DeFi Compliance After CLARITY: Rules, Not Law

On September 15, 2026, the United States Senate held a procedural vote on the Digital Asset Market CLARITY Act and did not reach the bill itself. The motion to invoke cloture, the step that would have opened formal debate, drew 49 votes to 50, eleven short of the sixty needed, which put the bill out of reach for the rest of the year. CLARITY was supposed to be the statute that finally told decentralized finance what the rules were: which regulator owned which market, when a developer became a money transmitter, what a front end could and could not do. It never got to the floor.

A month later, decentralized finance in the United States is not ungoverned. It is governed almost exactly as it was before the vote, by a patchwork of court rulings, agency guidance, and the one lever that reaches every protocol no matter how decentralized it claims to be: the settlement asset. What changed on September 15 was not the law. What changed was the expectation that a law was coming. With Congress out of the picture for 2026, the agencies have picked up the pen, and they are writing DeFi compliance rules in instruments that are fast, powerful, and temporary. This is compliance by rule, not by law, and the distinction matters more than it sounds.

What CLARITY Would Have Settled

The Digital Asset Market CLARITY Act (H.R. 3633) passed the House in 2025 and spent most of 2026 stuck in the Senate. Its job was structural. It would have split jurisdiction between the Securities and Exchange Commission and the Commodity Futures Trading Commission, handing the CFTC most spot trading of digital commodities while leaving the SEC its investment-contract turf. It carried a statutory test for when a blockchain system is decentralized enough to escape securities treatment, and it defined the roles DeFi actually runs on: developer, user, front-end operator. One provision, drawn from the Blockchain Regulatory Certainty Act, would have said plainly that a non-controlling developer or front-end provider, someone with no unilateral ability to control or effectuate transactions, is not a money transmitter.

For a sector that had spent years being regulated by enforcement action, that would have been the first real rulebook. Instead, the ethics fights, the consumer-protection objections, and the illicit-finance worries that dogged the bill all year kept it from the floor, and regulators moved in to fill the gap. Bitcoin, which had rallied earlier in the year on expectations that a market-structure law was close, was trading near $82,000 as the dust settled, down modestly on the month. The price barely registered the vote. The lawyers did.

Nothing Changed, Which Is the Point

Walk through the mechanics of DeFi compliance the morning after the vote and you find the same map as the morning before. A sector holding roughly $92 billion in total value locked still answered to the same five regulators, the same handful of court decisions, and the same freezable stablecoins settling most of its volume. No rule expired because the bill failed; no new rule appeared. That is precisely why the failure matters. The improvised regime that everyone had treated as a placeholder, something to tolerate until Congress acted, is now the regime, with no expiry date and no replacement scheduled.

The practical consequence is that the pressure CLARITY would have absorbed did not disappear. It redistributed. Every question the statute would have answered, who is a dealer, when a token stops being a security, whether a front end is a broker, now has to be answered somewhere else, by someone with less authority and a shorter time horizon than Congress. Some of those answers are landing at the SEC. Some at the CFTC. Some in a federal courtroom in Manhattan. And some, as the fight over competing stablecoin rulebooks shows, in the design of the dollar-tokens DeFi cannot function without.

The Perimeter Is Still Control, Not the Label

Underneath the politics, the organizing principle of DeFi compliance has not moved in years, and CLARITY failing did not move it either. The question regulators ask is not whether something calls itself decentralized. It is whether a natural or legal person exercises control or sufficient influence over the arrangement. The Financial Action Task Force made that the explicit test in its July 2026 targeted report on decentralized finance: wherever someone controls or sufficiently influences a DeFi service, that service is in scope for anti-money-laundering rules, and the label is irrelevant. Summarizing the report, the analytics firm Chainalysis noted that around 93% of surveyed jurisdictions had not implemented the standards for qualifying DeFi, and only a handful had ever licensed or acted against a single DeFi arrangement.

FATF sorts DeFi into three buckets, and the sorting is the whole game. Where a person or company clearly controls the service, it is a regulated entity and owes the full anti-money-laundering program. Where a platform looks decentralized but is effectively run by hidden operators, it is still in scope, and supervisors are told to go find those operators. Only a genuinely leaderless arrangement, with no one exercising control or sufficient influence, falls outside the registration rules, and even then jurisdictions are expected to mitigate the residual risk. The middle bucket, decentralization theater over a centralized core, is where most enforcement attention now sits.

