What Works & What Doesn't

Purpose

This analysis synthesizes findings from 27 jurisdiction profiles, 6 guidance documents, and 4 international framework assessments to identify which DeFi regulatory approaches produce measurable positive outcomes and which have demonstrably failed. Every claim is grounded in verified data from this repository. Where evidence is absent or ambiguous, the entry states "No data" or "Not verified" rather than speculating.

What Clearly Doesn't Work

1. Regulation by enforcement without clear rules

Jurisdiction:

United States (2021-2024)

The SEC under Chair Gensler brought 100+ crypto enforcement actions and issued Wells notices to at least 13 crypto companies in 2024 alone, including

Uniswap Labs. The CFTC pursued entity-level liability against Ooki DAO. OFAC sanctioned Tornado Cash smart contracts. The DOJ prosecuted Tornado Cash developer Roman Storm.

Outcome: DeFi activity moved offshore. No legal clarity was produced for developers. The SEC closed its Uniswap investigation in February 2025 without action. The SEC dismissed the Coinbase, Binance, and Ripple cases under the new administration. Van Loon v. Treasury (Nov 2024) held immutable smart contracts are not "property," and OFAC delisted Tornado Cash on 21 March 2025. The 2025-2026 administration reversed nearly all enforcement positions -- demonstrating that enforcement-only approaches produce no durable legal infrastructure.

Evidence:

US jurisdiction profile, Sections 8 and 10.

2. No licensing pathway for DeFi (de facto prohibition)

Jurisdictions:

South Korea,

Thailand

South Korea's VAUPA (effective July 2024) regulates centralized VASPs but provides no registration or licensing mechanism for DeFi protocols. The FSC has stated that entities controlling DeFi platforms fall within regulatory scope, but no pathway exists for them to comply. DeFi lending, staking, and yield farming are effectively prohibited in practice. Real-name banking — required of the five exchanges with banking partnerships (Upbit, Bithumb, Coinone, Korbit, Gopax) — structurally prevents permissionless DeFi from operating AML-compliant services.

Thailand reaches the same outcome through an explicit statutory prohibition rather than a vacuum: under the Emergency Decree on Digital Asset Businesses B.E. 2561, licensed operators are barred from providing deposit-taking, lending, or staking-yield products, foreclosing centralized DeFi-as-a-service. The regime channels permitted activity into seven licensed categories while permissionless DeFi remains undefined.

Outcome: Korean and Thai retail investors access offshore DeFi protocols without consumer protection. The regulatory grey zone (Korea) or yield-product ban (Thailand) produces the worst of both outcomes: no domestic DeFi industry and no user protection for offshore activity.

Evidence:

South Korea jurisdiction profile, Sections 1 and 2;

Thailand jurisdiction profile, Sections 1 and 2.

3. Punitive taxation of DeFi yields

Jurisdictions:

Japan,

India

Japan's current tax regime classifies all individual crypto gains -- including DeFi yields -- as "miscellaneous income" subject to progressive rates up to approximately 55.945% (national + 10% local inhabitant tax). The FY2026 tax reform (passed the Diet 31 March 2026, operative ~1 January 2027) introduces a 20.315% flat rate, but only for "Specified Crypto Assets" traded on FSA-registered exchanges. DeFi yields, staking rewards, lending income, and tokens on non-registered platforms explicitly remain at progressive rates up to 55%.

India applies an even blunter instrument: a 30% flat tax on all Virtual Digital Asset gains (Sec 115BBH) plus surcharge, 4% cess, and a 1% TDS on every transfer (Sec 194S), with no holding-period distinction, no loss set-off, and no carry-forward. The Budget 2026-27 retained the 30%/1% TDS unchanged, and the Income-tax Act 2025 (in force 1 April 2026) added a "crypto-asset" limb to the VDA definition without softening the rate.

Outcome: Both regimes create a structural disincentive for DeFi participation by residents. India's 1% TDS in particular dampened on-exchange volume and pushed activity to offshore and P2P venues outside the FIU-IND perimeter. Capital migrates to tax-neutral hubs --

Singapore (no CGT),

UAE (0% individual income tax),

Hong Kong (no CGT), and offshore zero-tax centres such as the

Cayman Islands, BVI, and

Bermuda. Japan has only 32 registered CAESPs after nearly a decade, suggesting the overall regulatory burden (including taxation) constrains the ecosystem.

Evidence:

Japan jurisdiction profile, Section 5;

India jurisdiction profile, Section 5;

Singapore jurisdiction profile, Section 5.

4. Treating governance token holders as general partners

Jurisdictions:

United States (California), EU member states (default)

In Samuels v. Lido DAO (N.D. Cal., December 2024), the court found that Lido DAO governance token holders -- including Paradigm, Andreessen Horowitz, and Dragonfly -- may face unlimited personal liability as general partners. The court held that DAO participation, even voting on governance proposals, could establish partnership status. Separately, CFTC v. Ooki DAO (2022-2023) established that DAO governance token voters are part of an unincorporated association subject to entity-level liability ($643,542 penalty, permanent shutdown).

