FATF Launches DeFi Control Test to Define Regulatory Scope for Protocols

FATF published its latest report on DeFi oversight on July 21, 2026, introducing a formal "DeFi Control Test" built around the concept of "control or sufficient influence." The framework updates the body's 2021 virtual asset guidance and tells national regulators exactly which levers to pull when a protocol claims decentralization. For DeFi builders and governance-token holders, the regulatory perimeter just got a measurable boundary.

Control, Not Code

The test is deliberately functional. FATF makes clear that open-source contracts, permissionless blockchains and autonomous execution do not exempt a protocol from AML/CFT obligations. What matters is whether an identifiable natural or legal person exercises control or sufficient influence over the arrangement — and that person then qualifies as a VASP if they conduct exchanges, transfers, custody or other covered activities.

A smart contract itself is not a VASP. The individuals controlling the protocol, its governance or its access points carry the obligation.

The report explicitly warns that marketing language is irrelevant. A project can brand itself "fully decentralized" while retaining centralized control through developers, investors, administrators or governance-token holders.

Three-Tier Classification

FATF sorts DeFi arrangements into three buckets:

• Centralized with identifiable controllers. Protocols where admins, developers, funders or governance-token holders hold meaningful decision-making authority. These fall squarely within the FATF Standards — full regulatory compliance expected.
• Centralized in practice, controllers obscured. Pseudonymity, layered ownership or distributed governance make it hard to pin down who runs the show. Still within scope, but enforcement is acknowledged as difficult. Jurisdictions are advised to treat these as effectively unregulated and apply risk-mitigation measures used for truly decentralized systems.
• Genuinely decentralized. Not explicitly labeled as exempt, but the implication is clear — if no person or entity exercises sufficient influence, the VASP framework does not attach.

Indicators of control cited in the report are non-exhaustive. Authorities must assess governance, operational and economic structure case by case — no rigid checklist.

Yield Sustainability Verdict

For DeFi protocols, this is a structural risk recalibration. Teams that relied on legal ambiguity around "decentralized" branding now face a testable standard. Governance-token holders with veto power, multisig key holders and core contributors with upgrade authority are all potential VASP-designees under this framework.

The practical drawdown: protocols with concentrated governance face compliance costs and jurisdictional risk that will compress risk-adjusted yields for liquidity providers. Protocols with genuinely distributed control — hard to find in practice — gain a competitive moat on the regulatory arbitrage layer.

Track national transposition timelines. FATF guidance is non-binding but sets the de facto global baseline; jurisdictions that move first will set the compliance floor for cross-border DeFi activity.