DeFi Compliance & Enforcement

1. Global Compliance Landscape

This section maps the principal compliance dimensions that regulators must address when applying anti-money laundering (AML) and counter-terrorism financing (CTF) frameworks to decentralised finance (DeFi). For each dimension, we identify the dominant regulatory models, current status, and cross-jurisdictional divergences. The analysis covers 27 jurisdictions across the Americas, Asia-Pacific, Europe, and the Middle East & Africa.

1.1 AML/KYC Applicability to DeFi

The central regulatory question is whether -- and when -- existing AML/KYC obligations attach to protocols that lack a traditional intermediary. Across all 27 jurisdictions surveyed, AML/CTF obligations attach to identifiable obliged entities (VASPs, CASPs, MSBs, DASPs, SPSAVs, or their local equivalents); not one jurisdiction has succeeded in imposing direct AML obligations on a genuinely controllerless protocol, and the great majority expressly leave such protocols outside the obliged-entity perimeter.

Operator-based model (US, FATF). The

US applies the Bank Secrecy Act (BSA) to DeFi where an identifiable operator exists. FinCEN classifies entities that accept and transmit convertible virtual currency as money services businesses (MSBs) subject to registration, customer identification programmes (CIPs), and suspicious activity reporting (SARs). Users of single-signature unhosted wallets transacting on their own behalf and unhosted-wallet software providers are not MSBs; fully decentralised protocols fall outside the BSA. In September 2024 FinCEN formally withdrew its 2020 proposed rule that would have imposed reporting requirements on transactions involving unhosted wallets, and in April 2025 the DOJ issued guidance titled "Ending Regulation by Prosecution," signalling a retreat from using enforcement as a substitute for rulemaking. The FATF Updated Guidance (October 2021, paragraphs 67-78) applies an "owner/operator" test: creators, owners, and operators who maintain control or sufficient influence over a DeFi arrangement may qualify as virtual asset service providers (VASPs) and bear full AML/KYC obligations. The software itself is not a VASP; the humans behind it may be. This owner/operator logic recurs almost verbatim in

India (FATF "control or sufficient influence"),

Hong Kong,

Japan,

Thailand,

South Africa (FSCA "spectrum of decentralization"), and

Nigeria.

Comprehensive licensing model (EU, Singapore). The

EU Anti-Money Laundering Regulation (AMLR, Regulation 2024/1624), directly applicable from 10 July 2027, extends AML obligations to all crypto-asset service providers (CASPs) authorised under MiCA; it expressly targets "so-called DeFi" while recognising that truly decentralised protocols remain a gap. CASPs must implement risk-based customer due diligence (CDD), transaction monitoring, and SAR filing. The Anti-Money Laundering Authority (AMLA), operational from 2028, will directly supervise high-risk CASPs. The EU AML perimeter is inherited verbatim by its member states surveyed here --

France (ACPR-supervised),

Germany (GwG),

Malta (FIAU Implementing Procedures Part II), and

Estonia (CASPs as obliged entities) -- and, via the EEA, by

Liechtenstein.

Singapore applies its Payment Services Act framework through MAS Notices PSN01 and PSN02, requiring all digital payment token service providers to implement AML/KYC programmes including risk assessments, CDD, and ongoing monitoring; the April 2024 PS Act amendments brought DEX operations into DPT-service scope where an identifiable provider exists.

Registration-based model (UK, Japan, India, Brazil). The

UK requires cryptoasset firms to register with the FCA under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017).

Japan regulates crypto-asset exchange service providers (CAESPs) under the Payment Services Act and applies AML obligations through the Act on Prevention of Transfer of Criminal Proceeds (APTCP).

India requires VDA service providers (VDASPs) to register with FIU-IND under the Prevention of Money Laundering Act (PMLA); registered VDASPs are full reporting entities, with updated AML/CFT Guidelines dated 8 January 2026.

Brazil imposes AML/CTF on SPSAVs under Law 14,478 and BCB Resolution 520, applying only to identifiable VASPs.

Bespoke activity-based AML regimes (Cayman, Bermuda, BVI, Marshall Islands, Seychelles, Thailand, South Africa, Nigeria). Several offshore and emerging-market jurisdictions enacted purpose-built VASP statutes that prescribe AML/CTF as part of the licensing perimeter. The

Cayman Islands applies AML/CTF (AML Regs 2025 Revision, Proceeds of Crime Act) to registered/licensed VASPs only; non-VASP foundation companies are not subject to VASP AML.

Bermuda designates digital asset businesses under DABA as AML/ATF-regulated financial institutions within the POCA 1997 framework. The BVI treats VASPs as "relevant persons" under its AML Regs and AML/TF Code (extended to virtual assets from 1 December 2022), and expressly excludes unhosted/non-custodial wallet providers from VASP scope. The Marshall Islands applies AML/CFT under its Banking Act framework with an FIU housed within the Marshall Islands Monetary Authority (MIMA). Seychelles makes licensed VASPs reporting entities under the AML/CFT (Amendment) Regulations 2024 and prohibits mixers/tumblers outright.

Thailand treats digital asset operators as "financial institutions" under its AML Act B.E. 2542 via the Emergency Decree, with full CDD/EDD and AMLO reporting.

South Africa designates CASPs as accountable institutions under FICA (Schedule 1, item 22).

Nigeria designates VASPs under the Money Laundering (Prevention and Prohibition) Act 2022, supervised by the NFIU/SCUML.

DeFi-specific and issuer-centric models (UAE, El Salvador). The

UAE is the only surveyed jurisdiction with a dedicated DeFi operating licence: all VASPs, including VARA DeFi Limited License operators, must implement AML/KYC, and the federal CMA embeds AML/CFT as a licensing prerequisite.

El Salvador attaches AML/CFT obligations to registered issuers and DASPs under LEAD, CNAD-supervised with UIF reporting (GAFILAT member).

Vacuum-with-overlay model (South Korea).

South Korea runs one of the strictest AML regimes -- CDD, real-name verification, and STR/CTR reporting to KoFIU -- but real-name banking effectively prevents DeFi from operating AML-compliant services at all, leaving DeFi in a regulatory vacuum with no licensing pathway.

Emerging frameworks (Switzerland, Germany).

Switzerland's Anti-Money Laundering Act (AMLA) applies to crypto providers acting as financial intermediaries; purely decentralised protocols with no operator are outside scope. The revised AMLA, adopted September 2025, is expected to enter into force in H2 2026 (no date set as of 4 June 2026), expanding the scope of obliged entities. Germany's Geldwaeschegesetz (GwG) applies to all crypto service providers; as amended by the Financial Market Digitalisation Act (FinMadiG, December 2024) it introduces Section 15a with specific, stricter-than-EU provisions for transfers involving self-hosted addresses, with BaFin extending the implementation deadline to July 2027.

1.2 Sanctions Compliance

Sanctions compliance in DeFi presents unique challenges because autonomous smart contracts cannot be "blocked" or "frozen" in the same way as traditional accounts.

The Tornado Cash precedent. In August 2022, OFAC designated Tornado Cash, adding over 100 Ethereum addresses to the Specially Designated Nationals (SDN) list. The Fifth Circuit Court of Appeals ruled in November 2024 (Van Loon v. Department of the Treasury) that OFAC exceeded its statutory authority because immutable smart contracts are not "property" capable of being owned under the International Emergency Economic Powers Act (IEEPA). Following this ruling, OFAC delisted Tornado Cash on 21 March 2025, acknowledging the "novel legal and policy issues" raised.

This outcome establishes a critical distinction: sanctions can target entities and individuals who control DeFi protocols, but cannot designate autonomous, immutable code deployed on public blockchains. However, mutable smart contracts -- where an admin key or governance mechanism allows updates -- remain potentially within OFAC's reach.

