The Financial Action Task Force says decentralized finance projects that have identifiable owners, operators, or controllers should be regulated as virtual asset service providers, signaling that a project’s “decentralized” branding will not by itself keep it outside anti-money-laundering rules.
The global anti-money-laundering standard-setter set out the position in its targeted report on decentralized finance, published in 2026, which examines how DeFi arrangements fit within existing FATF standards. The report is available on the FATF publications page.
A virtual asset service provider, or VASP, is FATF’s designation for firms that conduct activities such as exchange, transfer, or custody of crypto assets, and that classification carries obligations rather than optional best practices. FATF’s focus is on whether control or management of a DeFi arrangement can be attributed to real parties, not on the “decentralized” label a project applies to itself.
What counts as an identifiable controller
The report’s test centers on whether identifiable persons or entities retain influence over a DeFi arrangement. Compliance advisers reporting on the guidance note that FATF wants supervisors to look past decentralization claims to the substance of who runs a platform, according to ACAMS.
In practice, that can capture founders, developers, front-end operators, treasury signers, or governance actors who exercise ongoing control. Many projects that present as fully decentralized still have teams, interface operators, or concentrated governance power that regulators may treat as a point of accountability.
The distinction FATF draws is between technical decentralization and real operational control. Holding governance tokens alone may not remove accountability if a party can still direct how the service functions.
Why the position matters for DeFi compliance
Being treated as a VASP generally implies anti-money-laundering supervision, customer due diligence, reporting, and sanctions screening, rather than a purely voluntary compliance posture. The 2026 report sits alongside FATF’s broader push on virtual asset oversight, part of a continued effort to close gaps that FATF has flagged as stablecoin-linked crime rises, a theme covered in reporting on how the body has urged stronger crypto AML enforcement.
For protocol teams, the classification could affect product design, front-end access, disclosures, and jurisdiction strategy. Regulatory pressure of this kind can also weigh on liquidity access and how new protocols structure their launches.
A stronger substance-over-label test
The report challenges the assumption that all DeFi systems sit outside traditional compliance frameworks. FATF’s approach hinges on whether decentralization is substantive or cosmetic, drawing a line between protocol code and the operation of a service built on top of it.
That framing suggests regulators may scrutinize front ends and governance mechanisms more closely. Teams may respond by redesigning control, ownership, or user access to reduce the points at which an identifiable controller can be pinpointed. The tension mirrors wider debates over regulatory clarity, including warnings that firms such as Coinbase may expand overseas if U.S. rules stall.
FAQ
Are all DeFi protocols covered? No. FATF’s test turns on whether an identifiable owner, operator, or controller exists, not on whether a project calls itself DeFi.
Can DAOs or governance participants face scrutiny? Governance actors and concentrated governance power can be relevant to identifying control, though holding governance tokens alone may not create accountability.
What does VASP status mean in practice? It generally brings anti-money-laundering obligations, including customer due diligence, reporting, and sanctions screening.
How supervisors interpret and enforce the guidance is the key variable to watch, and that reading will determine which projects are ultimately brought into scope.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
