Legal Classification of DeFi Protocols

Executive Summary

The legal classification of decentralized finance (DeFi) protocols remains one of the most consequential and contested questions in financial regulation. As of June 2026, no jurisdiction has arrived at a comprehensive, purpose-built legal classification framework that resolves how genuinely decentralized protocols are treated. Instead, regulators are adapting existing financial services law, carving out exemptions for "fully decentralized" systems, or — in a growing number of cases — creating bespoke licensing categories or statutory entity wrappers. This guidance document maps the global landscape, compares approaches across 27 jurisdictions and 3 international standard-setting bodies, and recommends an evidence-backed classification framework for policymakers.

A recurring structural pattern emerges across all 27 jurisdictions: regulation attaches to identifiable persons — operators, issuers, service providers, front-end controllers, or governance-token holders with concentrated control — while controllerless protocols with no identifiable operator consistently fall into a regulatory gap, an explicit carve-out, or a "fully decentralized" exemption. The disagreement between jurisdictions is not over this principle but over (a) how aggressively the "identifiable person" net is cast, (b) whether a bespoke license, statutory wrapper, or pure exemption applies at the decentralized end, and (c) the steepness of the decentralization threshold.

1. Global Landscape: Classification Models

Six distinct classification models have emerged worldwide. Each carries different implications for protocol developers, governance participants, liquidity providers, and end users. Many jurisdictions blend two models (for example, an activity-based extension at the centralized end and a carve-out or statutory wrapper at the decentralized end).

Model 1: Activity-Based Extension of Existing Law

Jurisdictions:

US,

UK,

Singapore,

Hong Kong, Australia, Germany, France,

South Africa, India, Canada, Brazil

This is the dominant approach globally. Regulators apply existing securities, commodities, payments, or financial services law to DeFi activities based on substance over form. The regulatory question is not "is this a DeFi protocol?" but rather "does this activity constitute exchange operation, brokerage, lending, or collective investment management — and is there an identifiable person conducting it as a business?"

How it works: Regulators assess whether the functional output of a protocol (trading, lending, asset management) maps to a regulated activity. If so, the operator or responsible person must comply with existing licensing requirements.

Verified outcomes:

• In the US, the SEC and CFTC issued a joint five-category token taxonomy on 17 March 2026 (Release Nos. 33-11412/34-105020): digital commodities, digital collectibles, digital tools, stablecoins, and digital securities. Classification rests on the Howey test, with governance tokens generally falling within the "digital tools" carve-out (UNI is treated as governance, not a security). A 11 March 2026 SEC/CFTC MOU classifies BTC and ETH as digital commodities under CFTC oversight. (CFTC Press Release 9198-26, 17 March 2026)

• In Singapore, the Monetary Authority of Singapore (MAS) applies its "same activity, same risk, same regulation" principle through a function-based taxonomy (Digital Payment Tokens under the PS Act, Capital Markets Products under the SFA, and generally-unregulated utility/governance tokens). Part 9 of the Financial Services and Markets Act 2022 (FSMA) establishes licensing requirements for Digital Token Service Providers (DTSPs), effective 30 June 2025. DEX operations were explicitly brought within DPT-service scope by the April 2024 PS Act amendments — the absence of a central administrator does not exempt the service. (MAS Media Release, 2025)

• In Hong Kong, the SFC applies "same business, same risks, same rules" through a functional (non-technology-based) security-vs-non-security distinction under the SFO, operationalized through the AMLO Virtual Asset Trading Platform (VATP) licensing regime. The ASPIRe roadmap, launched in February 2025, sets out 12 initiatives across five pillars. DEXs and DAO-operated protocols with no identifiable operator fall outside the current VATP perimeter; an identifiable Hong Kong operator is expected to comply. (SFC ASPIRe Announcement, February 2025)

• In Australia, the Digital Assets Framework Act 2026 (now enacted, superseding the earlier 2025 Bill) extends the AFSL regime platform-wide to Digital Asset Platforms (DAPs) and Tokenised Custody Platforms (TCPs) from 9 April 2027, while carving out core token infrastructure, custodial staking arrangements, and low-value operators. Classification turns on a functional financial-product test under the Corporations Act; the Block Earner litigation tests whether pure intermediary access products fall outside that test (High Court judgment reserved).

• In South Africa, the FSCA regulates crypto by declaring it a "financial product" under the existing FAIS Act rather than enacting a bespoke crypto statute. Classification is activity-based, with no statutory token taxonomy. The FSCA recognises a "spectrum of decentralization": where an identifiable operator or centralized control exists (governance, oracles, liquidity pools), FAIS may apply; operator-less DeFi sits outside the CASP perimeter.

• In India, classification exists only for tax and AML purposes — a broad "Virtual Digital Asset" (VDA) definition under Section 2(47A), with a "crypto-asset" limb added effective 1 April 2026. There is no general securities taxonomy for DeFi. A protocol must register as a VDA service provider (VDASP) under the PMLA only where an identifiable person provides a covered service as a business; controllerless protocols have no registrant and no DeFi carve-out.

