DeFi Liability Allocation Frameworks

Purpose and Scope

This section provides regulators and policymakers with a comparative analysis of how liability is allocated when decentralized finance (DeFi) protocols cause harm. It examines the legal treatment of five categories of actors — developers, deployers, governance token holders, DAOs as entities, and front-end operators — across 27 jurisdictions. It synthesizes case law, legislation, and regulatory guidance as of June 2026 to identify what works, what does not, and what a principled framework should look like.

DeFi protocols present a fundamental challenge to liability allocation: traditional legal systems assign responsibility to identifiable legal persons, but DeFi systems distribute control across developers who write code, deployers who launch it on-chain, governance token holders who vote on parameters, DAOs that aggregate collective decision-making, and front-end operators who provide user-facing interfaces. When things go wrong — exploits, rug pulls, sanctions evasion, loss of funds — the question of "who is liable" has no settled global answer.

Why This Matters Now

Three developments in 2024-2025 have made liability allocation the single most urgent regulatory question in DeFi:

1. The partnership liability threat. The Samuels v. Lido DAO ruling (November 2024) found that a major DeFi protocol's governance token holders — including billion-dollar venture capital firms — may face unlimited personal liability as general partners. This applies retroactively to all unwrapped DAOs operating without legal entity structures.

2. The product liability expansion. The EU Product Liability Directive 2024/2853 explicitly classifies software as a product subject to strict liability, with a narrow open-source exemption that will not protect most commercial DeFi protocols. Transposition deadline: 9 December 2026.

3. The criminal prosecution precedent. Roman Storm's August 2025 conviction for operating an unlicensed money transmitting business through Tornado Cash establishes that DeFi developers can face criminal liability — not merely civil penalties — for protocol operations. (His Rule 29 acquittal motion remained undecided as of June 2026, and the DOJ has signalled its intention to retry the two deadlocked counts.)

These developments mean that the status quo of regulatory ambiguity is no longer tenable. Every actor in the DeFi stack — from solidity developer to front-end operator to governance token holder — now faces material legal risk in at least one major jurisdiction.

A countervailing development is the emergence of statutory liability shields. The Marshall Islands DAO LLC (effective November 2022, amended 2023-2024) is the world's first purpose-built statutory wrapper conferring corporate personhood and a member liability shield — a deliberate legislative answer to the Samuels v. Lido DAO partnership outcome. Together with the offshore foundation and wrapper jurisdictions (

Cayman Islands,

Switzerland, BVI,

Liechtenstein), this means the same DAO can face unlimited partnership liability in one jurisdiction and a complete liability shield in another — the largest source of regulatory arbitrage in DeFi.

1. Global Landscape: Six Liability Models

Six distinct approaches to DeFi liability allocation have emerged across the 27 jurisdictions surveyed. No model exists in pure form; most jurisdictions blend elements of multiple approaches.

Model A: Traditional Tort and Contract Law Extension

Jurisdictions apply existing tort (negligence, fraud) and contract law to DeFi actors without DeFi-specific legislation. Courts assess duty of care, foreseeability, and causation using established precedent. This is the default in most common-law jurisdictions.

Where observed:

UK,

Singapore,

Brazil (Art. 186 Civil Code),

Thailand,

South Africa, Seychelles, common-law and civil-law jurisdictions generally.

Key case: Quoine Pte Ltd v B2C2 Ltd [2020] SGCA(I) 2 — The Singapore Court of Appeal upheld that algorithmic trades on a cryptocurrency exchange created valid, binding contracts, and that unilateral reversal of those trades by the exchange constituted breach of contract. The Court applied conventional contract principles (offer, acceptance, consideration) to algorithmic trading, establishing that consensus ad idem exists when two algorithms interact within their programmed parameters (Singapore Court of Appeal, Quoine v B2C2).

In the UK, the UKJT Legal Statement on Cryptoassets and Smart Contracts (November 2019) concluded that cryptoassets have the legal indicia of property and smart contracts are capable of giving rise to binding legal obligations (UKJT Legal Statement, 2019). The Law Commission's November 2021 report on smart contracts confirmed that England and Wales' existing legal framework can facilitate smart legal contracts without statutory reform, proposing a "reasonable coder" test for interpreting coded terms (Law Commission, Smart Contracts, 2021).

Model B: Strict Product Liability (EU Product Liability Directive)

The

EU has explicitly classified software — including standalone software — as a "product" under the revised Product Liability Directive (EU) 2024/2853, which entered into force on 8 December 2024 and must be transposed into national law by 9 December 2026. Under this regime, manufacturers of defective software face strict liability — claimants need not prove fault, only that the software was defective and caused damage (EUR-Lex, Directive 2024/2853). Because the directive operates at the EU level, it reaches DeFi software deployed commercially across all Member States surveyed here —

France,

Germany,

Malta, and

Estonia — and, through the EEA, informs the posture of

Liechtenstein.

Open-source exemption: Open-source software is excluded from the directive's scope only if it is "not provided in the course of a business activity." A chargeable service or collection of personal data in connection with the software revives its product character and triggers full liability under the directive (IBA, Liability for Software under PLD).

Implications for DeFi: DeFi protocol software deployed commercially — including protocols that generate fees, collect data, or are maintained by entities earning revenue — will likely be classified as products. Protocol developers and deployers operating commercially within the EU face strict liability for defects. The narrow open-source exemption will not protect most commercial DeFi operations.

Note: The proposed EU AI Liability Directive was withdrawn in the Commission's 2025 Work Programme (February 2025). There was discussion of expanding it into a broader Software Liability Regulation, but the Product Liability Directive 2024/2853 currently serves as the primary strict-liability instrument for defective software in the EU (Inside Privacy, EU AI Liability Directive).

Model C: DAO-Specific Legislation

A small number of jurisdictions have enacted legislation specifically addressing DAO legal status, governance, and liability. They fall into two families: US state-level wrappers, and the Marshall Islands' standalone statutory entity.

Wyoming (US): Wyoming enacted the first US DAO legislation in 2021, allowing DAOs to register as LLCs under a DAO Supplement to the state's LLC Act (Wyoming Legislature, SF0038). The framework failed to attract significant uptake due to complications — LLC membership interests (tokens) are generally considered securities, and the Corporate Transparency Act's beneficial ownership reporting requirements are impractical for DAOs with thousands of anonymous members. In March 2024, Wyoming enacted a new framework creating Decentralized Unincorporated Nonprofit Associations (DUNAs), effective July 1, 2024, which avoids the securities classification problem by structuring DAOs as nonprofit associations (Fortune Crypto, Wyoming DUNA).