UK and EU approach. The UK applies sanctions through the Office of Financial Sanctions Implementation (OFSI) under the Sanctions and Anti-Money Laundering Act 2018; its July 2025 Cryptoassets Threat Assessment confirms all UK persons, including DeFi participants, are subject. On 26 May 2026 the UK designated Huobi Global S.A. (HTX) under its Russia sanctions -- the first crypto exchange so designated. The EU applies its consolidated sanctions lists through member-state competent authorities; on 23 April 2026 the EU adopted its 20th sanctions package, imposing a total sectoral ban on Russia-established crypto transfer/exchange platforms and banning the RUBx token (crypto measures from 24 May 2026). Neither jurisdiction has attempted to sanction a DeFi protocol directly, but both apply sanctions screening obligations to regulated CASPs/firms that interact with DeFi.

Asia-Pacific and Gulf screening obligations.

Hong Kong requires VASPs to screen against UN, PRC, and Hong Kong sanctions lists.

Singapore screens against UN designations and MAS-designated lists.

Thailand mandates enhanced CDD for FATF-listed high-risk jurisdictions (e.g., North Korea, Iran, Myanmar). The

UAE requires compliance with UAE, UN, and international sanctions lists across all VASPs including DeFi licensees.

Emerging-market and offshore posture.

South Africa is FATF-aligned; it was grey-listed in February 2023 and exited the grey list on 24 October 2025, with a new mutual evaluation expected ~2026-2027.

Nigeria is FATF-aligned and was grey-listed in February 2023 (current grey-list status as of June 2026 not verified).

Bermuda requires sanctions screening under the Anti-Terrorism (Financial and Other Measures) Act 2004 (CFATF member, FATF-aligned). Seychelles aligns with FATF Recommendation 15 and issues circulars on high-risk jurisdictions.

El Salvador, Marshall Islands (FATF/APG-assessed), and

India (PMLA transaction monitoring) require sanctions/watchlist screening as part of their AML programmes. For several jurisdictions --

Canada,

Brazil,

Cayman Islands,

Japan,

South Africa (no DeFi-specific framework beyond FATF alignment),

Switzerland, and several EU member states -- the matrix records no dedicated DeFi sanctions framework beyond general FATF alignment or the applicable EU regime.

1.3 Travel Rule Implementation for DeFi

The FATF Travel Rule (Recommendation 16) requires originator and beneficiary information to accompany virtual asset transfers. Implementation varies significantly across the 27 jurisdictions.

No-threshold / zero-threshold jurisdictions.

Japan applies the Travel Rule with no de minimis threshold since 1 June 2023 under the amended APTCP.

Singapore's PSN02 has required travel-rule information for all transfers since 28 January 2020 (one of the earliest globally), with enhanced personal-data requirements for transfers exceeding SGD 1,500. The

EU TFR sets a €0 CASP-to-CASP threshold for full originator/beneficiary information, inherited by

France,

Germany, and

Estonia.

Malta goes further still, applying travel-rule information to all crypto transfers with no de minimis threshold (stricter than both FATF and the EUR 1,000 enhanced-verification trigger).

South Korea imposes no de minimis threshold for domestic transfers.

Switzerland applies an effectively CHF 0 threshold for virtual-currency exchanges (with a CHF 1,000 trigger for transactions linked within 30 days).

Threshold-based jurisdictions. The EU TFR (Regulation 2023/1113, in force 30 December 2024) imposes enhanced verification requirements for transfers involving unhosted wallets exceeding EUR 1,000. The

US applies the BSA recordkeeping and travel rule at a USD 3,000 threshold (with a proposed reduction to USD 250 for international transfers).

Canada requires originator/beneficiary information for transfers of CAD 1,000 or more.

Hong Kong requires travel-rule information for transfers exceeding HKD 8,000 (~USD 1,000). The BVI attaches AML/travel-rule obligations to transactions valued at US$1,000 or more.

Liechtenstein applies a EUR 1,000 threshold (SPG amendment 1 April 2021, SPV in force 1 June 2021). The

UAE applies the full FATF Travel Rule above AED 3,500 (~USD 950).

South Africa implemented FIC Directive 9 (in force 30 April 2025) with a commonly cited ~ZAR 25,000 threshold.

Phased / all-transfer implementation. The

UK Travel Rule took effect on 1 September 2023 under amendments to MLR 2017, applying to all cryptoasset transfers regardless of value, with enhanced requirements above EUR 1,000.

Brazil is implementing a phased Travel Rule: Phase 1 (Feb 2026-Feb 2027), Phase 2 (Feb 2027-Feb 2028), with full compliance from 2 February 2028.

Thailand applies the Travel Rule to licensed operators under SEC/AMLO requirements.

Bermuda,

Cayman Islands,

India, and Seychelles require originator/beneficiary information to accompany virtual asset transfers for their licensed/registered entities (specific thresholds not all stated).

Nigeria is committed to FATF standards, but a specific Travel Rule threshold is not verified against a primary instrument.

Australia makes the FATF Travel Rule mandatory for VA transfers from 1 July 2026 (tranche 2), with no exemption.

El Salvador and the Marshall Islands have no confirmed Travel Rule threshold (El Salvador references a GAFILAT-recommended USD 1,000 transaction-limit policy).

DeFi-specific challenge. Where a user interacts directly with a smart contract (e.g., swapping tokens on a decentralised exchange), there is no counterparty VASP to receive travel-rule information. Regulators have not yet resolved this gap. The FATF's 2024 targeted update acknowledged that only 29% of jurisdictions have fully implemented the Travel Rule, and compliance for peer-to-peer and DeFi transactions remains particularly low. The wide threshold dispersion across the 27 jurisdictions surveyed -- from €0/zero (EU, Malta, Japan, Singapore all-transfer, Switzerland) through CAD/USD 1,000-equivalents (Canada, Hong Kong, BVI, Liechtenstein, UAE) to USD 3,000 (US) -- is itself a source of arbitrage.

1.4 Unhosted Wallet Rules

The treatment of self-hosted (unhosted) wallets is a key battleground in DeFi compliance policy.

Restrictive approach (EU, Germany, Malta). The EU AMLR prohibits CASPs from maintaining anonymous accounts and, from July 2027, requires enhanced due diligence for any transfer to or from an unhosted wallet exceeding EUR 1,000, including verification that the customer controls the wallet (AMLR Art. 79 also bans anonymous wallets).

Germany's GwG Section 15a goes further, requiring obliged entities to assess whether any transfer involving a self-hosted address presents elevated money laundering risk and to document their risk assessment, with a BaFin implementation deadline of July 2027.

Malta requires CASPs to assess ownership/control and apply mitigating measures for transfers over EUR 1,000 to or from self-hosted addresses.

Estonia applies the EU TFR to self-hosted-wallet transfers above thresholds.

Risk-based approach (UK, Singapore, Japan). The UK FCA expects registered firms to apply a risk-based approach to transactions with unhosted wallets but has not imposed a blanket prohibition; travel-rule data collection is not mandatory for unhosted-wallet transfers, though extra originator data may be required above EUR 1,000.

Singapore's MAS guidelines clarify that self-hosted wallets are exempt from travel-rule information sharing but should be treated as carrying higher ML/TF risk, with VASPs required to verify customer ownership / apply EDD.

Japan requires VASPs to collect and retain originator/beneficiary information and to assess ML/TF risk by investigating self-hosted-wallet attributes.

Permissive / carve-out approach (US, Switzerland, BVI). The US withdrew its proposed unhosted-wallet rule in September 2024; users of single-signature unhosted wallets and unhosted-wallet software providers are not money transmitters. Switzerland applies the AMLA to intermediaries (no distinct unhosted-wallet rule stated). The BVI expressly excludes unhosted/non-custodial wallet providers from VASP scope, placing non-custodial DeFi outside the AML regime unless a registrable activity is present.

Brazil requires SPSAVs to identify self-hosted-wallet owners, with self-hosted transfers also subject to the FX framework (Resolution 521).

