DeFi Protocol-Specific Regulation

Executive Summary

This guidance document analyzes the regulatory treatment of six distinct DeFi protocol types across twenty-seven jurisdictions. It provides evidence-based findings from enforcement actions and comparative regulatory analysis, and offers a decision matrix for protocol classification.

Decentralized finance (DeFi) protocols present regulators with a fundamental classification challenge: protocols that operate autonomously via smart contracts do not map neatly onto existing licensing categories designed for centralized intermediaries. This section provides a protocol-by-protocol analysis of the current regulatory treatment of decentralized exchanges (DEXs), lending protocols, liquidity pools, cross-chain bridges, oracle/MEV exploitation, and insurance protocols across major jurisdictions. It then offers a comparative framework and evidence-based recommendations for proportionate, protocol-specific regulation.

As of mid-2026, no jurisdiction has enacted a comprehensive regulatory regime that licenses genuinely decentralized protocols as such. Instead, two structural patterns dominate. Most jurisdictions extend existing frameworks---securities law, commodities law, payment services regulation, and anti-money laundering obligations---to DeFi activities conducted by identifiable operators, while leaving "fully decentralised" or controllerless protocols in an express carve-out or an undefined gap. A small but growing set of jurisdictions has moved further: the

UAE now issues DeFi-specific licences (VARA's DeFi Limited Licence; ADGM authorisation for DeFi protocol operators),

Bermuda has licensed a DAO-governed non-custodial DEX, and the Marshall Islands confers statutory legal personality on DAOs themselves. The result remains a fragmented global landscape with significant enforcement uncertainty---and an emerging divide between accommodation-leaning and prohibition-leaning regimes for protocol-level lending and staking.

1. Global Landscape by Protocol Type

1.1 Decentralized Exchange (DEX) Regulation

DEXs facilitate peer-to-peer trading of digital assets through automated market makers (AMMs) or order-book mechanisms, without a central intermediary holding user funds. The regulatory question is whether DEX operators, front-end providers, or governance token holders constitute regulated entities. Across all 27 jurisdictions surveyed, the recurring dividing line is the presence of an identifiable operator: where one exists, exchange/VASP licensing is generally engaged; where a protocol is genuinely controllerless, most regimes have no registrant to capture.

United States

The

US Securities and Exchange Commission (SEC) has historically treated most DEXs trading securities tokens as activities requiring exchange, ATS, or broker-dealer registration. In April 2024, Uniswap Labs received a Wells notice alleging it operated as an unregistered securities broker and exchange (CoinDesk, April 2024). However, the SEC closed its investigation in February 2025 without enforcement action, a significant departure attributed to Uniswap's non-custodial model and a broader shift in regulatory posture under the new administration (Columbia Law School CLS Blue Sky Blog, April 2025).

The Commodity Futures Trading Commission (CFTC) asserted jurisdiction over derivatives-focused DEXs through its landmark enforcement action against Ooki DAO. In June 2023, the CFTC obtained a default judgment, with the court finding that Ooki DAO illegally offered leveraged retail commodity transactions and operated as an unregistered futures commission merchant. The court imposed a $643,542 penalty and ordered permanent cessation of operations (CFTC Press Release 8715-23).

In January 2025, President Trump signed an executive order titled "Strengthening American Leadership in Digital Financial Technology," signaling a shift toward pro-innovation policy. The IRS DeFi Broker Rule, which would have required DeFi platforms to report transactions as brokers, was nullified in April 2025 under the Congressional Review Act (National Law Review, April 2025). On March 17, 2026, the SEC and CFTC published a joint five-category token taxonomy (digital commodities, collectibles, tools, stablecoins, digital securities), under which governance tokens generally fall within a "digital tools" carve-out rather than being treated as securities. On May 14, 2026, the Senate Banking Committee advanced a CLARITY Act substitute adding a dedicated DeFi title, though it was not enacted as of June 2026 (Cleary Gottlieb, January 2026).

European Union

Under

EU Markets in Crypto-Assets Regulation (MiCA), crypto-asset service providers (CASPs) require authorization. However, Recital 22 of MiCA states that "where crypto-asset services are provided in a fully decentralised manner, without intermediaries, they should not be covered by this Regulation." The practical threshold for "fully decentralized" remains undefined; ESMA applies a case-by-case, four-layer analysis (settlement, architecture, governance, user interface), and failure on any single layer brings a protocol into MiCA scope. Projects that use multisig governance to upgrade contracts, charge transaction fees, or control issuance revenues may be classified as CASPs (Merkle Science, 2024).

In January 2025, EBA and ESMA published a Joint Report under Article 142 of MiCAR analyzing DeFi and crypto lending, finding that Total Value Locked in DeFi represents approximately 4% of total crypto market capitalization. On May 20, 2026, the European Commission launched a targeted MiCA review consultation (closing August 31, 2026) discharging the Article 142 mandate, asking whether DeFi, staking, lending and borrowing should be brought into scope and whether CASPs should conduct due diligence over DeFi protocols and smart contracts (ESMA Joint Report, January 2025).

DEX front-end operators located in the EU may be captured as CASPs even if the underlying protocol is permissionless, creating a "front-end liability" model. The same MiCA architecture and Recital 22 carve-out apply across the EU member states surveyed here---

France,

Germany,

Malta and

Estonia---and, via the EEA, to

Liechtenstein.

France

France applies the MiCA CASP regime (superseding its bespoke PSAN regime from Loi PACTE), under which operating a DEX or trading platform is a regulated service while fully autonomous protocols fall outside the current framework. The AMF treats decentralisation as a spectrum rather than a binary, so protocols with identifiable controllers face proportionate obligations. A crypto-asset pledge regime (Law 2025-391) provides legal certainty for collateral and lending arrangements, though the DGFiP has issued no DeFi-specific tax guidance as of June 2026.

