FATF Says DeFi With Identifiable Controllers Should Be Regulated as VASPs

4 mins mins

The Financial Action Task Force says decentralized finance projects that have identifiable owners, operators, or controllers should be regulated as virtual asset service providers, signaling that a project’s “decentralized” branding will not by itself keep it outside anti-money-laundering rules.

FATF Says DeFi With Identifiable Controllers Should Be Regulated as VASPs

The global anti-money-laundering standard-setter set out the position in its targeted report on decentralized finance, published in 2026, which examines how DeFi arrangements fit within existing FATF standards. The report is available on the FATF publications page. For related coverage, see Top Tokenized Treasury Funds in 2026: 6 Products Compared by Access, Structure, and Distribution.

A virtual asset service provider, or VASP, is FATF’s designation for firms that conduct activities such as exchange, transfer, or custody of crypto assets, and that classification carries obligations rather than optional best practices. FATF’s focus is on whether control or management of a DeFi arrangement can be attributed to real parties, not on the “decentralized” label a project applies to itself. For related coverage, see Bitcoin Core v29.4 Now Available for Download.

What counts as an identifiable controller

The report’s test centers on whether identifiable persons or entities retain influence over a DeFi arrangement. Compliance advisers reporting on the guidance note that FATF wants supervisors to look past decentralization claims to the substance of who runs a platform, according to ACAMS. For related coverage, see South Korea Crypto Exchange Volume Falls 89% YoY to $305M.

In practice, that can capture founders, developers, front-end operators, treasury signers, or governance actors who exercise ongoing control. Many projects that present as fully decentralized still have teams, interface operators, or concentrated governance power that regulators may treat as a point of accountability.

The distinction FATF draws is between technical decentralization and real operational control. Holding governance tokens alone may not remove accountability if a party can still direct how the service functions.

Why the position matters for DeFi compliance

Being treated as a VASP generally implies anti-money-laundering supervision, customer due diligence, reporting, and sanctions screening, rather than a purely voluntary compliance posture. The 2026 report sits alongside FATF’s broader push on virtual asset oversight, part of a continued effort to close gaps that FATF has flagged as stablecoin-linked crime rises, a theme covered in reporting on how the body has urged stronger crypto AML enforcement.

For protocol teams, the classification could affect product design, front-end access, disclosures, and jurisdiction strategy. Regulatory pressure of this kind can also weigh on liquidity access and how new protocols structure their launches.

A stronger substance-over-label test

The report challenges the assumption that all DeFi systems sit outside traditional compliance frameworks. FATF’s approach hinges on whether decentralization is substantive or cosmetic, drawing a line between protocol code and the operation of a service built on top of it.

That framing suggests regulators may scrutinize front ends and governance mechanisms more closely. Teams may respond by redesigning control, ownership, or user access to reduce the points at which an identifiable controller can be pinpointed. The tension mirrors wider debates over regulatory clarity, including warnings that firms such as Coinbase may expand overseas if U.S. rules stall.

FAQ

Are all DeFi protocols covered? No. FATF’s test turns on whether an identifiable owner, operator, or controller exists, not on whether a project calls itself DeFi.

Can DAOs or governance participants face scrutiny? Governance actors and concentrated governance power can be relevant to identifying control, though holding governance tokens alone may not create accountability.

What does VASP status mean in practice? It generally brings anti-money-laundering obligations, including customer due diligence, reporting, and sanctions screening.

How supervisors interpret and enforce the guidance is the key variable to watch, and that reading will determine which projects are ultimately brought into scope.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.