In the EU, no member state has enacted DAO-specific legislation. Default classifications apply: GbR (Germany), société de fait (France), maatschap (Netherlands), società semplice (Italy) -- all imposing unlimited joint and several personal liability. The pattern recurs globally in jurisdictions without a wrapper:

Estonia's own e-Residency guidance warns that any DAO member "who has ever voted" can be held fully liable across jurisdictions;

Brazil defaults unincorporated DAOs to sociedade em comum;

India and

Singapore most plausibly treat them as associations of persons / general partnerships.

Outcome: The Lido ruling created a litigation roadmap for plaintiffs' attorneys targeting any unwrapped DAO. Miles Jennings (General Counsel, a16z crypto) warned the ruling "dealt a huge blow to decentralized governance." The result is a rush to offshore wrapper jurisdictions -- Cayman Foundation Company registrations grew 70% year-on-year to 1,300+ by end-2024, with 400+ additional registrations in early 2025, representing approximately $10 billion in combined assets. The contrast is sharpest against the Marshall Islands, whose DAO LLC Act deliberately statutorily shields members from personal liability for DAO debts.

Evidence:

US jurisdiction profile, Section 4.2; DAO Governance & Legal Status, Sections 1 and Model E; Liability Frameworks, Section Model E;

Estonia jurisdiction profile, Section 3.

5. Applying securities law to all DeFi tokens without taxonomy

Jurisdiction:

United States (2021-2024)

The SEC's position that "most crypto tokens are securities" under the Howey test created blanket uncertainty. The LBRY ruling (November 2022) found a non-ICO utility token to be a security. The Ripple ruling produced a split: XRP is a security in institutional sales but not in programmatic retail sales. No coherent taxonomy existed until the March 2026 SEC/CFTC joint interpretive release established five categories (digital commodities, digital collectibles, digital tools, stablecoins, digital securities), explicitly classifying 16 named assets (including BTC, ETH, SOL, XRP) as non-securities.

Outcome: Four years of regulatory uncertainty. Multiple major enforcement actions (Coinbase, Binance, Ripple, Uniswap) were ultimately dismissed or settled with no lasting legal framework. The eventual taxonomy demonstrates that the broad securities classification was overinclusive. The opposite over-correction also carries risk:

Nigeria's ISA 2025 statutorily classifies most digital assets — including stablecoins — as securities, sweeping the entire market into a single regime with no governance-token or DeFi carve-out.

Evidence:

US jurisdiction profile, Sections 3.1-3.2 and 8;

Nigeria jurisdiction profile, Section 2.

6. No DAO legal framework (default to hostile classifications)

Jurisdictions: Most civil-law and common-law jurisdictions without DAO-specific legislation

In jurisdictions without DAO-specific entities, unincorporated DAOs default to general partnership (unlimited personal liability for all participants). Only four jurisdictions have enacted DAO-specific legislation:

Wyoming (DAO LLC 2021, DUNA 2024) and Utah (DAO Amendments Act 2024) at the US state level,

Japan (GK-based DAO via the April 2024 ordinance), and the Marshall Islands (DAO LLC Act, effective November 2022 — the first sovereign statutory DAO entity with full corporate personhood). The

EU,

UK,

Singapore,

Germany,

France,

South Korea,

South Africa,

Nigeria,

Thailand, and most other major jurisdictions offer no DAO-specific legal pathway and rely on default partnership/association classifications.

Outcome: DAOs migrate to offshore wrappers. The

Cayman Islands Foundation Company is the de facto global standard (1,300+ registrations, ~$10 billion in assets);

Switzerland's Foundation (Stiftung) anchors Ethereum, Cardano, Solana, Polkadot, Aave, dYdX, Tezos and others; BVI orphan structures are often paired with a Cayman foundation in a "catamaran"; and

Liechtenstein uses the PGR Stiftung/Anstalt. Domestic regulatory perimeters lose oversight. Token holders in unwrapped DAOs face personal liability exposure.

Evidence: DAO Governance & Legal Status, Sections 1-3;

Cayman Islands jurisdiction profile, Sections 1 and 2; Marshall Islands jurisdiction profile, Section 3.

7. The "fully decentralised" exemption without a definition

Jurisdiction:

EU (MiCA Recital 22)

MiCA's Recital 22 states that services provided "in a fully decentralised manner without any intermediary" fall outside scope. But MiCA does not define "fully decentralised." ESMA has acknowledged the gap, stating each system must be assessed "case-by-case." The Article 142 report was due 30 December 2024; the standalone Commission report remained unpublished as of June 2026, though the Commission discharged the mandate via a targeted MiCA review consultation launched 20 May 2026 (closing 31 August 2026) asking whether DeFi, staking, lending and borrowing should be brought into scope. The same undefined carve-out is inherited verbatim by every MiCA member state in this study —

Malta,

Estonia,

Germany,

France — and by EEA implementer

Liechtenstein.

Outcome: Every DeFi protocol has an incentive to claim decentralisation while retaining control structures. ESMA's case-by-case approach is impractical at scale. The exemption creates regulatory uncertainty that neither industry nor supervisors can resolve. The four-layer decentralisation test (settlement, architecture, governance, user interface) proposed by legal analysts has no official standing.