Germany

In

Germany, BaFin requires centralised exchanges and front-ends interacting with DeFi to hold a MiCA CASP licence (or, for custody, the legacy KWG crypto-custody licence), while DEX protocols themselves are not directly regulated. There is no formal BaFin decentralisation test; the tax-transparency act (KStTG) carves out purely non-custodial, fully decentralised protocols without an identifiable operator, leaving them in a regulatory grey zone.

Malta

Malta implements MiCA through its Markets in Crypto-Assets Act (Chapter 647). A genuinely decentralised DEX is out of scope under Recital 22, while centralised or partial "DeFi" front-ends and operators are CASPs requiring authorisation. The legacy Virtual Financial Assets Act (Chapter 590) is scheduled for repeal on July 3, 2026, with VFA-to-CASP grandfathering ending July 1, 2026.

Estonia

Estonia applies MiCA via its Market in Crypto-Assets Act, with supervision moved from the FIU to Finantsinspektsioon. A fully decentralised DEX with no identifiable operator sits outside MiCA's direct scope; any centralised interface or operator is captured as a CASP. Legacy FIU/MLTFPA virtual-currency licences sunset on July 1, 2026, with no grace period.

Liechtenstein

Liechtenstein operates a dual regime: the TVTG (Blockchain Act) Token Container Model for non-MiCAR "TT services" and MiCAR via the EEA implementation act. A decentralised protocol with no identifiable operating person has no registrable entity, whereas an identifiable exchange or operator is a TT Exchange Service Provider or MiCAR CASP. The first MiCAR CASP authorisation (RULEMATCH Europe AG) took effect June 1, 2026.

Singapore

Singapore's Monetary Authority of Singapore (MAS) expanded the scope of the Payment Services Act (PS Act) in April 2024 to include entities that facilitate the exchange of digital payment tokens (DPTs) even where the service provider does not come into possession of moneys or DPTs. MAS has stated explicitly that the absence of a central administrator does not exempt DEX operations, which are brought within the DPT-service scope where an identifiable provider exists (MAS Media Release, April 2024).

Japan

Japan requires entities operating as Crypto-Asset Exchange Service Providers (CAESPs) to register with the Financial Services Agency (FSA). A DEX with an identifiable operator is a crypto-asset exchange service requiring CAESP registration; a protocol with no identifiable operator falls into a regulatory gap. A Cabinet-approved bill (April 10, 2026, pending Diet) would migrate crypto from the Payment Services Act to the Financial Instruments and Exchange Act (FIEA) and require issuer-identity disclosure regardless of decentralisation claims (Global Legal Insights, Blockchain & Cryptocurrency 2026).

Hong Kong

The

SFC's Virtual Asset Trading Platform (VATP) licensing regime, effective since June 2023, applies to centralized platforms under a "same business, same risks, same rules" approach. DEXs and DAO-operated protocols with no identifiable operator fall outside the current VATP perimeter, while a platform with an identifiable Hong Kong operator is expected to comply. The regime was expanded in November 2025 (global liquidity integration) and February 2026 (VA margin financing and perpetual contracts for professional investors) (SFC, November 2025).

South Korea

The

Virtual Asset User Protection Act (VAUPA), effective July 2024, requires all Virtual Asset Service Providers (VASPs) to segregate customer assets, maintain insurance, and retain transaction records for 15 years. There is no licensing pathway for DeFi protocols, and DeFi-adjacent services (including exchange-offered ones) are effectively prohibited in practice, since real-name banking requirements make it impractical for a DeFi service to operate AML-compliantly. The FSC's position is that entities controlling DeFi platforms fall within VA regulation (Library of Congress, July 2024).

Thailand

Thailand regulates digital asset businesses under the Emergency Decree on Digital Asset Businesses B.E. 2561 (2018), which became extraterritorial on April 13, 2025. A DEX that performs a regulated business (such as operating an exchange) must be licensed; there is no decentralisation carve-out, and tokens are assessed case-by-case against the cryptocurrency / investment-token / utility-token taxonomy. Exchange-offered staking and lending yield products are prohibited, foreclosing centralized DeFi-as-a-service.

India

India has no bespoke crypto/DeFi statute. A DEX must register as a Virtual Digital Asset Service Provider (VDASP) under the Prevention of Money Laundering Act (PMLA) only where an identifiable person provides a covered service as a business; controllerless protocols have no registrant and there is no DeFi carve-out. India follows FATF "control or sufficient influence" logic but has published no domestic guidance distinguishing controllerless from registrable protocols, leaving the boundary undefined.

Hong Kong, the offshore carve-out jurisdictions, and the Caribbean VASP regimes

Several jurisdictions regulate DEXs only by reference to whether a custodial or exchange-as-business chokepoint exists:

• Cayman Islands: A non-custodial DEX is generally outside the VASP Act 2020 scope; a custodial DEX requires a VASP licence (Phase 2). The Foundation Company remains the global-standard DAO wrapper.
• British Virgin Islands: A non-custodial DEX is generally outside the VASP Act 2022 scope; a custodial or order-matching-on-behalf DEX likely requires VASP registration. The FSC has confirmed (Circular 43 of 2025) that the sole act of issuing or selling a virtual asset is not a VASP activity.
• Bermuda: A DABA licence is required to operate a digital asset exchange (including derivatives) in or from Bermuda. Notably, Bermuda has licensed a non-custodial, DAO-governed derivatives DEX---DerivaDEX (Class T)---which launched its licensed BTC/ETH perpetuals platform for verified institutional traders on February 17, 2026. This is a world-first attempt to bring a DAO-governed DEX inside a supervised perimeter.
• Seychelles: Since the VASP Act 2024 (in force September 1, 2024), it is a criminal offence to offer VA services in or from Seychelles without an FSA licence. The Virtual Asset Exchange licence category is read to capture both centralized and decentralized platforms where an identifiable operator with a Seychelles nexus exists; controllerless protocols are not expressly addressed.
• Marshall Islands: The world-first DAO LLC statute confers legal personality on the DAO entity itself, but a DEX is not separately addressed; exchange-as-business is a financial-service-provider activity supervised by the Marshall Islands Monetary Authority (MIMA) under the Banking Act 1987.
• El Salvador: Trading occurs through licensed Digital Asset Service Providers (DASPs) under the LEAD framework; a non-custodial P2P DEX is not expressly captured, and DEXs are not specifically addressed.

