The Financial Action Task Force (FATF), the global standard-setter for anti-money laundering and counter-terrorist financing (AML/CFT), just released its first decentralized finance (DeFi) specific report, making clear that simply claiming to be decentralized is not enough to avoid regulatory oversight. The 49-page report provides a framework for determining which DeFi protocols should be regulated like traditional financial services, and it hinges on a single test: whether anyone actually exercises control over the protocol.

For years, DeFi has occupied a regulatory gray zone. Protocols offer real operational benefits, including automated settlement, programmable financial services, and around-the-clock availability. But their varied governance structures make it unclear who, if anyone, should be held responsible for compliance with financial regulations. The FATF's report tackles this head-on by introducing what it calls the "control or sufficient influence" (COSI) test, which helps regulators determine whether a protocol falls under their jurisdiction.

Protocols

The timing matters. Chainalysis's 2026 Crypto Crime Report found that illicit flows into DeFi protocols rose 343% year-on-year, making effective risk mitigation essential to ensuring DeFi can continue to grow safely. The FATF acknowledges that institutions want to use DeFi's benefits, and that jurisdictions should enable these interactions. But the same properties that attract legitimate users also appeal to bad actors.

How Does the FATF's Control Test Actually Work?

The COSI test divides DeFi protocols into three categories based on who exercises control or sufficient influence over them. Understanding these categories is crucial for both regulators and protocol developers trying to navigate the new framework.

• Centralized protocols: Persons or entities exercise clear control or sufficient influence. These fall within the scope of FATF standards and should be treated as Virtual Asset Service Providers (VASPs), the same category that includes crypto exchanges and stablecoin issuers.
• Centralized but with unidentified controllers: A protocol subject to control or sufficient influence by persons whose identities are unknown. These also fall within FATF scope. The FATF recommends that supervisors work with domestic authorities, foreign counterparts, and blockchain analytics providers to identify who is behind them.
• Truly decentralized protocols: A protocol not controlled or sufficiently influenced by anyone. These fall outside FATF standards, but still present risks that require alternative, risk-based mitigation measures.

To measure control or sufficient influence, the FATF points to specific on-chain and off-chain indicators. These include governance concentration, where a handful of individuals or entities hold enough governance tokens to meaningfully direct the protocol's financial operations. The FATF calls on supervisors to consider "potential wallet clustering" and on-chain voting behavior to identify hidden patterns of control.

Administrative privileges also matter. This includes possession of private keys allowing smart contract upgrades, parameter changes, protocol pauses, or access controls. Additionally, fee and treasury flows reveal control, such as receiving protocol fees, controlling treasury funds, or directing economic value.

Off-chain indicators round out the picture. These include control over front-end interfaces, development repositories, and public communications about the ability to modify the protocol.

What Role Does Blockchain Analytics Play in Enforcement?

The FATF's framework is only as effective as regulators' ability to see what is actually happening on-chain. This is where blockchain analytics becomes essential. The report explicitly identifies blockchain intelligence as "a key to the puzzle," enabling both builders and regulators to effectively apply the FATF's recommendations.

Blockchain analytics tools allow supervisors to cluster related wallets, trace fee and treasury flows through DeFi protocols, bridges, and decentralized exchanges (DEXs), and connect on-chain activity to real-world counterparties across multiple blockchains. This gives supervisors an evidence-based way to assess who actually exercises control or sufficient influence over a protocol, rather than relying on labels or public claims alone.

The FATF has set clear priorities for jurisdictions to speed up their enforcement efforts. These include conducting DeFi-specific risk assessments, considering the complex governance structures, cross-border nature, and concentration of activity. Jurisdictions are also told to deploy blockchain analytics for ongoing DeFi supervision, conducting continuous transaction tracing, wallet clustering, and network analysis to identify controllers and monitor high-risk protocols.

How Should Jurisdictions Implement This Framework?

The FATF's recommendations are detailed but leave room for jurisdictions to adapt the framework to their own contexts. However, the report does lay out specific steps that regulators should take to make the framework operational.

• Conduct DeFi-specific risk assessments: Jurisdictions should evaluate the complex governance structures, cross-border nature, and concentration of activity within DeFi protocols operating in their territory.
• Deploy blockchain analytics for ongoing supervision: The report recommends conducting continuous blockchain analytics, including transaction tracing, wallet clustering, and network analysis to identify controllers and monitor high-risk protocols.
• Collaborate with analytics providers: Supervisors are told to work with blockchain analytics companies who may have additional identifiers when trying to identify controllers of centralized DeFi protocols where controllers cannot be readily identified.
• Enhance oversight of front-end providers and oracle operators: Jurisdictions should require automated screening, risk-scoring, and geo-blocking to prevent illicit activity.
• Encourage smart-contract audits alongside embedded controls: The report recommends that jurisdictions consider smart-contract audits, embedded controls like kill switches and pause mechanisms, and ongoing monitoring as complementary measures for effective DeFi oversight.

Notably, the FATF actively encourages security features like kill switches and pause mechanisms, and AML risk mitigation controls such as front-end screening and sanctions checks, across all categories of DeFi. This distinction matters: protocols should feel encouraged to implement robust safeguards, knowing that the regulatory framework is designed to assess control or sufficient influence over financial services provided, not to penalize good practice.

Why Is This Report Significant Right Now?

The timing of the FATF's DeFi report reveals a significant enforcement gap. According to the FATF's 7th Targeted Update, published the same week as the DeFi report, 93% of jurisdictions have not identified qualifying DeFi protocols in their territory. Only four jurisdictions have imposed licensing requirements, and just one has taken enforcement action.

This underscores the importance of the framework the report establishes. Without clear guidance on how to apply existing AML/CFT standards to DeFi, regulators have been slow to act. The FATF's report provides that guidance, making it easier for jurisdictions to move forward with enforcement and for protocols to understand their obligations.

The report also reflects a broader shift in how regulators view DeFi. Rather than treating all protocols the same or dismissing them as unregulatable, the FATF acknowledges that DeFi exists on a spectrum. Some protocols are effectively centralized, even if they claim otherwise. Others are genuinely decentralized but still present risks. The framework allows regulators to apply proportionate oversight based on actual control structures, not marketing claims.

For the crypto industry, the message is clear: transparency about governance and control structures is becoming non-negotiable. Protocols that can demonstrate genuine decentralization through on-chain evidence will have an easier path forward. Those that claim decentralization while maintaining hidden control will face increased scrutiny and potential enforcement action. The FATF's framework, backed by blockchain analytics, makes it harder than ever to hide who is really in charge.

" }