Country Comparison Tables

Introduction

This analysis synthesizes verified data from 27 jurisdiction profiles and 8 guidance documents to produce seven side-by-side comparison tables covering the full regulatory landscape for decentralized finance. The tables cover legal status and institutional design, classification frameworks, liability and DAO treatment, licensing requirements, taxation, AML/KYC compliance, and enforcement outcomes.

The jurisdictions studied span a spectrum of regulatory archetypes. The

United States,

European Union, and

United Kingdom represent major financial centres applying existing law to DeFi activities.

Singapore,

Japan,

Hong Kong,

India, and

Thailand reflect Asia-Pacific models ranging from restrictive to sandbox-based.

Switzerland,

Germany,

Malta,

Liechtenstein, and

Estonia exemplify bespoke infrastructure law and MiCA implementation.

France applies the EU framework with distinctive tax treatment.

South Korea and

Australia represent jurisdictions in active regulatory transition. The

UAE has pioneered DeFi-specific licensing.

Canada,

Brazil,

South Africa, and

Nigeria apply cautious extensions of existing law. The

Cayman Islands,

Bermuda, British Virgin Islands, Marshall Islands, and Seychelles function as offshore hubs for DAO legal wrappers and VASP licensing.

El Salvador operates a purpose-built issuer/DASP registration regime.

All data is current as of June 2026. Cells marked "NO DATA" or "NOT VERIFIED" indicate that verified information was not available in the research corpus. Cells marked "N/A" indicate the category does not apply to the jurisdiction.

How to Read These Tables

Each table addresses a distinct regulatory dimension. Tables 1-2 cover the foundational questions of legal status and classification. Table 3 addresses the urgent liability and DAO governance questions that have been reshaped by landmark cases in 2024-2025. Table 4 provides the practical licensing data that protocol operators need for market entry decisions. Table 5 maps the tax landscape that drives capital allocation. Table 6 covers AML/KYC obligations that affect every DeFi participant. Table 7 documents enforcement actions that establish precedent and signal regulatory priorities.

Each table is followed by analytical notes highlighting the most significant patterns, outliers, and policy implications identified during cross-jurisdictional comparison. The Key Takeaways section at the end distills the most consequential findings. The Jurisdiction Archetypes Summary groups all 27 jurisdictions into models based on their observed regulatory philosophy.

Within each table, jurisdictions are grouped by region in a consistent order: the Americas (United States, Canada, Brazil, Cayman Islands, Bermuda, El Salvador, British Virgin Islands), Asia-Pacific (Marshall Islands, Australia, Hong Kong, Japan, Singapore, South Korea, India, Thailand), Europe (European Union, France, Germany, Switzerland, United Kingdom, Malta, Liechtenstein, Estonia), and the Middle East & Africa (UAE, South Africa, Nigeria, Seychelles).

Table 1: Legal Status & Institutional Design

Table 1 Notes:

• The UAE and the Marshall Islands operate the only purpose-built DeFi-specific instruments. The UAE's VARA DeFi Limited License (first granted to MANTRA in February 2025) regulates protocol operators; the Marshall Islands' DAO LLC (effective November 2022) is the world-first statutory DAO entity form. Bermuda has licensed a DAO-governed exchange (DerivaDEX, launched February 2026) under its DABA regime, and El Salvador and Seychelles channel activity through purpose-built issuer/VASP registration.
• DeFi is legal in all 27 jurisdictions. No studied jurisdiction has imposed a blanket ban on DeFi activity, though South Korea, Thailand, and Singapore restrict or prohibit retail access to certain DeFi services (lending, staking, yield products).
• Regulatory timelines vary by more than a decade: the US, Japan, and Estonia were regulating crypto in 2016-2017, while Seychelles (2024) and the Marshall Islands' financial-supervision track (2025) are the newest entrants. This variation in maturity directly affects the depth and specificity of DeFi treatment.
• Multi-regulator fragmentation is highest in the US (SEC, CFTC, FinCEN, 49 state regulators), Canada (CSA with 13 provincial regulators plus FINTRAC), the UAE (VARA, ADGM FSRA, DIFC DFSA, federal CMA, CBUAE), and South Africa (FSCA, SARB, FIC, SARS, IFWG). This fragmentation increases compliance costs and creates jurisdictional ambiguity for DeFi protocols.

