CFTC DeFi Report: What are the changes in regulatory risks for DeFi projects?

Author: Xiaoza Team

According to the U.S. Commodity Futures Trading Commission (CFTC), the CFTC's Digital Assets and Blockchain Technology Subcommittee recently released a report titled "Decentralized Finance" (hereinafter referred to as the "Report"), which analyzes the risks faced by DeFi and offers recommendations to inform ongoing policy debates among the U.S. Congress, state legislatures, and regulatory agencies, including the CFTC. This is a response to the "Illicit Finance Risk Assessment of Decentralized Finance" (hereinafter referred to as the "Risk Assessment") released by the U.S. Department of the Treasury in April 2023, which reported on the illicit financing risks of DeFi and suggested that federal regulators engage further with the industry to explain how relevant laws and regulations apply to DeFi services, take additional regulatory actions, and issue further guidance. The Report reflects the beginning of such engagement.

Justin Slaughter, Policy Director at crypto company Paradigm and a member of the CFTC's Technology Advisory Committee, pointed out that this report is a groundbreaking contribution to investigating the opportunities and risks associated with DeFi, stating that it "can be considered the most comprehensive review of DeFi by any U.S. government agency to date."

Today, the Xiaoza Team will interpret these two related documents for everyone to analyze future review and regulatory trends.

Risks and Challenges Faced by DeFi

We note that the risks addressed in the Risk Assessment and the Report do not completely overlap. The Risk Assessment focuses on the risks of DeFi being used for money laundering and terrorist financing. The Report provides a more detailed and multi-layered identification of risks related to DeFi.

Specifically, the Risk Assessment emphasizes the abuse of DeFi by illicit actors. The report points out that key factors such as non-compliance of DeFi services, lack of intermediation, foreign entities not enforcing international anti-money laundering/combating the financing of terrorism standards, and cybersecurity vulnerabilities of DeFi services have led illicit actors—including ransomware users, thieves, fraudsters, drug traffickers, and North Korean proliferation financiers—to utilize DeFi services to transfer and launder their illegal proceeds. However, the report also acknowledges that illicit activities are only a subset of the overall activities within the DeFi space, and that money laundering, proliferation financing, and terrorist financing most commonly use fiat currencies or other traditional assets rather than virtual assets.

The Report's focus areas include not only the abuse of DeFi but also highlight the lack of clear responsibility and accountability from the perspectives of investors and consumers, market integrity, businesses and ecosystems, financial system stability, and U.S. national security and leadership. This lack of accountability has led to a lack of motivation among DeFi industry participants to improve systems for victim recourse and prevention of illegal mining.

The Xiaoza Team believes that DeFi aims to leverage the characteristics of blockchain to address inefficiencies, structural issues, and security problems in traditional financial services, establishing a more resilient financial system. However, many DeFi projects are still not mature enough, and the cybersecurity vulnerabilities and lack of auditing standards of DeFi services make them susceptible to being tools for illegal activities. The lack of regulation in this emerging industry exacerbates participants' neglect of security risks and compliance systems, with issues such as the centralization of DeFi organizational structures, governance of DAOs, and chaos in the NFT market urgently needing resolution. In 2022, the collapse of algorithmic stablecoins due to Luna exposed that many DeFi projects had not established sound internal control mechanisms. Currently, DeFi services typically do not implement anti-money laundering/anti-terrorism financing controls or other procedures to identify customer identities, possessing a considerable degree of anonymity. Although they have not yet been widely exploited by illicit actors, proactive measures must be taken to ensure stability and sustainability, and the risks of DeFi cannot be ignored.

Regulatory Measures for DeFi

U.S. official agencies generally believe that the obligations to combat illicit finance, protect customers and investors, and maintain national security that apply to traditional financial industries also apply to DeFi services. The Risk Assessment states that the U.S. Bank Secrecy Act (BSA) and related laws and regulations require financial institutions to assist the U.S. government in investigating and preventing money laundering and terrorist financing, and whether DeFi entities fall under this obligation will depend on the specific facts and circumstances surrounding their financial activities. Although DeFi services claim to be "fully decentralized" or plan to be "fully decentralized," this does not affect their status as financial institutions under the BSA. Participants in the DeFi industry are obligated to fulfill anti-money laundering/anti-terrorism financing obligations (this claim was recognized by a California court in the CFTC v. Ooki DAO case in June 2023, which stated that DAOs engaged in DeFi activities are subject to the BSA).

