On 21 July 2026, the Financial Action Task Force (FATF) issued a targeted report on the regulatory challenges from decentralised finance (DeFi).

Background

In 2019, the FATF updated Recommendation15 and extended the application of the FATF Standards to virtual assets (VAs) and virtual asset service providers (VASPs). In 2021 the FATF issued guidance on VAs and VASPs.

This targeted report updates and complements the FATF’s previous analysis of DeFi, as set out in the 2021 FATF guidance on VAs and VASPs, in light of the sector’s substantial expansion and evolution since the publication of that guidance. 

The targeted report has three objectives:

  • Identify emerging money laundering, terrorist financing and proliferation financing risks and vulnerabilities within the DeFi ecosystem. 
  • Clarify how the FATF Standards apply to DeFi arrangements and outline good practices and practical tools that jurisdictions may adopt to identify, regulate, supervise and investigate DeFi arrangements that fall within the scope of the FATF framework. 
  • Present criteria that jurisdictions may use in a risk-based manner to identify controllers or persons exercising sufficient influence over DeFi arrangements. 

Highlights

The targeted report highlights that almost 93% of the reporting jurisdictions (132 of 143) that responded to a survey on the implementation of Recommendation 15 have not yet implemented the FATF Standards in relation to qualifying DeFi arrangements, and just two of 142 jurisdictions have actually licensed or registered a DeFi arrangement in practice.

The 2021 FATF guidance on VAs and VASPs clarifies that DeFi arrangements fall within the scope of Recommendation 15 where a natural or legal person exercises control or sufficient influence over the arrangement. Although many arrangements present themselves as decentralised in terms of governance, the targeted report finds that centralised elements frequently persist in practice, including through governance token concentration, administrative privileges, control over upgrades, significant economic benefits, and influence over development and infrastructure. The targeted report also identifies a non-exhaustive set of on-chain and off-chain indicators that can support jurisdictions in determining whether such control exists.

Based on governance and control structures, the targeted report distinguishes three broad categories of DeFi arrangements: (i) those with identifiable controllers (“centralised”); (ii) those that are centralised in practice but where controllers cannot be readily identified; and (iii) those that are truly decentralised. The FATF Standards apply to the first two categories.

Recommendations

The targeted report sets out recommendations for both jurisdictions and the private sector as regards mitigating the risk stemming from DeFi arrangements.