Evidence:

EU jurisdiction profile, Sections 1, 3.2-3.3, and 10.

What Clearly Works

1. Activity-based regulation ("same activity, same risk, same regulation")

Jurisdictions:

Singapore (MAS),

Switzerland (FINMA)

MAS applies a technology-neutral, activity-based framework: if a DeFi protocol performs a function equivalent to a licensed activity (exchange, custody, dealing in DPTs), it triggers licensing obligations under the Payment Services Act regardless of its technical architecture. The April 2024 PS Act amendments explicitly brought DEX operations within scope.

Switzerland's DLT Act applies the same "substance over form" principle: genuinely decentralised protocols with no identifiable controlling operator face no licence, while "organised and controlled" arrangements fall under existing financial-market law.

South Africa reaches the activity-based result by declaring crypto a "financial product" under existing FAIS/FICA rather than writing a bespoke statute.

Outcome: Clear rules for DeFi projects. ~33 Major Payment Institution licences issued to crypto firms in Singapore as of early 2025. Activity-based regulation scales without requiring new primary legislation -- the PS Act amendments extended existing categories to cover DEXs and new custody models. DigiFT Tech graduated from the MAS sandbox to a full CMS licence, demonstrating a viable sandbox-to-licence pathway.

Evidence:

Singapore jurisdiction profile, Sections 2, 3, and 6;

Switzerland jurisdiction profile, Sections 1 and 2.

2. Sandbox and pilot programs for institutional DeFi

Jurisdictions:

Singapore (Project Guardian),

UK (Digital Securities Sandbox),

Bermuda (graduated T→M→F + Embedded Supervision pilot)

Singapore's Project Guardian (launched 2022) has assembled 40+ financial institutions -- including JPMorgan, DBS, Standard Chartered, HSBC, Citi, BNY Mellon, Apollo, Schroders, Fidelity, Franklin Templeton -- conducting 15+ industry trials across 6 currencies. The trust anchor model (regulated institutions credential DeFi participants) provides compliant institutional DeFi. The Guardian Wholesale Network is commercialising asset tokenisation.

The UK's Digital Securities Sandbox allows firms to test DLT-based issuance, trading, and settlement within a modified regulatory environment.

Bermuda's graduated Class T (Test) → M (Modified) → F (Full) licence pathway under DABA brings DeFi inside a supervised perimeter on a phased basis: STS Digital progressed Test (2023) → Modified (2025) → Full (April 2026), and the BMA paired the on-ramp with an Embedded Supervision DeFi pilot.

Outcome: Institutional DeFi use cases developed under regulatory supervision. Franklin Templeton launched the first MAS-approved tokenised fund accessible to all Singapore investors (minimum S$20). The sandbox-first approach produces tested regulatory frameworks rather than speculative rules.

Evidence:

Singapore jurisdiction profile, Section 9 (Project Guardian);

UK jurisdiction profile, Section 9.4;

Bermuda jurisdiction profile, Section 4.

3. DAO legal entity legislation

Jurisdictions:

Cayman Islands (Foundation Company),

Wyoming (DUNA),

Japan (DAO LLC), Marshall Islands (DAO LLC),

Switzerland (Foundation/Verein)

The Cayman Foundation Company (Foundation Companies Act 2017, 2025 Revision) is the dominant global DAO wrapper: 1,300+ registrations by end-2024 (70% YoY growth), approximately $10 billion in combined assets, at least 17 foundations holding treasuries exceeding $100 million each. Formation costs are moderate ($5,000-15,000 in legal fees). The structure provides legal personality, limited liability, and the ability to hold assets and enter contracts, while allowing member-less governance directed by DAO votes.

Wyoming's DUNA (effective July 2024) provides a nonprofit structure that can generate revenue without distributing profits, aligning with protocol DAO operations. Japan's April 2024 Cabinet Office Ordinance enables LLC-type (godo kaisha) DAOs with tokenised membership classified as Paragraph II securities (lighter regulatory burden).

The clearest "purpose-built" model is the Marshall Islands DAO LLC Act (effective 25 November 2022): the first sovereign statute to grant DAOs full corporate personhood, on-chain governance recognition, smart-contract enforceability, and a member liability shield, with a 2023 Series DAO LLC amendment and 2024 regulations adding beneficial-ownership reporting. For-profit DAO LLCs pay a flat 3% Gross Revenue Tax (non-profits 0%).

Switzerland's Foundation (min CHF 50,000) and lighter-weight Verein offer a long-established alternative used by most major Layer-1 foundations.

Outcome: Measurable adoption. Legal wrappers reduce personal liability risk for governance participants while maintaining decentralised decision-making. Each model addresses different needs: Cayman and the Marshall Islands for offshore, tax-neutral structuring; DUNA for US-based nonprofit governance; Japan GK and the Swiss Foundation for domestic corporate integration. (Counter-caveat: the Marshall Islands member-liability shield remains judicially untested, and the FATF/APG 2024 evaluation rated the jurisdiction 0/11 on effectiveness outcomes — strong entity law is not the same as AML/CFT effectiveness.)