Table 2: Legal Classification & Decentralisation Tests

Table 2 Notes:

• The "front-end liability" model is now the de facto global standard: even where underlying protocols are deemed decentralised, the entity operating the user-facing interface may still face regulatory obligations. This is explicitly the case in the EU, UK, Singapore, Hong Kong, France, Switzerland, the Cayman Islands, BVI, Bermuda, Malta, Liechtenstein, Estonia, South Africa, and Seychelles — the dominant pattern across the dataset.
• Only a handful of jurisdictions articulate any formal multi-factor decentralisation test: the EU (ESMA's four-layer assessment under MiCA Recital 22), the UK (a three-factor controlling-person test: concentrated token governance, core-team treasury management, off-chain coordination), and Switzerland (genuinely decentralised vs "organised and controlled"). The US applies a "sufficient decentralization" spectrum without statutory definition; South Africa and France frame decentralisation as a spectrum/sliding scale. None has established a bright-line threshold.
• Governance token classification remains the most contested area globally and is unresolved in most jurisdictions (marked NOT VERIFIED / NO DATA for Brazil, El Salvador, Germany, India, Thailand, Malta, Estonia, Nigeria, and Seychelles). The clearer treatments diverge sharply: the US's March 2026 "digital tools" carve-out generally excludes governance tokens from securities; the UK treats them as third-category personal property under the Property Act 2025; the Marshall Islands exempts no-economic-rights governance tokens by statute; and Japan can classify them as Type I or Type II securities under FIEA.
• No jurisdiction has resolved the treatment of non-custodial DeFi lending. The closest contested precedent remains Australia's Block Earner case (heard by the High Court 12 March 2026, judgment reserved). Thailand and South Korea have moved in the opposite direction, prohibiting exchange-offered lending/staking yield products outright rather than classifying them.

Table 3: Liability & DAO Legal Status

Table 3 Notes:

• The 2024-2025 period produced developments that fundamentally reshaped DAO liability: (1) Samuels v. Lido DAO (December 2024) established that governance participation can create general partnership liability in the US; (2) the EU Product Liability Directive 2024/2853 classified software as a "product" subject to strict liability (transposition deadline 9 December 2026); and (3) Roman Storm's conviction on unlicensed money transmission (August 2025, with a hung jury on the money-laundering and sanctions counts, and the Rule 29 acquittal motion still undecided) confirmed that DeFi developers face criminal exposure.
• The Cayman Islands Foundation Company remains the dominant global DAO wrapper (1,300+ registrations at end-2024 with 70% year-on-year growth, plus 400+ more in 2025, and approximately USD 10 billion in combined assets). Competing purpose-built statutory forms have now emerged: the Marshall Islands DAO LLC (full statutory personhood and a member-liability shield) and Japan's godo kaisha DAO (limited liability via the April 2024 ordinance). Swiss Foundations anchor most major Layer-1 treasuries (Ethereum, Cardano, Solana, Polkadot, Aave, dYdX, Tezos, NEAR, Cosmos).
• Only four jurisdictions have enacted DAO-specific entity legislation conferring or restructuring liability: the US states (Wyoming, Utah, Tennessee, Vermont), the Marshall Islands (DAO Act 2022 and amendments), Japan (FSA ordinance 2024), and — via foundation/establishment forms used as de facto wrappers — the Cayman Islands, Switzerland, and Liechtenstein. The UK Law Commission and most other jurisdictions explicitly declined to legislate, leaving DAOs to default into general partnership or unincorporated-association status.
• In the great majority of jurisdictions an unwrapped DAO defaults to general/de facto partnership with unlimited personal liability: GbR in Germany, société de fait in France, sociedade em comum in Brazil, simple partnership in Liechtenstein, and association-of-persons in India. Estonia is the starkest articulation — e-Residency guidance states that any member who has ever voted can be held fully liable. South Africa, Nigeria, Thailand, El Salvador, and Seychelles have no judicial determination at all (NO DATA FOUND), leaving the question open.

