Risk Assessment Offers Treasury’s Most Extensive Comments To Date On DeFi Regulation – Money Laundering

The Division of the Treasury’s just lately issued Illicit Finance Risk Assessment of Decentralized
Finance is principally supposed to supply perception on how
illicit actors are abusing decentralized finance (DeFi) providers,
in addition to anti-money laundering (AML) and countering the financing
of terrorism (CFT) vulnerabilities distinctive to DeFi. Nonetheless, the
report additionally comprises vital perception on how Treasury, and,
presumably, the Monetary Crimes Enforcement Community (FinCEN)
inside Treasury, view the applicability of present US AML/CFT
laws, issued pursuant to the Financial institution Secrecy Act (BSA), to DeFi
initiatives.

FinCEN has beforehand issued two steerage paperwork relating to
what it calls “convertible digital foreign money” or
“CVC,” in addition to plenty of administrative rulings. The
2013 guidance didn’t particularly focus on DeFi.
The 2019 guidance briefly addresses decentralized
purposes (“DApps”) and decentralized exchanges, however
dedicates solely a few pages to the subject.

The Threat Evaluation dedicates considerably extra textual content to the
matter of when a DeFi undertaking may be topic to FinCEN’s
guidelines, notably as a cash transmitter, a kind of cash
providers enterprise (MSB). The Threat Evaluation states that it
“doesn’t alter any present authorized obligations, concern any new
regulatory interpretations, or set up any new supervisory
expectations.” Nonetheless, it does make specific plenty of
necessary factors which are at greatest implied in FinCEN’s 2019
steerage and introduces vital new terminology that doesn’t
seem within the prior FinCEN steerage. For instance, the Threat
Evaluation attracts a pointy distinction between the idea of
“decentralization,” which it states just isn’t related to
assessing a DeFi undertaking’s standing beneath the BSA, and
“disintermediation,” which it states is related (albeit
as a niche in present guidelines that needs to be stuffed). Notably,
“disintermediation” is a time period that’s by no means utilized in
FinCEN’s prior steerage.

Subsequently, whereas the Threat Evaluation is purportedly not supposed
to supply “new regulatory interpretations” it’s a key
new doc in understanding how the BSA applies to DeFi
initiatives.

FinCEN’s 2019 Steering on DeFi

To know the intersection of the Threat Evaluation and
FinCEN’s prior steerage, it’s value briefly revisiting that
steerage. As famous above, FinCEN’s 2019 steerage addresses
DApps and decentralized exchanges. FinCEN’s 2019 steerage
describes DApps as “software program packages that function on a P2P
community of computer systems working a blockchain platform (a kind of
distributed public ledger that enables the event of secondary
blockchains), designed such that they don’t seem to be managed by a
single individual or group of individuals (that’s, they don’t have an
identifiable administrator).”

The steerage explains “when DApps carry out cash
transmission, the definition of cash transmitter will apply to the
DApp, the house owners/operators of the DApp, or each.” Nonetheless, it
provides that “the developer of a DApp just isn’t a cash transmitter
for the mere act of making the appliance, even when the aim
of the DApp is to concern a CVC or in any other case facilitate monetary
actions denominated in CVC,” supplied the developer does
not use or deploy the DApp to have interaction in cash transmission. FinCEN
guidelines may apply to 3rd events that use the DApp to have interaction
in cash transmission.

With respect to decentralized exchanges, FinCEN explains:

Conversely, FinCEN guidelines do apply if, “when transactions
are matched, a buying and selling platform purchases the CVC from the vendor
and sells it to the customer.”

Threat Evaluation

The Threat Evaluation builds on the slightly sparse dialogue of
DeFi within the 2019 steerage in plenty of vital manners.

First, the Threat Evaluation states that the centralized or
decentralized standing of a given DeFi undertaking just isn’t related to its
standing beneath the BSA. For instance, it explains “a DeFi service
that features as a monetary establishment as outlined by the BSA,
no matter whether or not the service is centralized or decentralized,
shall be required to adjust to BSA obligations, together with AML/CFT
obligations. A DeFi service’s declare that it’s or plans to be
‘absolutely decentralized’ doesn’t impression its standing as a
monetary establishment beneath the BSA.” Whereas such a view is
arguably implied within the 2019 steerage’s dialogue of DApps it
just isn’t explicitly said. Nor does both the 2019 steerage or the
Threat Evaluation clarify who FinCEN would count on to hold out
AML/CFT compliance obligations in a totally decentralized mannequin. The
creators that coded the undertaking? Every particular person participant within the
undertaking? Governance token holders or a DAO (if such a factor exists
for the given undertaking)? Every potential reply raises a bunch of
further questions and problems not addressed within the
steerage or Threat Evaluation.