Evidence: DAO Governance & Legal Status, Models A and B;

Cayman Islands jurisdiction profile;

Japan jurisdiction profile, Section 4; Marshall Islands jurisdiction profile, Section 3.

4. DeFi-specific licensing

Jurisdictions:

UAE (VARA, ADGM),

Bermuda (DerivaDEX),

El Salvador (DASP), Seychelles (VASP Act)

VARA issued the world's first DeFi-specific operating licence to MANTRA in February 2025, authorising virtual asset exchange, broker-dealer, and management/investment services for a DeFi protocol operator. ADGM FSRA updated its framework in September 2025 to explicitly cover DeFi protocol operators, and finalised a VA staking framework on 29 April 2026 (extended to non-PoS models).

Bermuda complements UAE's first-mover claim with the world's first licence for a DAO-governed exchange: DerivaDEX received a Class T DABA licence and launched its licensed non-custodial derivatives platform (BTC/ETH perpetuals) on 17 February 2026, allocating regulatory responsibility to the licensed structure rather than individual governance-token holders.

El Salvador's LEAD regime channels regulation to registered issuers and DASPs (Tether, Bitfinex Derivatives, Freedx licensed), and Seychelles' VASP Act 2024 makes unlicensed VA service a criminal offence while reading its exchange/financial-services categories to capture DeFi conducted by an identifiable operator with a Seychelles nexus.

Outcome: Clear legal pathway for DeFi operations. MANTRA's licence focuses on real-world asset tokenisation, positioning Dubai as a hub for regulated institutional DeFi. The multi-regulator structure (VARA, ADGM, DIFC, CMA, CBUAE) provides regulatory choice. The trade-off in the licensing-led offshore models is a high gate: El Salvador's CNAD reports an ~84% rejection rate, and Seychelles' entire first licensed cohort remained in "Assessment" status as of June 2026 — purpose-built DeFi licences exist on paper faster than they are granted in practice.

Evidence:

UAE jurisdiction profile, Sections 2, 6, and 9;

Bermuda jurisdiction profile, Section 1;

El Salvador jurisdiction profile, Section 4; Seychelles jurisdiction profile, Section 1.

5. "Truly decentralised" exemption with clear indicators

Jurisdictions:

UK (FCA proposed),

South Africa (FSCA spectrum),

Switzerland (control test)

The UK FCA's CP25/40 (December 2025) proposes that "truly decentralised" protocols where no person carries on activity "by way of business" remain outside the regulatory perimeter. The FCA identifies three indicators of insufficient decentralisation: concentrated token governance, direct core-team treasury management, and centralised off-chain coordination. The FCA acknowledges a spectrum rather than a binary classification.

South Africa's FSCA articulated the same spectrum concept in its December 2024 DeFi Market Study: where an identifiable operator or centralized control point exists (governance, oracles, liquidity pools), FAIS may apply; genuinely operator-less protocols fall outside the CASP perimeter.

Switzerland's FINMA draws the line on whether the protocol is "organised and controlled" by an identifiable operator.

Outcome (preliminary): These approaches are more nuanced than MiCA's blanket Recital 22 exclusion because they provide indicators of what disqualifies a protocol from the exemption. By regulating based on the presence of a "controlling person," the FCA and FSCA avoid both under-regulation and stifling innovation. UK final rules are expected H2 2026, with the regime commencing 25 October 2027.

Evidence:

UK jurisdiction profile, Sections 2.3-2.4 and 3.4;

South Africa jurisdiction profile, Section 2;

Switzerland jurisdiction profile, Section 2.

6. Property law recognition of digital assets

Jurisdiction:

UK

The UK Law Commission's Digital Assets Final Report (June 2023) recommended recognising crypto-tokens as a third category of personal property. The Property (Digital Assets etc) Act 2025 (Royal Assent 2 December 2025) gave statutory effect, confirming that digital assets are not prevented from being objects of personal property rights merely because they are neither things in possession nor things in action.

Outcome: Legal foundation for collateral arrangements, token ownership disputes, proprietary remedies (tracing, freezing orders, constructive trusts), and security interests over digital assets. Demonstrated in practice: Fetch.ai v Binance (2021) -- worldwide freezing order and Norwich Pharmacal disclosure order granted against Binance. Bybit v Ho Kai Xin (2023) -- Singapore court recognised USDT as property capable of being held on trust, building on similar principles. The pattern of statutory property certainty recurs in

France (crypto-assets now intangible movable property under Ordinance 2024-936; pledge regime under Law 2025-391).

Evidence:

UK jurisdiction profile, Sections 2.5, 3.1-3.2, and 4;

Singapore jurisdiction profile, Section 4;

France jurisdiction profile, Section 2.

7. Proportionate AML with risk-based approach

Jurisdiction:

Singapore (MAS Notice PSN02), FATF risk-based framework

Singapore implemented the FATF Travel Rule via PSN02 in January 2020 -- one of the earliest adopters globally. The approach is risk-based: all DPT transfers require originator/beneficiary information, with enhanced PII for transfers above S$1,500. Self-hosted wallets are exempt from Travel Rule information sharing but treated as higher ML/TF risk, requiring VASPs to verify customer ownership.