Table 4: Licensing/Registration Requirements

Table 4 Notes:

• Capital requirements span five orders of magnitude: from $0 (US FinCEN MSB, Australia AUSTRAC DCE, Marshall Islands DAO LLC) and USD 2,000 (El Salvador statutory minimum) to ₦500 million (Nigeria VASP, ~USD 330K), Hong Kong's HKD 5 million VATP, and Brazil's R$37.2 million (~USD 6.2M) SPSAV. The cheapest meaningful CASP licence is the EU MiCA Tier 1 at €50,000; the most demanding combine high capital with substance requirements (Nigeria, Thailand, Brazil, Hong Kong).
• MiCA passporting remains the single largest structural advantage in global DeFi licensing. A single CASP authorisation in any EU member state grants access to all 27 EU member states (and the EEA via Liechtenstein's MiCAR route). This now spans seven studied EU/EEA jurisdictions — the EU bloc, France, Germany, Malta, Estonia, plus Liechtenstein (after MiCAR CASP authorisation). No non-EU/EEA jurisdiction offers equivalent cross-border access; Switzerland, the UK, the UAE, and all the offshore hubs are explicitly non-passporting.
• The offshore VASP/wrapper jurisdictions (Cayman, BVI, Bermuda, Marshall Islands, Seychelles) cluster around USD 100,000-level capital floors plus substance requirements, with the Marshall Islands and Cayman offering low-cost, fast entity formation (DAO LLC from USD 9,500, ~3 weeks; Cayman Foundation 1-2 months). These complement rather than replace the licensing regimes of larger jurisdictions.
• Several jurisdictions still report no licensed-firm count for DeFi-specific activity (NOT VERIFIED for Brazil, Marshall Islands, Australia, Estonia), and several others (South Korea, India, Nigeria, Seychelles) report active centralized-VASP populations but no DeFi-protocol registrant at all — underscoring that licensing infrastructure exists largely for custodial intermediaries, not for protocols.

Table 5: Taxation

Table 5 Notes:

• Eight jurisdictions impose zero personal tax on DeFi gains: the Cayman Islands, Bermuda, BVI, and Seychelles (no general crypto tax system), the UAE and Hong Kong (no personal income/CGT), El Salvador (0% for LEAD-registered activity), and Singapore (no CGT; de minimis exemption for yield under S$300/year). Switzerland exempts capital gains for private investors but still taxes yield as income. The Marshall Islands' 3% Gross Revenue Tax on for-profit DAO LLCs is the lowest positive rate, and it explicitly excludes capital gains.
• The "income at receipt" versus "disposal only" divide remains the most consequential structural difference. The US, Australia, Canada, Brazil, Germany, Switzerland, South Africa, and Estonia treat staking/yield rewards as income at fair market value on receipt, while France taxes only upon fiat conversion (crypto-to-crypto is non-taxable) and Switzerland exempts private capital gains entirely. The same yield-farming transaction can produce zero tax in France (absent fiat conversion) but a marginal-rate income hit in the US, Germany, or South Africa.
• India is the dataset's outlier on punitiveness: a 30% flat tax on VDA gains with a 1% TDS, no holding-period distinction, no loss set-off or carry-forward, and gifts taxable to the recipient. Japan's two-tier system (55.945% on DeFi yields vs 20.315% for "Specified Crypto Assets" on registered exchanges, operative ~2027) continues to push DeFi activity offshore, since DeFi yields are excluded from the reduced rate.
• The UK's proposed No Gain/No Loss (NGNL) regime for DeFi lending/staking/LP remains the most innovative tax design in the dataset but is still not enacted as of June 2026. Estonia adds a notable asymmetry — losses incurred on non-MiCA-authorised platforms are not deductible, a deliberate channelling incentive toward licensed venues. Thailand's capital-gains PIT exemption (2025-2029, via licensed operators only) is the most generous time-limited incentive but expressly excludes off-chain/DeFi gains.
• CARF/DAC8 implementation is now broadly synchronised on a 1 January 2026 data-collection start across the EU bloc (the EU, France, Germany, Malta, Estonia), the UK, Canada, the Cayman Islands, Japan, India, and South Africa (1 March 2026), with first exchanges generally in 2027. Notable laggards or non-commitments: Switzerland deferred crypto provisions out of 2026, Hong Kong and Singapore target 2028, and Bermuda, El Salvador, the Marshall Islands, the UAE, and Seychelles have no verified CARF commencement date.