That control test is the thread connecting five separate regulators, each owning a different slice of the same protocol. A recurring mistake, even in serious coverage, is to treat the SEC as the anti-money-laundering authority. It is not. Securities law and the Bank Secrecy Act are different surfaces with different triggers, and a project can be clean under one and exposed under another. The table below is the map that survived the CLARITY vote intact.

The Agencies Pick Up the Pen

Within days of the vote, the two financial regulators began doing by rule what CLARITY would have done by statute. The symmetry was not accidental. SEC Chair Paul Atkins has run a program he calls Project Crypto since 2025, and the CFTC is now led by Mike Selig, confirmed in December 2025, who came to the job straight from serving as chief counsel to the SEC crypto task force. The lawyer who helped shape the SEC posture now runs the agency that was supposed to inherit most of DeFi under CLARITY. The two are, in effect, writing from the same outline.

The SEC centerpiece is a proposed rule called Regulation Crypto Assets, published in the Federal Register on August 21, 2026 with a sixty-day comment window that closes on October 20. The roughly four-hundred-page proposal (file number S7-2026-27) includes Rule 400, an investment-contract safe harbor that would give a token a rule-based way to stop being a security, two new registration exemptions, and a pathway preempting state registration for certain offerings. The agency pitched it as a fit-for-purpose framework for crypto investment contracts. It is, for now, a proposal.

For a DeFi project, the detail that matters is what Rule 400 and the two exemptions would actually do. The safe harbor gives a token issuer a defined path to argue that whatever investment contract once surrounded a token has ended, so the token can trade as a commodity rather than a security, the exact question that has frozen so many launches. The two registration exemptions, each carrying crypto-specific disclosure requirements, are meant to let a project raise capital and distribute tokens without the full weight of a traditional securities registration. None of it is settled until the rule is final, but it is the first time the SEC has tried to answer the when-does-a-token-stop-being-a-security question by rule instead of by lawsuit.

Two days after CLARITY failed, the SEC issued something firmer: an order it branded an Innovation Exemption, effective September 17, that lets qualifying venues trade tokenized National Market System stocks through automated market makers and liquidity pools without registering as exchanges, and exempts certain proprietary liquidity providers from dealer registration. Gibson Dunn described it as a five-year sandbox. On the derivatives side, Selig sent the CFTC crypto-market proposal to the White House for review on the same September 17 and has said publicly that spot crypto exchanges will be able to register with the agency to shield customers from fraud and theft, framing it as the structure that would have stopped an FTX-style collapse. None of this is the statute the industry wanted. All of it is arriving faster than a statute ever could.

Rule, Not Law: The Catch

Here is the problem with the agencies filling the gap. A statute binds until Congress repeals it. A rule, an order, or a piece of staff guidance binds until the next commission changes its mind, and most of these instruments carry their own expiration dates. The tokenized-stock exemption runs for five years and then lapses. The Regulation Crypto Assets proposal is not law yet and can be reshaped or abandoned once the comment period ends. The staff statement that eased pressure on DeFi front ends, discussed in the next section, explicitly says it has no legal force and will be considered withdrawn five years out. A CFTC chair appointed by a different president could rescind a registration framework with a vote. Compliance built on this foundation is real, but it is rented, not owned.

That fragility is the genuinely new feature of the post-CLARITY landscape, and it is worth laying out instrument by instrument. The pattern repeats: powerful, specific, reversible. The one durable thing in the stack is the stablecoin law, and it reaches DeFi through the asset rather than the protocol.

The Front End Is Still the Choke Point

If the protocol is just code, the website is not. A smart contract can be immutable and unstoppable; the hosted interface most users actually click is a company with servers, a domain, and lawyers, and that is where enforcement has always found purchase. The clearest signal of how the agencies think about this came in April 2026, when the SEC Division of Trading and Markets said it would not recommend enforcement action for failure to register as a broker against certain interface providers, as long as users prepare their own trade instructions through self-custodied wallets. The relief came fenced with conditions. It does not cover soliciting transactions, recommending investment judgments, holding or accessing user assets, or directly executing and settling trades.