Outcome: Compliance leadership. Licensed firms face reduced friction in cross-border operations. The risk-based approach avoids blanket KYC for all DeFi users (which would be technically infeasible for permissionless protocols) while ensuring regulated touchpoints capture relevant information. The offshore VASP regimes —

Cayman Islands, BVI,

Bermuda, Seychelles — apply the same FATF Rec. 15 logic at the custodial chokepoint while expressly leaving non-custodial, controllerless protocols outside the AML perimeter.

Evidence:

Singapore jurisdiction profile, Section 7; FATF international framework profile.

8. Comprehensive token taxonomy by regulators

Jurisdiction:

United States (SEC/CFTC joint taxonomy, March 2026)

The SEC and CFTC jointly published a five-category interpretive release on 17 March 2026: digital commodities, digital collectibles, digital tools, stablecoins, and digital securities. The release explicitly classifies 16 named assets (including BTC, ETH, SOL, XRP) as digital commodities -- not securities -- and provides guidance on when tokens transition between categories. A preceding SEC/CFTC MOU (11 March 2026) had already placed BTC and ETH under CFTC oversight.

Outcome: The most detailed agency-level classification framework of any major jurisdiction. Eliminates four years of uncertainty about the regulatory status of major crypto assets. Provides actionable guidance for token issuers and DeFi protocols on which regulatory regime applies. Function-based statutory taxonomies elsewhere (

Thailand's cryptocurrency/investment-token/utility-token split;

Bermuda's single broad "digital asset" definition) show the same value of clarity, though none matches the US release's granularity.

Evidence:

US jurisdiction profile, Sections 3.2 and 9.4.

Mixed Results

1. MiCA's comprehensive approach

Jurisdiction:

EU

MiCA is the world's first comprehensive, harmonised crypto-asset regulatory framework. It provides EU-wide passporting (eliminating 27 separate national licences), a unified CASP authorisation regime (approximately 102 CASPs authorised by December 2025), and market abuse provisions for crypto-assets.

What works: Passporting provides genuine single-market advantage — a

Malta,

Estonia, or

Germany CASP licence passports across all 27 member states. The framework creates regulatory clarity for centralised crypto services. Enforcement credibility is demonstrated (cumulative MiCA-related fines exceeded €540 million by November 2025).

What doesn't: The "fully decentralised" exemption is undefined (Recital 22). The Article 142 DeFi review is late (due December 2024; standalone report still unpublished as of June 2026, now subsumed into a 20 May 2026 review consultation). MiCA does not address lending, staking, or borrowing -- core DeFi activities. Transitional-period fragmentation (member states ran different deadlines, all converging on 1 July 2026) undermined single-market objectives. The ESMA fast-track peer review of

Malta's MFSA (10 July 2025) found material issues not fully resolved at authorisation, raising quality concerns about rapid CASP authorisations. Taxation remains unharmonised (Germany taxes crypto held <1 year and treats LP deposits as disposals; France taxes only fiat conversions at a 31.4% flat rate from 2026).

Net assessment: Strong for centralised crypto; insufficient for DeFi. DeFi-specific calibration is proceeding via the 20 May 2026 consultation but no legislative proposal has yet been tabled.

Evidence:

EU jurisdiction profile, Sections 1-6 and 10;

Malta jurisdiction profile, Section 7.

2. US regulatory reset (2025-2026)

Jurisdiction:

United States

The 2025-2026 administration reversed enforcement-heavy policies: SEC Crypto Task Force formed (January 2025); DOJ Blanche Memo ended "regulation by prosecution" (April 2025); SEC dropped Coinbase, Binance, and Ripple cases; SEC/CFTC joint taxonomy published (March 2026); GENIUS Act signed into law for stablecoins (July 2025); CRA nullified DeFi broker reporting rules (April 2025).

What works: Speed of correction. The token taxonomy provides the most detailed classification of any major jurisdiction. The GENIUS Act demonstrates Congress can enact targeted, well-structured legislation for specific DeFi sub-sectors.

What doesn't: Durability. The Blanche Memo is executive policy, not law. The SEC's case dismissals can be reversed by a future administration. Market structure legislation remains in flight — a CLARITY Act substitute adding a dedicated DeFi title advanced out of Senate Banking Committee on 14 May 2026 but is not yet enacted. Developer liability remains unresolved (Roman Storm convicted on unlicensed money transmission, hung jury on the other counts, with the DOJ signalling a retry and a Rule 29 acquittal motion undecided as of June 2026; Mango Markets / Eisenberg conviction overturned May 2025). DAO liability gap persists at federal level.

Net assessment: Positive direction, but may lack durability absent legislation. The CRA nullification of DeFi broker rules is permanent, but most other changes are executive policy reversible by a future administration.

Evidence:

US jurisdiction profile, Sections 9 and 10.