Not addressed / not verified. For a large share of the surveyed jurisdictions the matrix records no distinct unhosted-wallet rule:

Canada,

Australia,

Hong Kong,

South Korea,

India,

Thailand,

Cayman Islands,

Bermuda,

El Salvador, Marshall Islands,

Liechtenstein,

UAE,

South Africa,

Nigeria, and Seychelles. Honest reflection of these gaps matters: the absence of a stated rule is not equivalent to a permissive rule.

1.5 Blockchain Analytics Requirements

Most jurisdictions do not explicitly mandate the use of blockchain analytics tools, but supervisory expectations are converging around their use as a necessary component of AML compliance.

US Treasury position. The US Treasury has described blockchain analytics solutions as "essential components of AML/CFT compliance programs," noting their functions in wallet screening, transaction monitoring, and counterparty risk scoring. However, regulators have not issued specific guidance on minimum standards for analytics tool deployment.

EU and UK expectations. Under MiCA and AMLR, CASPs are expected to implement transaction monitoring systems capable of detecting suspicious patterns -- an expectation that flows through to France, Germany, Malta, Estonia, and (via the EEA) Liechtenstein. The UK FCA has indicated that registered firms should use appropriate technology to screen transactions, including those involving DeFi protocols.

Industry standard. In practice, major blockchain analytics providers (Chainalysis, Elliptic, TRM Labs) are used by the majority of regulated exchanges and increasingly by DeFi front-end operators. The Marshall Islands' 2024 Regulations expressly authorise law-enforcement monitoring of on-chain activity. The FATF's 2025 targeted update noted that AI-powered analytics are improving detection of on-chain laundering typologies but called for clearer supervisory expectations.

2. Comparative Analysis

The table below summarises the AML, Travel Rule, unhosted-wallet, and sanctions posture for all 27 jurisdictions. Cells reading "Not verified" reflect that the underlying jurisdiction file does not confirm a specific rule, not that the activity is unregulated.

Derived aggregates (N = 27). Every jurisdiction surveyed applies AML/CTF obligations to an identifiable obliged entity, and none imposes direct AML obligations on a genuinely controllerless protocol. Sixteen jurisdictions have a confirmed numeric or "all-transfer/zero" Travel Rule threshold (US, Canada, Hong Kong, Japan, Singapore, South Korea, BVI, EU, France, Germany, Switzerland, UK, Malta, Liechtenstein, UAE, South Africa); the remainder are phased (Brazil, Australia), confirmed-without-numeric-threshold (Cayman, Bermuda, India, Thailand, Estonia, Seychelles, Nigeria), or not verified (El Salvador, Marshall Islands). Only the EU and its member states (and Malta most strictly) impose a hard EUR 1,000 unhosted-wallet verification or anonymous-wallet prohibition; the majority of jurisdictions have no stated unhosted-wallet rule. Two jurisdictions impose outright product bans relevant to AML — the EU/member states (privacy coins, AMLR Art. 79, from July 2027) and Seychelles/Thailand-adjacent mixer prohibitions (Seychelles bans mixers/tumblers).

3. Enforcement Case Analysis

This section analyses the most significant enforcement actions that have shaped DeFi compliance expectations. Cases are organised by the legal theory underpinning the enforcement. Across all 27 jurisdictions surveyed, no regulator has taken an enforcement action against a genuinely decentralised, controllerless DeFi protocol or DAO wrapper: every action below targets an identifiable centralised operator, developer, or front-end.

3.1 Unlicensed Money Transmission / Operating Without Authorisation

Tornado Cash -- Roman Storm (US, DOJ)

• Jurisdiction: United States (SDNY)
• Regulator/Prosecutor: Department of Justice
• Target: Roman Storm, co-founder of Tornado Cash
• Charges: (1) Conspiracy to commit money laundering; (2) Conspiracy to operate an unlicensed money transmitting business; (3) Conspiracy to violate IEEPA (sanctions evasion)
• Outcome (August 2025): Mixed verdict after four-week trial. Storm was convicted of conspiracy to operate an unlicensed money transmitting business. The jury deadlocked on the two more serious charges -- conspiracy to commit money laundering and conspiracy to violate sanctions. On 9 March 2026 the DOJ filed a letter intending to retry the two deadlocked counts (proposed October 2026 start); on 9 April 2026 Judge Failla heard Storm's Rule 29 acquittal motion, which remained undecided as of June 2026.
• DeFi precedent: Establishes that developers who create, deploy, and profit from a mixing protocol can be prosecuted for operating an unlicensed money transmitter -- even where the protocol runs autonomously on-chain. However, the jury's inability to reach a verdict on money laundering and sanctions charges suggests limits to criminal liability for code deployment.
• Implications: DeFi developers face criminal exposure if their protocol functions as a money transmitting business and they fail to register with FinCEN. The DOJ's April 2025 guidance on "Ending Regulation by Prosecution" may limit future prosecutions of this nature.
• Sources: Mayer Brown Analysis; CoinDesk Report; IRS Criminal Investigation

Tornado Cash -- Alexey Pertsev (Netherlands / EU)

• Jurisdiction: Netherlands (s-Hertogenbosch Court)
• Regulator/Prosecutor: Dutch Public Prosecution Service (Openbaar Ministerie)
• Target: Alexey Pertsev, Tornado Cash developer
• Charges: Money laundering (habitual)
• Outcome (May 2024): Convicted. Sentenced to 64 months imprisonment for laundering an estimated USD 2.2 billion. Seized assets including a Porsche and EUR 1.9 million in cryptocurrency not returned. Appeal pending as of June 2026.
• DeFi precedent: First criminal conviction of a DeFi developer in Europe for money laundering based on deploying a mixing protocol. Court held that Pertsev should have suspected criminal origins of illicit funds transiting through Tornado Cash.
• Implications: EU jurisdictions may hold developers criminally liable under national money laundering statutes even where the developer does not directly handle funds.
• Sources: CoinDesk Report; The Hacker News

3.2 Unregistered Exchange / Commodity Law Violations

Ooki DAO (US, CFTC)

• Jurisdiction: United States (ND California)
• Regulator: Commodity Futures Trading Commission (CFTC)
• Target: Ooki DAO (successor to bZeroX)
• Charges: (1) Unlawful off-exchange leveraged retail commodity transactions; (2) Operating as an unregistered futures commission merchant; (3) Failure to implement AML/KYC procedures
• Outcome (June 2023): Default judgment. Court ordered USD 643,542 penalty and permanent cessation of operations.
• DeFi precedent: First enforcement action establishing that a DAO can be treated as a legal "person" -- specifically, an unincorporated association under California law -- subject to the Commodity Exchange Act. The court rejected the argument that a DAO's decentralised governance structure places it beyond regulatory reach.
• Implications: Token holders who vote on governance proposals may bear collective liability for regulatory violations. Transferring control from a corporate entity to a DAO does not extinguish regulatory obligations.
• Sources: CFTC Press Release; CFTC Enforcement Statement; CoinDesk Report

3.3 Market Manipulation in DeFi

Mango Markets -- Avraham Eisenberg (US, DOJ/CFTC)

• Jurisdiction: United States (SDNY)
• Regulator/Prosecutor: Department of Justice; CFTC (parallel civil action)
• Target: Avraham Eisenberg
• Charges: Commodities fraud, commodities manipulation, wire fraud
• Outcome: Convicted by jury in April 2024. However, in May 2025, Judge Arun Subramanian vacated all criminal convictions on grounds of improper venue and failure to prove material misrepresentation for wire fraud. Prosecution has appealed (appeal pending as of June 2026). Eisenberg separately sentenced to 52 months for unrelated charges.
• DeFi precedent: Initial conviction established that exploiting a DeFi protocol's oracle mechanism constitutes market manipulation and fraud under federal law -- rejecting the "code is law" defence. The subsequent vacatur on venue grounds complicates the precedent but does not eliminate the substantive legal theory.
• Implications: Prosecutors must carefully establish venue for DeFi-related crimes, particularly where decentralised protocols operate across jurisdictions. The "code is law" defence remains legally insufficient, but the government faces practical challenges in proving traditional fraud elements in on-chain contexts.
• Sources: TRM Labs Analysis; CoinDesk Report; Venable LLP Analysis

