DeFi Regulations: Securities, AML, Tax, and DAO Liability

Decentralized finance runs on public blockchains, but DeFi regulations in the United States are the same federal laws that govern the rest of finance: securities statutes, commodities rules, anti-money-laundering requirements, sanctions, and tax reporting. What makes compliance hard is that no single agency owns the space, and the rules attach differently depending on the token involved, the activity, and who actually controls the protocol in practice.

When a DeFi Token Is a Security

The SEC decides whether a digital asset is a security by applying the test from the 1946 Supreme Court case SEC v. W.J. Howey Co. An asset qualifies as an investment contract when someone invests money in a common enterprise with an expectation of profits coming from the efforts of others.¹ The test is technology-neutral. It applies to tokens the same way it applies to orange groves.

For most DeFi tokens, the fight is over that fourth prong. Governance and yield-bearing tokens often face the argument that a core development team’s ongoing work drives the project’s value, satisfying the “efforts of others” element even when the code is open source. The SEC’s framework treats an “Active Participant” performing essential managerial tasks as weighing heavily toward securities classification.¹

There is a flip side. Once a network is fully developed and operational, and holders can use the asset for its intended purpose rather than speculate on price, the case for securities classification weakens. A truly decentralized network where no single group carries out essential managerial efforts looks less like an investment contract. The SEC has never drawn a bright line for where “sufficiently decentralized” begins, so this stays a facts-and-circumstances judgment.²

When a token does qualify as a security, every offer and sale must be registered with the SEC or fall under an exemption. The Securities Act of 1933 requires issuers to disclose financial and material information to investors, and the Securities Exchange Act of 1934 governs secondary trading.³ Platforms facilitating those trades can trigger obligations as exchanges, broker-dealers, or clearing agencies.

When a DeFi Asset Is a Commodity

The CFTC classifies Bitcoin and certain other digital assets as commodities under the Commodity Exchange Act. That gives the agency jurisdiction over fraud, market manipulation, and derivatives products built on those underlying assets, including futures, options, and swaps.

The CFTC has used this authority directly against decentralized organizations. In 2022, it charged the Ooki DAO as an unincorporated association for offering leveraged digital-asset trading without registering and for failing to comply with the Bank Secrecy Act, and it assessed penalties against the founders individually.⁴ Converting a company into a DAO does not erase regulatory obligations that existed before the conversion.

The CFTC does not currently have broad authority over spot commodity markets the way the SEC has over securities markets. Legislation to grant explicit spot-market jurisdiction over digital commodities (the FIT21 bill) has not been enacted as of mid-2026. For now, CFTC power over spot transactions is largely limited to pursuing fraud and manipulation after the fact.

Rules for Specific DeFi Activities

Decentralized Exchanges

If the assets traded on a DEX are securities, the platform could be operating as an unregistered national securities exchange. The SEC evaluates this by function, not technology: any system that brings buyers and sellers of securities together using established, non-discretionary methods can meet the statutory exchange definition.⁵

A 2022 SEC proposal to amend Rule 3b-16 and explicitly cover DeFi trading systems within the exchange definition was withdrawn in 2025.⁶ That does not exempt DEXs. A DEX matching orders for tokens that are securities can still face enforcement under the existing exchange definition; what is off the table for now is the broader net the proposal would have cast.

Lending and Staking

DeFi lending protocols that pool user assets and distribute yield attract scrutiny as unregistered securities offerings. SEC enforcement against centralized crypto lending products established that interest-bearing accounts using customer crypto can function as investment contracts when returns depend on the platform’s management of pooled funds.

Staking has gotten different treatment. In May 2025, the SEC’s Division of Corporation Finance issued a statement that “Protocol Staking Activities” do not involve the offer and sale of securities. The division’s reasoning: a node operator who stakes tokens directly is performing an administrative task to help secure the network, and any reward comes from that task rather than someone else’s managerial efforts.⁷

The statement covered custodial staking too. Even when a third party holds and stakes your tokens, SEC staff concluded the custodian is acting as an agent performing an administrative function rather than providing entrepreneurial or managerial efforts.⁷ This is staff guidance, not a formal rule, and it can be revised.