3. Tax-free jurisdictions attracting DeFi

Jurisdictions:

UAE,

Singapore,

Hong Kong,

Cayman Islands, BVI,

Bermuda,

El Salvador

The UAE imposes no individual income tax or capital gains tax. Singapore and Hong Kong impose no capital gains tax. The pure offshore zero-tax centres go further: the

Cayman Islands, BVI, and

Bermuda levy no income, corporate, capital gains, or withholding tax (Bermuda adds only a 15% CIT on in-scope MNE groups above €750m revenue).

El Salvador applies 0% income/CGT/VAT to LEAD-registered digital-asset activity, and the Marshall Islands charges for-profit DAO LLCs a flat 3% GRT. All actively compete to attract DeFi firms and talent.

What works: Strong economic incentive for DeFi talent and capital. The UAE's tax environment is a primary driver of DeFi migration; the offshore centres pair zero tax with bespoke VASP regimes and (Cayman/BVI) the dominant DAO-wrapper stack. Singapore differentiates on institutional DeFi rather than retail volume.

What doesn't: FATF and OECD scrutiny. Tax-neutral jurisdictions face ongoing pressure to demonstrate adequate AML/CFT controls and information exchange. The OECD Crypto-Asset Reporting Framework (CARF) now applies regardless of domestic tax treatment — in force from 1 January 2026 in Cayman, BVI (CRS 2.0), and many peers, with first reports 2027-2028. The Marshall Islands illustrates the ceiling: a FATF/APG 0/11 effectiveness rating and repeated IMF Article IV warnings over its DAO registry show that tax neutrality plus light entity law invites macro-prudential pushback. Singapore's FSMA Part 9 crackdown on offshore-only models caused a 37% decline in crypto job postings in Q1 2025.

Net assessment: Effective for attracting DeFi businesses in the short term, but sustainability depends on maintaining both tax competitiveness and international compliance credibility.

Evidence:

UAE jurisdiction profile, Section 5;

Singapore jurisdiction profile, Sections 5 and 8;

Cayman Islands jurisdiction profile, Section 5; Marshall Islands jurisdiction profile, Section 5.

4. EU Product Liability Directive applied to software

Jurisdiction:

EU

Directive (EU) 2024/2853 (entered into force 8 December 2024, transposition deadline 9 December 2026) explicitly classifies software -- including standalone software -- as a "product" subject to strict liability. The open-source exemption is narrow: free and open-source software is excluded only if not provided in the course of a commercial activity. Software provided in exchange for personal data or as part of a paid service loses this exemption.

What works (potentially): Provides clear liability framework for DeFi protocol deployers. Strict liability removes the difficulty of proving fault in smart contract exploit cases. Cannot be contractually excluded.

What doesn't (potentially): May chill open-source DeFi development in the EU. Most commercial DeFi protocols (generating fees, collecting data, or maintained by revenue-earning entities) will not qualify for the open-source exemption. The narrow exemption may drive open-source DeFi development to non-EU jurisdictions. The interaction between the PLD, MiCA's DeFi exemption, and national tort law creates a liability patchwork. The contrast with the Marshall Islands is instructive: its 2023 amendment expressly shields DAOs from liability for open-source software they create.

Net assessment: Significant but untested. No DeFi-specific PLD enforcement has occurred. The December 2026 transposition deadline will be the first real test.

Evidence:

EU jurisdiction profile, Section 4.2; Liability Frameworks, Model B.

5. Self-regulatory organisations for crypto

Jurisdiction:

Japan (JVCEA)

The JVCEA, designated as a certified fund settlement business association under the PSA, performs critical regulatory functions: token listing approval (member exchanges cannot list tokens over JVCEA objection), member discipline, margin trading limits (2x leverage), and enhanced security standards. In April 2025, listing rules were relaxed for qualified institutional investors.

What works: Industry-informed governance with statutory backing. No customer has lost funds due to an exchange failure since the enhanced regime was fully implemented. The JVCEA token listing review has prevented listing of fraudulent tokens on registered exchanges.

What doesn't: Slow listing process constrains innovation. Only 32 CAESPs registered after nearly a decade. The self-regulatory model works for centralised exchanges but has no clear application to decentralised protocols. (Japan is now migrating the underlying regime from the PSA to the FIEA via a Cabinet-approved bill of 10 April 2026, pending the Diet.)

Net assessment: Effective for centralised exchange oversight; unclear path to DeFi applicability.

Evidence:

Japan jurisdiction profile, Sections 2 and 10.

6. UK's comprehensive but delayed cryptoasset regime

Jurisdiction:

United Kingdom

The UK is building arguably the most comprehensive DeFi regulatory framework among major jurisdictions. The Cryptoassets Regulations 2026 (formally made by Parliament 4 February 2026) create new regulated activities including issuance, trading-platform operation, dealing, arranging, custody, and staking. The FCA's CP25/40 proposes applying substantive rules to DeFi where a controlling person is identifiable, including retail over-collateralisation (max 50% LTV) and a ban on proprietary tokens in lending. The regime explicitly captures staking, lending, and borrowing -- core DeFi activities that MiCA omits. The "reasonable coder" interpretation standard for smart contracts, the Property (Digital Assets etc) Act 2025, and the Law Commission's DAO Scoping Paper provide a coherent legal foundation.