South Korea -- First Pump-and-Dump Prosecution (South Korea, FSC)

• Jurisdiction: South Korea
• Regulator: Financial Services Commission (FSC) / Financial Supervisory Service (FSS)
• Target: Unnamed individual
• Charges: Market manipulation under the Virtual Asset User Protection Act (VAUPA)
• Outcome: First criminal pump-and-dump charge under VAUPA, which took effect 19 July 2024. The accused acquired large positions, executed rapid buy orders to inflate prices (completing manipulation cycles within 10 minutes), and sold upon price increase; reported profits of "several hundred million won."
• DeFi precedent: First use of VAUPA's market manipulation provisions. VAUPA provides penalties including life imprisonment for severe cases.
• Implications: Jurisdictions with dedicated virtual asset legislation can prosecute manipulation more efficiently than those relying on legacy securities or commodities law.
• Sources: Cointelegraph Report; Library of Congress Analysis

3.4 Sanctions Evasion

OFAC Tornado Cash Designation and Reversal (US, Treasury)

• Jurisdiction: United States (Fifth Circuit)
• Regulator: OFAC / Treasury Department
• Target: Tornado Cash (protocol smart contracts)
• Charges: Designation under IEEPA for facilitating over USD 7 billion in cryptocurrency laundering, including by North Korea's Lazarus Group
• Outcome: Designated August 2022. Fifth Circuit held in November 2024 (Van Loon v. Department of the Treasury) that OFAC exceeded statutory authority because immutable smart contracts are not "property" under IEEPA. OFAC delisted Tornado Cash on 21 March 2025.
• DeFi precedent: Landmark ruling establishing that autonomous, immutable smart contracts cannot be designated as sanctioned property. This does not protect mutable protocols or the individuals who control them.
• Implications: Regulators must distinguish between immutable and mutable smart contracts when applying sanctions. Sanctions can still target protocol operators, governance token holders with meaningful control, and front-end operators.
• Sources: Jones Day Analysis; Treasury Delisting Notice; Venable LLP Analysis

UK and EU Russia-Sanctions Designations of Crypto Platforms (2026)

• Jurisdiction: United Kingdom; European Union
• Regulator: OFSI (UK HM Treasury); EU Council
• Target: Huobi Global S.A. (HTX) (UK); Russia-established crypto transfer/exchange platforms and the RUBx token (EU)
• Charges: Sanctions designation in the context of the UK and EU Russia sanctions regimes
• Outcome: On 26 May 2026 the UK designated HTX -- the first crypto exchange designated under UK Russia sanctions. On 23 April 2026 the EU adopted its 20th sanctions package imposing a total sectoral ban on Russia-established crypto transfer/exchange platforms and banning the RUBx token (crypto measures effective 24 May 2026).
• DeFi precedent: Sanctions are being applied to centralised exchanges and named tokens/platforms, not to autonomous protocols -- consistent with the Van Loon distinction. The EU's sectoral ban targets established platforms (legal persons), not deployed code.
• Implications: Regulated CASPs and firms must screen for newly designated platforms and tokens; the trend confirms that sanctions tooling is directed at identifiable entities and instruments.
• Sources: EU 20th sanctions package (adopted 23 April 2026); UK HM Treasury / OFSI designation of HTX (26 May 2026).

3.5 MiCA/Licensing Violations

Ethena GmbH (Germany, BaFin)

• Jurisdiction: Germany
• Regulator: BaFin
• Target: Ethena GmbH (issuer of USDe stablecoin)
• Charges: Offering tokens to the public without required authorisation; violations of MiCA organisational, capital, and reserve requirements
• Outcome: BaFin prohibited new USDe business (21 March 2025), imposed a EUR 600,000 coercive fine (4 April 2025), and ordered wind-down (14 April 2025). Ethena withdrew its MiCA authorisation application and ceased all EU operations. BaFin continued "name-and-warn" consumer warnings through March-May 2026.
• DeFi precedent: First significant MiCA-related enforcement action. Demonstrates that EU regulators will use MiCA's authorisation framework to shut down non-compliant token issuers operating in or targeting EU markets.
• Implications: DeFi protocols issuing tokens that qualify as e-money tokens or asset-referenced tokens under MiCA must obtain authorisation before offering to EU residents or face enforcement and forced wind-down.
• Sources: BaFin Notice; Finance Magnates Report

3.6 AML Compliance Failures

Korbit (South Korea, KoFIU)

• Jurisdiction: South Korea
• Regulator: Korea Financial Intelligence Unit (KoFIU)
• Target: Korbit (crypto exchange)
• Charges: Multiple violations of the Specific Financial Transaction Information Act -- 22,000 breaches including incomplete KYC checks, unreported overseas VASP transactions, and failure to assess ML risks in 655 NFT transactions
• Outcome (December 2025): KRW 2.73 billion (USD 1.9 million) fine, institutional warning, CEO warning, compliance officer reprimands.
• DeFi precedent: Demonstrates that NFT transactions fall within AML screening obligations. Part of a systematic inspection cycle across major Korean exchanges.
• Implications: Exchanges that facilitate access to DeFi (including NFT marketplaces) must apply the same AML rigour as to traditional crypto trading.
• Sources: Korea Herald; KuCoin News

Xeltox / Cryptomus (Canada, FINTRAC)

• Jurisdiction: Canada
• Regulator: FINTRAC
• Target: Xeltox Enterprises (operating Cryptomus)
• Charges: AML/CTF violations under the PCMLTFA
• Outcome (October 2025): CAD 176.9 million penalty -- the largest in FINTRAC history. Separately, FINTRAC revoked 23 crypto-linked MSB registrations on 17 March 2026 (~47 revocations in 2026), and earlier obtained a CAD 6M+ outcome against Binance (which withdrew from the Canadian market).
• DeFi precedent: Reinforces the Canadian enforcement-first posture targeting centralised gateways and unregistered MSBs rather than protocols.
• Implications: Crypto MSBs serving Canadian users face record-scale AML penalties; no DeFi-protocol or DAO enforcement has occurred as of March 2026.
• Sources: FINTRAC enforcement notices (Xeltox/Cryptomus, October 2025; MSB revocations, 17 March 2026).

FIU Mass Revocations (Estonia)

• Jurisdiction: Estonia
• Regulator: Financial Intelligence Unit (FIU / Rahapesu Andmebüroo)
• Target: Virtual currency licensees (sector-wide)
• Charges: AML/CTF non-compliance under MLTFPA
• Outcome: A 2020 mass revocation of 500+ VASP licences, followed by 2022 MLTFPA amendments under which 389 authorisations expired; active authorisations fell from 2,000+ to ~100 by 1 May 2023 (an ~85%+ contraction). Supervision has since moved to Finantsinspektsioon under MiCA, with a hard legacy-VASP sunset on 1 July 2026.
• DeFi precedent: Demonstrates an AML-driven crackdown that reshaped a former "VASP haven" -- though directed at registered VASPs, not decentralised protocols.
• Implications: Permissive licensing regimes can pivot sharply to restrictive AML enforcement; firms relying on light-touch jurisdictions face concentrated revocation risk.
• Sources: Estonian FIU revocation records; Finantsinspektsioon CASP-transition notices (March 2026).