Utah (US): The Utah Decentralized Autonomous Organizations Act, signed March 13, 2023 (effective January 1, 2024), creates a distinct entity type — the Limited Liability Decentralized Autonomous Organization (LLD) — rather than wrapping DAOs in existing LLC frameworks. Members are liable only for their on-chain contributions; they are not personally liable for other members' actions or the LLD's obligations in excess of its assets. The Act requires quality assurance of smart contract code and a graphical user interface for transaction monitoring (Utah Legislature, HB0357; ArentFox Schiff, Utah DAOs). Tennessee and Vermont have also enacted DAO-enabling provisions; there remains no federal US DAO law.

Marshall Islands — the world-first statutory DAO LLC: The Marshall Islands is the first sovereign state to recognize DAOs as legal entities in their own right. The DAO Act of 2022 (effective 25 November 2022, following a February 2022 amendment to the Non-Profit Entities Act) creates a purpose-built DAO LLC: an entity with full corporate personhood that can own property, contract, and sue or be sued, while statutorily shielding members from personal liability for the DAO's debts. This is a deliberate legislative contrast to the Samuels v. Lido DAO general-partnership outcome. A 2023 Amendment added the Series DAO LLC, on-chain governance carve-outs, and a 3% Gross Revenue Tax for for-profit DAO LLCs (non-profit DAO LLCs are tax-exempt); 2024 DAO Regulations added beneficial ownership information reporting (BOIR), a Representative Agent requirement, and penalties (dissolution and/or up to USD 5,000). A 2023 amendment also shields DAOs from liability for open-source software they create, with smart-contract obligations attaching to the entity rather than to individual contributors. Entities are administered via MIDAO; they may be member-managed or smart-contract-managed, with no board required. Financial-supervision of VASP-type activity now sits with the Marshall Islands Monetary Authority (MIMA, established 23 September 2025) (MIDAO). The member-liability shield remains judicially untested as of June 2026, and the IMF's 2025 Article IV review (Country Report No. 25/321) reiterated financial-integrity concerns over the registry.

Japan: Japan's Financial Services Agency issued a Cabinet Office Ordinance (April 2024) amending the definitions under the Financial Instruments and Exchange Act to reclassify tokenized LLC (godo kaisha) membership rights from "Paragraph I Securities" (subject to stringent disclosure and sales regulations) to "Paragraph II Securities" under certain conditions. This enables LLC-type DAOs to issue tokenized membership rights without triggering the full securities registration regime, making DAO-as-LLC structures practically viable; members' liability is limited to their contributions. The LDP's 2024 Web3 White Paper recommends a dedicated DAO law (CryptoNews, "Japan's FSA grants limited rights to DAO member tokens").

Model D: Foundation and Wrapper Approach

Jurisdictions provide legal entity structures that DAOs can "wrap" around their operations, granting legal personality, limited liability, and the ability to contract and hold property.

Cayman Islands: The Cayman Islands Foundation Company (under the Foundation Companies Act 2017, 2025 Revision) has become the dominant global standard for DAO legal wrappers. At the end of 2024, more than 1,300 foundation companies were on the register (up from 790 the previous year — a 70% year-on-year increase), with over 400 more registered in the first months of 2025. At least 17 foundation companies each hold treasuries exceeding $100 million, with total estimated assets of approximately $10 billion. The structure has no shareholders or members and gives the DAO separate legal personality, shielding token holders from personal liability while providing a corporate vehicle to interact with traditional legal and financial systems (Cayman Finance, Web3 Foundations; Cointelegraph, Foundation Registrations).

Switzerland: Swiss foundations (Stiftung, under the Swiss Civil Code, Art. 80 ff.) and Swiss associations (Verein, Art. 60 ff.) serve as DAO wrappers. The Ethereum, Cardano, Solana, Polkadot, Aave, dYdX, Tezos, NEAR, and Cosmos foundations are among those incorporated in Switzerland. A Swiss foundation is an ownerless legal entity (minimum CHF 50,000 endowment, local board member required) established by endowment of assets for specific purposes, offering limited liability protection to token holders governing through it; board members are liable under Art. 55 CC only absent diligence. The lighter Verein requires no capital and two founders. Switzerland's DLT Act (fully in force since 1 August 2021) introduced ledger-based securities ("Registerwertrecht") and a new DLT trading facility license category, providing additional infrastructure for tokenized governance (Swiss Federal Council, DLT Act; Legal Nodes, Swiss Foundation).

British Virgin Islands: The BVI has no dedicated DAO or foundation statute, but its facilitative VASP Act 2022 regime (in force 1 February 2023) and well-developed corporate law make it a leading wrapper jurisdiction. DAOs are typically structured as a BVI Business Company in an "orphan" structure (shares held on a purpose trust) or as a company limited by guarantee (CLG) — and very often paired with a Cayman foundation in a so-called "catamaran" structure. Members of a properly structured BVI BC are not personally liable beyond unpaid contributions; an unwrapped DAO, by contrast, risks general-partnership unlimited liability (cf. Samuels v. Lido DAO). The FSC has confirmed (Industry Circular 43 of 2025) that the sole act of issuing or selling a virtual asset is not a VASP activity, underpinning the territory's token-launch industry (Harneys, Circular 43).

Liechtenstein: Liechtenstein has no bespoke DAO statute, but its Token and TT Service Provider Act (TVTG, the "Blockchain Act") provides a civil-law basis for tokenisation, and its long-established PGR legal forms serve as wrappers. A DAO can wrap as a Foundation (Stiftung — memberless, minimum capital CHF 30,000) or an Establishment (Anstalt — liability limited to entity assets; segmented-shares form minimum CHF/EUR/USD 50,000). Wrapped governance participants are generally shielded if formalities are observed; an unwrapped DAO risks treatment as a simple partnership exposing active participants to liability. The TVTG regulates identifiable "TT service providers" — persons, not protocols or code.

Seychelles: Seychelles offers no DAO-purpose-built wrapper, but traditional vehicles — the International Business Company (IBC Act 2016), the Special Licence Company (CSL), and the Foundation (Foundations Act 2009) — are available. No statute or court decision addresses DAO legal personality (NO DATA FOUND), and its VASP regime regulates persons, not decentralization, so an identifiable operator with a Seychelles nexus is in scope.