Table 6: AML/KYC & Compliance

Table 6 Notes:

• All 27 jurisdictions apply AML obligations to DeFi through some mechanism, but the trigger varies: operator/MSB-based (US — BSA applies if an identifiable MSB), licence-based (EU, Singapore, Malta, the UAE — obligations attach to authorised CASPs/DPT providers), and registration-based (UK, Japan, BVI, Liechtenstein, Seychelles — obligations attach upon registration). The recurring consequence across every jurisdiction is that truly decentralised protocols with no identifiable operator fall outside AML obligations — explicitly described as a "gap" in the EU, Brazil, Hong Kong, India, Cayman, Nigeria, and South Africa.
• Travel Rule thresholds remain inconsistent globally: zero threshold in Japan, Singapore (since 2020), the EU/Malta (CASP-to-CASP), and South Korea (domestic); USD 1,000-equivalent in BVI, Hong Kong, Liechtenstein, and El Salvador (proposed); CAD 1,000 in Canada; AED 3,500 (~USD 950) in the UAE; USD 3,000 in the US; CHF 0/1,000 in Switzerland; and ~R25,000 in South Africa. Australia's mandate begins 1 July 2026 (tranche 2) and Brazil's phases in through February 2028.
• Unhosted wallet treatment is the sharpest point of divergence: the EU, Malta, and Germany impose the most restrictive approach (EUR 1,000 enhanced CDD; anonymous wallets prohibited under AMLR Art 79; Germany's GwG §15a stricter than the EU minimum), while the US (single-signature self-custody not money transmission), BVI (non-custodial providers expressly excluded), and the UK (Travel Rule data not mandatory for unhosted transfers) maintain permissive stances. Most offshore and emerging-market jurisdictions leave the question NOT VERIFIED.
• The Tornado Cash sanctions saga established a critical legal principle that constrains every jurisdiction: immutable smart contracts deployed on public blockchains cannot be designated as sanctioned property (Van Loon v. Treasury, Fifth Circuit, November 2024; OFAC delisted Tornado Cash 21 March 2025). The EU has since moved in the opposite direction at the sectoral level — its 23 April 2026 20th sanctions package imposes a total ban on Russia-established crypto transfer/exchange platforms and the RUBx token, illustrating that mutable platforms with identifiable operators remain fully sanctionable. The UK designated Huobi (HTX) under its Russia regime on 26 May 2026, its first crypto-exchange designation.