Before the Report expressed support for this view, several senators jointly launched the "Digital Asset Anti-Money Laundering Act" (hereinafter referred to as the "Proposal") in December 2023, clearly supporting that digital asset wallet providers, miners, validators, and other network participants who may verify, protect, or facilitate digital asset transactions become subjects of BSA responsibilities—including KYC ("Know Your Customer"). Furthermore, the Proposal expands the scope of BSA rules regarding foreign bank account reporting to include digital assets, requiring U.S. citizens to submit Foreign Bank and Financial Accounts Reports (FBAR) to the IRS when conducting digital asset transactions exceeding $10,000 through one or more foreign entities. It is conceivable that if this bill is formally enacted, it will trigger another earthquake within the industry. Currently, the Proposal has not yet passed, and the Xiaoza Team will closely monitor future developments.
The Report also requires DeFi projects to assume policy goals and regulatory obligations when providing financial services and demands that engineers consider these as part of the DeFi project, incorporating the most effective and economical controls and security features from the early stages of DeFi development.

We note that over time, U.S. official agencies have become increasingly firm in requiring DeFi projects to assume corresponding obligations. The Risk Assessment previously explained the expansion of obligations through a purpose-based interpretive approach, suggesting that certain DeFi services be regulated beyond the definition of financial institutions to strengthen anti-money laundering/anti-terrorism financing oversight. However, it reserved opinions on the standards for determining financial institutions under the BSA and the regulation of DeFi services that do not fall under the BSA definition, welcoming public input on this matter. In the Report, this obligation is viewed as self-evident. The Report posits that it is more worth considering the exceptions to obligations, namely, which projects seek exemption from the recognized obligations of attempting to achieve regulatory goals in providing financial services, and whether they have proposed specific control measures, possible time limits, and effectiveness testing.

Additionally, the Report provides detailed recommendations for specific regulatory and compliance directions for DeFi. The specific list is as follows for your reference:

Since 2023, the CFTC has focused its enforcement efforts on the decentralized finance (DeFi) sector. In the absence of formal laws and regulations, the CFTC and other regulatory agencies have expanded interpretations of the obligations set forth in relevant laws and regulations, gradually expanding their administrative regulatory authority through litigation, penalizing several blockchain companies and their executives, including Opyn, Inc., ZeroEx, Inc., and Deridex, Inc. As of November 2023, the CFTC has undertaken 96 enforcement actions, 47 of which are related to digital assets, indicating relatively aggressive regulatory behavior.

However, comprehensive regulation does not equate to stringent regulation. We also note that the Report calls for increased understanding of DeFi, emphasizing the necessity of a detailed understanding of decentralized financial systems, which is conducive to avoiding the excessive demonization of DeFi and alleviating tensions between regulators and DeFi. Moreover, from the historical perspective of U.S. legislation and judiciary, U.S. regulatory policies have always been subject to adjustments. Therefore, while the legal actions of the CFTC and the lawsuits initiated by the SEC are indeed significant, they should not be overly exaggerated. Overall, regulatory agencies recognize the innovation and transformation that DeFi brings to the financial industry, and their attitude towards DeFi may be gradually becoming more positive.

Final Thoughts

It is commonly believed in the industry that there is insufficient clarity regarding regulation in the DeFi sector, with a lack of clarity on whether DeFi meets the BSA's definition of financial institutions and registration entities, which is used to counter the obligations imposed on industry participants by the CFTC, FinCEN (Financial Crimes Enforcement Network), and SEC (Securities and Exchange Commission). However, this viewpoint has been refuted by case law.

The Xiaoza Team believes that there is a lag in global regulation of Web3. Although DeFi has garnered increasing attention from more countries and regions, the governance and norms of the industry are still in an exploratory phase. Promoting accountability and compliance mechanisms may become one of the future development focuses of the industry, and requiring DeFi services to fulfill some or all obligations of traditional financial industries may become a regulatory trend. Instead of forcibly applying existing laws to DeFi, actively exploring pathways for DeFi to adapt to the existing framework and obtaining secure and cost-effective financial service channels should be prioritized in the future.