Model E: Enforcement-Driven Liability (US Federal Agencies)

The

US federal approach has primarily been enforcement-driven rather than legislative, with the CFTC, SEC, DOJ, and OFAC establishing precedent through individual actions. (Activity has dropped sharply post-2025 as the federal posture shifted from regulation-by-enforcement to a fraud-focused, accommodation-oriented approach.)

CFTC v. Ooki DAO (2022-2023): The CFTC charged Ooki DAO with operating illegal off-exchange digital asset trading and failing to comply with the Bank Secrecy Act. The Northern District of California held that Ooki DAO was an "unincorporated association" under California law — the first US court to find a DAO to be a legal person capable of being subject to entity-level liability. A default judgment imposed a $643,542 penalty and permanent trading bans, and ordered the shutdown of the DAO's website. The CFTC asserted that anyone who voted using a governance token was part of the unincorporated association (CFTC Press Release 8590-22; CFTC Order, June 2023).

Samuels v. Lido DAO (2024): On 18 November 2024, the US District Court for the Northern District of California denied motions to dismiss, holding that the plaintiff sufficiently alleged Lido DAO is a general partnership under California law. The court found that major venture capital firms (Paradigm, Andreessen Horowitz, Dragonfly) that purchased significant governance tokens and actively participated in Lido's governance could be liable as general partners with unlimited personal liability for the DAO's alleged securities law violations. Discovery is ongoing; dispositive motions are scheduled for mid-November 2026 (Davis Wright Tremaine, Samuels v. Lido; Winston & Strawn, DAO Partnership).

Tornado Cash — OFAC sanctions and criminal prosecution: In August 2022, OFAC sanctioned Tornado Cash's smart contracts. On 26 November 2024, the Fifth Circuit in Van Loon v. Department of the Treasury held that OFAC exceeded its statutory authority because immutable smart contracts cannot be "property" under IEEPA — they cannot be owned, controlled, or altered by any person (Fifth Circuit, Van Loon v. Treasury). Treasury delisted Tornado Cash on 21 March 2025. Separately, developer Roman Storm was indicted in August 2023 (S.D.N.Y.) for money laundering, sanctions violations, and operating an unlicensed money transmitting business. At trial in August 2025, the jury convicted Storm on the unlicensed money transmitting charge (up to 5 years) but deadlocked on the money laundering and sanctions counts. His Rule 29 acquittal motion (heard 9 April 2026 before Judge Failla) remained undecided as of June 2026, and on 9 March 2026 the DOJ filed a letter signalling its intention to retry the two deadlocked counts (proposed October 2026 start) (Mayer Brown, Tornado Cash Trial; IRS Criminal Investigation).

Uniswap — SEC Wells Notice: In April 2024, the SEC issued a Wells notice to Uniswap Labs, signaling intent to pursue enforcement for operating as an unregistered securities broker and exchange. In February 2025, the SEC closed the investigation without action, possibly reflecting Uniswap's non-custodial model and proactive engagement (Uniswap Blog, SEC Investigation Closed; Columbia Law CLS Blue Sky, Uniswap Reprieve).

Model F: No Framework (Default to General Partnership / De Facto Partnership)

Jurisdictions without DAO-specific legislation or clear regulatory guidance default to existing business organization law. In most civil-law and common-law systems, a group of persons carrying on business together for profit without forming a legal entity is classified as a general (or de facto) partnership, exposing all participants to unlimited personal liability. This is the largest model by jurisdiction count.

Germany: Under the Gesellschaft bürgerlichen Rechts (GbR) framework, all partners share unlimited liability with their private assets. The January 2024 MoPeG reform modernized partnership law but did not create DAO-specific provisions (Deloitte Legal Germany, MoPeG Reform).

France: Under the Société de fait / Société en participation (SEP) framework, a group of persons carrying on a joint enterprise without formal registration constitutes a de facto partnership. All participants face unlimited joint and several liability for the partnership's obligations. French courts have broad discretion to recharacterize informal arrangements as partnerships based on the factual indicia of shared management, profit-sharing, and joint enterprise.

Brazil: Under Arts. 986-990 of the Civil Code, an unincorporated DAO defaults to a sociedade em comum (de facto partnership), exposing participants to unlimited joint and several liability. Projects structure through a Ltda. or S.A. to avoid this classification. Developers may face general tort liability under Article 186 of the Civil Code.

Singapore: No DAO-specific framework exists. DAOs default to general partnership classification under the Partnership Act (Cap. 391), exposing all participants to unlimited joint and several liability; absent a wrapper, developers and key contributors may bear personal liability for exploits and regulatory non-compliance. DAOs may instead incorporate as a Pte Ltd, LLP, or Company Limited by Guarantee (CLG). The landmark Quoine v. B2C2 decision confirms that Singapore courts will apply conventional contract and equity principles to algorithmic and smart contract transactions, but the case did not address DAO governance liability.

Other partnership-default jurisdictions:

Canada (risk of general partnership under provincial Partnership Acts; Quebec civil law differs; Samuels v. Lido DAO persuasive),

Hong Kong (no DAO recognition; case-by-case treatment as unincorporated association or partnership — see Mantra Dao v Mullin (2024), which compelled a DAO to disclose financial records),

Thailand (analysed under general civil/commercial/partnership principles; NO DATA FOUND on any ruling),

India (no legal personality; most plausibly an association of persons / unincorporated partnership under the Partnership Act 1932 — NOT VERIFIED, no precedent; projects domicile offshore in Cayman, Switzerland, or Singapore),

South Africa (defaults to general company, partnership, or trust law; could be partnership or universitas, not judicially determined),

Nigeria (no DAO entity; would use CAMA 2020 vehicles; ISA 2025 targets persons "in control" of an unregistered exchange — directors and promoters prosecutable, but no liability for autonomous code), and

El Salvador (no statutory DAO recognition; must adopt a hybrid local SA/SRL company or foundation to interface with the CNAD; NO DATA FOUND on any DAO-liability ruling).

Estonia, though an EU/MiCA state, sits here for governance liability: its e-Residency programme warns that in an unincorporated DAO any member who has ever voted can be held fully liable, facing joint and several legal and tax liabilities across jurisdictions; DAOs there instead use an OÜ (private limited company) or MTÜ (non-profit association).

Malta likewise relies on conventional company/foundation/association wrappers — its ITAS Act (Chapter 592) offers only voluntary technology-arrangement certification and does not confer legal personality.