Second, the Threat Evaluation discusses the idea of
“disintermediation,” a time period that by no means seems in
FinCEN’s prior steerage. In keeping with the Threat Evaluation,
disintermediation refers to “digital belongings [that] may be
self-custodied and transferred with out the involvement of an
middleman monetary establishment.” For instance,
disintermediation consists of “customers of unhosted wallets [that]
can retain custody of and switch their digital belongings with out the
involvement of a regulated monetary establishment.” The Threat
Evaluation notes, “Many DeFi providers declare to be
disintermediated by enabling automated P2P transactions with out the
want for an account or custodial relationship.” The Threat
Evaluation acknowledges that such disintermediated initiatives
at present fall outdoors FinCEN guidelines, however suggests the principles ought to
be up to date to deal with that hole. Subsequently, the Threat Evaluation
attracts a pointy line between “decentralization,” which is
not related to an entity’s BSA standing, and
“disintermediation,” which is a key consideration. This
distinction doesn’t seem in FinCEN’s prior steerage, at
least not in any specific method. As famous above, the phrase
“disintermediation” by no means even seems within the prior
steerage.

Third, the Threat Evaluation states that FinCEN takes a distinct
strategy than the Monetary Motion Process Power (FATF) with respect
to DeFi. FATF is a world AML/CFT standards-setting physique
that establishes a sequence of suggestions for AML/CFT
compliance, which, whereas not strictly compulsory, most
jurisdictions search to observe. As outlined in FATF’s Updated Guidance for a Risk-Based Approach to
Virtual Assets and Virtual Asset Service Providers, software program
packages themselves aren’t topic to AML/CFT necessities beneath
the FATF requirements and, subsequently, absolutely decentralized DeFi
initiatives aren’t topic to these obligations. With that mentioned, FATF
notes that in observe most DeFi initiatives do have some parts of
centralization and, subsequently, might not in truth be absolutely
decentralized, regardless of representations to that impact.

FATF’s up to date steerage was revealed in October 2021 and
the US was extensively understood to be concerned in that
replace. No US authorities company or official had publicly said
that the US disagreed with FATF’s strategy to DeFi till the
Threat Evaluation. The Threat Evaluation criticizes FATF’s strategy
noting it “may result in potential gaps for DeFi providers in
different jurisdictions” and contrasts it in opposition to the US strategy
through which, in accordance with the Threat Evaluation, the decentralized
standing of a undertaking just isn’t related to the applicability of the
BSA.

Lastly, the Threat Evaluation highlights plenty of methods in
which initiatives claiming to be decentralized might in truth be largely
or partially centralized. Amongst different examples, the Threat Evaluation
cites: a focus of governance tokens or voting energy, a
focus of nodes or validators, retention of an
administrative key or related again door to amend a protocol, and a
centralized front-end that’s essential to entry the protocol (or
with out which protocol entry could be very troublesome). Nonetheless, as famous
above, as a result of the Threat Evaluation states that the extent of
decentralization of a undertaking just isn’t related beneath the BSA, these
elements shouldn’t impression the general evaluation of whether or not a undertaking
falls inside the BSA.

The Path Forward

Whereas the Threat Evaluation just isn’t supposed to vary regulatory
interpretations, it comprises the US authorities’s most intensive
feedback thus far on the applicability of the BSA to DeFi and, as
such, will undoubtedly form how trade understands FinCEN’s
guidelines and steerage. The Threat Evaluation’s introduction of latest
terminology and ideas which are, at greatest, solely implied in
FinCEN’s prior steerage will additional heighten the significance of
the doc.

The Threat Evaluation signifies Treasury is open to receiving
trade feedback, together with on the next questions:

• What elements needs to be thought of to find out whether or not DeFi
  providers are a monetary establishment beneath the BSA?




• How can the U.S. authorities encourage the adoption of
  measures to mitigate illicit finance dangers … together with by DeFi
  providers that fall outdoors of the BSA definition of economic
  establishment?




• The evaluation finds that non-compliance by lined DeFi
  providers with AML/CFT obligations could also be partially attributable to
  a lack of information of how AML/CFT laws apply to DeFi
  providers. Are there further suggestions for methods to make clear
  and remind DeFi providers that fall beneath the BSA definition of a
  monetary establishment of their present AML/CFT regulatory
  obligations?




• How can the U.S. AML/CFT regulatory framework successfully
  mitigate the dangers of DeFi providers that at present fall outdoors of
  the BSA definition of a monetary establishment?




• How ought to AML/CFT obligations range based mostly on the totally different
  varieties of providers provided by DeFi providers?

Entities concerned within the DeFi area might want to fastidiously evaluation
the Threat Evaluation and to supply feedback to Treasury. Steptoe is
out there to help corporations in getting ready and submitting
feedback.

The content material of this text is meant to supply a common
information to the subject material. Specialist recommendation needs to be sought
about your particular circumstances.