Model 2: "Fully Decentralized" Exemption (MiCA and MiCA-Aligned)

Jurisdictions:

EU (MiCA), Germany, France,

Malta,

Liechtenstein,

Estonia,

UK (carve-out, in progress)

This model establishes that protocols meeting a high threshold of decentralization fall outside the regulatory perimeter entirely. The rationale is that where no intermediary exists, conduct regulation has no entity to attach to. Across the EU and EEA, this exemption flows from MiCA itself and is implemented near-identically by member states.

How it works: Under the EU's Markets in Crypto-Assets Regulation (MiCA), Recital 22 states: "Where crypto-asset services are provided in a fully decentralised manner without any intermediary, they should not fall within the scope of this Regulation." This requires two cumulative conditions: (1) fully decentralized service provision, and (2) absence of any intermediary in the provision chain. Where a token is a financial instrument, MiFID II prevails (MiCA Art 2(4)). (MiCA Recital 22; Article 2)

Verified outcomes:

• The joint EBA-ESMA report under Article 142 of MiCA, published 16 January 2025, found that DeFi Total Value Locked represents just 4% of total crypto-asset market capitalization globally. ESMA assesses decentralization on a case-by-case basis using a four-layer test — settlement (blockchain consensus), architecture (smart contracts, oracles, off-chain components), governance (token distribution, DAO structures), and user interface (front-ends, RPCs, wallets) — where failure on any single layer brings the protocol into MiCA scope. ESMA's position is that decentralization exists on a spectrum with no definitive threshold for "full decentralization." DEX front-ends with identifiable operators are CASPs; fully decentralized provision is exempt per Recital 22. (EBA-ESMA Joint Report, 16 January 2025)

• Germany classifies under existing categories (crypto-assets under KWG §1(11), crypto securities/electronic shares under eWpG, EMTs/ARTs under MiCA/KMAG). BaFin has issued no formal decentralization test; purely non-custodial, fully decentralized protocols without an identifiable operator sit in a regulatory grey zone, while centralized exchanges and front-ends interacting with DeFi require a BaFin licence. Germany runs one of the EU's strictest "compliance-first" regimes, with assertive BaFin enforcement (e.g. Ethena).

• France integrated the MiCA categories into its bespoke PACTE regime (jetons and actifs numériques), with crypto-assets now treated as intangible movable property (Ordinance 2024-936). The AMF treats decentralization as a sliding scale, not a binary: protocols with identifiable controllers face proportionate obligations, while fully autonomous protocols fall outside the current framework. The crypto-asset pledge regime (Law 2025-391) provides certainty for collateral/lending arrangements.

• Malta applies economic substance via its legacy Financial Instrument Test plus the MiCA token taxonomy (ART/EMT/other) under Chapter 647. A genuinely decentralized DEX is out of scope; centralized or partial "DeFi" front-ends and operators are CASPs requiring authorisation.

• Liechtenstein pioneered comprehensive blockchain law with its Token Container Model (TVTG) — a token-type-agnostic civil-law container whose financial classification is determined by the economic substance of the embedded right under MiCAR or sectoral law. The test is whether an identifiable person provides an enumerated TT service "on a professional basis"; a decentralized protocol with no identifiable operating person has no registrable entity.

• Estonia applies the harmonised MiCA categories with no Estonian-specific taxonomy. Fully decentralized protocols without an identifiable operator are outside MiCA's direct scope; any centralized operator, front-end, or provider is captured as a CASP. Estonia has moved from a permissive VASP haven to a restrictive, AML-driven regime (from 2,000+ to roughly 100 licences) consolidating under full MiCA supervision, with a hard 1 July 2026 VASP sunset.

• The UK is building a comprehensive activity-based regime (below) that includes a "truly decentralised" carve-out via a controlling-person test, positioning it alongside the MiCA-aligned exemption cluster while remaining outside MiCA itself.

Model 3: Bespoke DeFi Licensing

Jurisdictions:

UAE (VARA, ADGM)

A small number of jurisdictions have created purpose-built license categories for DeFi protocol operators.

How it works: The regulator defines a "DeFi protocol operator" category and issues licenses with tailored requirements, recognizing that DeFi operations differ structurally from traditional financial intermediaries.

Verified outcomes:

• Dubai's Virtual Assets Regulatory Authority (VARA) granted the first DeFi-specific VASP license to MANTRA Finance FZE on 19 February 2025, covering exchange, broker-dealer, and management and investment services. VARA regulates by activity category (not token), and "Lending and Borrowing" is a distinct licensed activity. Its Exchange Services Rulebook v2.1 (31 March 2026) added a permanent VA derivatives regime (retail 5:1 leverage, 20% margin). (MANTRA Announcement, 19 February 2025)

• Abu Dhabi Global Market (ADGM) updated its Digital Assets Framework in September 2025 to include DeFi protocol operators. ADGM's FSRA applies a "nexus to ADGM" test that can capture protocol developers, governance-token holders, or foundation entities where sufficient centralization (control over smart contracts, ability to pause operations, custody of assets, or governance of key parameters) is present. (ADGM FSRA Announcement, December 2025)

Model 4: Substance-Over-Form with Bespoke Infrastructure or Entity Law

Jurisdictions:

Switzerland,

Japan,

Cayman Islands, British Virgin Islands,

Bermuda, Marshall Islands, Seychelles,

El Salvador

These jurisdictions adapt existing law based on economic substance but also create new statutory categories — either for the distributed-ledger infrastructure itself, for the digital-asset service activity, or for the decentralized organisation as a legal entity (the DAO wrapper). They split into two sub-families: infrastructure/activity statutes (Switzerland, Japan, Cayman, BVI, Bermuda, Seychelles, El Salvador) and statutory DAO/entity law (Marshall Islands, with Cayman and BVI providing the leading offshore wrappers).