2. Comparative Analysis

The following table maps liability dimensions across jurisdictions. Each cell reflects the current legal position as of June 2026. "NOT VERIFIED" / "NO DATA" indicates the underlying jurisdiction research did not establish a position.

Table: Liability Dimensions by Jurisdiction (Core Set)

Table: Liability Dimensions — Extended Set (12 Additional Jurisdictions)

Key Observations from the Comparative Table

Several patterns emerge from the cross-jurisdictional comparison across all 27 jurisdictions:

1. Developer liability is converging. Across the jurisdictions surveyed, developers face increasing liability exposure — whether through strict product liability (EU and its Member States), criminal prosecution (US Tornado Cash; Nigeria ISA 2025 for persons "in control"), arguable fiduciary duties (UK), control-based registrant theory (India's "control or sufficient influence"), or ordinary tort law (Singapore, Japan, Brazil, Switzerland, Thailand). No jurisdiction provides developers with blanket immunity — though the Marshall Islands comes closest, shielding DAOs from liability for the open-source software they create. Several smaller jurisdictions (Bermuda, El Salvador, Estonia, Seychelles, South Africa) have no tested developer-liability position at all (NOT VERIFIED / NO DATA), meaning the default is unsettled common-law or civil-law tort.

2. Governance token holder liability is sharply divided. Of the 27 jurisdictions, two camps dominate. Statutory or wrapper-based limited liability is available in the Marshall Islands (statutory DAO LLC shield), Cayman Islands, Switzerland, BVI, Liechtenstein, and Japan (LLC-type DAO). Default unlimited partnership liability applies in the US (active participants), Brazil, Singapore, Germany, France, Estonia (any voter), and — at risk but untested — Canada, India, Thailand, South Africa, Nigeria, Hong Kong, and most other no-framework jurisdictions. Estonia is notable for the bluntest official warning of all: per its e-Residency guidance, any member who has ever voted can be held fully liable. This divergence creates the largest regulatory arbitrage opportunity in DeFi: a DAO can obtain a complete liability shield in the Marshall Islands or Cayman Islands while its unwrapped equivalent faces unlimited partnership liability elsewhere.

3. Front-end operator regulation is broadening but uneven. The US (Treasury/IRS final regulations, December 2024 — though the DeFi broker rule was later nullified by the Congressional Review Act in April 2025) and the EU/MiCA jurisdictions (EU, France, Germany, Malta, Estonia, plus EEA-aligned Liechtenstein) now reach front-ends that are not "fully decentralized." Several activity-based regimes capture front-end operators indirectly: Bermuda (DABA), BVI (custodial/transfer-on-behalf VASP), India (PMLA "control or sufficient influence"), Thailand, Nigeria (DAX), and Seychelles all regulate an identifiable operator/front-end where one exists. Purely decentralized, operator-less front-ends remain outside most of these perimeters.

4. Smart contract enforceability is settled in the mature jurisdictions but unverified in several newer ones. Every common-law and major civil-law jurisdiction surveyed (US, UK, Singapore, Cayman, BVI, Switzerland, Japan, Marshall Islands by statute) recognizes smart contracts as capable of creating binding legal obligations. For a number of the newer jurisdictions (El Salvador, India, Thailand, South Africa, Nigeria, Seychelles), the matrix records NOT VERIFIED / NO DATA — there is no published authority squarely on smart-contract enforceability, even though general contract law is expected to apply.

5. Purpose-built DAO entities remain rare. Only the Marshall Islands (statutory DAO LLC), and US states Wyoming (DUNA), Utah (LLD), Tennessee and Vermont have created DAO-specific entity forms. The Cayman, Swiss, BVI, and Liechtenstein "wrapper" approaches adapt existing entity law rather than creating a new form. The remaining 18 jurisdictions have no DAO entity at all, defaulting to partnership, association, or conventional company law.

IOSCO "Responsible Persons" Framework

The International Organization of Securities Commissions (IOSCO) published its final Policy Recommendations for Decentralized Finance in December 2023, introducing the "Responsible Persons" concept. IOSCO recommends that regulators identify individuals or entities with "actual control or influence" over DeFi activities — including founders, developers, token issuers, DAO participants, and holders of smart contract admin keys — and apply regulatory requirements achieving outcomes consistent with traditional finance (IOSCO, DeFi Policy Recommendations, December 2023).

This framework has no binding force but represents the consensus position of securities regulators from over 130 jurisdictions and is likely to influence domestic legislative and enforcement approaches. Its "control or influence" logic is already visible in domestic guidance — most explicitly in India's "control or sufficient influence" VDASP test, South Africa's FSCA "spectrum of decentralization", and the MiCA Recital 22 "identifiable intermediary" line drawn across the EU, Malta, and Estonia.

The IOSCO framework identifies six categories of potential Responsible Persons:

• Founders and promoters who initiate the protocol
• Developers who write and maintain code
• Token issuers who create and distribute governance or utility tokens
• DAO governance participants who vote on material decisions
• Admin key holders who retain the ability to modify smart contracts
• Service providers (oracles, relayers, bridge operators) who provide essential infrastructure

For each category, IOSCO recommends that regulators assess the degree of "actual control or influence" and impose obligations proportionate to that control. This approach is consistent with the tiered liability framework recommended in Section 4 of this document.

3. What Works and What Does Not

3.1 Enforcement-Driven Liability: Effective but Unpredictable

Ooki DAO demonstrated that US regulators can reach into decentralized governance by characterizing a DAO as an unincorporated association. The default judgment imposed a $643,542 penalty and permanent injunctions. However, the precedent is limited: Ooki DAO did not defend the case, so no adversarial testing of the "governance token holder = association member" theory occurred. The CFTC's assertion that any governance vote makes the voter a member of a liable entity remains untested in contested litigation.

Samuels v. Lido DAO pushed further, applying general partnership theory to major venture capital investors who actively participated in governance. The court distinguished between passive token holders and active governance participants, but the boundary between "passive" and "active" remains undefined. This case is ongoing (dispositive motions November 2026), and its final outcome will significantly shape US law. Its persuasive reach extends well beyond the US: Canada's and the BVI's jurisdiction research both cite it as a model for how an unwrapped DAO would be analysed under their partnership law, and the Marshall Islands DAO LLC was designed explicitly as a statutory answer to it.