UAE

UAE's Virtual Assets Regulatory Authority (VARA) issued what it termed its first "DeFi Limited License" to MANTRA Finance FZE in February 2025, authorizing it to operate as a Virtual Asset Exchange and provide broker-dealer and management/investment services in Dubai. The UAE has since gone further than any other jurisdiction in building DeFi-specific licensing: ADGM brought DeFi protocol operators expressly into scope in September 2025 (its "nexus to ADGM" test can capture protocol developers, governance token holders, or foundation entities), and VARA's Exchange Services Rulebook v2.1 (effective March 31, 2026) added a permanent virtual-asset derivatives regime (retail 5:1 leverage, 20% margin, mandatory insurance fund) (GlobeNewsWire, February 2025).

Switzerland

FINMA applies a "same business, same risks, same rules" principle under the technology-neutral DLT Act. A centralised or controlled trading interface engages licensing (a DLT trading facility licence under FMIA), while a genuinely decentralised DEX presents "no entity to regulate." A new crypto-institution licence category was proposed, with the FinIA consultation closing in February 2026 (Chambers & Partners, Blockchain 2025 Switzerland).

United Kingdom

The

UK FCA's forthcoming regime (commencing October 25, 2027) makes operating a "qualifying cryptoasset trading platform" (CATP) a regulated activity; decentralised platforms with a controlling person are in scope, while "truly decentralised" platforms with no person acting "by way of business" fall outside. The controlling-person test turns on three factors: concentrated token governance, core-team treasury management, and centralised off-chain coordination, applied on a sliding scale (CP25/40).

Canada, Australia, Brazil, Nigeria and South Africa

• Canada: AMMs may face marketplace registration if analogous to traditional marketplaces, per the 2024 OSC/Bank of Canada AMM Discussion Paper (analysing Uniswap, Curve, Sushiswap, Balancer). The analysis applies equally to centralized and decentralized platforms; there is no formal decentralisation test.
• Australia: Crypto-to-crypto DEX trading is not clearly captured by current DCE registration but may be picked up by the tranche-2 VASP expansion from July 1, 2026. The Digital Assets Framework Act 2026 extends AFSL obligations to Digital Asset Platforms but carves out core token infrastructure.
• Brazil: DEXs are not specifically addressed; DeFi conducted via an identifiable front-end operator or developer company is captured as an SPSAV under Resolution 519, while truly decentralized protocols without an operator are a regulatory gap.
• Nigeria: Digital assets are statutorily classified as securities under the Investments and Securities Act (ISA) 2025; only centralized Digital Asset Exchange (DAX) registration exists. No data was found on non-custodial DEX treatment; an on/off-ramp or operator is caught as a VASP.
• South Africa: An operator-less DEX is outside the CASP perimeter; where an identifiable operator exists, the FSCA's FAIS regime may apply. The FSCA recognises a "spectrum of decentralization" (per its December 2024 DeFi Market Study).

---

1.2 DeFi Lending Protocol Regulation

DeFi lending protocols enable users to supply and borrow crypto-assets through smart contracts, with interest rates determined algorithmically. Regulatory concern centers on whether yield-bearing deposits constitute securities and whether platforms operate as unlicensed lenders. A clear policy divide is now visible: some jurisdictions (

Thailand,

South Korea, and

Singapore for retail) effectively prohibit protocol-level or exchange-offered lending and staking, while the

UK is moving toward a bespoke regulated-activity regime for it.

United States

The SEC has consistently treated centralized crypto lending as securities offerings. BlockFi Lending LLC settled for $100 million in February 2022 for failing to register its BlockFi Interest Accounts (BIAs) as securities and operating as an unregistered investment company (Paul, Weiss, February 2022). The SEC sued Celsius Network and founder Alex Mashinsky in July 2023 for securities fraud related to its "Earn" program, which was followed by Mashinsky's criminal arrest.

The application of these precedents to decentralized, non-custodial lending protocols (such as Aave or Compound) remains untested. There is no specific DeFi lending rule; the clearest CFTC marker is that leveraged or margined retail commodity transactions require DCM/SEF registration (the Ooki DAO theory). The critical distinction is that in non-custodial DeFi lending, the protocol itself does not take possession of user funds, make credit decisions, or guarantee returns---functions that are central to the regulatory characterization of lending and securities offerings.

However, the involvement of protocol governance in setting interest rate parameters, collateral requirements, and liquidation thresholds may provide sufficient "efforts of others" to support securities classification under the Howey test, particularly where a small group of governance token holders exercises outsized influence over these parameters.

European Union

MiCA does not specifically address lending and borrowing of crypto-assets. The EBA-ESMA Joint Report of January 2025 acknowledged this gap, and the Commission's May 20, 2026 consultation now expressly asks whether crypto lending and borrowing should be brought into MiCA scope. National member states diverge:

Germany explicitly taxes DeFi lending income (per the March 2025 BMF letter) without a regulatory classification;

France's Law 2025-391 crypto-asset pledge regime provides collateral certainty; and

Malta,

Estonia and

Liechtenstein have no DeFi-specific lending treatment, assessing it under the CASP/MiCA carve-out by intermediary presence.