How it works: Existing financial services law applies based on economic substance, while a new license type, statutory category, or legal-entity form accommodates DLT-native structures.

Verified outcomes:

• Switzerland's DLT Act (in force 1 August 2021) created the DLT Trading Facility license under the Financial Market Infrastructure Act, layered over its economic-function "substance over form" token taxonomy (payment/utility/asset tokens; DLT securities under Art 973d–973i CO). FINMA licensed the first DLT trading facility, BX Digital, on 12 March 2025. Genuinely decentralized protocols with no identifiable controlling operators require no licence; "organised and controlled" arrangements do. (FINMA Press Release, 18 March 2025)

• Japan classifies via substance over form (PSA Type I/II crypto-asset definitions; FIEA for security tokens). The FSA's April 2025 Discussion Paper proposed shifting crypto-asset regulation from the Payment Services Act (PSA) to the Financial Instruments and Exchange Act (FIEA), with a two-tier classification — a transition now Cabinet-approved (April 2026). A DEX with an identifiable operator is a crypto-asset exchange service requiring CAESP registration; no identifiable operator leaves a regulatory gap, though the FIEA bill would require issuer-identity disclosure regardless of decentralization claims. Japan also has a pioneering DAO LLC carve-out via a 2024 ordinance. (FSA Discussion Paper, April 2025)

• The Cayman Islands regulates by exclusion under the VASP Act 2020: regulation depends on whether activities constitute VASP activities (custody, exchange, public sale), not protocol classification, with securities and funds excluded from the "virtual asset" definition. Non-custodial DEX and peer-to-peer lending are generally outside scope; custodial equivalents require a VASP licence (Phase 2 from April 2025). The Foundation Company (Foundation Companies Act 2017) is the global-standard DAO wrapper, conferring separate legal personality and limited liability — 1,300+ registered by end-2024.

• The British Virgin Islands runs a facilitative activity-based VASP regime (VASP Act 2022). The sole act of issuing or selling a virtual asset is not a VASP activity (FSC-confirmed carve-out, Circular 43 of 2025); non-custodial DEX and P2P lending sit outside scope, while custodial/transfer-on-behalf services require registration. Investment-characteristic tokens are captured under SIBA 2010. DAOs are wrapped using BVI Business Companies in orphan structures or companies limited by guarantee, often paired with a Cayman foundation ("catamaran").

• Bermuda operates a bespoke, activity- and risk-based regime (DABA 2018 + DAIA 2020) built on a single broad statutory "digital asset" definition with no mandatory token taxonomy. A DABA licence is required for a digital-asset exchange (including derivatives) — and Bermuda issued the world-first DAO-governed exchange licence to the non-custodial DerivaDEX (Class T), alongside an Embedded Supervision DeFi pilot, bringing DeFi inside a supervised perimeter.

• The Marshall Islands is the first country to recognize DAOs as legal entities, via the DAO Act of 2022 (effective 25 November 2022) and its 2023/2024 amendments. It applies a three-way digital-asset taxonomy (virtual currency / digital consumer asset / digital security). A governance token conferring no economic rights is not deemed a security; for-profit DAO LLC tokens with economic rights are fact-specific. DAO LLCs have full corporate personhood and a statutory member-liability shield (a deliberate contrast to the US Samuels v. Lido DAO general-partnership outcome). VASP-type activity falls under the Banking Act 1987 framework supervised by the Marshall Islands Monetary Authority (MIMA, from 23 September 2025).

• Seychelles mandates substance-demanding VASP licensing under the bespoke VASP Act 2024. There is no "decentralized = exempt" carve-out — the Act regulates persons, and an identifiable operator with a Seychelles nexus is in scope. The Virtual Asset Exchange licence category captures centralized and decentralized platforms where an identifiable operator exists; lending, borrowing, and other VA financial services require a VASP licence. The regime also imposes mining and mixer bans.

• El Salvador built a purpose-built issuance- and service-provider-centric regime under LEAD (in force 2023), with CNAD as the sole regulator. Classification is functional, based on economic purpose, with LEAD digital assets generally expected to be backed by an underlying asset or right. Regulation attaches to registered issuers and identifiable DASPs only; genuinely decentralized DeFi is permissive-by-omission. (DEX, lending, and governance-token treatment are not specifically addressed — NOT VERIFIED in the source files.)

