For years, decentralised finance operated in a regulatory grey zone — too new to regulate, too complex to supervise, and too decentralised to pin down.
For years, decentralised finance operated in a regulatory grey zone — too new to regulate, too complex to supervise, and too decentralised to pin down. That era is ending.
The FATF's sixth targeted update on virtual assets, published in June 2025, delivered the clearest guidance yet. Approximately 88% of DeFi projects are not truly decentralised. Someone retains control or sufficient influence — whether through code update authority, governance token structures, fund-freezing capabilities, or ongoing business relationships with users. Under the FATF's framework, those projects are VASPs, and they carry the same AML/CFT obligations as any other regulated entity.
Only projects where no identifiable operator exists, no governance body holds unilateral authority, and code updates happen through genuine consensus — roughly 12% of the market — sit outside the VASP definition. For the rest, the compliance obligations are real.
The EU has moved faster than most. MiCA came into full effect in December 2024, and the Transfer of Funds Regulation now requires Crypto Asset Service Providers to collect and transmit sender and recipient information for all crypto transfers, regardless of amount. DeFi protocols with identifiable operators may fall within MiCA's scope. The EU is developing separate DeFi-specific regulation for future implementation, but in the meantime, the functional test applies — if it looks like a VASP, it is treated like one.
The Travel Rule adds another layer. As of mid-2025, 85 of 117 jurisdictions have passed or are implementing Travel Rule legislation for virtual assets. For DeFi platforms where Travel Rule-compliant entities participate, the obligations flow through. Exchanges and custodians interfacing with DeFi protocols must capture beneficiary information for on-chain transfers.
Governance token holders face their own reckoning. The FATF has clarified that individual holders are not automatically VASPs — but they may be classified as such if they exercise control or sufficient influence over a protocol. Participating in centralised governance structures, voting on fund allocations, or controlling code updates could cross the line.
The challenges of applying AML to genuinely decentralised protocols remain real. Identifying operators, determining jurisdiction, implementing KYC on-chain, and enforcing compliance against decentralised entities are problems that regulators have not fully solved. But the direction of travel is unmistakable — the regulatory perimeter is expanding, and projects that assumed they were outside it are discovering otherwise.
For businesses building or interacting with DeFi protocols, the practical question is no longer whether regulation will come, but whether they are ready for it.
At Kybri Consulting Limited, we advise digital asset businesses on AML/CFT compliance across DeFi, VASP registration, and regulatory frameworks — helping them understand where the perimeter sits and what is required to operate within it.
A thirty-minute call, no obligation. If the answer is that you do not need us yet, you will hear that too.