Singapore

MAS has restricted retail access to crypto staking and lending services. Licensed DPT service providers are prohibited from facilitating lending or staking for retail customers under the PS Act framework (April 2024), though institutional and accredited investor access is permitted.

Thailand

Thailand goes further than retail restriction: digital asset operators may not provide deposit-taking and lending, and exchange-offered lending and staking yield products are barred outright. This effectively forecloses centralized DeFi-as-a-service while leaving genuinely permissionless protocols undefined.

South Korea

In

South Korea, DeFi lending, staking, and yield farming are effectively prohibited in practice---they fall within the scope of VA regulation but have no pathway to operate, given the absence of a DeFi licensing route and the real-name banking requirement.

United Kingdom

The

UK is the clearest example of bringing DeFi lending into a bespoke perimeter: under the forthcoming regime, DeFi lending and borrowing becomes a regulated activity. CP25/40 proposes retail over-collateralisation (a maximum 50% loan-to-value) and a ban on proprietary tokens in lending. This is more comprehensive on lending than MiCA.

Switzerland and the offshore VASP regimes

• Switzerland: Custodial or deposit-taking lending falls under the Banking Act; non-custodial lending faces fewer restrictions, with yield taxed as income at receipt.
• Cayman Islands / British Virgin Islands: Peer-to-peer, non-custodial lending is generally outside the VASP scope; custodial or pooled lending may require VASP registration or licensing.
• Bermuda: Lending and repurchase transactions conducted as a business are a DABA prescribed activity requiring a licence.
• Seychelles: Lending, borrowing, and other VA financial services require a VASP licence.
• UAE: "Lending and Borrowing" is an express VARA-licensed activity category.

Other jurisdictions

In

Japan, a lending or borrowing protocol may be a collective investment scheme under FIEA (a Type II financial-instruments business if fund criteria are met).

El Salvador,

India, Marshall Islands,

Nigeria,

Malta,

Liechtenstein and

Estonia have no DeFi-specific lending treatment, defaulting to whatever VASP/securities/AML framework applies where an identifiable operator exists. In

South Africa, lenders furnishing advice or intermediary services as a business require a CASP licence, while operator-less lending protocols sit outside the perimeter.

Australia

The

Australian Securities and Investments Commission (ASIC) brought proceedings against Block Earner, a fintech offering crypto yield products. In February 2024, the Federal Court initially found that Block Earner's "Earner" product required an Australian Financial Services Licence but, critically, that its "Access" product---which gave users direct access to DeFi lending protocols---was not a financial product and did not require a licence.

On appeal in 2025, the Full Federal Court overturned the original decision entirely, finding that even the Earner product was not a financial product and Block Earner did not require an AFSL. The High Court heard ASIC's further appeal on March 12, 2026, with judgment reserved as of June 2026 (ASIC Media Release 25-062MR). This decision, if upheld, would significantly narrow the scope of Australian financial product regulation as applied to DeFi access services.

---

1.3 Liquidity Pool Regulation

Liquidity pools are smart contracts that hold reserves of token pairs, enabling automated market making. Users who deposit tokens into pools receive LP (liquidity provider) tokens representing their proportional share of the pool and earned fees.

Regulatory Status Globally

No jurisdiction among the 27 surveyed has enacted specific liquidity pool regulation. Key unresolved questions include:

• Securities classification: The

  US SEC has indicated that LP tokens could constitute securities under the Howey test if they represent an investment of money in a common enterprise with an expectation of profits derived from the efforts of others. However, no enforcement action has specifically targeted LP token issuance as of mid-2026.

• Collective investment scheme analysis: In the

  EU and several common law jurisdictions, liquidity pools could be analyzed as collective investment schemes or pooled funds. If LP tokens represent units in a pooled investment, they may trigger fund management licensing requirements.
  South Africa's FSCA has specifically flagged liquidity pools, alongside governance and oracles, as a centralized-control indicator that may bring a protocol within FAIS.

• Tax treatment: Most jurisdictions have not clarified whether depositing tokens into a liquidity pool constitutes a taxable disposition event, creating compliance uncertainty for participants. Where guidance exists it points toward a disposal:

  Australia treats deposit into a pool as a CGT event where beneficial ownership changes;
  Germany treats an LP deposit as a taxable disposal; and
  Japan treats depositing tokens into a pool as a disposal of the original tokens and acquisition of pool tokens. The
  UK's proposed "no-gain/no-loss" (NGNL) regime for lending/staking/LP deposits was not enacted as of June 2026.

The absence of specific regulation creates risk for both protocol developers and liquidity providers. Providers may inadvertently participate in unregistered securities offerings, while developers face uncertain liability for pool design decisions.

Concentrated Liquidity and Composability Risks

The evolution from constant-product AMMs (Uniswap v2) to concentrated liquidity models (Uniswap v3, v4) further complicates regulatory analysis. In concentrated liquidity pools, providers actively manage price ranges, which more closely resembles active market making than passive investment. This distinction may affect securities classification in jurisdictions that consider the "efforts of others" prong of investment contract tests.

Additionally, LP tokens are frequently used as collateral in other DeFi protocols (lending, yield farming, derivatives), creating composability chains where a single regulatory action on an LP token can cascade through multiple protocol layers. Regulators should account for these systemic interconnections when designing liquidity pool regulation.

Impermanent Loss and Consumer Protection

Impermanent loss---the difference in value between holding tokens in a pool versus holding them in a wallet---is a material risk that is poorly understood by retail participants. Studies of major AMM pools have shown that a majority of liquidity providers experience net losses after accounting for impermanent loss, even when including fee revenue. No jurisdiction currently requires standardized disclosure of this risk, and several tax authorities (

Malta's CfR,

Liechtenstein's and

Switzerland's tax administrations, and

France's DGFiP among them) have explicitly issued no guidance on impermanent loss treatment, though some industry participants have voluntarily adopted impermanent loss calculators and warnings.