Model 5: No DeFi-Specific Regulation (Wait-and-See / Effective Prohibition)

Jurisdictions:

South Korea, Brazil (decentralized gap),

Thailand (effective prohibition)

These jurisdictions have enacted crypto-asset user protection or exchange licensing laws but have not extended them to genuinely decentralized DeFi protocols — leaving either a regulatory vacuum or, in Thailand's case, an effective prohibition of DeFi-as-a-service.

How it works: General financial regulation may apply where DeFi activities fall within existing definitions, but regulators have either not clarified how DeFi is captured, or have foreclosed centralized DeFi service offerings entirely.

Verified outcomes:

• South Korea's Virtual Asset User Protection Act (VAUPA), effective 19 July 2024, focuses on exchange registration, user protection, and unfair trading. The Digital Asset Basic Act (DABA) was passed in June 2025, addressing stablecoin issuance and reserve backing. Neither creates a DeFi-specific licensing pathway. DeFi has no licensing pathway, and DeFi-adjacent lending/staking/yield-farming services are effectively prohibited in practice — a regulatory vacuum with an enforcement overlay. (Library of Congress, July 2024; Korean Law Blog on DABA, September 2025)

• Thailand operates a comprehensive licensing-led Emergency (Digital Asset Business) Decree regime with a function-based taxonomy (cryptocurrency / investment token / utility token). It excludes permissionless DeFi by prohibiting digital-asset operators from deposit-taking and lending, and barring exchange-offered staking/lending yield products — which forecloses centralized DeFi-as-a-service — while channeling activity into licensed venues via sandboxes and a 2025–2029 tax exemption.

• Brazil has a comprehensive VASP/SPSAV licensing regime (Law 14,478/2022 + Resolutions 519/520/521) regulating identifiable service providers, but truly decentralized protocols without an identifiable operator fall into an explicit carve-out/gap with no BCB guidance — placing Brazil partly in Model 1 (for identifiable VASPs) and partly here (for the decentralized gap).

Model 6: International Standard-Setting Frameworks

Bodies: FATF, IOSCO, FSB/BIS

International bodies have established frameworks that do not bind jurisdictions directly but exert significant influence on national regulators — and, notably, the "identifiable controller" logic underlying almost every national approach above traces directly to FATF and IOSCO.

How it works: These bodies issue guidance, recommendations, and analytical frameworks that member jurisdictions are expected to implement.

Verified outcomes:

• FATF's October 2021 Updated Guidance (paragraphs 67-78) establishes that "a DeFi application (i.e. the software program) is not a VASP under the FATF standards." However, "creators, owners and operators who maintain control or sufficient influence in the DeFi arrangements, even if those arrangements seem decentralized, may fall under the FATF definition of a VASP." This owner/operator test is the direct ancestor of India's, Hong Kong's, Switzerland's, Seychelles', and Nigeria's "identifiable operator" tests. (FATF Updated Guidance, October 2021)

• IOSCO's Final Report on DeFi (IOSCOPD754, December 2023) establishes nine policy recommendations centered on identifying "Responsible Persons" — entities or individuals with actual control or influence over DeFi activities. IOSCO states that "regardless of the labels, organizational forms, or technologies used, persons and entities who offer or provide financial products and services and engage in financial activities should be subject to applicable laws." (IOSCO Final Report, December 2023)

• The FSB published nine high-level recommendations (CA1-CA9) for crypto-asset activities in July 2023, based on "same activity, same risk, same regulation." A thematic peer review published in October 2025 found "significant gaps and inconsistencies" in implementation across jurisdictions. The BIS has contributed the influential "decentralization illusion" thesis, arguing that governance concentration in DeFi creates traditional intermediary-like dependencies. (FSB Framework, July 2023; BIS Quarterly Review, December 2021)

2. Comparative Analysis

The following tables compare classification approaches across all 27 jurisdictions and 3 international frameworks examined. Given the complexity, the analysis is organized by key regulatory dimensions. Where the source files record no verified position, the cell reads "NOT VERIFIED" or "NO DATA" honestly rather than inferring one.

2.1 Classification Approach and Decentralization Test

2.2 Treatment of Specific DeFi Activities

2.3 International Framework Alignment

3. What Works and What Doesn't

3.1 Activity-Based Extension: The Dominant But Incomplete Approach

Strengths:

• Technology-neutral: avoids obsolescence as DeFi architectures evolve
• Leverages existing institutional knowledge and enforcement infrastructure
• Consistent with the "same activity, same risk, same regulation" principle endorsed by FATF, IOSCO, and FSB

Weaknesses:

• Definitional mismatch: concepts like "exchange operator," "broker," and "custodian" assume identifiable intermediaries. Protocols that genuinely distribute these functions across smart contracts and governance participants do not map cleanly
• Enforcement difficulty: identifying the regulated entity in a multi-layered, globally distributed protocol is practically challenging
• Chilling effect: the US experience under the prior SEC enforcement-first approach (pre-2025) demonstrated that ambiguity deters compliant innovation without meaningfully deterring fraud