Table 7: Enforcement & Outcomes

Table 7 Notes:

• DeFi-specific enforcement remains concentrated in a small set of jurisdictions: the United States (Ooki DAO, Tornado Cash/Roman Storm, Mango Markets), the EU/Germany (Ethena GmbH) and the Netherlands (Pertsev conviction), South Korea (first pump-and-dump prosecution under VAUPA), and — adjacently — Australia (Block Earner). The large majority of the 27 jurisdictions have produced no DeFi-protocol- or DAO-specific enforcement at all; the recurring corpus phrase is "NO DATA FOUND" / "no DeFi-specific action" (Brazil, Cayman, Bermuda, El Salvador, BVI, Marshall Islands, Japan, India, Thailand, France, Switzerland, UK, Malta, Liechtenstein, Estonia, Nigeria, Seychelles).
• US enforcement outcomes have been mixed and the posture has reversed. The CFTC's Ooki DAO action succeeded (default judgment, $643,542), but the Mango Markets conviction was overturned (May 2025), major SEC cases (Coinbase, Binance, Ripple) were dismissed in 2025, and Roman Storm's trial produced only a conviction on unlicensed money transmission with a hung jury on money-laundering and sanctions. The DOJ disbanded its crypto enforcement team and pivoted to a fraud-only focus in 2025-26.
• Where enforcement does occur, it overwhelmingly targets centralized chokepoints rather than protocols. Canada (Xeltox CAD 176.9M, 23 MSB revocations), India (Binance, Bybit), Nigeria (Binance executives detained), Thailand (offshore-exchange blocking), Hong Kong (JPEX), South Korea (Korbit), and Estonia (mass VASP revocations, 2,000+ to 100 licences) all illustrate the same pattern: aggressive action against exchanges and unregistered VASPs, none against decentralized protocols.
• Enforcement intensity does not correlate with DeFi activity level. The Cayman Islands, BVI, Bermuda, Marshall Islands, and Seychelles host high DeFi-adjacent activity (as wrapper/VASP jurisdictions) but produce essentially zero DeFi enforcement. Switzerland and the UK report "high"/"rising" activity with no DeFi-specific actions. Many jurisdictions are deferring enforcement until clearer frameworks commence (UK Oct 2027, EU's Article 142 calibration, Brazil's October 2026 prohibition deadline).
• The criminal-prosecution vector remains the most consequential for individuals. Roman Storm's conviction (unlicensed money transmission) and Alexey Pertsev's 64-month sentence (money laundering, appeal pending) establish that DeFi developers face personal criminal exposure in both the US and EU. Bermuda's DABA regime carries criminal exposure up to US$250,000 and 5 years, the BVI up to US$100,000 and 5 years, and Seychelles up to USD 350,000 and 15 years for unlicensed VA business — though none has yet been applied to a DeFi protocol.

Key Takeaways

Regulatory model spectrum. The 27 jurisdictions cluster across a spectrum from "no-framework/vacuum with enforcement overlay" (South Korea) and "enforcement-first / extension-of-existing" (US, Canada, Germany, India, Estonia) through "extension-of-existing" (Hong Kong, Japan, France, South Africa) and "comprehensive-with-carve-out" (EU, Brazil, Australia, UK, Malta, Thailand, BVI, Nigeria) to "DeFi-specific licensing" (El Salvador, Seychelles) and "innovation-first/sandbox" (Cayman, Bermuda, Singapore, Switzerland, Liechtenstein, Marshall Islands, UAE). The activity-based extension and comprehensive-with-carve-out models dominate, but only the UAE and the Marshall Islands operate genuinely DeFi/DAO-specific statutory instruments.

Liability gap. Only four jurisdictions have enacted DAO-specific entity legislation (US states, the Marshall Islands, Japan, plus the foundation/establishment forms of Cayman, Switzerland, and Liechtenstein used as de facto wrappers). In the great majority, unwrapped DAOs default to general/de facto partnership with unlimited personal liability (GbR in Germany, société de fait in France, sociedade em comum in Brazil, simple partnership in Liechtenstein, association-of-persons in India), and several jurisdictions (South Africa, Nigeria, Thailand, El Salvador, Seychelles) have no judicial determination at all. The Cayman Islands Foundation Company (1,300+ registrations, ~USD 10 billion in assets) remains the dominant workaround, now joined by the purpose-built Marshall Islands DAO LLC.

