FATF Warns Institutions on DeFi Risks Despite Easier Access

Institutional access to decentralized finance (DeFi) is becoming easier thanks to infrastructure simplification, but this comes with its own set of challenges. The Financial Action Task Force (FATF) has released a report admitting that Virtual Asset Service Providers (VASPs) and DeFi arrangements bring operational benefits such as automated settlement, cross-border reach, 24/7 availability, and higher yields.

However, none of these benefits move institutions outside their existing Anti-Money Laundering/Countering the Financing of Terrorism (AML/CFT) responsibilities. Financial regulators have emphasized that brokers, banks, and other regulated financial institutions must identify who controls a DeFi protocol before using or integrating it into their systems.

The report categorizes DeFi arrangements into three tiers: those with identifiable controllers, those that are centralized in practice but whose controllers are hard to pin down, and those that are genuinely decentralized. The category does not change the obligation but determines the amount of paperwork companies will have to perform before entering into business relations with the DeFi entity.

For instance, if a controller can be identified, financial institutions and VASPs must conduct customer due diligence on the arrangement itself: confirming whether it's licensed or registered where applicable, assessing whether it's adequately supervised, and reviewing its AML/CFT framework. If a controller cannot be identified, and for genuinely decentralized arrangements, institutions must apply AML/CFT measures directly to the underlying customers using the arrangement.

Regulators are still catching up with DeFi developments. FATF's survey data show that out of 142 jurisdictions that responded, only 26 had assessed DeFi-related risks, and 132 had not identified a single qualifying DeFi arrangement operating in their territory. Only four jurisdictions have implemented licensing or registration requirements for such arrangements, and only two have actually licensed or registered one in practice.