Evidence: The US shift from enforcement-first to the March 2026 taxonomy reflects recognition that activity-based classification needs explicit categories. The SEC dropped nearly all non-fraud enforcement actions against fintech companies commenced under the previous administration. The breadth of this model — eleven of the 27 jurisdictions surveyed rely on it as their primary or partial approach (US, UK, Singapore, Hong Kong, Australia, Germany, France, South Africa, India, Canada, Brazil) — confirms it as the global default, but South Africa's "declare crypto a financial product" route and India's tax/AML-only "Virtual Digital Asset" definition show how thinly the model can be stretched where no bespoke crypto statute exists. (Cleary Gottlieb Analysis, 2026)

3.2 The "Fully Decentralized" Exemption: Theoretically Sound, Practically Narrow

Strengths:

• Recognizes that truly autonomous software cannot be regulated as an intermediary
• Provides a clear incentive structure for genuine decentralization
• Avoids attempting to regulate code itself

Weaknesses:

• Extremely narrow applicability: ESMA's four-layer assessment makes it practically impossible for commercially significant protocols to qualify, because failure on any single layer (settlement, architecture, governance, or UI) brings the protocol into scope
• Binary classification problem: protocols may be decentralized in some dimensions but not others
• Gaming risk: protocols may engage in "decentralization theater" — distributing governance tokens or relinquishing upgradeability — to claim the exemption without substantively reducing risk

Evidence: The EBA-ESMA January 2025 report found DeFi represents just 4% of crypto-asset market capitalization. The exemption is now implemented near-identically across the EU/EEA cluster (EU, Germany, France, Malta, Liechtenstein, Estonia) plus the UK's parallel "truly decentralised" carve-out, yet its practical applicability remains untested — no protocol has been formally assessed as "fully decentralized" under MiCA. The UK's controlling-person test (token-governance concentration, treasury management, off-chain coordination) is the most operationally explicit articulation of where the carve-out bites.

3.3 Bespoke DeFi Licensing and Statutory Entity Law: Promising But Still Thin

Strengths:

• Tailored requirements that acknowledge structural differences between DeFi and traditional finance
• Clear compliance pathway that does not force DeFi protocols into ill-fitting CeFi categories
• First-mover advantage in attracting compliant DeFi projects

Weaknesses:

• Untested at scale: VARA's MANTRA license (February 2025) remains the only bespoke DeFi protocol-operator license issued, and Bermuda's DerivaDEX (the world-first DAO-governed exchange licence) is a single early data point
• Jurisdictional arbitrage risk: jurisdictions offering bespoke licensing or statutory DAO wrappers may attract regulatory shopping
• Sustainability uncertain: whether these frameworks can handle the diversity of DeFi protocols (AMMs, lending, derivatives, bridges) remains to be seen; the Marshall Islands' member-liability shield remains judicially untested and the jurisdiction scored 0/11 on FATF/APG effectiveness outcomes

Evidence: MANTRA's VARA license covers exchange, broker-dealer, and management/investment services — traditional categories applied to a DeFi entity. The statutory-entity branch (Marshall Islands DAO LLC, Cayman Foundation Company, BVI orphan structures) addresses the liability and personhood problem — the gap exposed by Samuels v. Lido DAO — rather than the regulatory-substance problem, and the two should not be conflated.

3.4 Substance-Over-Form with Bespoke Infrastructure Law: The Swiss-Japanese Approach

Strengths:

• Creates statutory categories that accommodate DLT-native infrastructure (Switzerland's DLT Trading Facility) or recognize the investment-product nature of crypto assets (Japan's PSA-to-FIEA transition)
• Maintains regulatory rigor while adapting legal infrastructure

Weaknesses:

• Slow to implement: Switzerland's DLT Act entered force in 2021 but the first license was not issued until March 2025; Japan's FIEA transition was proposed in April 2025 and only Cabinet-approved in April 2026
• Limited scope: Japan's two-tier FIEA system applies to exchange services, not the full spectrum of DeFi activities
• Does not resolve the core question of who the regulated entity is in a decentralized protocol

Evidence: BX Digital, the first DLT Trading Facility licensee in Switzerland, operates with regulated-entity-only participation, which limits DeFi's permissionless access model. The offshore VASP statutes in this family (Cayman, BVI, Bermuda, Seychelles, El Salvador) similarly regulate the custodial/exchange chokepoint while leaving non-custodial activity outside — Seychelles being the notable outlier in refusing a decentralization carve-out and regulating any identifiable operator with a local nexus.

3.5 No Regulation / Effective Prohibition: The Growing Risk of Inaction or Overreach

Strengths:

• Avoids premature regulation of nascent technology (the wait-and-see rationale)

Weaknesses:

• Leaves consumers and investors unprotected (South Korea)
• Creates regulatory arbitrage opportunities
• Or, at the opposite extreme, forecloses legitimate innovation: Thailand's prohibition on operator deposit-taking, lending, and exchange-offered yield bars centralized DeFi-as-a-service entirely
• May result in more restrictive catch-up regulation later

Evidence: South Korea's VAUPA (2024) and DABA (2025) address centralized exchanges and stablecoins respectively but leave DeFi in a regulatory vacuum with lending/staking effectively prohibited in practice. Thailand reaches a similar end state (no permissionless DeFi) by affirmative prohibition rather than omission, showing that "no DeFi-specific framework" can mean either a vacuum or a wall.