Stablecoins Under the GENIUS Act

Stablecoins got their own federal framework when the GENIUS Act was signed into law on July 18, 2025. It creates the first dedicated federal system for payment stablecoins.⁸

Issuers must back every stablecoin with 100% reserves in highly liquid assets such as U.S. dollars and short-term Treasuries with maturities of 93 days or less. They must publish monthly disclosures on reserve composition. The law also subjects stablecoin issuers to the Bank Secrecy Act, requiring anti-money-laundering programs, sanctions screening, and customer identity verification.⁸ Issuers must have the technical ability to seize, freeze, or burn tokens when legally required, and they cannot claim their stablecoins are backed by the U.S. government, federally insured, or legal tender.

Anti-Money Laundering and KYC

The Bank Secrecy Act requires financial institutions to maintain programs designed to detect and prevent money laundering. FinCEN applies these requirements to crypto by classifying certain participants as Money Services Businesses.⁹

A DeFi entity that exchanges or transmits convertible virtual currency can fall under the MSB classification. Once classified, the entity must register with FinCEN and build an AML program that verifies customer identities, files Suspicious Activity Reports on transactions suggesting illicit activity, and reports cash transactions over $10,000.¹⁰ The obligation lands on whoever controls the protocol’s operations in practice: developers, foundation teams, or front-end interface operators.

The Travel Rule

Fund transmittals of $3,000 or more trigger the Travel Rule, which requires the sending financial institution to include identifying information about both sender and recipient and pass it to the next institution in the chain.¹¹ The required data includes the sender’s name, address, and account number, plus the recipient’s name and account number if available.

Applying this to DeFi creates real friction. Many protocols operate on pseudonymous wallet addresses, and peer-to-peer transfers may not pass through an institution that can collect and relay identity data. FinCEN has signaled that it considers the Travel Rule applicable to virtual currency transmissions; full implementation for decentralized protocols remains in progress.

Penalties

The consequences for ignoring BSA obligations are severe. FinCEN’s 2023 settlement with Binance for failing to maintain an effective AML program and neglecting customer verification resulted in a $3.4 billion civil penalty, the largest in FinCEN history.¹²

Criminal exposure runs deep too. A willful BSA violation carries a fine of up to $250,000 and up to five years in prison. If the violation is part of a pattern of illegal activity involving more than $100,000 over a 12-month period, the maximums double to $500,000 and ten years.¹³

Sanctions Screening After Tornado Cash

OFAC maintains the Specially Designated Nationals list, and U.S. persons are prohibited from transacting with listed individuals, entities, or property. OFAC has added specific digital-currency wallet addresses to the SDN list and expects anyone facilitating crypto transactions to screen against those addresses through a risk-based compliance program.¹⁴

The Tornado Cash case set the outer limit. In August 2022, OFAC sanctioned Tornado Cash, a mixing protocol, by adding its smart contract addresses to the SDN list. The Fifth Circuit reversed that action in late 2024, ruling that immutable smart contracts are not “property” under the International Emergency Economic Powers Act because no one owns or controls them.¹⁵ OFAC removed Tornado Cash from the SDN list in March 2025.¹⁶

The ruling narrowed OFAC’s ability to sanction autonomous code, but it did not eliminate sanctions risk. OFAC can still sanction the people behind a protocol, and U.S. persons who knowingly transact with blocked individuals through any channel remain liable. Front-end operators and interface providers should keep screening users and wallet addresses against the SDN list.¹⁴

Tax Reporting on DeFi Transactions

The IRS treats virtual currency as property, so every disposal is a potential taxable event. Swapping one token for another through a DeFi protocol counts as a disposition, and you recognize a capital gain or loss equal to the difference between the fair market value of what you received and your adjusted basis in what you gave up.¹⁷ That applies to token-to-token swaps, liquidity pool deposits, and any other exchange of one digital asset for another.

Starting with transactions on or after January 1, 2025, covered U.S. digital-asset brokers must report proceeds to both the IRS and the customer on Form 1099-DA. Basis reporting began for transactions on or after January 1, 2026.¹⁸ The form captures sale dates, proceeds, cost basis, and whether the gain is short-term, long-term, or ordinary.¹⁹

Here is the gap that hits DeFi users. The final regulations explicitly exclude decentralized and non-custodial brokers that do not take possession of the assets being sold. Treasury and the IRS have said they intend to address these brokers in a separate rulemaking, but as of mid-2026 no final rule has been published.¹⁸ The absence of a 1099-DA does not make the income untaxed. Wallet-to-wallet swaps and on-chain transactions through decentralized protocols are fully taxable even when no one sends you a form. You are responsible for tracking cost basis and reporting gains.