---

1.4 Cross-Chain Bridge Regulation

Cross-chain bridges enable transfers of digital assets between distinct blockchains. They have become critical infrastructure for multi-chain DeFi but represent a major security vulnerability, with over $2.8 billion stolen from bridge exploits since 2022, including the Ronin Bridge ($625 million, March 2022) and Wormhole ($320 million, February 2022) (Halborn, Top 100 DeFi Hacks 2025).

FATF Guidance

FATF has identified cross-chain bridges as potential VASPs subject to AML/CFT obligations. The 2025 FATF Targeted Update reported that more than $21 billion has been laundered through cross-chain and cross-asset services, representing a fivefold increase since 2022. Illicit actors increasingly rely on unregulated cross-chain bridges for "chain-hopping" to obscure fund origins (FATF Targeted Update, 2025).

Jurisdictional Approaches

No jurisdiction among the 27 surveyed has enacted bridge-specific regulation. Key regulatory gaps include:

• Liability for exploits: No legal framework clearly allocates liability when a bridge is exploited---between the bridge operator, validators/guardians, liquidity providers, and users.
• AML/CFT obligations: Where a bridge has identifiable operators or governance, FATF guidance suggests they should be treated as VASPs. However, enforcement against decentralized bridge protocols has not been tested.
• Consumer protection: Bridge users have no regulatory recourse when funds are lost. In the Wormhole case, Jump Trading, an investor, voluntarily covered the $320 million loss; in the Ronin case, the Ronin Network and Sky Mavis bore the loss.
• State-sponsored threats: The Ronin Bridge exploit was attributed to North Korea's Lazarus Group. The FATF has noted the industrialization of cryptocurrency theft by state-sponsored actors, who disproportionately target bridge infrastructure due to the concentration of locked value.
• Travel Rule applicability: The FATF Travel Rule requires VASPs to share originator and beneficiary information for transactions above specified thresholds. As of 2025, 85 of 117 assessed jurisdictions have enacted Travel Rule legislation, but application to bridge transactions remains ambiguous---particularly where the bridge operator is decentralized and cannot identify counterparties (FATF Targeted Update, 2025).

---

1.5 Oracle Manipulation and MEV Regulation

Blockchain oracles supply external data (prices, interest rates) to smart contracts. Maximal Extractable Value (MEV) refers to the profit that block producers or validators can extract by reordering, including, or excluding transactions within a block.

United States: The Eisenberg Precedent

Avraham Eisenberg exploited oracle pricing on the Mango Markets DEX in October 2022, extracting approximately $110 million. In April 2024, a jury convicted Eisenberg on all three counts of wire fraud, commodities fraud, and commodities manipulation (CoinDesk, April 2024).

However, in a significant development, Federal Judge Arun Subramanian subsequently vacated Eisenberg's commodities convictions (May 2025) and acquitted him of wire fraud, raising fundamental questions about whether existing fraud statutes adequately address DeFi-native market manipulation (TRM Labs, 2025). Prosecutors have appealed the acquittal.

This reversal means that, as of mid-2026, no US criminal conviction for DeFi oracle manipulation stands. The case remains in litigation and will be a defining precedent for the application of traditional market abuse law to DeFi.

European Union: MiCA Title VI and ESMA Guidelines

MiCA Title VI establishes a market abuse framework for crypto-assets, prohibiting insider dealing, unlawful disclosure of inside information, and market manipulation. On July 9, 2025, ESMA published Guidelines on supervisory practices to prevent and detect market abuse, specifically identifying "abusive maximal extractable value (MEV) practices" as a form of potential market manipulation that national competent authorities (NCAs) should monitor (ESMA Guidelines, July 2025).

ESMA also published a dedicated analysis paper on MEV implications for crypto markets in July 2025, examining sandwich attacks, front-running, and other extraction strategies (ESMA MEV Analysis, July 2025). These guidelines apply across the EU member states surveyed---

France,

Germany,

Malta and

Estonia---through their NCAs.

Other Jurisdictions

Most jurisdictions have not addressed oracle manipulation or MEV specifically.

South Korea's VAUPA prohibits market manipulation broadly, which could encompass DeFi-native manipulation.

Singapore's securities fraud provisions may apply where the manipulated asset is a regulated product, and

Hong Kong's SFO market-manipulation provisions could apply where an identifiable operator and regulated product are involved. Among the 12 newly integrated jurisdictions, none (

Bermuda,

El Salvador, BVI,

India,

Thailand, Marshall Islands,

Malta,

Liechtenstein,

Estonia,

South Africa,

Nigeria, Seychelles) has issued DeFi-specific oracle or MEV rules, though general securities/market-abuse law could in principle reach manipulation conducted through an identifiable operator.

---

1.6 DeFi Insurance Protocols

DeFi insurance protocols (such as Nexus Mutual, InsurAce, and OpenCover) provide parametric or discretionary coverage against smart contract failures, depegging events, and exchange hacks. They operate as decentralized risk pools where members stake tokens to underwrite coverage.

Regulatory Status

No jurisdiction among the 27 surveyed has enacted DeFi insurance-specific regulation. Key considerations:

• Insurance licensing: In most jurisdictions, offering insurance products requires a licence. DeFi insurance protocols argue they provide "coverage" or "protection" rather than insurance, but this distinction may not withstand regulatory scrutiny. Nexus Mutual, the largest protocol by coverage ($290 million active coverage as of 2025), is incorporated as a discretionary mutual in the UK but structured to avoid classification as a regulated insurer (CoinDesk, October 2024).