Read closely, that statement is the control test applied to the front end. The agencies are looking for retained human authority, not for automation. The factors they weigh are concrete, and any team shipping a DeFi interface should treat them as a checklist of what pulls you back inside the perimeter.

• Who can designate or whitelist the pools an interface routes to
• Who can deploy or upgrade the trading contract
• Who can change rules, parameters, or fees
• Who can halt trading or freeze access
• Whether the interface ever holds, accesses, or routes user assets

Existing practice bears this out. Uniswap Labs, which operates the best-known front end over an autonomous protocol, screens addresses against sanctions and illicit-activity lists through the analytics firm TRM Labs and removes tokens under its token policy when it receives an adverse legal finding or a credible fraud report. The on-chain contracts keep running for anyone with the skill to reach them directly; the website quietly stops serving flagged addresses. That gap between the uncensorable protocol and the compliant interface is where nearly all practical DeFi enforcement lives, and it is why what a wallet or interface does on your behalf has become a compliance question as much as a usability one.

The Courtroom Writes Rules Too

When Congress goes quiet, judges get louder, and the most consequential DeFi rules of the past two years were written in courtrooms, not committee rooms. The Tornado Cash cases are the canon. In Van Loon v. Treasury, the Fifth Circuit held in late 2024 that immutable smart contracts are not property under the sanctions statute, because no one owns or controls them, and the Treasury sanctions office delisted Tornado Cash in March 2025 as a result. Code, on its own, turned out to be beyond the reach of a sanctions designation.

Conduct around the code was another matter. Roman Storm, one of the Tornado Cash developers, was convicted in August 2025 of conspiracy to operate an unlicensed money-transmitting business; the jury hung on the money-laundering and sanctions counts. Prosecutors wanted a quick retrial, but the schedule slipped, and the retrial is now set for April 26, 2027 before Judge Katherine Polk Failla, with Storm motion for acquittal still pending. The line the cases draw is the same control line: writing and publishing a protocol is protected, but running a service around it, taking fees, operating relayers, maintaining an interface, is conduct that can carry liability.

Even the Justice Department has conceded the principle. Matthew Galeotti, who led the department Criminal Division, told an industry audience in 2025 that “merely writing code without ill intent is not a crime”. That is a reassuring sentence for developers and a thin one for the ecosystem, because it leaves every question of where intent and control begin to be settled case by case, defendant by defendant, rather than by a statute that draws the line once and for everyone.

Developers, unsurprisingly, want that principle written down rather than left to prosecutorial discretion. Amanda Tuminelli, executive director of the DeFi Education Fund, has made the case that the priority should be protecting developers from being misclassified and forced into regulatory categories built for traditional financial intermediaries. That is close to what CLARITY Section 604, the developer money-transmitter shield, would have codified, and it is precisely what died with the bill. Absent a statute, the protection Galeotti describes is a prosecutorial posture, not a right, and postures change with administrations.

Who Is Actually on the Hook

Strip away the labels and DeFi liability follows two things: control and profit. The precedents that exist, thin as they are, all point the same way. Developers who retain control can be prosecuted, as the Storm case shows. Front-end operators can be pressured into screening and delisting. And a decentralized autonomous organization is not a liability shield. In CFTC v. Ooki DAO, a federal court entered a default judgment in 2023 treating the DAO as an unincorporated association and a person under the Commodity Exchange Act, ordering it to pay a $643,542 penalty and to shut its website, with governance-token voters treated as members. Liquidity providers and relayers, the other participants everyone worries about, remain largely untested.

The through-line is worth stating plainly because it is the one rule that no court, agency, or failed statute has disturbed: liability tracks control and profit, not the word on the landing page. A project that keeps admin keys, directs fees to a team treasury, or can flip a protocol off is holding the kind of control that attaches a person to the arrangement. A project that has genuinely given that up is harder to reach, which is exactly why the hardest enforcement questions keep migrating to the settlement layer.