What works: Comprehensive scope (staking, lending, borrowing included). Pragmatic DeFi perimeter based on spectrum of decentralisation. Strong common-law foundation for digital asset property rights.

What doesn't: The regime does not commence until 25 October 2027 -- more than four years after FSMA 2023 received Royal Assent. No DAO-specific entity despite the Law Commission's consideration of a limited liability nonprofit association (the Commission concluded bespoke DAO legislation is not currently needed). The FCA's ~87% first-application failure rate for MLR registration (~44 firms registered from ~359 applications) raises capacity concerns for the full authorisation gateway, which opens 30 September 2026. No passporting (UK-only).

Net assessment: Directionally sound and more comprehensive than MiCA for DeFi, but the implementation lag means UK consumers remain reliant on the financial promotions regime until late 2027.

Evidence:

UK jurisdiction profile, Sections 2, 3, 6, and 10.

7. Restrictive VASP licensing in offshore and emerging-market hubs

Jurisdictions:

Estonia, Seychelles,

Nigeria

A cluster of jurisdictions pursue mandatory, substance-demanding VASP licensing as a corrective to earlier permissive eras.

Estonia moved from a permissive virtual-currency-licence haven to an AML-driven crackdown — active authorisations collapsed from 2,000+ to ~100 (2020-2023) — and is now consolidating under full MiCA prudential supervision with a hard 1 July 2026 legacy-VASP sunset. Seychelles' VASP Act 2024 made unlicensed VA service a criminal offence (from 1 September 2024) and demands local substance (183+ day resident director).

Nigeria's ISA 2025 built a comprehensive securities-based regime around locally incorporated VASPs (₦500m paid-up capital, ₦30m registration fee).

What works: Closes the "registration haven" gap that earlier let thousands of shell VASPs operate with minimal oversight. Substance requirements and criminal liability for unlicensed operation give regulators credible deterrence.

What doesn't: High gates throttle legitimate entrants and do nothing for genuinely controllerless DeFi. Seychelles' entire first licensed cohort remained "in Assessment" as of June 2026; Nigeria's SEC is "slowing new approvals"; Estonia's contraction was a blunt AML instrument, not a DeFi framework. None of the three addresses non-custodial protocols, which fall outside the obliged-entity perimeter entirely.

Net assessment: Effective at disciplining centralised VASP gateways; irrelevant to permissionless DeFi, and prone to bottlenecks that push activity offshore.

Evidence:

Estonia jurisdiction profile, Sections 1 and 7; Seychelles jurisdiction profile, Section 1;

Nigeria jurisdiction profile, Section 1.

Evidence-Based Playbook: 12 Principles for DeFi Regulation

1. Regulate activities, not technologies. Singapore's activity-based framework scales without new primary legislation and provides clear compliance pathways -- the PS Act amendments extended existing categories to cover DEXs without requiring a bespoke DeFi statute; Switzerland's DLT Act and South Africa's FAIS "financial product" declaration reach the same result (

   Singapore, Section 2;
   Switzerland, Section 2).

2. Provide a DAO legal entity. Jurisdictions without DAO-specific entities lose governance structures to offshore wrappers -- the Cayman Foundation Company captured 1,300+ registrations and ~$10 billion in assets, while the Marshall Islands' statutory DAO LLC and Switzerland's Foundation give members an explicit liability shield that default partnership classifications deny (DAO Governance & Legal Status, Sections 1-3; Marshall Islands, Section 3).

3. Define "sufficiently decentralised" with measurable criteria. Undefined exemptions (MiCA Recital 22, inherited by Malta, Estonia, Germany and France) create uncertainty that neither industry nor supervisors can resolve -- the UK FCA's three-indicator test and South Africa's FSCA "spectrum of decentralization" provide workable alternatives (

   UK, Section 3.4;
   South Africa, Section 2;
   EU, Section 3.3).

4. Use sandboxes for institutional DeFi before writing permanent rules. Singapore's Project Guardian (40+ institutions, 15+ trials, near-commercialisation) and Bermuda's graduated T→M→F licence plus Embedded Supervision pilot demonstrate that structured sandbox collaboration produces tested regulatory frameworks rather than speculative legislation (

   Singapore, Section 9;
   Bermuda, Section 4).

5. Establish a token taxonomy through inter-agency coordination. The US SEC/CFTC joint five-category taxonomy (March 2026) resolved four years of classification uncertainty by assigning clear regulatory status to major asset classes -- inter-agency coordination was essential to avoid jurisdictional conflicts (

   US, Section 3.2).

6. Recognise digital assets as property. The UK Property (Digital Assets etc) Act 2025 unlocked existing proprietary remedies (tracing, freezing orders, constructive trusts) for digital assets without requiring wholesale legislative overhaul -- practical enforcement tools demonstrated in Fetch.ai v Binance; France's reclassification of crypto as intangible movable property does the same (

   UK, Sections 2.5 and 4;
   France, Section 2).