Personal Liability for DAO Governance

Participating in a DAO’s governance can create personal liability that most token holders don’t anticipate. Courts and regulators have increasingly treated DAOs as familiar structures rather than novel ones: general partnerships or unincorporated associations whose members share liability for the organization’s obligations.

The CFTC took this position in the Ooki DAO action, treating the DAO as an unincorporated association and holding its founders liable as actively participating members.⁴ Civil courts have followed similar reasoning. In Samuels v. Lido DAO (2024), a federal court in California concluded that a DAO could be treated as a general partnership under state law, meaning large token holders who meaningfully participated in governance could face liability as general partners. A separate case, Sarcuni v. bZx DAO (2023), suggested that all token holders of a DAO might be partners.

The practical takeaway: buying governance tokens in large quantities, voting on proposals, or publicly stating your intent to guide a DAO’s direction can all be treated as evidence of partnership participation. In a general partnership, each partner can be held personally liable for the partnership’s debts and legal violations. DAOs seeking to limit member exposure have increasingly incorporated as LLCs or other legal entities in states that have adopted DAO-specific legislation.

Which Agency Regulates What

No single agency owns DeFi oversight. The SEC focuses on investor protection, regulating tokens that qualify as securities and the platforms that trade them; its jurisdiction is triggered by the economic substance of the transaction, not the technology.¹ The CFTC has authority over digital assets classified as commodities and any derivatives built on them, targeting unregistered platforms and fraudulent schemes.⁴

FinCEN administers the Bank Secrecy Act and classifies crypto participants as Money Services Businesses subject to registration and AML compliance.⁹ OFAC enforces sanctions and expects anyone facilitating crypto transactions to screen against the SDN list.¹⁴ The OCC regulates national banks that interact with digital assets and has confirmed that crypto custody, certain stablecoin activities, and participation in distributed-ledger networks are permissible banking activities with appropriate risk management.²⁰

The FTC and the Consumer Financial Protection Bureau share authority over consumer protection for non-bank financial institutions, which can include DeFi lending platforms engaged in deceptive or abusive practices. The IRS treats all digital-asset transactions as property dispositions and is steadily expanding broker reporting to close the information gap between on-chain activity and tax compliance.¹⁷

1
U.S. Securities and Exchange Commission. Framework for “Investment Contract” Analysis of Digital Assets
2
U.S. Securities and Exchange Commission. Framework for “Investment Contract” Analysis of Digital Assets
3
U.S. Securities and Exchange Commission. Registration Under the Securities Act of 1933
4
Commodity Futures Trading Commission. CFTC Imposes $250,000 Penalty Against bZeroX, LLC and Its Founders and Charges Successor Ooki DAO
5
Federal Register. Supplemental Information and Reopening of Comment Period for Amendments Regarding the Definition of “Exchange”
6
U.S. Securities and Exchange Commission. Notice of Withdrawal of Proposed Regulatory Actions
7
U.S. Securities and Exchange Commission. Statement on Certain Protocol Staking Activities
8
The White House. Fact Sheet: President Donald J. Trump Signs GENIUS Act into Law
9
Financial Crimes Enforcement Network. The Bank Secrecy Act
10
eCFR. 31 CFR Part 1022 – Rules for Money Services Businesses
11
Financial Crimes Enforcement Network. Funds “Travel” Regulations: Questions and Answers
12
U.S. Department of the Treasury. U.S. Treasury Announces Largest Settlements in History with World’s Largest Virtual Currency Exchange Binance
13
Office of the Law Revision Counsel. 31 USC 5322 – Criminal Penalties
14
Office of Foreign Assets Control. Questions on Virtual Currency
15
United States Court of Appeals for the Fifth Circuit. Van Loon v. Department of the Treasury
16
Office of Foreign Assets Control. North Korea Designation Update and Removal
17
Internal Revenue Service. Frequently Asked Questions on Virtual Currency Transactions
18
Internal Revenue Service. Final Regulations and Related IRS Guidance for Reporting by Brokers on Sales and Exchanges of Digital Assets
19
Internal Revenue Service. Form 1099-DA Digital Asset Proceeds From Broker Transactions 2026
20
Office of the Comptroller of the Currency. OCC Clarifies Bank Authority to Engage in Certain Cryptocurrency Activities