FATF: Many DeFi platforms are decentralized in name only

The Financial Action Task Force, in a report published Tuesday, found that many decentralized finance platforms are ‘decentralized in name only’ and urged countries to treat identifiable controllers as virtual asset service providers subject to anti-money-laundering rules.

The Paris-based watchdog divides DeFi into three groups: platforms with identifiable controllers, protocols that are centralized in practice but operated by hidden actors, and a small set it regards as truly leaderless. The FATF’s standards apply where an identifiable person or entity retains control or sufficient influence over a protocol.

The report lists on-chain and off-chain signs of control. Examples include private upgrade keys, ‘kill switch’ functions, the power to set fees or risk parameters, concentrated voting power through large governance token holdings, control of the public website or app, and corporate entities that employ core developers or hold a protocol treasury. Operating a front-end that directs users into a protocol can also qualify as control that requires licensing and supervision.

The FATF identified enforcement gaps. Nearly 93% of jurisdictions that responded to its recent survey have not applied FATF standards to any qualifying DeFi arrangement, and just 26 of 142 respondents have assessed DeFi risks. Four jurisdictions have explicit licensing rules for some DeFi activities, and two have used those rules to register or license a platform.

To reduce risks, the report recommends that countries require or encourage projects to build anti-money-laundering controls into smart contracts and user interfaces, such as sanctions screening and proof-of-KYC checks that prevent certain functions until checks are complete. For genuinely leaderless projects, regulators should target surrounding choke points: stablecoin issuers that can freeze tokens, exchanges that provide fiat on- and off-ramps, and front-end operators. Banks and exchanges are advised to conduct due diligence on any DeFi platform they interact with and to stop dealing with platforms that refuse to cooperate. As a last resort, jurisdictions could ban noncompliant platforms from operating in their territory.

The report highlights recent large criminal incidents. It attributes two April attacks to state-linked North Korean hackers that together drained more than $570 million: a $285 million exploit of a Solana perpetuals exchange and a $292 million breach of another protocol. The FATF said those two incidents accounted for about 76% of the year’s crypto-hacking losses cited in the report. The watchdog also notes use of mixers, bridges and swaps by ransomware groups, professional laundering networks and investor frauds.

Legal cases are cited to show how authorities have treated developers and operators as regulated entities. U.S. prosecutors this year obtained prison terms for two co-founders of a Bitcoin mixer and secured a conviction against a developer linked to a mixing service. The report frames these examples as precedents for holding builders and maintainers of DeFi code accountable under AML rules.

Giles Thomson, president of the FATF, described the goal as stopping criminals who exploit new technology to ‘launder dirty money’ while ‘supporting responsible financial innovation.’ He called for stronger public-private information sharing to address the risks.

The report notes DeFi’s total value locked reached $86.6 billion this year, an increase of about 85% since 2023, with the top dozen protocols holding more than 60% of that value. The FATF recommended that countries adopt its virtual asset rulebook, identify controllers, mandate licensing where appropriate, and use regulatory choke points when projects refuse to cooperate.