The Tornado Cash paradox illustrates the limits of enforcement-driven liability. OFAC sanctioned the protocol's smart contracts in 2022, but the Fifth Circuit ruled in November 2024 that immutable smart contracts are not "property" that can be sanctioned; Treasury delisted the protocol on 21 March 2025. Meanwhile, developer Roman Storm was convicted on the unlicensed money transmitting charge in August 2025 (Rule 29 acquittal motion undecided as of June 2026; DOJ intends to retry the deadlocked counts). The result: the code cannot be sanctioned, but the developer can be prosecuted for writing it. This creates a perverse incentive structure where deploying immutable code reduces the protocol's regulatory exposure while increasing the developer's personal criminal risk.

Assessment: Enforcement actions create deterrence and establish precedent, but lack the predictability required for responsible innovation. Market participants cannot plan around case-by-case determinations. The divergent outcomes in Tornado Cash (sanctions reversed; criminal conviction upheld) demonstrate that enforcement-driven approaches can produce internally contradictory results.

3.2 Strict Product Liability (EU PLD): Comprehensive but Untested in DeFi

The EU's approach of treating software as a product subject to strict liability provides clarity: if your DeFi protocol is defective and causes damage, you are liable regardless of fault. The narrow open-source exemption (non-commercial only) means most production DeFi protocols will be covered. Because the directive operates EU-wide, it simultaneously binds France, Germany, Malta, and Estonia — and, through the EEA, shapes Liechtenstein's posture — meaning a commercial DeFi deployer faces the same strict-liability exposure across the entire single market.

Assessment: This model provides the strongest consumer/user protection and requires no new DAO-specific legislation. However, it has not yet been applied to a DeFi protocol (transposition deadline is December 2026), and Germany's research notes that whether protocol code is a "product" remains untested in German courts. Open questions include: who is the "manufacturer" of a protocol deployed by a DAO? How is "defect" defined for software operating as designed but exploited? Does a governance vote approving a parameter change make all voters co-manufacturers?

Interaction with MiCA: The EU Markets in Crypto-Assets Regulation (MiCA), reaching full implementation between late 2025 and July 2026, exempts services provided "in a fully decentralized manner without any intermediary" (Recital 22). However, what constitutes "fully decentralized" remains undefined. Regulators will likely assess decentralization as a question of control — admin keys, upgrade authority, emergency stop mechanisms, concentrated voting power, or a single official interface all indicate centralized control points that would bring a protocol within MiCA's scope (Aurum Law, MiCA DeFi Exemption). Malta (Chapter 647 CASP regime) and Estonia both apply this "identifiable intermediary" test case-by-case. A DeFi protocol that falls within MiCA must comply with CASP (Crypto-Asset Service Provider) licensing and its operator faces the full weight of PLD product liability simultaneously.

3.3 DAO-Specific Legislation: Promising but Fragmented

Wyoming's 2021 DAO LLC framework failed in practice — securities classification of tokens and Corporate Transparency Act reporting requirements made it impractical. The 2024 DUNA framework and Utah's LLD model address some of these shortcomings but remain limited to single US states with no federal coordination.

Japan's approach of reclassifying tokenized LLC membership rights is pragmatic — it reduces regulatory friction for DAO formation by adapting existing corporate law rather than creating entirely new entity types.

The Marshall Islands is the only sovereign state to have created a standalone statutory DAO entity with corporate personhood and a member liability shield. As a piece of entity law it is the most ambitious in the world — it answers the partnership-liability problem head-on, recognises on-chain and smart-contract governance, and (in the 2023 Series amendment) allows segregated sub-DAOs. But its strength on entity law is matched by weakness on financial-integrity effectiveness: the FATF/APG 2024 assessment rated the RMI 0 of 11 effectiveness outcomes as substantially or highly effective, and the IMF's 2025 Article IV review reiterated concerns about the registry. The member-liability shield also remains judicially untested as of June 2026.

Assessment: DAO-specific legislation works best when it adapts existing entity frameworks (Japan, Utah) or builds a clean statutory entity backed by credible AML supervision. The Marshall Islands demonstrates that a full statutory DAO entity is achievable, but also that entity-law innovation without commensurate AML/CFT effectiveness invites external (FATF/IMF) scrutiny that can undermine the wrapper's commercial credibility. The lack of federal/supranational coordination means DAOs must still navigate a patchwork. Wyoming's experience is instructive: the 2021 DAO LLC law was well-intentioned but practically unworkable because it did not account for securities classification and beneficial ownership reporting. The 2024 DUNA correction demonstrates that iteration is necessary and that policymakers should consult closely with practitioners before enacting DAO frameworks.

3.4 The Foundation/Wrapper Approach: The Market Standard

The Cayman Islands Foundation Company has emerged as the dominant solution by market adoption: 1,300+ registrations by end of 2024, 70% year-on-year growth, and approximately $10 billion in aggregate treasury assets. The Samuels v. Lido DAO ruling — finding unwrapped DAOs constitute general partnerships with unlimited personal liability — has accelerated adoption.

The wrapper ecosystem is now multi-jurisdictional. Swiss foundations offer a similar function with the added benefit of Switzerland's DLT Act infrastructure, but at higher cost and with stricter regulatory requirements (FINMA oversight for financial services). The BVI offers BC orphan structures and CLGs, frequently paired with a Cayman foundation in a "catamaran" structure. Liechtenstein offers the Stiftung and Anstalt under its PGR forms, with the TVTG providing a tokenisation basis. Several jurisdictions that lack any DAO-specific law — India and (per the EU file) some EU protocols — explicitly send their DAOs offshore to these wrapper jurisdictions, confirming the wrapper market's role as the de facto global default.

Assessment: The wrapper approach works in practice. It provides legal personality, limited liability, contracting capacity, and a jurisdictional anchor. However, it depends on voluntary adoption and does not address the liability of actors outside the wrapper (e.g., unaffiliated front-end operators, independent developers). It also raises questions about regulatory arbitrage — protocols wrapping in the Cayman Islands, BVI, Liechtenstein, or the Marshall Islands to avoid EU product liability or US/EU-Member-State partnership law.