3.7 Product Classification

Block Earner (Australia, ASIC)

• Jurisdiction: Australia
• Regulator: Australian Securities and Investments Commission (ASIC)
• Target: Block Earner / Web3 Ventures (crypto yield product provider)
• Charges: Offering financial products without an Australian financial services licence
• Outcome: Federal Court initially found unlicensed conduct (February 2024) but declined to impose a penalty. Full Federal Court reversed on appeal (April 2025), holding that the product was not a financial product. ASIC obtained special leave to appeal to the High Court, which heard the appeal on 12 March 2026 with judgment reserved as of June 2026.
• DeFi precedent: Providing access to DeFi yield products may not constitute offering a financial product under Australian law, although this remains contested at the highest court level.
• Implications: Courts may resist regulators' attempts to shoehorn DeFi access products into existing financial product definitions. Dedicated DeFi legislation may be necessary.
• Sources: ASIC Media Release 25-062MR; ASIC Media Release 25-194MR

BPS Financial / Qoin (Australia, ASIC)

• Jurisdiction: Australia
• Regulator: ASIC
• Target: BPS Financial (Qoin)
• Charges: Unlicensed financial-services conduct
• Outcome (27 January 2026): Federal Court ordered BPS Financial to pay an AUD 14 million penalty plus a 10-year AFSL ban (ASIC 26-008MR).
• DeFi precedent: Substantial penalty for a non-compliant token/payment product, complementing the contested Block Earner litigation as ASIC pursues a "facilitative but firm" posture.
• Implications: Australian regulators will impose significant penalties on unlicensed crypto product providers even while DeFi-specific classification questions remain unresolved at the High Court.
• Sources: ASIC Media Release 26-008MR (27 January 2026).

3.8 Unlicensed Exchange Operations

JPEX (Hong Kong)

• Jurisdiction: Hong Kong
• Regulator: Securities and Futures Commission (SFC) / Hong Kong Police
• Target: JPEX (crypto exchange)
• Charges: Operating without a licence, fraud, misleading claims about licensing status
• Outcome: SFC flagged JPEX in September 2023. Approximately 80 individuals arrested and HKD 1.6 billion in assets frozen. The case remains the largest crypto enforcement action in Hong Kong history, with disciplinary action against 14 individuals and 12 corporations; total fines of HKD 49.9 million (~USD 6.4 million) were imposed across 2023/2024.
• DeFi precedent: While JPEX was a centralised exchange, the case catalysed Hong Kong's tightening of its VATP licensing regime, with direct implications for DeFi front-ends operating in or marketing to Hong Kong.
• Implications: Regulators will pursue aggressive enforcement against unlicensed platforms, including criminal prosecution and asset freezing, where consumer losses are substantial.
• Sources: SCMP Report; Skadden Analysis

Thailand -- Extraterritorial Unlicensed-Exchange Enforcement

• Jurisdiction: Thailand
• Regulator: SEC Thailand / Economic Crime Suppression Division / MDES
• Target: Bybit, 1000X, CoinEx, OKX, XT.COM (named 29 May 2025); a licensed Thai broker, its affiliated overseas platform, and executives (February 2026 criminal complaints)
• Charges: Operating a digital asset business / serving Thai users without an SEC licence (Emergency Decree §§26, 66), extraterritorial since 13 April 2025
• Outcome: The five named offshore platforms were all blocked for Thai users by 28 June 2025; in February 2026 the SEC filed criminal complaints over unlicensed exchange operation dating to 2023. Unlicensed operation carries up to 3 years' imprisonment and/or a fine up to THB 300,000.
• DeFi precedent: Thailand's extraterritorial regime reaches offshore centralised platforms targeting Thai users; no DeFi-protocol or DAO-specific action has been recorded.
• Implications: Offshore operators -- and the local intermediaries that channel users to them -- face MDES blocking plus criminal referral; the staking/lending prohibition forecloses centralised "DeFi-as-a-service."
• Sources: SEC Thailand notices (29 May 2025); SEC criminal complaints (February 2026).

UAE -- VARA Unlicensed-Firm Penalties

• Jurisdiction: UAE (Dubai)
• Regulator: Virtual Assets Regulatory Authority (VARA)
• Target: 19 unlicensed firms
• Charges: Conducting virtual asset activity without a VARA licence
• Outcome (7 October 2025): VARA penalised 19 firms with fines of AED 100,000-600,000 plus cease-and-desist orders. The maximum VARA fine is AED 10,000,000 (~USD 2.7 million), doubled for repeat offences.
• DeFi precedent: Demonstrates an escalating enforcement posture in the world's first DeFi-specific licensing regime; the action targeted unlicensed centralised activity, not licensed DeFi operators.
• Implications: Even in the most DeFi-friendly jurisdiction, operating without authorisation draws graduated fines, suspension, and revocation. No specific Gate.io enforcement was verified (see Verification Notes).
• Sources: Cointelegraph; Finance Magnates

India -- FIU-IND Chokepoint Penalties

• Jurisdiction: India
• Regulator: FIU-IND (PMLA); Enforcement Directorate (ED)
• Target: Binance (₹18.82 crore, June 2024); Bybit (₹9.27 crore, January 2025); offshore exchanges (show-cause notices); WazirX (ED investigation)
• Charges: PMLA AML/reporting-entity violations; unregistered offshore VDASP operation
• Outcome: Aggregate PMLA penalties of ~₹28 crore (~USD 3.37 million) in FY2024-25; 53 unregistered exchanges taken down cumulatively since 2023; 54 VDASPs registered as of 9 March 2026.
• DeFi precedent: India's surveillance-heavy chokepoint enforcement targets centralised and offshore exchanges; no DeFi-protocol action is on record.
• Implications: Offshore exchanges serving Indian users must register with FIU-IND and meet full reporting-entity obligations; controllerless protocols have no registrant and fall outside the perimeter.
• Sources: FIU-IND penalty orders (Binance, June 2024; Bybit, January 2025).

South Africa -- Exchange-Control Forfeiture Litigation

• Jurisdiction: South Africa
• Regulator/Court: SARB/FinSurv; High Court
• Target: Mangundhla (and contrasting Standard Bank v SARB)
• Charges: Exchange-control contravention; characterisation of Bitcoin as "money"/"capital"
• Outcome: Two conflicting High Court judgments: Standard Bank v SARB [2025] (crypto not "capital") versus Mangundhla v SARB [2026] ZAGPJHC 579 (1 June 2026 -- Bitcoin held to be "money" and "capital," forfeiture upheld; ~R6m assets forfeited, ~1,680 BTC / ~R182m funnelled offshore). The FSCA reported 81 unlicensed-business investigations (56 ongoing).
• DeFi precedent: The contested characterisation of crypto under exchange-control law shapes how cross-border DeFi flows are treated; no DeFi-protocol action has occurred.
• Implications: Cross-border DeFi transfers may be caught by exchange-control forfeiture where crypto is treated as "capital"; the law remains unsettled pending the draft Capital Flow Management Regulations 2026.
• Sources: Mangundhla v SARB [2026] ZAGPJHC 579; Standard Bank v SARB [2025]; FSCA enforcement updates.

Nigeria -- Binance Coercive Enforcement

• Jurisdiction: Nigeria
• Regulator: SEC / CBN / EFCC / NRS (ex-FIRS)
• Target: Binance and its executives
• Charges: Money-laundering and tax-evasion allegations; unregistered operation
• Outcome: Executives detained in 2024-2025 (charges against Tigran Gambaryan dropped October 2024); the EFCC froze 105 accounts (April 2024); a tax-evasion claim reportedly sought up to US$10 billion (resolution not verified). Unregistered exchange operation carries fines up to ₦10m and/or ≥5 years' imprisonment under ISA 2025.
• DeFi precedent: Nigeria's aggressive, sometimes coercive posture targets centralised exchanges and P2P/FX activity, not DeFi; no DeFi-specific enforcement has been found.
• Implications: Centralised exchanges serving Nigerian users face statutory securities-based enforcement, executive removal, and operational halts under ISA 2025.
• Sources: EFCC account-freeze notices (April 2024); Nigerian press reporting on Binance proceedings (2024-2025).