The Backdoor That Needs No Statute

All of the above assumes compliance has to attach to a person: a developer, an operator, a DAO. There is one route that skips the person entirely and reaches straight into the protocol, and it is already law. Most DeFi activity settles in dollar-pegged stablecoins, a market worth about $292 billion, with Tether USDT near $184 billion and Circle USDC near $73 billion making up the vast majority. Those two tokens are the water DeFi swims in, and under the GENIUS Act, signed into law in July 2025, their issuers must hold the technical capability to seize, freeze, or burn tokens on a lawful order and must comply when one arrives.

That single requirement does more work than any front-end screen. A protocol can be flawlessly decentralized, leaderless, and unstoppable, and the dollars moving through it can still be frozen at the issuer, because the issuer is a regulated company that answers to a court order. Compliance enters DeFi through the settlement asset, not the smart contract. It is also why the fight over stablecoins is really a fight over DeFi plumbing, from the freeze switch to the question of who gets to keep the yield those reserves generate. Chainalysis reports that stablecoins now account for the large majority of illicit on-chain value, around 84%, which is exactly why regulators treat the issuer as the most valuable chokepoint they have.

That is also where the next binding constraints bite without Congress lifting a finger. The GENIUS Act does more than mandate a freeze switch; it also limits the yield that issuers can pay to stablecoin holders, which reshapes how a DeFi protocol can market a dollar that pays. A protocol can route around a sanctioned front end; it cannot easily route around the dollar it settles in. The issuer freeze is the one compliance hook that survives full decentralization, which is why regulators guard it so closely and why the stablecoin fight is, at bottom, a DeFi fight.

Does Any of This Touch DeFi?

There is a fair question lurking under the whole enterprise: does this scaffolding of rules and orders actually prevent crime, or just inconvenience the law-abiding? Illicit activity remains a small share of on-chain volume, under 1% by Chainalysis estimates even as the absolute dollar figure rose, which cuts both ways. It suggests either that enforcement works or that the problem was never as large as the compliance budget implies. Peter Van Valkenburgh of Coin Center takes the harder line, arguing that the existing anti-money-laundering regime “does remarkably little to prevent illicit finance” while imposing heavy costs on everyone else.

Rule-by-rule governance has a specific blind spot here. The instruments the agencies are issuing all attach to a controller: an issuer, an operator, a registrant. The hardest cases, genuinely leaderless protocols and value that routes around any chokepoint, are exactly the ones a statute would have had to confront and that guidance tends to leave alone. So does the long tail of on-chain extraction that is technically permitted even when it looks predatory, the sort of oracle manipulation that DeFi effectively made legal by writing it into the mechanics rather than the rulebook. Compliance reaches the edges where people are attached. It does not reach the middle of a truly autonomous system, and no amount of staff guidance changes that.

Europe Made the Opposite Bet

The contrast with Europe is the sharpest way to see what the United States chose by not choosing. The European Union already has its statute, the Markets in Crypto-Assets regulation, and MiCA deliberately regulates crypto-asset service providers and issuers rather than autonomous protocols. Where Washington is improvising, Brussels is legislating, and in September 2026 it showed exactly how it intends to reach DeFi. Responding to the Commission MiCA review, the European Securities and Markets Authority called for a new regulated service covering firms that provide users with access to DeFi protocols, the web interfaces, wallets, and aggregators that sit between a person and a smart contract. Alongside it, ESMA asked for clearer tests of genuine decentralization, tighter rules on influencer marketing, and a ban on regulated firms offering non-compliant stablecoin services.

The logic is identical to the American control test; the instrument is not. ESMA would regulate the access point as a licensed activity under a law that binds every member state, with the Commission reports on the review due by June 2027 and any MiCA revision to follow. That is slower than an SEC order and far harder to unwind. The two jurisdictions have landed on the same insight, that you govern DeFi by reaching the humans at its gateways, and split on the hardest part: the European answer is a durable law that takes years, and the American answer, for now, is a fast rule that expires.

For a protocol that serves users on both continents, that divergence is not academic. A global DeFi team now has to design for a European regime that will license its access points under a slow, durable law, and an American regime that tolerates those same access points under a fast order that can vanish in five years or with a change of chair. The safe move, increasingly, is to build to the stricter of the two and treat the looser one as a bonus that might not last. Compliance teams that once waited for Washington to set the baseline are starting to treat Brussels as the floor.

