The Financial Action Task Force said many decentralized finance platforms are decentralized in name only and should fall under its standards when identifiable people retain control or meaningful influence over them.

In a report published Tuesday, the Paris-based anti-money-laundering body urged countries to identify those controllers and regulate them as virtual asset service providers. It also said jurisdictions could, as a last resort, ban platforms that refuse to cooperate. The guidance extends the same Travel Rule framework FATF already applies to centralized crypto exchanges and custodial wallets, which requiresVASPs to collect and share sender and recipient information on transactions above a threshold.

Nearly 93% of jurisdictions surveyed by FATF have not applied the standards to qualifying DeFi arrangements, and only two have ever licensed or registered one, according to the report.

FATF, whose standards are used across more than 200 jurisdictions, said decentralized finance often remains subject to its rules wherever an identifiable person maintains “control or sufficient influence,” regardless of how decentralized a project describes itself. The report divides DeFi into three broad categories: platforms with identifiable controllers; platforms that are centralized in practice while their operators remain hidden; and a smaller group of genuinely leaderless systems that FATF describes as truly decentralized. Only the last category falls outside its standards.

Although many DeFi projects present themselves as fully decentralized, centralized elements “frequently persist in practice,” the report said. Those elements can include concentrated governance token holdings, administrative privileges, control over upgrades, and fees or rewards that flow to insiders.

FATF President Giles Thomson said in a statement accompanying the report that the aim is to prevent criminals from exploiting new technology to “launder dirty money” while “supporting responsible financial innovation.” He also described strong information sharing between the public and private sectors as central to the response.

DeFi control indicators

The report identifies both on-chain and off-chain signs of control. These include upgrade keys, “kill switch” functions, the ability to set fees or risk parameters, concentrated voting power, control of a public website or app, and corporate entities that employ core developers or hold a protocol treasury.

Where such control exists, FATF said the people behind a DeFi arrangement should be licensed and supervised like other financial firms. That group may include developers, large token holders, front-end operators or funders. The report said that even operating a front-end that directs users to a protocol can be sufficient to bring a person or entity within scope.

FATF said implementation remains limited. Nearly 93% of jurisdictions that responded to its recent survey have not applied the standards to any qualifying DeFi arrangement, while only 26 of 142 have assessed the risks. Four jurisdictions have licensing rules in place, and just two have used them to register or license a platform.

FATF guidance is not law, but member jurisdictions are evaluated on how closely they follow it. Persistent gaps can contribute to a country being placed on the watchdog’s “grey list”, which signals deficiencies in AML regimes and can restrict access to international banking and investment. The report followed a broader FATF update released days earlier that found many countries are still struggling to enforce crypto rules more broadly.

Controls, choke points and possible bans

FATF called on countries to close the regulatory gap by requiring, or at least encouraging, DeFi projects to build anti-money-laundering controls directly into smart contracts or user interfaces. Those controls could include sanctions screening and proof-of-KYC checks before certain functions are executed.

For projects that are genuinely leaderless, the report directs regulators toward surrounding choke points. These include stablecoin issuers with the ability to freeze tokens, exchanges that handle fiat on- and off-ramps, and front-end operators that provide user access.

If a platform refuses to cooperate, FATF said a jurisdiction may ban it from operating in its territory as a last resort. Banks and exchanges are also told to conduct due diligence on any DeFi platform they interact with, or stop dealing with it.

North Korea and illicit DeFi activity

The report focuses heavily on how criminal groups already use the sector. It specifically cites North Korea, saying state-linked hackers were responsible for two April attacks that together drained more than $570 million. Those attacks included the $285 million exploit of Solana perpetuals exchange Drift Protocol, which FATF said was carried out in 12 minutes, and a $292 million hack of KelpDAO.

Together, the two attacks accounted for about 76% of the year’s crypto-hacking losses, according to the report. FATF also pointed to ransomware groups, professional laundering networks and investor fraud schemes as major users of DeFi mixers, bridges and swaps.

Related enforcement actions are already moving ahead in other jurisdictions. U.S. prosecutors this year secured prison sentences for the two co-founders of Bitcoin mixer Samourai Wallet and a conviction against Tornado Cash developer Roman Storm. Those cases rest on a similar premise to the one FATF emphasizes in the report: that people who build and operate code can be treated as regulated money businesses.

The report said DeFi’s total value locked reached $86.6 billion this year, an increase of about 85% since 2023. It added that the top dozen protocols hold more than 60% of that total. FATF called for regulators to implement its rulebook rather than leave a gap that could allow illicit finance to operate at scale.