• Cross-border issues: DeFi insurance is inherently global but insurance regulation is jurisdiction-specific. A user in Jurisdiction A purchasing coverage from a protocol governed by token holders worldwide creates significant jurisdictional ambiguity.

• Consumer protection: Unlike traditional insurance, DeFi coverage claims are adjudicated by token-holder votes, not independent assessors. There is no regulatory backstop if a claim is wrongly denied.

2. Comparative Analysis

Regulatory Status by Protocol Type and Jurisdiction

Key Observations

1. DEXs receive the most regulatory attention. Most of the 27 jurisdictions have at least considered how exchange-like DEX activities fit within existing frameworks. The US, EU, Singapore, UAE, Bermuda and Seychelles have taken the most concrete steps. The trend is toward regulating identifiable operators and front-end interfaces rather than attempting to regulate the underlying protocol code itself---with the UAE's DeFi-specific licences and Bermuda's licensing of a DAO-governed DEX as the leading edge.

2. An identifiable-operator dividing line is near-universal. Across the surveyed regimes, the recurring test is not "is the protocol decentralized?" but "is there an identifiable person providing the service as a business with a domestic nexus?" The EU (four-layer test), UK (controlling-person test), South Africa (spectrum of decentralization), Switzerland ("organised and controlled"), and the Cayman/BVI/Bermuda/Seychelles VASP regimes all turn on this. Only the Marshall Islands inverts the question by conferring personality on the DAO entity itself.

3. Lending regulation is bifurcating into prohibition and bespoke licensing. The US BlockFi/Celsius actions set the enforcement tone, but the policy frontier has moved. Three jurisdictions now effectively prohibit protocol-level or exchange-offered lending/staking (Thailand outright; South Korea in practice; Singapore for retail), while the UK is building a bespoke regulated-activity regime with quantified retail guardrails (max 50% LTV, ban on proprietary tokens). The custodial/non-custodial distinction---highlighted by Block Earner in Australia (High Court judgment reserved, March 2026)---remains the critical boundary elsewhere.

4. Liquidity pools, bridges, and insurance protocols are regulatory blind spots. No jurisdiction has specific licensing rules for any of these protocol types. The only movement is at the tax layer (Australia, Germany and Japan treat LP deposits as disposals) and in soft signalling (South Africa's FSCA flags pools as a centralization indicator). This gap is particularly concerning for bridges, which handle billions in cross-chain transfers and have been the target of the largest DeFi exploits (over $2.8 billion lost since 2022).

5. MEV regulation is nascent. Only the EU (through ESMA's July 2025 guidelines, applied via the NCAs of France, Germany, Malta and Estonia) has explicitly addressed MEV as a regulatory concern. The US approach remains uncertain following the vacatur of Eisenberg's convictions, and the remaining 22 jurisdictions have not engaged with the issue.

6. Regulatory arbitrage is a systemic risk. The wide variation in regulatory treatment across the 27 jurisdictions incentivizes protocol operators and front-end providers to establish themselves in the most permissive jurisdictions. The contrast is now stark: prohibition-leaning regimes (Thailand, South Korea) sit alongside innovation-first regimes (UAE, Cayman, Bermuda, Switzerland, Marshall Islands, Liechtenstein, Singapore). FATF data showing $21 billion laundered through cross-chain services demonstrates the consequences of fragmented regulation.

7. The "fully decentralized" threshold is the central unresolved question. Most frameworks implicitly or explicitly distinguish between centralized and decentralized protocols, but no jurisdiction has defined a rigorous, testable standard for decentralization. The EU's MiCA Recital 22 exemption, the UK's controlling-person test, the US "sufficient decentralization" concept, and the South African "spectrum of decentralization" all depend on this distinction and all leave it under-specified.

3. What Works and What Doesn't

3.1 Evidence from Enforcement Actions

Ooki DAO (CFTC, 2022-2023): Precedent on DAO Liability

What it established: A DAO can be treated as an unincorporated association and held liable for regulatory violations. Governance token holders who vote on protocol operations may bear personal liability.

What worked: The CFTC successfully demonstrated that transferring operations to a DAO does not create regulatory immunity. The default judgment sent a clear deterrent signal.

What didn't work: The default judgment meant the case was never fully litigated on the merits. The precedent is untested against a DAO that mounts a defense. The destruction of Ooki DAO eliminated a protocol rather than bringing it into compliance.

Eisenberg/Mango Markets (DOJ/CFTC, 2022-2025): Limits of Traditional Fraud Law

What it established: Initially, that oracle manipulation on a DEX can constitute commodities fraud and market manipulation under existing law.

What didn't work: The subsequent vacatur of Eisenberg's convictions (May 2025) demonstrated the difficulty of applying traditional fraud statutes to DeFi-native manipulation. The case exposed a gap: existing law may not adequately define when exploiting protocol mechanics crosses the line from "using the protocol as designed" to "market manipulation." This remains under appeal.

Block Earner (ASIC, 2024-2026): The Access vs. Product Distinction

What it established: The initial trial distinguished between a centralized yield product (regulated) and a DeFi access product (unregulated). The Full Federal Court went further, finding that neither product was a regulated financial product. ASIC's appeal was heard by the High Court on March 12, 2026, with judgment reserved as of June 2026.

What it signals: Regulators cannot assume that all crypto yield offerings are financial products. The characterization depends on the specific structure---particularly whether the platform takes custody, bears counterparty risk, or exercises discretion over user funds.

Uniswap (SEC, 2024-2025): Enforcement Limits for Non-Custodial Protocols

What it signals: The SEC's decision to close its investigation without action, despite issuing a Wells notice, suggests that purely non-custodial, permissionless protocol architectures may be outside the practical reach of securities enforcement. However, this was an administrative decision, not a judicial ruling, and provides no binding precedent.