4. Recommended Framework: Tiered Classification Based on Control Attribution

Based on the evidence gathered across 27 jurisdictions and 3 international frameworks, this guidance recommends a tiered classification framework that combines the strengths of multiple approaches while mitigating their respective weaknesses. The framework's central insight — that classification should begin with who controls the protocol, not what the protocol is — is the common denominator that already unites every national regime surveyed.

Tier 1: Identify the Responsible Person(s)

Before classifying the protocol, classify the degree of human control. This aligns with FATF's owner/operator test, IOSCO's "Responsible Persons" framework, ESMA's four-layer decentralization assessment, the UK's controlling-person test, South Africa's "spectrum of decentralization," and the ADGM "nexus" test.

Control indicators (drawn from verified regulatory practice):

If one or more control indicators are present: The entity or person exercising control is the "responsible person" and must be classified under Tier 2 or Tier 3.

If no control indicators are present: The protocol qualifies for Tier 4 treatment (fully decentralized exemption).

Tier 2: Activity-Based Classification for Identified Operators

Where a responsible person is identified, classify the protocol's primary regulated activity using existing financial services law:

Tier 3: Bespoke DeFi License or Statutory Wrapper for Partially Decentralized Protocols

Where a protocol has some decentralized characteristics but retains identifiable responsible persons, regulators should consider a bespoke DeFi license and/or a statutory entity wrapper that:

• Imposes proportionate requirements based on the actual risk profile
• Recognizes that smart-contract-based risk management may substitute for some traditional compliance functions
• Requires governance transparency (voting power distribution, upgrade authority, treasury management)
• Mandates smart contract audit and disclosure
• Resolves liability and legal personhood (the Samuels v. Lido DAO problem) via a recognized DAO entity form

Precedent: VARA's DeFi license to MANTRA (February 2025) and ADGM's DeFi protocol operator framework (September 2025) on the licensing side; Bermuda's DerivaDEX DAO-governed exchange licence; and on the entity side the Marshall Islands DAO LLC, the Cayman Foundation Company, and BVI orphan/CLG structures.

Tier 4: Fully Decentralized Exemption with Monitoring

Where no responsible person can be identified under Tier 1, the protocol falls outside the regulatory perimeter, subject to:

• Periodic reassessment if governance or control structures change
• Mandatory disclosure at the interface layer (wallets, aggregators, front-ends that provide access remain regulated)
• AML/CFT obligations at on-ramp/off-ramp points (fiat interfaces, centralized exchange interactions)

Precedent: MiCA Recital 22 "fully decentralized" exemption; the UK "truly decentralised" controlling-person carve-out; FATF guidance that software itself is not a VASP. Note the divergence: Seychelles deliberately offers no such carve-out, regulating any identifiable operator with a local nexus — a reminder that Tier 4 is a policy choice, not a legal inevitability.

Governance Token Classification

Governance tokens should be classified based on their functional attributes:

• Pure governance (voting only, no economic rights): Not a security or financial instrument, but the holder may be a "responsible person" if voting power is concentrated. The Marshall Islands codifies this directly — a governance token conferring no economic rights is statutorily not a digital security.
• Governance + economic rights (fee sharing, revenue distribution, staking rewards): Likely a security under the Howey test (US) or a financial instrument under MiFID II (EU), and potentially a Type I/II FIEA security (Japan), subject to full securities regulation.
• Governance + utility (voting + protocol access): Hybrid classification requiring case-by-case assessment.

5. Decision Matrix

The following matrix helps policymakers select an appropriate classification approach based on their jurisdiction's characteristics.

Scenario A: Jurisdiction with Mature Securities and Financial Services Law

If your country has: An established securities regulator, existing exchange and broker-dealer licensing, and precedent for applying functional tests (e.g., Howey test or equivalent).

Consider: Activity-based extension (Model 1) with a tiered decentralization assessment.

Because: The US, UK, Hong Kong, Singapore, Australia, France, and South Africa have all adopted this approach and it leverages existing institutional capacity. The US March 2026 five-category taxonomy provides a tested template for token classification; South Africa shows the route can work even without a bespoke crypto statute by declaring crypto a "financial product."

Key risk: Definitional gaps where DeFi activities do not map cleanly to existing categories. Mitigate by adding the Tier 3 bespoke license option.

Scenario B: Jurisdiction Implementing Regional Harmonized Framework (e.g., EU Member State)

If your country has: Obligations under a supranational framework such as MiCA that includes a decentralization exemption.

Consider: Implementing the exemption with a rigorous multi-layer assessment framework, and focus regulatory resources on the interface and on-ramp layers.

Because: The EU experience demonstrates that the "fully decentralized" exemption is practically narrow (ESMA's four-layer test makes qualification extremely difficult). Germany's strict KWG-anchored implementation, France's PACTE-to-MiCA transition, Malta's Chapter 647 CASP regime, Estonia's post-crackdown consolidation, and Liechtenstein's Token Container Model provide a spread of templates. Focus compliance effort on CASPs and interface providers where enforcement is practical.