7. Align DeFi taxation with financial market norms. Japan's ~55% rate on DeFi yields and India's 30% flat tax plus 1% TDS both drive capital offshore -- jurisdictions should avoid penal or two-tier tax systems that disadvantage DeFi relative to equivalent traditional finance activities (

   Japan, Section 5;
   India, Section 5).

8. Anchor enforcement in fraud, not regulatory status. The US Blanche Memo's pivot from "tokens are securities until proven otherwise" to "fraud and manipulation are prosecuted; innovation is accommodated" better fits the DeFi landscape -- enforcement should target actual harm (theft, fraud, sanctions evasion), not mere failure to register (

   US, Section 9.2).

9. Build legislation, not executive policy. The GENIUS Act provides durable stablecoin rules that survive administration changes; the Blanche Memo, SEC case dismissals, and DOJ disbandment of NCET are all reversible executive actions -- only enacted legislation provides lasting certainty for multi-year compliance investments (

   US, Section 10).

10. Apply the Travel Rule proportionately with risk-based thresholds. Singapore's tiered approach (all transfers require basic information; enhanced PII above S$1,500; self-hosted wallets exempt but risk-assessed) balances AML effectiveness with technical feasibility for DeFi, and is mirrored at the custodial chokepoint by the offshore VASP regimes (Cayman, BVI, Bermuda, Seychelles) (

    Singapore, Section 7).

11. Address developer liability through clear safe harbours, not prosecution. The Tornado Cash prosecution chilled legitimate privacy development; Van Loon v. Treasury (immutable contracts not sanctionable as property) and the Marshall Islands' statutory open-source-software shield provide workable boundaries -- code publication alone should not create criminal liability absent knowing facilitation of specific criminal conduct (

    US, Sections 7.2 and 8.2; Marshall Islands, Section 3).

12. Coordinate internationally before regulating. The divergence between the Dutch Pertsev conviction (64 months for developing Tornado Cash) and the US Van Loon ruling (immutable contracts not sanctionable) creates transatlantic legal uncertainty that benefits no jurisdiction -- FATF, IOSCO, and FSB coordination on DeFi standards should precede domestic legislation where possible (

    EU, Section 8.1;
    US, Section 8.2; FATF framework profile).

Methodology Note

This analysis draws exclusively from the 27 jurisdiction profiles, 6 guidance documents, and international framework assessments in this repository. All factual claims are verified against primary sources cited in the underlying jurisdiction profiles. Where jurisdiction profiles identify data gaps or caveats, those limitations are inherited by this analysis. Aggregate counts (e.g. "four jurisdictions have enacted DAO-specific legislation") are derived from the 27-jurisdiction fact matrix.

Key sources of uncertainty:

• The SEC/CFTC joint taxonomy (17 March 2026) and its application to specific DeFi tokens are still being interpreted by practitioners
• The European Commission's standalone Article 142 DeFi report remains unpublished as of June 2026; the 20 May 2026 review consultation closes 31 August 2026
• The Roman Storm retry and Rule 29 acquittal motion are pending
• The UK FCA's "truly decentralised" criteria have not been finalised (regime commences 25 October 2027)
• The EU Product Liability Directive transposition (December 2026) has not yet been tested against DeFi protocols
• US market structure legislation (the CLARITY Act substitute with a DeFi title) is actively evolving and not yet enacted
• The Marshall Islands DAO LLC member-liability shield remains judicially untested
• Several offshore VASP regimes (Seychelles, Cayman, BVI) have first licensed cohorts still "in assessment" and CARF reporting cycles that have not yet produced data

Verification Notes

• Jurisdiction coverage: 27 jurisdictions — United States, Canada, Brazil, Cayman Islands, Bermuda, El Salvador, British Virgin Islands, Australia, Hong Kong, Japan, Singapore, South Korea, India, Thailand, Marshall Islands, European Union, France, Germany, Switzerland, United Kingdom, Malta, Liechtenstein, Estonia, UAE, South Africa, Nigeria, Seychelles.
• Source of truth: .claude/defi-fact-matrix.json (one canonical record per jurisdiction, extracted from the verified jurisdiction profiles). No fact in this file originates from web search; "NOT VERIFIED" / "NO DATA FOUND" entries in the matrix are reflected honestly rather than filled in.
• Corrected facts this revision: Samuels v. Lido DAO dated December 2024; Tornado Cash sanctions framed via Van Loon v. Treasury (Nov 2024) with March 2025 OFAC delisting; Japan max rate stated as ~55.945% with the 20.315% reform passed 31 March 2026; EU Article 142 mandate discharged via the 20 May 2026 consultation; UK regime commencement date stated as 25 October 2027; Roman Storm status updated (conviction on money transmission, retry pending); DAO-legislation count corrected to four enacting jurisdictions (Wyoming, Utah, Japan, Marshall Islands).
• Derived aggregates recomputed for N=27: DAO-specific legislation (4 enacting jurisdictions + wrapper jurisdictions Cayman/Switzerland/BVI/Liechtenstein); tax-neutral cluster expanded to include Cayman, BVI, Bermuda, El Salvador, Marshall Islands; "no DAO framework" list expanded to the relevant default-partnership jurisdictions.