DerivaDEX (BMA, Bermuda, 2026): A Supervised DAO-Governed DEX

What it established: A non-custodial, DAO-governed derivatives DEX can be brought inside a supervised perimeter via a bespoke licence. Bermuda licensed DerivaDEX under a DABA Class T (Test) licence, and it launched its BTC/ETH perpetuals platform for verified institutional traders on February 17, 2026.

What it signals: The "regulate the licensed structure, not the individual governance-token holders" model offers an alternative to both the Ooki DAO destruction approach and the laissez-faire carve-out---allocating regulatory responsibility to a licensed wrapper while preserving non-custodial mechanics. Its durability is untested at scale.

3.2 Regulatory Approaches: Comparative Assessment

4. Recommended Framework: Protocol-Specific Proportionate Regulation

4.1 Guiding Principles

1. Substance over form. Regulatory treatment should follow the economic substance of the protocol's activities, not its technological architecture or self-description.

2. Proportionality. Requirements should be calibrated to the risk profile of each protocol type and the degree of centralization in its governance and operations.

3. Technology neutrality with DeFi-awareness. Regulation should not discriminate for or against specific technologies but must account for the structural differences between custodial and non-custodial, centralized and decentralized models.

4. Identifiable control points. Regulation should target identifiable actors who exercise meaningful control---front-end operators, governance participants with outsized influence, oracle providers, and MEV extractors---rather than attempting to regulate autonomous code.

5. International coordination. Given the borderless nature of DeFi, jurisdictions should coordinate through FATF, IOSCO, and bilateral arrangements to prevent regulatory arbitrage---especially given the now-visible split between prohibition-leaning and innovation-first regimes.

4.2 Protocol-Specific Recommendations

DEXs

• Tiered licensing based on decentralization. Protocols with identifiable operators, admin keys, fee extraction, or governance concentration should be licensed as exchanges. Protocols meeting defined decentralization thresholds (no admin keys, immutable contracts, distributed governance) should be exempt from exchange licensing but subject to transparency requirements.
• Front-end regulation. Entities operating user-facing interfaces for DEXs should be subject to consumer disclosure, AML screening (where technically feasible), and restricted token listing requirements.
• Consider the supervised-wrapper model. Where a DAO governs a non-custodial venue, jurisdictions should evaluate the Bermuda DerivaDEX approach---licensing the structure and allocating responsibility to it---as an alternative to either destruction (Ooki DAO) or a pure carve-out.
• Safe harbor period. New DEXs should have a defined period (e.g., 24 months) to achieve decentralization milestones before full regulatory requirements apply, following the model proposed by SEC Commissioner Peirce.

Lending Protocols

• Distinguish custodial from non-custodial. Where a protocol or associated entity takes custody of user funds or exercises discretion over lending decisions, securities or banking regulation should apply. Where lending is purely algorithmic and non-custodial, lighter disclosure-based requirements are appropriate.
• Prefer calibrated guardrails over blanket prohibition. The UK's quantified retail approach (over-collateralisation, a maximum 50% LTV, and a ban on proprietary tokens in lending) is a more proportionate model than outright prohibition (Thailand, South Korea), which tends to drive activity offshore without protecting consumers.
• Risk disclosure requirements. All DeFi lending interfaces should prominently disclose smart contract risk, liquidation risk, and the absence of deposit insurance.
• Institutional access thresholds. Jurisdictions should consider restricting retail access to high-risk lending protocols (as Singapore has done) while permitting institutional participation.

Liquidity Pools

• Classification guidance. Regulators should issue explicit guidance on whether LP tokens constitute securities or units in collective investment schemes, and under what conditions.
• Tax-event clarity. Jurisdictions should clarify whether a pool deposit is a taxable disposition; the divergent treatments in Australia, Germany and Japan (disposal) versus the UK's proposed no-gain/no-loss approach create avoidable cross-border uncertainty.
• Impermanent loss disclosure. Interfaces facilitating liquidity provision should be required to display clear, standardized disclosures of impermanent loss risk.

Cross-Chain Bridges

• VASP classification for identifiable operators. Bridge operators with governance structures, admin keys, or validator sets should be classified as VASPs subject to AML/CFT obligations.
• Security standards. Bridge operators should be required to undergo regular security audits, maintain bug bounty programs, and disclose validator/guardian configurations.
• Loss-sharing frameworks. Regulators should develop frameworks for liability allocation in bridge exploits, distinguishing between operator negligence, validator compromise, and external attack.

Oracle/MEV

• Explicit market abuse provisions. Regulators should clarify that deliberate oracle manipulation for personal profit constitutes market manipulation, regardless of whether existing manipulation statutes apply. The EU's approach under MiCA Title VI and ESMA's July 2025 guidelines provides a model.
• MEV disclosure. Validators and block producers should be required to disclose MEV extraction practices. Protocols should be encouraged to adopt MEV mitigation mechanisms (e.g., fair ordering, MEV auctions with redistribution).
• Oracle standards. Protocols relying on oracles for material functions (pricing, liquidations) should be required to use multiple independent data sources and disclose oracle architecture.

Insurance Protocols

• Regulatory sandbox. DeFi insurance protocols should be offered a sandbox pathway to operate under modified insurance requirements, given the early stage of the market.
• Claims adjudication standards. Protocols offering coverage should be required to maintain transparent, documented claims processes with an independent appeal mechanism.
• Capital adequacy. Risk pools should maintain minimum capital relative to active coverage exposure, with requirements calibrated below traditional insurance solvency standards but above current voluntary practice.

5. Decision Matrix: Protocol Regulatory Classification

The following decision matrix provides regulators with a structured approach to classifying DeFi protocol activities.