Tax competition. Effective maximum rates range from 0% (Cayman, Bermuda, BVI, Seychelles, UAE, Hong Kong, El Salvador, and Singapore for personal investors), through the Marshall Islands' 3% GRT and Liechtenstein's 12.5% corporate flat, up to 55.945% (Japan's current miscellaneous-income regime) and India's punitive 30% flat + 1% TDS with no loss offset. A competitive equilibrium persists in the 17.5-31.4% band (Brazil, Singapore corporate, France PFU, South Korea proposed). The UK's unenacted NGNL regime and France's fiat-off-ramp-only model remain the most distinctive behavioural designs.

Enforcement asymmetry. The US has produced the most DeFi enforcement actions globally, but outcomes are mixed (Ooki DAO succeeded; Mango Markets overturned; major SEC cases dismissed; Roman Storm a split verdict) and the posture reversed to fraud-only in 2025-26. The EU's MiCA enforcement (Ethena, cumulative fines >€540m) is more predictable. Most of the 27 jurisdictions have produced zero DeFi-protocol-specific enforcement, and where action occurs it targets centralized exchanges and unregistered VASPs, not protocols.

AML convergence with a persistent decentralisation gap. All 27 jurisdictions apply AML to DeFi through some trigger (MSB/operator, licence, or registration), but implementation ranges from permissive (US single-signature self-custody not money transmission; BVI excludes non-custodial providers) to restrictive (EU/Malta ban anonymous wallets; Germany's GwG §15a exceeds the EU minimum). The universal feature is that protocols with no identifiable operator fall outside the obliged-entity perimeter — an explicit "gap" in the EU, Brazil, Hong Kong, India, Cayman, Nigeria, and South Africa. CARF/DAC8 reporting is now broadly synchronised on a 1 January 2026 start across the EU bloc, the UK, Canada, Cayman, Japan, India, and South Africa.

Licensing cost and passporting disparity. First-year regulatory costs range from effectively $0 (US FinCEN MSB, Australia AUSTRAC DCE) and USD 2,000 (El Salvador) to ₦500 million (Nigeria VASP), Hong Kong's HKD 5 million VATP, and Brazil's ~USD 6.2 million SPSAV. The EU MiCA CASP at €50,000-150,000 with passporting to all 27 EU member states (plus EEA via Liechtenstein's MiCAR route) remains the best value for cross-border operations and the only passporting regime in the dataset; Switzerland, the UK, the UAE, and all offshore hubs are explicitly non-passporting.

Classification gap. No jurisdiction has resolved the fundamental classification question for non-custodial DeFi protocols. The US applies a "sufficient decentralization" spectrum (now layered with the March 2026 token taxonomy) without a statutory threshold; the EU exempts "fully decentralised" services under a four-layer test but has not defined the line; the UK uses a three-factor controlling-person test. Governance token classification is unresolved (NOT VERIFIED / NO DATA) in roughly a third of jurisdictions, with the clearest treatments diverging sharply between the US "digital tools" carve-out, the UK's personal-property categorisation, and Japan's FIEA securities classification.

DAO legal infrastructure deficit and offshore concentration. The gap between DAO economic activity and legal infrastructure remains the most significant finding. Protocols managing billions of dollars operate under frameworks designed for 19th-century general partnerships, and the viable purpose-built solutions are concentrated in a handful of small jurisdictions — the Cayman Foundation Company, the Marshall Islands DAO LLC, Swiss and Liechtenstein foundations, Japan's godo kaisha, and the US state DAO LLCs. Regulators in major financial centres (EU, UK, Germany, France, Singapore, South Africa, India) continue to face a policy choice: develop domestic DAO legal entities or watch governance structures migrate offshore.

Methodology Notes

Data sourcing. All table entries are derived from the 27 jurisdiction profiles and Phase 2 guidance documents produced during this research. No new claims are introduced in the tables; all data points are cross-referenced against primary sources cited in the underlying documents.