3.5 The UK's "Wait and See" Position

The UK Law Commission's July 2024 DAO scoping paper concluded there is "no current need" for a DAO-specific legal entity in England and Wales, finding that "pure" governance DAOs are most likely unincorporated associations (with general-partnership risk where business is carried on with a view to profit), and recommending instead that existing company and LLP law — and a possible limited-liability not-for-profit association — be reviewed to accommodate technology-driven governance (Law Commission, DAO Scoping Paper, July 2024). The Tulip Trading v. van der Laan case, in which the Court of Appeal found in February 2023 an arguable ("serious issue to be tried") case that developers owe fiduciary duties to protocol users, was discontinued in 2024, but its reasoning stands as the leading common-law authority on developer duties (Judiciary UK, Tulip Trading).

Assessment: The UK's approach preserves common-law flexibility but creates uncertainty. The Tulip Trading reasoning, though no longer being litigated, keeps open the possibility that courts will recognise developer fiduciary duties — a significant expansion of liability with no legislative safe harbors.

3.6 The "No Framework" Majority: Liability on Paper, No Recourse in Practice

The single largest group of jurisdictions surveyed has neither DAO-specific legislation nor a wrapper regime: Canada, Brazil, Singapore, Hong Kong, India, Thailand, South Korea, France, Germany, Estonia, Malta, South Africa, Nigeria, El Salvador, and Seychelles all default to partnership, association, universitas, or conventional company law. For governance participants this nominally means unlimited (or unverified-but-likely-partnership) liability — Estonia's e-Residency guidance is the most explicit, warning that any member who has ever voted can be held fully liable. In practice, however, several of these jurisdictions (South Africa, Nigeria, Thailand, El Salvador, Seychelles) have no enforcement track record and no tested authority on DAO liability (NO DATA FOUND). The result is the worst of both worlds: theoretical unlimited liability that deters legitimate formation, combined with an absence of recourse for harmed users who cannot identify or sue anonymous, cross-border token holders.

4. Recommended Framework: Tiered Liability Based on Degree of Control

Based on the evidence examined across 27 jurisdictions, the following framework principles are recommended for policymakers designing DeFi liability regimes.

4.1 Core Principle: Liability Proportional to Control

Liability should be allocated based on the degree of control an actor exercises over the protocol, its governance, and its user-facing operations. This aligns with the IOSCO "Responsible Persons" framework, the MiCA "identifiable intermediary" line, India's "control or sufficient influence" test, and the emerging judicial approach in Samuels v. Lido DAO (distinguishing active governance participants from passive token holders).

4.2 Liability Tiers

Tier 1 — Developers and Deployers (Highest Liability) Actors who write, audit, and deploy smart contract code exercise the highest degree of control over protocol behavior. They should bear:

• Duty of care to users (negligence-based liability for defective code)
• Strict liability for known vulnerabilities left unpatched (where the developer retains upgrade authority)
• Criminal liability for code designed to facilitate illegal activity (consistent with Roman Storm prosecution)

Safe harbor: Developers who (a) open-source their code, (b) do not retain admin keys or upgrade authority, (c) do not profit from the protocol's operation, and (d) conduct and publish a third-party audit should receive a safe harbor from strict liability, retaining only negligence-based liability for defects that a reasonable developer would have detected. The Marshall Islands' statutory shield for open-source software a DAO creates is the closest existing analogue to such a safe harbor.

Tier 2 — Active Governance Participants (Significant Liability) Actors who propose governance actions, vote on material protocol parameters (fee structures, collateral requirements, whitelists), or serve on DAO committees exercise meaningful control. They should bear:

• Joint and several liability for governance decisions that cause harm (consistent with general partnership principles)
• Disclosure obligations regarding their governance participation and voting record

Safe harbor: Governance participants who (a) hold tokens below a defined threshold (e.g., 1% of total supply), (b) vote only on routine matters, and (c) do not propose actions or serve on committees should be treated as passive holders and excluded from Tier 2.

Tier 3 — Front-End Operators (Operational Liability) Operators of user-facing interfaces control the practical access point to protocols. They should bear:

• AML/KYC obligations (consistent with US Treasury December 2024 final regulations classifying front-end operators as digital asset middlemen, and the MiCA "identifiable intermediary" test applied across the EU, Malta, and Estonia)
• Duty to implement sanctions screening
• Consumer protection disclosure obligations
• Liability for misrepresentation or fraud in the interface

Tier 4 — Passive Token Holders (Minimal Liability) Holders who do not vote, do not propose, and do not operate infrastructure should bear no personal liability for the DAO's obligations, consistent with the limited liability protections in Utah's LLD framework, the Marshall Islands DAO LLC statutory shield, and the Cayman Islands foundation model.

4.3 Defining "Active" vs. "Passive" Governance Participation

The distinction between Tier 2 (active governance) and Tier 4 (passive holding) is the most critical line-drawing exercise in DeFi liability frameworks. The Estonian position — that any member who has ever voted is fully liable — illustrates the harshest possible line and the importance of a calibrated threshold. The following factors should be considered:

Indicators of active participation (Tier 2):

• Submitting governance proposals
• Voting on proposals that materially alter protocol economics, risk parameters, or asset listings
• Serving on multisig committees, security councils, or grant committees
• Delegating significant voting power and actively directing the delegate's votes
• Publicly advocating for specific governance outcomes while holding tokens above the threshold
• Holding admin keys, upgrade authority, or emergency pause capabilities

Indicators of passive holding (Tier 4):

• Holding governance tokens without voting
• Voting on routine matters (UI updates, minor parameter adjustments) below the threshold
• Receiving airdropped tokens without solicitation
• Staking tokens for yield without governance participation
• Holding tokens solely for speculative trading purposes

The Samuels v. Lido DAO court's approach provides a starting framework: it examined both the quantum of tokens held and the quality of governance engagement (e.g., statements about helping with "start-up expertise," active participation in governance forums). A threshold-based approach (e.g., 1% of total token supply) combined with qualitative assessment of governance engagement is more workable than a purely quantitative test — and far more proportionate than Estonia's "any voter is liable" default.

4.4 Legal Wrapper Requirements

Jurisdictions should require DAOs operating within their territory or serving their residents to adopt a recognized legal wrapper providing:

• Legal personality (capacity to sue and be sued)
• A registered agent for service of process
• Minimum asset segregation for user protection
• Governance transparency (published voting records and treasury reports)

The Cayman Islands Foundation Company, Swiss Foundation, BVI orphan/CLG, Liechtenstein Stiftung/Anstalt, and Marshall Islands DAO LLC models demonstrate that this is practically achievable at scale. The 70% year-on-year growth in Cayman foundation registrations through 2024 confirms market willingness to adopt formal structures when the legal alternative (unlimited personal liability as general partners) is clearly articulated.