Bittrex Global (Bermuda, BMA)

• Jurisdiction: Bermuda
• Regulator: Bermuda Monetary Authority (BMA)
• Target: Bittrex Global (Bermuda) Ltd
• Charges: DABA compliance failures
• Outcome: BMA issued a decision notice and imposed a "substantial civil penalty" (amount not stated; civil penalties up to US$10,000,000 are available). Lai v BMA (2025 SC (Bda) 49 Civ) upheld the BMA's DABA authority.
• DeFi precedent: Bermuda's first significant digital-asset enforcement targeted a centralised licensee; its engagement-led posture toward DeFi (licensing DerivaDEX, the Embedded Supervision pilot) is distinct from its enforcement against centralised entities.
• Implications: Even an innovation-first regime with a world-first DAO-governed-exchange licence enforces civil penalties against non-compliant centralised digital asset businesses.
• Sources: BMA decision notice (Bittrex Global); Lai v BMA 2025 SC (Bda) 49 Civ.

Singapore -- Bsquared MPI Revocation and Composition Penalties

• Jurisdiction: Singapore
• Regulator: Monetary Authority of Singapore (MAS)
• Target: Bsquared Technology Pte Ltd (MPI licence revoked); five Major Payment Institutions (composition penalties)
• Charges: Regulatory/AML failings
• Outcome: On 14 May 2026 MAS revoked the MPI licence of Bsquared Technology -- the first publicly disclosed revocation of a crypto/DPT MPI licence. On 27 June 2025 MAS imposed S$960,000 in composition penalties on five MPIs.
• DeFi precedent: Singapore's historically mild posture is hardening; the action targeted licensed centralised DPT providers, not a DeFi protocol.
• Implications: Activity-based licensees in Singapore now face revocation and composition penalties; no enforcement has targeted a DeFi protocol directly as of March 2026.
• Sources: MAS enforcement notices (Bsquared revocation, 14 May 2026; MPI composition penalties, 27 June 2025).

4. What Works and What Doesn't

4.1 Approaches That Are Working

Risk-based AML frameworks applied to identifiable intermediaries. Jurisdictions that apply AML obligations to entities with meaningful control over DeFi protocols (front-end operators, governance token holders with admin keys, protocol treasuries) achieve compliance without attempting to regulate autonomous code. Singapore's approach under PSN02, the FATF owner/operator test, and the recurring "control or sufficient influence" / "spectrum of decentralization" tests adopted by India, Hong Kong, Japan, Thailand, South Africa, and Nigeria all exemplify this model. The key advantage is that this approach focuses resources on the points where intervention is both legally sound and practically effective -- the human-controlled interfaces between DeFi protocols and the traditional financial system. The unanimity of the surveyed jurisdictions on this point (all 27 attach AML to obliged entities, none to controllerless code) is itself evidence that the model is the global consensus.

Dedicated virtual asset legislation. South Korea's VAUPA, the EU's MiCA/AMLR package, and the new bespoke statutes in Bermuda (DABA/DAIA), the Cayman Islands (VASP Act), the BVI (VASP Act 2022), the Marshall Islands (DAO Act), Thailand (Emergency Decree), Seychelles (VASP Act 2024), and Nigeria (ISA 2025) provide purpose-built frameworks that address DeFi-adjacent risks without forcing regulators to rely solely on legacy statutes. VAUPA's market manipulation provisions enabled the first pump-and-dump prosecution within months of taking effect. By contrast, the US reliance on legacy statutes (the Securities Act, the Commodity Exchange Act, and the BSA) has produced contested enforcement outcomes and judicial reversals.

Coordinated enforcement with clear legal authority. The CFTC's Ooki DAO action succeeded because it used established commodity exchange law and obtained a default judgment. BaFin's Ethena GmbH action succeeded because MiCA provides clear authorisation requirements. ASIC's AUD 14m Qoin penalty and FINTRAC's record CAD 176.9m Xeltox penalty rested on well-defined statutory mandates. In each case the regulator operated within a clear statutory mandate, reducing the risk of judicial pushback and improving the deterrent signal.

Blockchain analytics as a supervisory tool. Regulators and compliance teams that leverage blockchain analytics for transaction monitoring, wallet screening, and sanctions compliance detect illicit flows more effectively than those relying solely on traditional AML tools. The US Treasury has described these tools as "essential components of AML/CFT compliance programs," and the Marshall Islands has expressly authorised law-enforcement on-chain monitoring. The public and auditable nature of most blockchain transactions means that, paradoxically, DeFi can provide greater transparency than traditional finance -- provided regulators invest in the analytical capacity to exploit this advantage.

Graduated enforcement escalation. Jurisdictions that use a graduated approach -- supervisory engagement, then remediation requirements, escalating to formal enforcement only when necessary -- achieve better outcomes than punitive-only regimes. South Korea's systematic inspection programme across all registered exchanges (Upbit, Korbit, Coinone, Bithumb, Gopax), the UAE's tiered VARA penalties, and Seychelles' "Show and Tell" supervisory model all illustrate this approach.

4.2 Approaches That Are Not Working

Regulation by enforcement. The US experience demonstrates the limitations of using enforcement actions to establish regulatory norms in the absence of clear rules. The DOJ's own April 2025 guidance -- titled "Ending Regulation by Prosecution" -- acknowledged this problem explicitly. The Tornado Cash sanctions were reversed by the Fifth Circuit, the Mango Markets convictions were vacated on procedural grounds, and the SEC's Wells notice to Uniswap was followed by closure of the investigation (February 2025) without enforcement. This pattern creates regulatory uncertainty that deters legitimate innovation without effectively deterring illicit activity.

Sanctioning autonomous code. OFAC's attempt to designate Tornado Cash's immutable smart contracts failed at the Fifth Circuit, which held that code running autonomously on a public blockchain is not "property" capable of being owned. The 2026 UK (HTX) and EU (20th package) sanctions designations confirm the durable lesson: sanctions tooling must target identifiable entities, platforms, and named tokens, not deployed code. The lesson is not that mixing services are beyond regulatory reach, but that the tool chosen must match the nature of the target.

Applying legacy product definitions to DeFi. ASIC's attempt to classify Block Earner's DeFi yield product as a financial product was rejected by the Full Federal Court (and remains contested at the High Court, judgment reserved as of June 2026). South Africa's conflicting High Court judgments on whether Bitcoin is "capital" (Standard Bank versus Mangundhla) show the same strain. Existing definitions -- designed for securities, derivatives, and managed investment schemes -- were not drafted with DeFi in mind and risk both under-inclusion and over-inclusion.

Blanket prohibitions without enforcement capacity. Banning privacy coins (as the EU AMLR does from July 2027), prohibiting staking/lending yield products (Thailand, Singapore retail, South Korea in practice), or banning mixers outright (Seychelles) is only effective if regulators can monitor and enforce compliance at the protocol level. Without sufficient supervisory resources and technical capacity, such prohibitions may drive activity to non-compliant jurisdictions or to fully decentralised interfaces that are harder to regulate. South Korea's real-name-banking requirement, which forecloses any compliant DeFi pathway, illustrates how a prohibition-by-design can leave activity in a vacuum rather than under supervision.

Inconsistent Travel Rule implementation. The FATF's 2024 targeted update found that only 29% of jurisdictions have fully implemented the Travel Rule for virtual assets. Even among the implementing jurisdictions surveyed here, threshold dispersion is stark: €0/zero (EU, Malta, Japan, Singapore all-transfer, Switzerland, South Korea domestic), CAD/USD/EUR/HKD/AED ~1,000-equivalents (Canada, Hong Kong, BVI, Liechtenstein, UAE), ~ZAR 25,000 (South Africa), USD 3,000 (US), with several jurisdictions (Brazil, Australia) still phasing in and others (El Salvador, Marshall Islands) unconfirmed. This inconsistency creates gaps that facilitate regulatory arbitrage, particularly for cross-border DeFi transactions.

Delayed or fragmented implementation. Several major initiatives have been delayed. The EU AMLA will not be fully operational until 2028 and the AMLR applies only from 10 July 2027. Germany extended the GwG Section 15a unhosted-wallet deadline to July 2027. Switzerland's AMLA revision is expected only in H2 2026 (no date set). Brazil's Travel Rule does not reach full compliance until February 2028. Australia's tranche-2 Travel Rule commences 1 July 2026. South Korea has deferred its 22% crypto capital-gains tax three times (now January 2027). These delays create regulatory gaps during which illicit actors can exploit the absence of clear rules.

