The United States and DeFi

Nicola Sharp of Rahman Ravelli details the US Treasury’s assessment of decentralised finance.

The United States Treasury Department has assessed the risks surrounding decentralised finance (DeFi) and outlined the need for regulation.

The US Treasury’s 40-page “2023 DeFi Illicit Finance Risk Assessment’’ - the first such risk assessment conducted on DeFi anywhere – sees it emphasising the need for industry guidance and regulation.

It examines the potential risks, including the range of related offences, including ransomware, hacking and money laundering. But the report’s most important point relates to potential regulatory requirements relating to DeFi.

The Treasury makes it clear that its assessment is not establishing what it calls “new supervisory expectations”. But the report puts forward the view that there is a need for totally and partially decentralised services to ensure anti-money laundering (AML) compliance under the Bank Secrecy Act, which is the US AML regime. It believes that those in the private sector should use the assessment to inform their own risk mitigation strategies and take clear steps to prevent illicit actors from abusing DeFi services.

According to the US Treasury, illicit actors are exploiting Defi services’ non-compliance with anti-money laundering / combating the financing of terrorism (AML/CFT) and sanctions obligations.

It emphasises that DeFi services engaged in activity that is covered by the Bank Secrecy Act have AML/CFT obligations - regardless of whether those services claim that they are or plan to be decentralised. The assessment highlights other vulnerabilities, including the potential for some DeFi services to be out of scope of existing AML/CFT obligations, weak or non-existent AML/CFT controls for DeFi services in other jurisdictions, and poor cybersecurity controls by DeFi services, which can lead to the theft of funds.

Although risk assessments are mainly conducted to identify the scope of an issue, the study also includes recommendations for US government action to reduce the illicit finance risks associated with DeFi services.

These include:

• strengthening US AML/CFT regulatory supervision
• considering additional guidance for the private sector on DeFi services’ AML/CFT obligations
• assessing enhancement to address any AML/CFT regulatory gaps related to DeFi services

The DeFi risk assessment follows on from the US Executive Order 14067, “Ensuring Responsible Development of Digital Assets’’, which was signed in March 2022. The Order addresses the potential national security implications of cryptocurrencies and the responsible development of digital assets.