What Builders, Front Ends, and Users Should Do

For builders, the practical takeaway from a rule-not-law regime is that the control test is now your compliance manual, because there is no statute to appeal to instead. Admin keys, upgrade authority, a fee switch pointed at a team treasury, and a front end you can throttle are all control indicators, and each one nudges a project from the protected just-code zone toward the liability of an operator. Teams that want to stay on the safe side of the Storm line minimize retained control and document that they have done so; teams that keep the keys should assume they keep the exposure.

For front-end operators, the April staff statement is a narrow shelter, not a blanket exemption. Keep users in self-custody, let them form their own trade instructions, avoid touching their assets, and screen for sanctioned addresses, and you fit the carve-out; solicit, recommend, custody, or execute, and you do not. For users, the lessons are blunter. Self-custody keeps you outside the intermediary perimeter, which Atkins has defended as “a foundational American value” that should not vanish when you log on, but it also means no one can recover your funds if you lose your keys or get phished through a SIM-swap. And the stablecoins in your wallet, however decentralized the protocol you used, can be frozen by their issuer on a court order. Convenience and censorship-resistance are the same dial turned in opposite directions.

The Road Ahead

The near-term calendar is a string of deadlines that belong to regulators, not legislators. The Regulation Crypto Assets comment window closes on October 20, after which the SEC has to decide whether to finalize, revise, or shelve it. The CFTC spot-market proposal sits at the White House awaiting review. The Storm retrial lands in April 2027. And the clocks on the temporary instruments keep running: the tokenized-stock exemption and the front-end staff statement both lapse around 2031 unless the agencies act again. CLARITY itself is not dead forever, only dead for 2026; a revival in 2027 or 2028 is possible, though the ethics and illicit-finance disputes that sank it have not been resolved.

It is worth picturing what a reversal actually looks like, because the fragility is not hypothetical. A future SEC could let the tokenized-stock exemption lapse, decline to finalize Regulation Crypto Assets, and quietly withdraw the front-end staff statement, and none of those steps would need an act of Congress or even much public notice. Builders who structured around today’s guidance would wake up inside a perimeter that had moved under them. That is the difference between a rule and a law, and it is the reason the industry keeps pressing for a statute even as it leans on the rules it has.

Until one of those things changes, this is the settlement: DeFi compliance in the United States is written by rule, not law. It is faster, more technocratic, and more responsive than the gridlocked alternative, and it is also provisional by design, a stack of orders and guidance that the next election or the next commission can rewrite. The industry spent years asking Congress for certainty. What it got instead was a set of regulators willing to supply the rules, on the condition that nobody mistake them for permanent.

Frequently Asked Questions

Did the CLARITY Act pass in 2026?

No. The Senate cloture vote failed on September 15, 2026, eleven short of the sixty votes needed to open debate, so no crypto market-structure statute passed this year. The House had approved the bill in 2025, but disputes over ethics, consumer protection, and illicit finance kept it off the Senate floor.

Who regulates DeFi in the United States now?

No single agency does. The SEC handles securities questions, the CFTC derivatives and digital-commodity spot markets, FinCEN anti-money-laundering, OFAC sanctions, and the IRS tax. After CLARITY failed, the SEC and CFTC began writing rules under their existing authority, including the proposed Regulation Crypto Assets and a new CFTC spot-market framework.

What does ‘rule, not law’ mean for DeFi compliance?

It means the rules come from agency orders, exemptions, and staff guidance rather than a statute passed by Congress. Those instruments are faster to create but are often temporary, with several carrying five-year sunsets, and a future commission can change or withdraw them, so they offer less certainty than a law.

Can a stablecoin inside a DeFi protocol be frozen?

Yes. Under the GENIUS Act, issuers of US-usable payment stablecoins such as USDT and USDC must be able to seize, freeze, or burn tokens on a lawful order. Because most DeFi activity settles in those tokens, funds can be frozen at the issuer even when the underlying protocol is fully decentralized.

Is writing DeFi code illegal in the United States?

Writing and publishing code is protected, and a senior Justice Department official has said that merely writing code without ill intent is not a crime. Liability attaches to conduct and control instead: operating a service, taking fees, running relayers, or keeping admin control over a protocol can all create exposure, as the Tornado Cash prosecutions show.

Anneke de Vries covers crypto regulation and policy for HOGE Wire.