Currency conversions. Where multiple currencies appear, approximate USD equivalents are provided in parentheses for comparability. Exchange rates reflect approximate 2026 values and are indicative only.

"NO DATA" / "NOT VERIFIED" entries. Where a cell contains "NO DATA" or "NOT VERIFIED," this means the research corpus did not contain verified information for that specific dimension in that jurisdiction. It does not necessarily mean the jurisdiction has no policy on the topic — only that it was not captured in the studied sources.

Temporal scope. All data reflects the regulatory state as of June 2026. Several jurisdictions have pending legislation or consultations that may materially change the picture within 12-18 months, including: the EU's Article 142 review and 20 May 2026 MiCA consultation, the UK's FSMA regime (commences 25 October 2027), Japan's PSA-to-FIEA migration (Cabinet-approved April 2026), Australia's Digital Assets Framework Act 2026 (commences 9 April 2027), Brazil's SPSAV compliance deadline (October 2026), South Korea's deferred crypto tax (2027), and the EU/EEA MiCA transitional sunset (1 July 2026, affecting Malta, Liechtenstein, and Estonia).

Jurisdiction Archetypes Summary

Based on the seven comparison tables, the 27 jurisdictions cluster into archetypes that reflect fundamentally different philosophies toward DeFi:

Archetype 1: No-Framework / Vacuum (South Korea). Virtual-asset trading is regulated via VAUPA, but DeFi has no licensing pathway and lending/staking/yield are effectively prohibited in practice, leaving DeFi in a regulatory vacuum overlaid with aggressive enforcement.

Archetype 2: Enforcement-First / Extension-of-Existing (United States, Canada, Germany, India, Estonia). Characterized by applying pre-existing securities/commodities/AML statutes and active enforcement against centralized gateways rather than bespoke DeFi rules. The US's March 2026 SEC-CFTC taxonomy signals a partial pivot; Germany runs the EU's strictest "compliance-first" KWG regime; India governs negatively via a punitive VDA tax and PMLA registration; Estonia moved from permissive VASP haven to AML-driven crackdown (2,000+ to ~100 licences).

Archetype 3: Extension-of-Existing (Hong Kong, Japan, France, South Africa). Characterized by extending existing licensing case-by-case under "same business, same risk" principles. Hong Kong adds activity-specific VASP verticals; Japan transitions from PSA to FIEA with a pioneering DAO LLC carve-out; France extends PACTE into MiCA CASP; South Africa declared crypto a "financial product" under FAIS/FICA.

Archetype 4: Comprehensive-with-Carve-Out (European Union, Brazil, Australia, United Kingdom, Malta, Thailand, British Virgin Islands, Nigeria). Characterized by comprehensive statutory licensing regimes that explicitly carve out genuinely decentralised, operator-less activity. MiCA (and its Maltese implementation) carves out "fully decentralised" services via Recital 22; the UK's regime covers staking/lending/custody with a "truly decentralised" controlling-person test; Australia's Digital Assets Framework Act extends AFSL platform-wide; Thailand channels activity into licensed venues while banning staking/lending; the BVI and Nigeria carve out sole token issuance / non-custodial protocols from their VASP regimes.

Archetype 5: DeFi-Specific / Issuer-DASP Licensing (El Salvador, Seychelles). Characterized by purpose-built registration regimes channelling regulation to registered issuers/DASPs/VASPs. El Salvador's LEAD regime attaches to issuers and DASPs (permissive-by-omission for genuinely decentralised activity); Seychelles' substance-demanding VASP Act 2024 reaches DeFi-style activity conducted by an identifiable local operator, with mining and mixer bans.