Minimum wrapper standards should include:

• Audited financial statements (annual, publicly available)
• Published governance framework including voting rules, quorum requirements, and amendment procedures
• Incident response plan and disclosure obligations for exploits or material losses
• Insurance or reserve fund requirements proportionate to TVL (total value locked)
• Designation of a compliance officer or equivalent responsible person
• Credible AML/CFT supervision of the wrapper jurisdiction itself (the Marshall Islands experience shows that entity-law innovation without effective AML supervision invites FATF/IMF scrutiny that undermines the wrapper's credibility)

4.5 Cross-Border Coordination

DeFi is inherently cross-border. The IOSCO Responsible Persons framework should serve as the foundation for mutual recognition agreements between jurisdictions. A DAO that wraps in a jurisdiction meeting minimum standards (legal personality, limited liability, transparency, AML compliance) should be recognized by other jurisdictions without requiring duplicative registration.

Specific coordination mechanisms recommended:

1. Mutual recognition of legal wrappers. A Cayman Islands Foundation Company, Swiss Foundation, BVI orphan structure, Liechtenstein Stiftung, or Marshall Islands DAO LLC meeting defined governance and transparency standards should be recognized as having legal personality in the EU, UK, US, and Asia-Pacific jurisdictions without requiring separate registration — analogous to how corporate legal personality is generally recognized across borders.

2. Harmonized "Responsible Person" identification. Adopt the IOSCO framework as a common standard: each DAO must identify at least one Responsible Person in each jurisdiction where it has material operations or users. This person bears regulatory accountability without requiring the entire membership to register. India's "control or sufficient influence" test and the MiCA "identifiable intermediary" line are domestic instances of this approach already in operation.

3. Shared enforcement information. Establish information-sharing agreements between the CFTC, SEC, ESMA, FCA, MAS, JFSA, FINMA, and the supervisory authorities of the offshore wrapper jurisdictions (CIMA, BVI FSC, BMA, MIMA, FMA Liechtenstein) specifically for DeFi enforcement actions, exploit reporting, and sanctions compliance.

4. Jurisdictional nexus rules. Define clear rules for when a DeFi protocol is "operating in" a jurisdiction — e.g., by maintaining a front-end interface geographically targeted at that jurisdiction's residents, by holding assets denominated in that jurisdiction's fiat currency, or by having identified Responsible Persons resident in that jurisdiction. (Seychelles' "identifiable operator with a Seychelles nexus" test and the UAE's ADGM nexus test are early examples.)

---

4.6 Emerging Risks and Open Questions

AI-driven DeFi agents. Autonomous AI agents that interact with DeFi protocols — executing trades, providing liquidity, participating in governance — introduce a new liability layer. If an AI agent votes on a governance proposal and the resulting parameter change causes losses, is the agent's developer liable? The operator who deployed the agent? The DAO that approved the agent's participation? The EU's withdrawal of the AI Liability Directive leaves this question unaddressed at the supranational level. Policymakers should proactively consider how AI agents fit within the tiered liability framework before, not after, a major loss event.

Restaking and liquid staking derivatives. Protocols like EigenLayer create chains of liability: a staker deposits ETH, receives a liquid staking token (LST), restakes that LST on a restaking protocol, and receives a liquid restaking token (LRT). If the underlying validator is slashed, liability cascades through multiple protocol layers. No jurisdiction has addressed multi-layer protocol liability.

Cross-chain bridge failures. Bridges are among the most exploited DeFi infrastructure components (over $2.5 billion lost in bridge exploits 2021-2024). Liability allocation for bridge failures involves developers, validators, relayers, and governance participants across two or more blockchains, potentially spanning multiple jurisdictions simultaneously.

Immutable vs. upgradeable contracts. The Fifth Circuit's Tornado Cash ruling creates a distinction with liability implications: immutable contracts cannot be sanctioned as property, but upgradeable contracts (where someone retains admin keys) likely can be. This creates an incentive to deploy immutable code, but immutable code cannot be patched if vulnerabilities are discovered. Policymakers must address this tension — possibly by requiring a time-locked upgrade mechanism as a condition of safe harbor eligibility.

Untested statutory shields. The Marshall Islands DAO LLC member-liability shield — the strongest statutory protection available globally — remains judicially untested as of June 2026. Until a court (domestic or, more likely, a foreign court asked to recognise or pierce the shield) tests it against a real loss event, its protective value is uncertain. The same caveat applies to the many "NOT VERIFIED / NO DATA" positions across the smaller jurisdictions: an absence of tested authority is itself a material risk, because the first adverse ruling will set the default.

5. Decision Matrix for Policymakers

Policymakers should use the following matrix to evaluate their jurisdiction's current position and identify gaps.

Step 1: Classify Your Current Framework

Step 2: Identify the Default Rule

Step 3: Evaluate the Adequacy of Available Wrappers

Step 4: Priority Actions

1. Immediate (0-6 months): Ensure DAOs operating without wrappers have a clear legal default (partnership, association, or other) so that harmed parties have recourse. Issue regulatory guidance clarifying the default classification of unwrapped DAOs in your jurisdiction. This is most urgent for the NO-DATA jurisdictions (South Africa, Nigeria, Thailand, El Salvador, Seychelles), where no default has been articulated. This costs nothing and immediately reduces uncertainty.

2. Short-term (6-18 months): Adapt existing entity law to accommodate token-based governance, following the Japan, Utah, or wrapper (Cayman/BVI/Liechtenstein) models. This does not require creating an entirely new entity type — reclassifying tokenized membership interests (Japan) or creating a variant of existing limited liability structures (Utah LLD, BVI orphan) is sufficient. Jurisdictions willing to go further can study the Marshall Islands statutory DAO LLC.

3. Medium-term (18-36 months): Implement tiered liability tied to degree of control, with safe harbors for passive holders and audited open-source code. This requires primary legislation in most jurisdictions and should be coordinated with the IOSCO Responsible Persons framework.

4. Long-term (36+ months): Pursue cross-border mutual recognition of DAO legal wrappers through IOSCO or bilateral frameworks. Establish shared enforcement databases and harmonized jurisdictional nexus rules.