Key risk: "Decentralization theater" — protocols structuring to appear decentralized while retaining effective control. Mitigate through periodic reassessment and substance-over-form enforcement.

Scenario C: Jurisdiction Seeking to Attract DeFi Innovation

If your country has: A regulatory sandbox or special economic zone framework, limited existing crypto regulation, and a policy objective to attract fintech investment.

Consider: Bespoke DeFi licensing or a statutory entity wrapper (Model 3 / Model 4 entity branch) with graduated requirements.

Because: The UAE's dual approach (VARA bespoke license + ADGM principle-based framework) has attracted the first licensed DeFi operation globally. Bermuda's graduated T→M→F sandbox produced the world-first DAO-governed exchange licence. The Marshall Islands' statutory DAO LLC and Cayman's Foundation Company supply the leading entity wrappers. Switzerland's DLT Trading Facility demonstrates how bespoke infrastructure licensing can coexist with existing financial regulation.

Key risk: Regulatory shopping and reputational risk if licensed entities fail; and, as the Marshall Islands shows, entity-law innovation can outrun AML/CFT effectiveness (a 0/11 FATF/APG outcome score). Mitigate through robust AML/CFT requirements, capital adequacy standards, and international cooperation.

Scenario D: Jurisdiction with Limited Regulatory Capacity

If your country has: Limited financial regulatory infrastructure, no specialized crypto or fintech regulator, and resource constraints on supervision.

Consider: Adopting international framework principles (FATF owner/operator test, IOSCO Responsible Persons, FSB CA1-CA9) as the basis for initial guidance, focusing enforcement on fiat on-ramps and centralized intermediaries.

Because: International frameworks provide a ready-made analytical structure that does not require building bespoke DeFi expertise immediately. India's PMLA-registration-plus-VDA-tax approach and South Korea's exchange-focused VAUPA demonstrate that chokepoint-focused regulation can provide foundational coverage while more comprehensive frameworks are developed.

Key risk: DeFi activity occurring entirely outside the regulatory perimeter, or punitive overreach (India's high VDA tax, Thailand's lending prohibition) driving activity offshore. Mitigate through international cooperation and proportionate calibration.

Scenario E: Jurisdiction Where Court Precedent is Shaping Classification

If your country has: Active litigation testing the application of existing law to DeFi-adjacent products.

Consider: Monitoring outcomes and using judicial precedent to inform legislative action, rather than rushing to legislate.

Because: Australia's Block Earner case demonstrates how courts can provide classification guidance. The Full Federal Court found in April 2025 that a DeFi access product was NOT a financial product requiring an AFSL — but ASIC has been granted High Court special leave to appeal (heard 12 March 2026; judgment reserved). The US Samuels v. Lido DAO ruling (governance-token holders as general partners) similarly shows how litigation drives the liability question that statutory DAO wrappers then answer.

Key risk: Inconsistent or unpredictable judicial outcomes. Mitigate by issuing clear regulatory guidance that reduces the need for litigation-driven classification.

6. Implementation Considerations

6.1 The Interface Layer Problem

Regardless of whether a protocol itself is classified as regulated or exempt, the interface layer (front-ends, aggregators, wallets that provide access to DeFi protocols) consistently falls within regulatory scope across all jurisdictions examined. Policymakers should ensure that:

• Front-end operators providing access to DeFi protocols are subject to AML/CFT obligations
• Risk disclosures are required at the point of user interaction
• Geo-blocking and access restriction capabilities are maintained

6.2 Cross-Border Coordination

DeFi protocols operate globally by default. Effective classification requires:

• Mutual recognition of licensing decisions where regulatory standards are equivalent
• Information-sharing agreements between national regulators
• Alignment with FATF, IOSCO, and FSB frameworks to ensure baseline consistency

6.3 Periodic Review

DeFi technology and governance structures evolve rapidly. Any classification framework should include:

• Mandatory review periods (the EU's Article 142 report mechanism and its 20 May 2026 lending consultation provide a template)
• Reclassification triggers when control structures change
• Stakeholder consultation processes

Verification Notes

This synthesis mirrors the canonical fact-matrix extracted from the 27 already-verified jurisdiction files (as of 2026-06-04). Aggregate counts ("eleven of 27 jurisdictions…") are derived from that matrix, not independently researched. Cells reading "NOT VERIFIED" / "NO DATA" reflect the absence of a verified position in the source file and are reproduced honestly rather than inferred.

Sources Verified via Direct Fetch or Official Press Release

1. SEC-CFTC Joint Token Taxonomy (March 2026): Verified via CFTC Press Release 9198-26. Five categories confirmed: digital commodities, digital collectibles, digital tools, stablecoins, digital securities. Date: 17 March 2026 (Release Nos. 33-11412/34-105020). A separate 11 March 2026 SEC/CFTC MOU classifies BTC and ETH as digital commodities. Governance tokens generally fall within the "digital tools" carve-out (UNI treated as governance, not a security); there is no formal SEC "decentralization spectrum" test beyond the acknowledged spectrum/"sufficient decentralization" framing.

