FATF Demands Global Crackdown on DeFi Platforms with ‘Identifiable Controllers’

The global financial watchdog, the Financial Action Task Force (FATF), has issued a directive to international regulators to strip away the “decentralized” label from crypto projects that maintain central points of control. In a comprehensive report released Tuesday, the Paris-based organization asserted that most Decentralized Finance (DeFi) platforms are not as leaderless as they claim and should be subject to the same anti-money laundering (AML) and counter-terrorist financing (CTF) rules as traditional banks.

The FATF, which sets the international standards for more than 200 jurisdictions, argues that any project where an identifiable person or entity retains “control or sufficient influence” must be regulated as a Virtual Asset Service Provider (VASP). This classification forces platforms to perform “Know Your Customer” (KYC) checks and report suspicious transactions to authorities.

According to the watchdog, truly decentralized protocols—those without any central authority—are a small minority. The FATF categorized the sector into three distinct groups: platforms with clear controllers, those where operators hide behind a facade of decentralization, and a tiny fraction that is genuinely leaderless. Only the latter category is exempt from current FATF standards.

To identify where control resides, the FATF pointed to specific “on-chain” and “off-chain” indicators. These include the possession of administrative “upgrade keys,” the ability to trigger a “kill switch,” the power to set transaction fees, and the ownership of the web domains used to access the protocol. Even the employment of core developers by a centralized corporate entity can be enough to trigger regulatory requirements.

The push for stricter oversight comes as DeFi’s economic footprint grows. The sector’s Total Value Locked (TVL) reached $86.6 billion this year, marking an 85% increase since 2023. However, this wealth is highly concentrated, with the top 12 protocols controlling over 60% of the market’s total assets. This concentration of power simplifies the task for regulators but complicates the industry’s narrative of total decentralization.

Despite the FATF’s clear stance, global implementation remains sluggish. A survey conducted by the organization revealed that 93% of responding jurisdictions have yet to apply these standards to DeFi arrangements. Only 26 out of 142 countries have even conducted a risk assessment of the sector. This regulatory vacuum is a primary concern for the FATF, as countries that fail to adopt these measures risk being placed on the “grey list,” a move that can severely restrict a nation’s access to international capital markets and damage its credit rating.

The urgency of the report is underscored by the rise in sophisticated cybercrime. The FATF specifically highlighted the activities of North Korean state-linked hackers, who have increasingly targeted DeFi protocols to fund the regime’s weapons programs. In April alone, hackers linked to the Lazarus Group were allegedly responsible for two massive exploits: a $285 million drain of the Solana-based Drift Protocol and a $292 million attack on KelpDAO. These two incidents accounted for roughly 76% of all crypto-hacking losses recorded so far this year.

FATF President Giles Thomson emphasized that while the goal is to support “responsible financial innovation,” the priority remains preventing criminals from using new technologies to launder illicit funds. The report suggests that if a platform refuses to cooperate with regulators, jurisdictions should consider banning it entirely as a last resort.

This regulatory shift mirrors recent legal actions in the United States. The U.S. Department of Justice has successfully prosecuted developers behind privacy-focused tools, such as the co-founders of Bitcoin mixer Samourai Wallet and Roman Storm of Tornado Cash. These cases established a legal precedent that building and maintaining code used for financial transactions can be treated as operating an unlicensed money-transmitting business.

For protocols that lack a clear human controller, the FATF advises regulators to target “choke points.” These include stablecoin issuers who have the technical ability to freeze assets, centralized exchanges that provide the necessary on-ramps for fiat currency, and the operators of the front-end websites that allow users to interact with the underlying smart contracts.