FATF Sees Right Through DeFi's "Decentralized" Disguise 😏

The Financial Action Task Force declared in a report published Tuesday that most of decentralized finance is not as decentralized as it claims, and that platforms exercising real control should be regulated like any other financial business. The Paris-based anti-money-laundering body, whose standards govern more than 200 jurisdictions, said its rules already apply to any DeFi arrangement where an identifiable person retains "control or sufficient influence," regardless of the project's branding.

FATF sorts DeFi into three categories: platforms with identifiable controllers, those centralized in practice but whose operators stay hidden, and a genuinely leaderless minority it considers truly decentralized. Only the last escapes its standards. Although many projects market themselves as fully decentralized, the report found that centralized elements "frequently persist in practice" through concentrated governance tokens, administrative privileges, control over upgrades, and the fees and rewards that flow to insiders.

The report lays out on-chain and off-chain markers of control, including upgrade keys and "kill switch" functions, the power to set fees or risk parameters, concentrated voting power, command of the public website or app, and the corporate entities that employ core developers or hold the treasury. Where such control exists, FATF said, the people behind it, whether developers, large token holders, front-end operators or funders, should be licensed and supervised like any financial firm. Operating a front-end that routes users to a protocol can be enough to qualify.

FATF President Giles Thomson said in a statement accompanying the report that the goal is to prevent criminals from exploiting new technology to "launder dirty money" while "supporting responsible financial innovation," and called strong public-private information sharing central to the response. The watchdog also wants countries to require, or at least encourage, DeFi projects to build anti-money-laundering controls directly into their smart contracts or interfaces, from sanctions screening to proof-of-KYC checks before certain functions execute.

Compliance is lagging. Nearly 93% of jurisdictions responding to a recent FATF survey have not applied the standards to any qualifying DeFi arrangement, and only 26 out of 142 have assessed the risks at all. Four have licensing rules on the books, while just two have ever used them to register or license a platform. FATF guidance is not binding law, but members are graded on adherence, and persistent gaps can help land a country on the watchdog's "grey list." The report follows a broader FATF update days earlier finding that most countries still struggle to enforce crypto rules across the board.