Archetype 6: Innovation-First / Sandbox (Cayman Islands, Bermuda, Singapore, Switzerland, Liechtenstein, Marshall Islands, UAE). Characterized by facilitative legal environments that leave genuinely decentralised activity largely unregulated while offering purpose-built entity or licensing infrastructure. The Cayman Foundation Company and Marshall Islands DAO LLC provide global-standard DAO wrappers; Switzerland's DLT Act and Liechtenstein's Token Container Model leave decentralised protocols unlicensed; Singapore pairs activity-based regulation with the Project Guardian institutional sandbox; Bermuda offers a graduated T→M→F sandbox plus a world-first DAO-governed exchange licence; and the UAE issued the world's first DeFi-specific operating licence (VARA, February 2025).

Cross-Reference to Guidance Documents

The data in these tables is drawn from and can be validated against the following guidance documents:

• Table 1 (Legal Status): See "DeFi Protocol-Specific Regulation" (Section 1: Global Landscape by Protocol Type) and "Legal Classification of DeFi Protocols" (Section 1: Global Landscape: Classification Models) for underlying analysis.
• Table 2 (Classification): See "Legal Classification of DeFi Protocols" (all sections) for the classification models and their application across jurisdictions.
• Table 3 (Liability): See "DeFi Liability Allocation Frameworks" (Section 1: Six Liability Models) and "DAO Governance & Legal Status" (Section 1: Global Landscape of DAO Legal Treatment) for case law and legislative analysis.
• Table 4 (Licensing): See "DeFi Licensing Frameworks" (Section 2: Jurisdiction Comparison Table) for the full comparison and arbitrage analysis.
• Table 5 (Taxation): See "DeFi Taxation Frameworks" (Section 2: Comparative Analysis) for the jurisdiction-by-jurisdiction tax treatment matrix and CARF implementation timeline.
• Table 6 (AML/KYC): See "DeFi Compliance & Enforcement" (Sections 1-2) for AML framework comparison, Travel Rule implementation details, and unhosted wallet treatment.
• Table 7 (Enforcement): See "DeFi Compliance & Enforcement" (Section 3: Enforcement Case Analysis) for detailed case summaries including citations to primary legal sources.

Individual jurisdiction profiles in the regulations/ directory provide the full primary-source citations, legislative text references, and regulatory history for each of the 27 jurisdictions. The guidance documents in the guidance-document/ directory provide the thematic cross-jurisdictional analysis from which these tables are synthesized.

Limitations

These tables necessarily compress complex regulatory regimes into single-cell summaries. Several important caveats apply:

1. Sub-national variation. The US (50 states), Canada (13 provinces/territories), the UAE (multiple free zones — VARA, ADGM, DIFC, federal CMA), and Switzerland (26 cantons) each contain significant internal regulatory variation that cannot be fully captured in a single jurisdiction row.
2. Temporal lag. Several jurisdictions have pending legislation or live consultations that may materially change entries within months of publication. The UK FSMA regime (October 2027), Australia's Digital Assets Framework Act (April 2027), Japan's FIEA migration, the EU's Article 142 review and MiCA consultation, Brazil's October 2026 prohibition deadline, and the 1 July 2026 EU/EEA MiCA transitional sunset (Malta, Liechtenstein, Estonia) are the most likely to produce near-term changes.
3. Enforcement data incompleteness. Some jurisdictions may have taken informal supervisory actions (warnings, remediation orders) that are not publicly reported and therefore not captured in Table 7. Many cells are marked "NO DATA FOUND" specifically to flag the absence of verified DeFi-protocol-specific action.
4. Tax treatment complexity. Table 5 captures headline rates and broad treatment categories but cannot reflect the full complexity of tax interactions (e.g., deductibility of losses, treatment of wrapped tokens, impermanent loss, or impact of double taxation treaties on cross-border DeFi income).
5. Offshore substance requirements. For the wrapper/VASP hubs (Cayman, BVI, Bermuda, Marshall Islands, Seychelles), the headline capital and fee figures understate the economic-substance, resident-director, and local-presence requirements that materially affect the true cost and feasibility of establishment.