
FATF says DeFi platforms with identifiable controllers must follow AML rules, citing $570M in North Korean-linked hacks and 93% jurisdiction non-compliance.
The Financial Action Task Force published a report Tuesday urging governments to apply anti-money laundering rules to decentralized finance platforms where developers, token holders or other identifiable parties retain meaningful control. The Paris-based standard-setter said many platforms that call themselves decentralized are not.
FATF divides DeFi arrangements into three categories: platforms with identifiable controllers; platforms that are effectively centralized but whose operators stay hidden; and a small group of genuinely leaderless protocols. Only the last category falls outside FATF standards, the report said.
Features commonly associated with DeFi do not make a platform decentralized for regulatory purposes, according to the report. FATF identified concentrated holdings of governance tokens, administrative privileges, control over protocol upgrades and the distribution of fees and rewards as indicators that centralized control may remain.
Other signs include upgrade keys or “kill switches,” authority to set fees or risk parameters, concentrated voting power, control of a public-facing website or app, and corporate entities that employ core developers or control a project treasury. Developers, major token holders, funders and front-end operators could therefore qualify for licensing and supervision as financial businesses. Simply operating an interface that channels users into a protocol may be sufficient, the report said.
Implementation has been sparse. Nearly 93% of jurisdictions responding to a recent FATF survey have never applied the standards to a qualifying DeFi arrangement. Only 26 of 142 jurisdictions have assessed DeFi-related risks. Only four have established licensing requirements. Only two have actually registered or licensed a platform.
The figures expose a gap between FATF’s existing framework and national enforcement. FATF standards are not themselves law, the organization said. More than 200 jurisdictions use them as a benchmark. Countries can face increased scrutiny, including placement on FATF’s “grey list,” for persistent deficiencies.
FATF President Giles Thomson said the objective is to prevent criminals from exploiting emerging technologies to “launder dirty money” while “supporting responsible financial innovation.”
To close the compliance gap, FATF recommends that jurisdictions require or encourage DeFi projects to incorporate AML safeguards directly into smart contracts or user interfaces. Those controls could include sanctions screening and proof-of-know-your-customer checks before certain transactions or functions can occur, the report said.
Where protocols are genuinely decentralized, regulators should focus on surrounding “choke points,” including stablecoin issuers capable of freezing tokens, exchanges providing fiat on- and off-ramps and front-end operators, the report said. Banks and crypto exchanges should conduct due diligence on DeFi platforms they interact with and stop doing business with platforms presenting unacceptable risks.
FATF tied the regulatory urgency to DeFi’s growing use in illicit finance. The report cites ransomware groups, professional money-laundering networks and investment fraud operations using mixers, bridges and swaps. It also points to more than $570 million allegedly stolen in two April attacks attributed to North Korean state-linked hackers. That sum represents roughly 76% of crypto hacking losses for the year covered by the report.
The potential exposure is growing with the sector itself. DeFi’s total value locked has reached $86.6 billion, about 85% above 2023 levels. The 12 largest protocols account for more than 60% of that value.
FATF’s core message is that regulators should examine how a platform actually operates rather than accept decentralization claims at face value. Where identifiable parties retain the ability to control code, governance, interfaces or economic benefits, the watchdog said existing AML obligations should follow that control.
Drafted by a large language model from the source reporting linked above, then screened by automated publishing checks. It is not read by a journalist before publication. Some articles cite our Alpha Score. Verify prices and figures against the original source. Educational coverage, not personalized advice.