to a legal problem the law has not finished defining. It shows that the privacy-versus-compliance framing may be a false choice, while leaving unresolved the human question of who decides what counts as clean.

The Compliance Toolkit: Screening, Attestations, and On-Chain Identity

Between fully open and fully permissioned sits a growing stack of tooling that lets protocols and their operators meet obligations without abandoning composability.

• Blockchain analytics. Chainalysis, Elliptic, and TRM Labs map addresses to real-world risk, powering the front-end screening described above. Their scores are probabilistic, not proof, and privacy-preserving chains blunt them, but they are the backbone of practical sanctions and AML compliance today.
• On-chain attestations and zero-knowledge KYC. Verifiable credentials let a user prove an attribute (over 18, not on a sanctions list, resident of an allowed jurisdiction) without revealing the underlying documents, so an interface can gate access without hoarding identity data.
• Travel Rule messaging. Specialized networks let compliant venues exchange the originator and beneficiary information that the FATF Travel Rule requires when value crosses between regulated providers.

The pressure to automate this is only growing as more on-chain activity is initiated by software rather than people. As autonomous programs begin to hold keys and move funds, described in our look at how AI agents actually pay on-chain, compliance has to run at machine speed and be encoded into the transaction flow rather than bolted on afterward. It is worth keeping the scale in perspective: even as the absolute value of illicit crypto flows rose in 2025, analytics firms still estimate it at well under one percent of total on-chain volume, which is both a defense of the ecosystem and a reminder that the compliance burden is large relative to the crime it catches.

That mismatch fuels a running critique from civil-liberties advocates. Peter Van Valkenburgh of the research group Coin Center has argued that the existing anti-money-laundering regime ‘does remarkably little to prevent illicit finance’ while imposing heavy costs and surveillance on everyone else, a case that gains force when the tools sweep in ordinary users to catch a sliver of bad actors. Whether the next generation of privacy-preserving compliance can shrink that gap is one of the defining questions for the sector.

Europe’s Contrast: MiCA Leaves DeFi Mostly Alone

US readers should know that the other major rulebook takes a different path. The European Union’s Markets in Crypto-Assets regulation, MiCA, governs crypto-asset service providers and token issuers, but it explicitly does not cover fully decentralized protocols that operate without an intermediary. A joint report from the European Banking Authority and the European Securities and Markets Authority in early 2025 found DeFi to be a niche corner of the market, on the order of a few percent of total crypto value, and the European Commission has not prioritized bespoke DeFi rules; a broader MiCA review opened for consultation in 2026 to revisit exactly where that boundary should sit. AML duties in Europe live separately, in the incoming Anti-Money-Laundering Regulation and the Transfer of Funds Regulation, supervised by a new EU authority rather than by MiCA.

The contrast with the United States is instructive. Europe wrote a comprehensive statute up front and carved DeFi out of it explicitly; the US is arriving at a similar perimeter through litigation, agency rulemaking, and a market-structure bill still working through Congress. Both are converging on the same test, control, from opposite directions.

What Actually Complies Today: A Practical Map

Strip away the doctrine and a workable playbook emerges for each participant.

For builders, the decisive variable is control. A protocol that genuinely renounces it, with immutable contracts, no admin keys, no upgrade switch, and no fee stream flowing to an identifiable team, has the strongest claim to FATF’s leaderless bucket and the CLARITY Act’s decentralization test. A protocol that keeps the keys, collects the fees, and steers the roadmap should expect to be treated as a regulated operator, because every one of those is an indicator of control. The dangerous position is the middle: marketing a system as decentralized while holding the levers that make it centralized, which is precisely the fact pattern regulators are now trained to spot.

For front-end and interface operators, compliance is concrete and unavoidable: screen addresses against sanctions and illicit-activity lists, geofence restricted jurisdictions, publish a clear token policy, keep custody at zero so you are not a money transmitter, and document the whole program. This is the layer where enforcement actually lands.

For users, the honest summary is that permissionless means unprotected. There is no deposit insurance, no chargeback, no complaints line, and no one to reverse a mistaken or exploited transaction. Self-custody is a right the SEC now champions, but it is also a responsibility, and the compliance status of the front-end you use, along with the provenance of the funds you touch, is now part of your own risk. Choosing a wallet and interface with a credible screening and security posture is a defensive act, not a bureaucratic one.

The Bottom Line

2026 did not resolve DeFi compliance, but it drew the map. The organizing principle is settled in theory: obligations follow control, whether that control shows up as admin keys, fee flows, governance concentration, or a hosted front-end. The tools to comply without destroying what makes DeFi useful, permissioned pools, zero-knowledge privacy with association sets, front-end screening, and on-chain attestations, are maturing quickly. And the durable legal framework, a market-structure statute with a real decentralization test and a securities safe harbor, is close but not finished.

Two events will tell you which way the wind is blowing. The Roman Storm retrial, expected in October 2026, will test how far the government can push developer liability for publishing code. The Senate’s September vote on the CLARITY Act will show whether Congress can write the perimeter into law or leave it to the courts for another cycle. Watch those, and you will understand DeFi compliance better than any single rule can teach you.

Frequently Asked Questions

Is DeFi legal in the United States in 2026?

Yes. Using and building decentralized finance is legal in the US, and the SEC under Chair Paul Atkins has openly defended the right to self-custody and to interact with DeFi protocols. What can cross the line is operating an unlicensed money-transmitting or unregistered securities business around a protocol, which is the conduct at issue in the Tornado Cash prosecution, not the act of writing or using code itself.

Does DeFi have to follow KYC and AML rules?

It depends on control. Where an identifiable person or company controls or sufficiently influences a protocol, FATF and US regulators treat it like any other financial service, with full know-your-customer and anti-money-laundering duties enforced by FinCEN and OFAC, not the SEC. A genuinely leaderless protocol has no one to carry those duties, but the front-ends, custodians, and stablecoin issuers around it still do.

Who is liable when a DeFi protocol breaks the law?

Liability follows control and profit. Developers can be charged for operating a service, as in U.S. v. Storm; front-end operators must screen and geofence; and even governance token holders have been held liable as an unincorporated association, as the CFTC established against the Ooki DAO. Passive liquidity providers have not yet faced a clear ruling.

Can a DeFi protocol be truly compliant?

Two paths exist. A protocol can embrace compliance by permissioning access with KYC gates, as Aave Arc and Aave Horizon do, or it can renounce control so thoroughly that no intermediary exists to regulate, pushing compliance duties onto the front-ends and stablecoins around it. Tools like zero-knowledge attestations and Privacy Pools aim to offer a middle path that proves clean funds without collecting identity.

What is the FATF control-or-influence test for DeFi?

It is the standard from FATF’s July 2026 DeFi report. A decentralized arrangement falls under global AML rules wherever a natural or legal person exercises control or sufficient influence over it, judged by indicators such as governance-token concentration, admin privileges, upgrade power, and fee flows. Only protocols where no one holds such control sit outside the rules, and FATF found almost none of them in practice.

By Priya Reddy, regulation desk, HOGE Wire.