5. Recommended Framework: Risk-Based AML for DeFi

5.1 Guiding Principles

1. Regulate the humans, not the code. AML/KYC obligations should attach to identifiable persons and entities that exercise meaningful control over DeFi protocols -- deployers who retain admin keys, governance participants with decision-making power, front-end operators, and treasury managers. The unanimous practice of all 27 jurisdictions surveyed confirms this is the only workable locus of obligation.

2. Proportionality. Compliance requirements should be proportionate to the risk posed and the control exercised. A front-end operator that provides a user interface to a decentralised exchange poses different risks than the deployer of an immutable smart contract.

3. Technology neutrality with functional equivalence. The same activity (e.g., exchanging value, lending, custodying assets) should attract the same regulatory treatment regardless of whether it is performed through a traditional intermediary or a DeFi protocol -- the "same activity, same risk, same regulation" principle shared by Singapore, Switzerland, Hong Kong, France, South Africa, and the UK.

4. International coordination. DeFi operates across borders by default. Unilateral regulatory action -- as the Tornado Cash sanctions episode demonstrated -- is both legally fragile and practically insufficient.

5.2 Tiered Compliance Obligations

Tier 1: Full AML/KYC (high control). Entities that operate DeFi protocol front-ends, hold admin keys or upgrade authority, control protocol treasuries, or receive fees from protocol operations. Requirements: registration/licensing, CDD, transaction monitoring, SAR filing, Travel Rule compliance, sanctions screening. Examples include companies operating swap interfaces (e.g., Uniswap Labs operating the uniswap.org front-end), stablecoin issuers with redemption mechanisms, and lending protocol operators who control interest rate parameters.

Tier 2: Enhanced due diligence (moderate control). Governance token holders who participate in votes affecting protocol parameters, oracle providers, bridge operators. Requirements: identity verification, risk-based transaction monitoring, sanctions screening, cooperation with law enforcement upon request. The threshold for "meaningful governance participation" should be defined by reference to voting power (e.g., holding more than 1% of governance tokens or actively participating in more than three governance votes within a 12-month period).

Tier 3: Monitoring only (minimal control). Immutable smart contracts with no admin key, fully autonomous protocols with no identifiable operator. Requirements: blockchain analytics monitoring by regulators and compliant intermediaries that interact with these protocols; no direct AML obligations on the protocol itself (as there is no obliged entity). This tier recognises the Fifth Circuit's holding in Van Loon v. Department of the Treasury that immutable code cannot be treated as property or sanctioned -- and reflects the surveyed jurisdictions' uniform recognition that controllerless protocols have no obliged entity. However, Tier 1 and Tier 2 entities that interact with Tier 3 protocols must apply enhanced due diligence to those interactions.

5.3 Specific Recommendations

For AML/KYC:

• Adopt the FATF owner/operator test as the primary method for determining DeFi AML applicability.
• Require DeFi front-end operators to implement CDD at minimum for transactions exceeding a risk-based threshold (recommend USD/EUR 1,000 for enhanced CDD).
• Mandate blockchain analytics integration for all Tier 1 obliged entities.

For sanctions compliance:

• Target sanctions designations at identifiable persons, entities, platforms, and named tokens, not at autonomous code (per Van Loon and the 2026 UK/EU platform designations).
• Require Tier 1 and Tier 2 entities to screen transactions against consolidated sanctions lists.
• Develop guidance on the treatment of mutable versus immutable smart contracts for sanctions purposes.

For the Travel Rule:

• Harmonise Travel Rule thresholds across jurisdictions to reduce arbitrage opportunities (the €0-to-USD 3,000 dispersion documented above is a live arbitrage vector).
• Develop technical standards for Travel Rule compliance in DeFi contexts, including solutions for smart contract interactions where no counterparty VASP exists.
• Encourage industry development of decentralised identity and verifiable credential solutions that enable Travel Rule compliance without centralised data collection.

For unhosted wallets:

• Apply risk-based enhanced due diligence rather than blanket prohibitions.
• Require wallet ownership verification for transactions above a harmonised threshold.
• Permit proof-of-control mechanisms (e.g., signed messages) as sufficient verification.

For enforcement:

• Prioritise clear rulemaking over enforcement-as-regulation. The DOJ's April 2025 guidance acknowledging the failure of this approach should be treated as a lesson for all jurisdictions.
• Focus enforcement resources on fraud, market manipulation, and sanctions evasion rather than on regulatory classification disputes.
• Ensure enforcement actions are based on established legal authority, with particular attention to jurisdictional and venue issues (as illustrated by the Mango Markets vacatur).
• Develop international enforcement cooperation frameworks specifically for DeFi (e.g., Operation Atlantic, which Canada joined 16 March 2026), recognising that protocol operators, users, and infrastructure may be located in different jurisdictions.
• Invest in regulatory technical capacity, including in-house blockchain analytics capability, to reduce dependence on industry self-reporting.

For supervisory coordination:

• Establish clear lead-regulator assignment for DeFi activities that span traditional regulatory boundaries (e.g., a DeFi lending protocol that also facilitates token swaps may fall within the remit of both securities and banking regulators).
• Implement information-sharing agreements between AML supervisors, securities regulators, and commodity regulators to prevent duplication and gaps.
• Participate actively in FATF's Virtual Assets Contact Group and contribute to the development of global standards that account for DeFi-specific risks.

6. Decision Matrix

Regulators can use the following matrix to determine the appropriate compliance approach for a DeFi protocol or activity.

Step 1: Identify the Control Structure

Step 2: Determine Applicable Obligations

Step 3: Assess Cross-Border Dimensions

Step 4: Enforcement Prioritisation

Step 5: Assess Protocol-Specific Characteristics

Step 6: Implementation Timeline

Regulators should sequence implementation to align with the global regulatory calendar:

1. Immediate (2026): Ensure all Tier 1 entities are registered or licensed under existing frameworks. Implement sanctions screening for all regulated DeFi interactions. Deploy blockchain analytics for supervisory monitoring. Note the 2026 milestones already in force: South Africa's FIC Directive 9 Travel Rule (April 2025), Australia's tranche-2 Travel Rule (1 July 2026), Brazil's phased Travel Rule (from February 2026), and the EU 20th sanctions package crypto measures (24 May 2026).

2. Near-term (July 2027): Align with EU AMLR and TFR applicability dates and Germany's GwG §15a unhosted-wallet deadline. Implement enhanced due diligence for unhosted wallet transfers. Apply Travel Rule requirements to all regulated DeFi intermediaries.

3. Medium-term (2028): Align with EU AMLA operational date and Brazil's full Travel Rule compliance (February 2028). Extend supervision to Tier 2 entities where appropriate. Develop enforcement cooperation frameworks for cross-border DeFi cases.

4. Ongoing: Participate in FATF review cycles (note South Africa's expected 2026-2027 mutual evaluation and Bermuda's October 2026 CFATF mutual evaluation). Update frameworks as DeFi technology evolves (e.g., zero-knowledge proofs enabling compliant privacy, decentralised identity solutions enabling Travel Rule compliance without centralised data collection).

Verification Notes

All factual claims in this document derive from the canonical DeFi fact-matrix compiled from the already-verified jurisdiction files. Figures and dates were originally verified through web searches conducted on 20 March 2026, with the cross-country synthesis refreshed and extended to all 27 jurisdictions on 4 June 2026. Where Phase 1 findings were found to be inaccurate or unverifiable, corrections are noted below. Regulators should independently verify all cited sources before relying on them for policy decisions.