Step 5: Risk Assessment for Inaction

Jurisdictions that fail to establish clear DeFi liability frameworks face three risks:

1. Regulatory arbitrage. DeFi protocols will wrapper in Cayman Islands, Switzerland, BVI, Liechtenstein, or the Marshall Islands and serve your jurisdiction's residents without local accountability. The 70% year-on-year growth in Cayman foundation registrations — and India's explicit practice of domiciling DAOs offshore — demonstrates this dynamic is already underway.

2. Consumer harm without recourse. In jurisdictions defaulting to general partnership, harmed users theoretically have claims against all governance participants — but practically cannot identify or sue anonymous token holders across borders. The result is liability on paper but no recourse in practice. This is most acute in the NO-DATA jurisdictions, where even the default rule is unsettled.

3. Innovation flight. Overly aggressive enforcement without clear safe harbors (the pre-2025 US SEC approach) drives legitimate developers to other jurisdictions. The SEC's closure of the Uniswap investigation in February 2025, after the protocol demonstrated its non-custodial architecture and proactive compliance engagement, suggests a potential shift toward engagement-based rather than enforcement-first approaches.

Step 6: Jurisdiction-Specific Starting Points

The following table provides recommended first actions for specific jurisdictions based on their current framework maturity.

Verification Notes

All factual claims in this document mirror the canonical DeFi fact-matrix (jurisdiction files verified to the dates stated therein) and were originally verified via web search; aggregate/count statements have been recomputed for the full set of 27 jurisdictions as of 4 June 2026. Key sources:

US Case Law and Enforcement:

• CFTC v. Ooki DAO: CFTC Press Release 8590-22; CFTC Order (June 2023); Proskauer Rose, Default Judgment Analysis
• Samuels v. Lido DAO: FindLaw, Case Record; Davis Wright Tremaine Analysis; Winston & Strawn Analysis
• Tornado Cash (Fifth Circuit): Fifth Circuit Opinion, No. 23-50669; Mayer Brown Analysis; Venable, Treasury Delisting (March 21, 2025)
• Roman Storm Trial (Aug 2025 conviction; Rule 29 motion undecided as of June 2026; DOJ retrial of deadlocked counts proposed Oct 2026): Mayer Brown, Mixed Verdict Analysis; IRS Criminal Investigation Press Release
• Uniswap SEC: Uniswap Blog, Investigation Closed; Columbia Law CLS Blue Sky

US State Legislation:

• Wyoming DAO LLC (2021): Wyoming Legislature, SF0038
• Wyoming DUNA (2024): Fortune Crypto
• Utah LLD (2024): Utah Legislature, HB0357; ArentFox Schiff
• Tennessee and Vermont have also enacted DAO-enabling provisions (per jurisdiction file).

EU and Member States:

• Product Liability Directive 2024/2853 (in force 8 Dec 2024; transposition by 9 Dec 2026): EUR-Lex Official Text; IBA, Software Liability; Hogan Lovells Analysis
• MiCA DeFi Exemption (Recital 22): Aurum Law, MiCA DeFi Exemption; Merklescience, DeFi Exemption
• AI Liability Directive Withdrawal: Inside Privacy
• Germany GbR/Partnership Law: Deloitte Legal, MoPeG Reform
• France société de fait / société en participation default; Malta ITAS Act (Chapter 592) certification (no legal personality); Estonia e-Residency DAO liability guidance (OÜ/MTÜ wrappers) — per jurisdiction files.

UK:

• UKJT Legal Statement (2019): Full Text (PDF)
• Law Commission Smart Contracts (2021): Law Commission Project Page
• Law Commission DAO Scoping Paper (2024): Law Commission Project Page; Norton Rose Fulbright Analysis
• Tulip Trading v. van der Laan (CoA Feb 2023, "serious issue to be tried"; discontinued 2024): Court of Appeal Judgment (PDF); Mayer Brown Analysis

Offshore Wrapper Jurisdictions:

• Cayman Islands Foundation Company Registrations: Cayman Finance (Dec 2025); Cointelegraph
• BVI VASP Act 2022, BC orphan / "catamaran" structures, Circular 43 of 2025 — per BVI jurisdiction file (Harneys / Mourant / Walkers).
• Bermuda DABA 2018 / DAIA 2020; DerivaDEX licensed DAO-governed DEX; DAO Working Group proposals (not enacted as of June 2026) — per Bermuda jurisdiction file.
• Liechtenstein TVTG (Blockchain Act); PGR Stiftung / Anstalt wrappers — per Liechtenstein jurisdiction file.
• Seychelles IBC Act 2016, CSL, Foundations Act 2009 — per Seychelles jurisdiction file.

Marshall Islands (Statutory DAO LLC):

• DAO Act of 2022 (eff. 25 Nov 2022); 2023 Amendment (Series DAO LLC, open-source shield, 3% GRT); 2024 DAO Regulations (BOIR, Representative Agent); MIMA established 23 Sep 2025; FATF/APG 2024 effectiveness assessment; IMF 2025 Article IV (Country Report No. 25/321): MIDAO — per Marshall Islands jurisdiction file.

Japan:

• DAO LLC (godo kaisha) Ordinance (April 2024); LDP Web3 White Paper 2024: CryptoNews

Switzerland:

• DLT Act: Swiss Federal Council; Library of Congress
• Swiss Foundation / Verein Model: Legal Nodes

Singapore and Hong Kong:

• Quoine v. B2C2: Singapore Court of Appeal, [2020] SGCA(I) 2
• Hong Kong Mantra Dao v Mullin (2024) DAO financial-record disclosure — per Hong Kong jurisdiction file.

Asia-Pacific & MEA No-Framework Jurisdictions:

• India PMLA "control or sufficient influence" VDASP test; offshore domicile practice — per India jurisdiction file.
• Thailand Digital Asset Business Decree; NO DATA on DAO/developer rulings — per Thailand jurisdiction file.
• South Africa FSCA Dec 2024 DeFi Market Study; "spectrum of decentralization"; FAIS — per South Africa jurisdiction file.
• Nigeria ISA 2025 (persons "in control"); CAMA 2020 vehicles — per Nigeria jurisdiction file.
• El Salvador LEAD issuer/DASP regime; hybrid SA/SRL or foundation; NO DATA on DAO rulings — per El Salvador jurisdiction file.

IOSCO:

• DeFi Policy Recommendations (December 2023): IOSCO Final Report (PDF); Norton Rose Fulbright Analysis

US Front-End Operator Regulations:

• Treasury/IRS Final Regulations (December 2024; DeFi broker rule nullified by Congressional Review Act, April 2025): PwC Analysis