2. MiCA "Fully Decentralized" Exemption: Verified via MiCA text (Recital 22, Article 2). Two cumulative conditions confirmed. MiFID II prevails where a token is a financial instrument (Art 2(4)).

3. EBA-ESMA Joint Report (January 2025): Verified via ESMA press release. 4% TVL figure confirmed as DeFi TVL relative to total crypto market capitalization (NOT a measure of what qualifies as fully decentralized). ESMA's decentralization assessment is a four-layer test (settlement, architecture, governance, user interface), failure on any single layer bringing the protocol into MiCA scope. (Earlier drafts of this document described a "five-dimension" framing including an "operations" layer; the matrix records the four-layer formulation, which is used here.)

4. UK FCA / Property Act 2025: UK regime verified — FCA token categories, new "qualifying cryptoassets" from October 2027, CATP/CASP authorisation, CP25/40 lending proposals (retail over-collateralisation max 50% LTV, ban on proprietary tokens in lending), and the Property (Digital Assets etc) Act 2025 third category of personal property. "Truly decentralised" carve-out rests on a controlling-person test (three factors).

5. Singapore FSMA Part 9 & DEX scope: Effective date 30 June 2025 confirmed for DTSPs. Per the matrix, DEX operations were brought within DPT-service scope by the April 2024 PS Act amendments (absence of a central administrator does not exempt). Licensed DPTSPs are barred from facilitating staking/lending for retail customers (April 2024). Governance tokens are excluded from FSMA Part 9.

6. Japan FSA PSA-to-FIEA: Discussion Paper April 2025; PSA-to-FIEA transition with two-tier classification now Cabinet-approved (April 2026). A 2024 ordinance provides a DAO LLC carve-out.

7. Switzerland FINMA DLT Trading Facility: First license to BX Digital, 12 March 2025. Genuinely decentralized protocols require no licence.

8. Australia Digital Assets Framework Act 2026: Per the matrix, the framework is now enacted (Act 2026, superseding the earlier Bill 2025), extending AFSL to DAPs/TCPs from 9 April 2027 with carve-outs for core infrastructure, custodial staking, and low-value operators. Block Earner: Full Federal Court ruled in Block Earner's favour (April 2025); ASIC High Court appeal heard 12 March 2026, judgment reserved.

9. UAE (VARA/ADGM): MANTRA VARA DeFi license 19 February 2025; VARA Exchange Services Rulebook v2.1 (31 March 2026) adds a permanent VA derivatives regime; "Lending and Borrowing" is a licensed activity category. ADGM "nexus to ADGM" test (September 2025 Digital Assets Framework update) can reach developers, governance-token holders, and foundations.

10. South Korea VAUPA/DABA: VAUPA effective 19 July 2024; DABA passed June 2025. No DeFi licensing pathway; lending/staking/yield effectively prohibited in practice.

11. New jurisdictions integrated (12): Bermuda (DABA 2018/DAIA 2020, DerivaDEX world-first DAO exchange licence), El Salvador (LEAD 2023, CNAD), British Virgin Islands (VASP Act 2022, Circular 43 of 2025 sole-issuance carve-out), India (VDA definition Sec 2(47A), crypto-asset limb 1 April 2026, PMLA VDASP registration), Thailand (Emergency Decree taxonomy, deposit/lending prohibition), Marshall Islands (DAO Act 2022, statutory DAO LLC, three-way taxonomy), Malta (Chapter 647 CASP, Financial Instrument Test + MiCA), Liechtenstein (TVTG Token Container Model + MiCAR), Estonia (MiCA categories, VASP sunset 1 July 2026), South Africa (FAIS "financial product" declaration, FSCA spectrum-of-decentralization), Nigeria (ISA 2025, digital assets as securities), Seychelles (VASP Act 2024, no decentralization carve-out, mining/mixer bans).

12. International frameworks: FATF owner/operator test (October 2021 Guidance, paras 67-78); IOSCO IOSCOPD754 nine recommendations / "Responsible Persons" (December 2023); FSB CA1-CA9 (July 2023, October 2025 thematic review finding "significant gaps and inconsistencies"); BIS "decentralization illusion" (December 2021).

Claims Corrected or Updated in This Revision

• Australia: Status corrected from "Digital Assets Framework Bill 2025 (proposed)" to the enacted Digital Assets Framework Act 2026 per the matrix.
• Japan: FIEA transition updated from "discussion paper (proposed)" to Cabinet-approved (April 2026).
• EU decentralization test: Standardised to the four-layer formulation (settlement, architecture, governance, UI) per the matrix, replacing the prior "five-dimension" description.
• Singapore: DEX scope reflected per the matrix as brought into DPT-service scope by the April 2024 PS Act amendments.
• Jurisdiction count: All aggregate statements recomputed for 27 jurisdictions (up from 15) plus 3 international frameworks.
• Governance-token statutory exemption: Marshall Islands' codified "no economic rights = not a security" rule integrated.
• Decentralization carve-out divergence: Seychelles noted as deliberately offering no "decentralized = exempt" carve-out, in contrast to the MiCA/UK cluster.