Key verification details:

Tornado Cash -- Roman Storm trial: Verified via Mayer Brown, CoinDesk, and IRS Criminal Investigation. The Phase 1 finding of "acquitted June 2025 on money laundering" was CORRECTED: Storm was not acquitted; the jury deadlocked on money laundering and sanctions charges in August 2025, with conviction only on unlicensed money transmitting. Updated 4 June 2026: on 9 March 2026 the DOJ filed a letter intending to retry the two deadlocked counts (proposed October 2026 start); the Rule 29 acquittal motion was heard 9 April 2026 and remained undecided as of June 2026.

Tornado Cash -- Alexey Pertsev: 64-month sentence (for laundering ~USD 2.2 billion) verified via CoinDesk and The Hacker News. Appeal pending as of June 2026.

OFAC Tornado Cash delisting: Verified via US Treasury Press Release and Fifth Circuit ruling analysis by Jones Day.

UK and EU 2026 Russia-sanctions designations: UK designation of Huobi Global S.A. (HTX) on 26 May 2026 (first crypto exchange so designated) and the EU 20th sanctions package (adopted 23 April 2026; total sectoral ban on Russia-established crypto platforms and RUBx token ban, crypto measures from 24 May 2026) reflected per the fact-matrix UK and EU records.

Ooki DAO: USD 643,542 fine verified via CFTC Press Release 8590-22 and CFTC Enforcement Statement.

Mango Markets -- Eisenberg: Conviction (April 2024) and subsequent vacatur (May 2025) verified via TRM Labs and Venable LLP. Phase 1 finding of "convicted fraud + manipulation" was CORRECTED: convictions were vacated on venue and misrepresentation grounds; appeal pending as of June 2026.

EU AMLR / TFR: AMLR (Regulation 2024/1624) effective 10 July 2027 and EUR 1,000 unhosted-wallet threshold; TFR (Regulation 2023/1113) in force 30 December 2024 with €0 CASP-to-CASP threshold. Privacy-coin / anonymous-wallet prohibition under AMLR Art. 79.

UK Travel Rule: 1 September 2023 effective date verified via FCA Statement and Mayer Brown.

Japan Travel Rule: 1 June 2023 effective date and no-threshold requirement verified via Sygna and Notabene.

Singapore PSN02: 28 January 2020 effective date and all-transfer requirement verified via Notabene and MAS Notice PSN02. MAS revoked the Bsquared Technology MPI licence on 14 May 2026 (first crypto/DPT MPI revocation) and imposed S$960,000 in composition penalties on five MPIs (27 June 2025).

Switzerland AMLA revision: H2 2026 expected entry into force (no date set as of 4 June 2026); effectively CHF 0 Travel Rule threshold for virtual-currency exchanges (CHF 1,000 for transactions linked within 30 days).

Germany GwG Section 15a: BaFin July 2027 unhosted-wallet implementation deadline; stricter-than-EU enhanced due diligence on self-hosted-wallet transfers.

Ethena GmbH: EUR 600,000 coercive fine, 21 March 2025 prohibition, 14 April 2025 wind-down order verified via BaFin Official Notice and Finance Magnates.

Korbit: KRW 2.73 billion fine verified via Korea Herald and KuCoin News.

Canada -- Xeltox/Cryptomus: CAD 176.9 million FINTRAC penalty (October 2025, record) and 23 crypto-MSB registration revocations (17 March 2026) per the fact-matrix Canada record. Canada joined Operation Atlantic on 16 March 2026.

Estonia -- FIU mass revocations: 2020 revocation of 500+ VASP licences; 2022 MLTFPA amendments (389 authorisations expired); active authorisations fell from 2,000+ to ~100 by 1 May 2023. Legacy VASP sunset 1 July 2026 (no extension).

Block Earner / BPS Financial (Qoin): Full Federal Court reversal (April 2025) and High Court appeal (heard 12 March 2026, judgment reserved) verified via ASIC Media Release 25-062MR and ASIC Media Release 25-194MR. BPS Financial (Qoin) ordered to pay AUD 14 million plus a 10-year AFSL ban on 27 January 2026 (ASIC 26-008MR).

JPEX: Approximately 80 arrests and HKD 1.6 billion frozen; HKD 49.9 million total fines (2023/2024); disciplinary action against 14 individuals and 12 corporations. Largest crypto enforcement action in Hong Kong history.

South Korea pump-and-dump prosecution: First criminal charge under VAUPA (effective 19 July 2024) verified via Cointelegraph; reported profits of "several hundred million won."

Thailand extraterritorial enforcement: SEC named Bybit, 1000X, CoinEx, OKX, XT.COM illegal for Thai users (29 May 2025; all blocked by 28 June 2025); February 2026 criminal complaints against a licensed broker, its overseas affiliate, and executives under Emergency Decree §§26, 66; extraterritorial regime since 13 April 2025.

Uniswap SEC Wells notice: Closure without enforcement action (February 2025) verified via Columbia Law CLS Blue Sky Blog and Uniswap Blog.

UAE VARA enforcement: Fines against 19 unlicensed firms (7 October 2025; AED 100,000-600,000 + cease-and-desist) verified via Cointelegraph and Finance Magnates. Max VARA fine AED 10,000,000 (doubled for repeat). No specific Gate.io enforcement notice was verified; the Phase 1 finding regarding Gate.io could NOT BE VERIFIED. UAE Travel Rule threshold AED 3,500 (~USD 950). VARA DeFi Limited License first issued February 2025 (MANTRA).

India FIU-IND enforcement: Binance ₹18.82 crore (June 2024); Bybit ₹9.27 crore (January 2025); aggregate ~₹28 crore PMLA penalties FY2024-25; 54 VDASPs registered (9 March 2026); 53 unregistered exchanges taken down cumulatively since 2023.

South Africa exchange-control litigation: Conflicting High Court judgments Standard Bank v SARB [2025] (crypto not "capital") and Mangundhla v SARB [2026] ZAGPJHC 579 (1 June 2026; Bitcoin "money"/"capital", forfeiture upheld, ~R6m forfeited). FIC Directive 9 Travel Rule in force 30 April 2025 (~ZAR 25,000). South Africa exited the FATF grey list 24 October 2025.

Nigeria Binance enforcement: Executives detained 2024-2025 (Gambaryan charges dropped October 2024); EFCC froze 105 accounts (April 2024); tax-evasion claim reportedly up to US$10 billion (resolution NOT VERIFIED). Digital assets statutorily classified as securities under ISA 2025; FATF grey-listed February 2023 (current status NOT VERIFIED).

Bermuda Bittrex Global: BMA decision notice + "substantial civil penalty" (amount not stated; civil penalties up to US$10,000,000 available); Lai v BMA (2025 SC (Bda) 49 Civ) upheld DABA/BMA authority. World-first DAO-governed exchange licence (DerivaDEX, Class T).

Marshall Islands: AML/CFT under Banking Act framework with FIU within MIMA (from 23 September 2025); Travel Rule threshold NOT VERIFIED; on-chain law-enforcement monitoring authorised under 2024 Regulations; FATF/APG 2024 rated 0/11 effectiveness outcomes as substantially/highly effective.

Cayman Islands / BVI / Seychelles / El Salvador AML perimeters: Cayman AML/CTF applies to registered/licensed VASPs (AML Regs 2025 Revision); BVI VASPs are "relevant persons" with unhosted/non-custodial providers expressly excluded (US$1,000 Travel Rule context); Seychelles licensed VASPs are reporting entities under AML/CFT (Amendment) Regs 2024 with mixers/tumblers prohibited; El Salvador AML/CFT attaches to registered issuers/DASPs under LEAD (UIF reporting, GAFILAT member; Travel Rule threshold NOT VERIFIED).

FATF owner/operator test: Verified via TRM Labs and FATF 2024 Targeted Update.

FinCEN unhosted wallet rule withdrawal: Verified via Unchained Crypto and Consumer Financial Services Law Monitor.

Binance AMF investigation: French judicial probe verified via CoinDesk and Crypto Briefing. Note: The investigating authority is JUNALCO (National Jurisdiction for the Fight against Organized Crime), not the AMF directly.