Why DeFi Regulation Keeps Getting the Analysis Wrong

The test for determining whether someone is subject to financial regulation has always been the same: does the person engage in activities that constitute financial services? That test applies in DeFi just as it does everywhere else. The activities that constitute regulated financial services are well established. In the DeFi context, a person who does any of the following is doing something that regulation of financial services intermediaries is designed to reach:

1. execute or alter orders or transactions;
2. affect settlement finality or custody;
3. change customer balances or ledger state;
4. freeze, redirect, or seize assets; or
5. provide investment advisory services.

This article will refer to these five things as the “core intermediary function.” They are the activities of a financial intermediary in other contexts as well. They are what creates the risks to customers, to counterparties, and to the financial system that regulation is designed to address. The test for whether someone in a DeFi context is an intermediary subject to regulation is therefore straightforward: is anyone performing one or more of the core intermediary functions? If so, regulate them for performing those activities. If not, there is nothing to regulate, regardless of what else they may be doing.

Why DeFi and Decentralization Complicate the Analysis

The reason this simple inquiry has become complicated in DeFi is that in many decentralized systems, no one is performing the core intermediary functions. A genuinely decentralized protocol — one with no single point of failure, no single source of truth, and no single authority capable of or responsible for making changes to transactions, balances, or ownership — executes autonomously. The code of the protocol runs, determining all outcomes, and no person controls it. Finality of transactions and balances occurs without an intermediary.

Where those conditions hold, the standard regulatory test produces a clear answer: no one is performing regulated financial services activities, so no one is regulated. Decentralization is not a separate regulatory concept. It is the explanation for why the standard test yields a negative result. No legal person is conducting regulated activities.

The limit with a decentralization test is that financial services activities are broader than transaction execution and settlement finality, which is why talismanic use of decentralization does not always end the analysis. Lending, custody, asset management, investment advice — none of these reduce neatly to a single moment of finality or a single act of execution. So what framework can be used to capture both the variety of activities and identify when regulated activity is being performed by an intermediary?

Regulators have correctly recognized that control or influence over a DeFi arrangement can take many forms, and that some of those forms might amount to performing regulated financial services even where no single transaction-level act of control is present. Often, multi-factor tests are devised to attempt to capture the range of possibilities and tag someone with intermediary status.

Getting the Test Right

The problem is not that multi-factor tests are inherently wrong. The problem is that they are only valid if they key off the right thing: whether the influence or control amounts to the conduct of one or more of the core intermediary functions. A multi-factor test that measures governance participation, treasury access, and software authority without asking whether any of those factors translate into regulated financial services is measuring the wrong thing. It identifies influence without establishing whether that influence constitutes regulated activity. A presumption that control of any kind amounts to the provision of financial services is where these tests often go wrong.

A governance token holder who can vote on protocol parameters controls something, but the relevant question is whether that vote translates into any of the intermediary activities subject to regulation. In many cases it does not. Governance participation shapes the evolution of a system without conferring authority over the financial outcomes the system produces for its users. Governance in the abstract is not intermediation.

“Governance in the abstract is not intermediation.”

A software developer who can propose and implement upgrades exercises influence, but influence over code is not the same as authority over transactions, balances, or settlement. A validator who processes and confirms transactions is essential to the functioning of a network, but essentiality is not control. A telephone or other network is essential to a trade order without being a broker.

Financial regulation has long recognized that infrastructure providers generally fall outside the regulatory perimeter because their activities do not amount to the core intermediary functions. Where their conduct crosses into fraud or willful misconduct, liability attaches not because they are infrastructure providers in financial services but because of the nature of what they actually did.

DeFi vaults illustrate what happens when the analysis is more complex. At the basic level, a vault is a smart contract that accepts user assets and automatically executes predefined yield strategies according to rules encoded at deployment, without ongoing human intervention. As one adds levels of human involvement, questions of influence and control arise, particularly if they result in conducting one or more of the core intermediary functions.

In a fully automated vault operating on a decentralized protocol, the inquiry is short: no single person or authority directs or controls what happens to any assets, none of the core intermediary functions are being performed by any person, and no one is regulated.

In highly curated vaults, curators set risk parameters, select where assets are deployed, and adjust strategy on an ongoing basis. These scenarios require careful analysis. Where a curator's discretion is tightly constrained by smart contract guardrails, some influence may be present but it may not translate into control over the core intermediary functions that constitute financial services. Where a curator exercises genuine ongoing discretion over the deployment of user assets, with meaningful ability to determine where capital goes and on what terms, the test points squarely toward financial intermediation because of the nature of what the curator has the power to do.

The vault example shows why the test must focus on activities: the same role can fall inside or outside the regulatory perimeter depending entirely on what the person in that role can actually do.

The objection to this approach is that it leaves a gap. Users of a genuinely decentralized protocol still face risks such as flawed code, manipulated price feeds, and losses with no one to hold accountable. The concern is legitimate, but does not change the analysis. Intermediary regulation exists to address the risks associated with intermediaries. Where no one is performing the core intermediary functions, the risks that remain are of a different kind. Whether and how to address them is a policy question for legislators and regulators to take up directly, not a reason to assign intermediary status to people who do not perform regulated activities. Indeed, doing so creates its own harm: it imposes obligations on people who have no ability to meet them, because they lack control over the issues the obligations are meant to govern.

Focus on the Functions

Technology-neutral regulation means applying existing law to new technology, not creating new presumptions that override it. Asking whether anyone is performing regulated financial services activities has long been the linchpin of regulatory analysis. If the answer is yes, identify who and regulate them for what they actually do. If the answer is no — because the system is genuinely decentralized, because the actors involved are only providing infrastructure, or because the influence present does not extend to regulated activity — then there is nothing to regulate. The failure to ask whether regulated activities are being conducted is not a gap in the law. It is a choice to ignore well-established law.