Step 1: Identify the Protocol Type

Step 2: Assess Degree of Centralization

Step 3: Determine Regulatory Response

Step 4: Apply Protocol-Specific Requirements

Once the base regulatory tier is determined, apply the protocol-specific requirements outlined in Section 4.2 above. Requirements should be additive: a highly centralized DEX receives both exchange licensing obligations and DEX-specific front-end and listing requirements.

Step 5: Monitor and Reassess

DeFi protocols are not static. Governance structures evolve, admin keys may be renounced, and new front-end operators may emerge. Regulators should:

• Conduct periodic reassessment of protocol centralization at least annually, or upon material governance changes (e.g., admin key renouncement, governance token redistribution, or protocol upgrade).
• Maintain a public registry of assessed protocols with their current classification tier, enabling market participants to understand regulatory expectations.
• Establish clear transition pathways for protocols moving from higher to lower centralization tiers, including criteria for de-registration or reduced obligations.
• Coordinate internationally through existing multilateral forums (IOSCO, FATF, FSB) to ensure consistent classification approaches and prevent arbitrage across jurisdictions.

Worked Example: Applying the Matrix

Scenario: A DEX with a DAO governance structure, admin keys held by a 5-of-9 multisig, a single front-end operated by a registered company, and non-custodial trading.

• Step 1: Token exchange --- primary analogue is securities/commodities exchange.
• Step 2: Admin keys (centralized), front-end control (centralized), governance concentration (assess multisig holder distribution), fee extraction (assess destination), custody (decentralized). Score: 2-3 centralized indicators = Medium to High.
• Step 3: Medium to High --- targeted obligations at minimum; full licensing may be appropriate depending on governance concentration assessment.
• Step 4: Apply DEX-specific requirements: front-end AML screening, restricted token listing, consumer disclosure. If High tier, add full exchange licensing. A jurisdiction with a supervised-wrapper option (cf. Bermuda's DerivaDEX) could license the DAO-governed structure directly.
• Step 5: Reassess if multisig is expanded, admin keys are time-locked, or additional independent front-ends are deployed.

Verification Notes

This document was first verified through web searches conducted on March 20, 2026, and updated on June 4, 2026 to integrate all 27 jurisdictions and reflect the latest verified facts from the canonical DeFi fact-matrix. Aggregate counts ("X of 27 jurisdictions") are derived from that matrix. Key sources:

Enforcement Actions:

• Ooki DAO: CFTC Press Release 8590-22 (September 2022) and 8715-23 (June 2023), verified at cftc.gov
• Uniswap Wells Notice: Verified via CoinDesk (April 2024); closure confirmed via Columbia Law CLS Blue Sky Blog (April 2025)
• Eisenberg/Mango Markets: Conviction verified via CoinDesk (April 2024); vacatur (May 2025) verified via TRM Labs (2025)
• Block Earner: Initial ruling verified via ASIC Media Release 24-019MR; Full Court reversal via ASIC 25-062MR; High Court appeal heard 12 March 2026 (judgment reserved)
• BlockFi: $100M settlement verified via Paul, Weiss (February 2022)
• DerivaDEX (Bermuda): DAO-governed non-custodial derivatives DEX licensed by the BMA under a DABA Class T licence; platform launch 17 February 2026 (per fact-matrix)

Regulatory Frameworks:

• MiCA DeFi exemption (Recital 22) and four-layer decentralisation test: Verified via Merkle Science (2024) and LBKP Legal
• EBA-ESMA Joint Report (Article 142): Verified at ESMA (January 2025); May 20, 2026 Commission review consultation per fact-matrix
• ESMA MEV Guidelines: Verified at ESMA (July 2025)
• Singapore PS Act amendment: Verified via MAS (April 2024)
• UAE VARA/ADGM DeFi licensing: VARA DeFi Limited License (MANTRA, February 2025) verified via GlobeNewsWire (February 2025); ADGM DeFi protocol operators in scope (September 2025) and VARA Exchange Services Rulebook v2.1 (31 March 2026) per fact-matrix
• South Korea VAUPA: Verified via Library of Congress (July 2024)
• Japan DeFi/CAESP framework and FIEA migration bill: Verified via Global Legal Insights (2026)
• Switzerland FINMA proposals: Verified via Chambers & Partners (2025)
• UK FCA DeFi lending (CP25/40, max 50% LTV, proprietary-token ban) and CATP regime (commences 25 October 2027); Thailand staking/lending prohibition; Seychelles VASP Act 2024; Marshall Islands DAO LLC statute; and the remaining new-jurisdiction protocol treatments are sourced from the canonical DeFi fact-matrix (t1/t2)
• US SEC/CFTC March 17, 2026 five-category token taxonomy and IRS DeFi broker-rule nullification: Verified via National Law Review (April 2025) and Cleary Gottlieb (January 2026)
• FATF cross-chain bridge data ($21B laundered): Verified via FATF Targeted Update (2025)
• Bridge exploit data ($2.8B stolen): Verified via Halborn Top 100 DeFi Hacks 2025

NOTE: Several matters remain in flux as of June 2026 and should be monitored: the Eisenberg case is under appeal; the ASIC v Block Earner High Court judgment is reserved; the SEC-CFTC DeFi safe harbor / CLARITY Act DeFi title is not yet enacted; the EU Commission's Article 142 review consultation (closing 31 August 2026) may bring DeFi lending, staking and borrowing into MiCA scope; the UK's bespoke DeFi regime commences only 25 October 2027; and DeFi-specific licensing in the UAE, Bermuda, Seychelles and the Marshall Islands has a limited track record. Where the fact-matrix records "NOT VERIFIED" or "NO DATA FOUND" (e.g. DeFi-specific lending treatment in Malta, Liechtenstein and Estonia; non-custodial DEX treatment in Nigeria), this document reflects that status honestly rather than inferring a position.