DeFi has no single license and no single regulator. This guide maps which EU, US, UK, and global rules touch protocols, frontends, and DAOs — and when you need authorization.
Decentralized Finance (DeFi) regulation has no single license and no single regulator. If you run a DeFi protocol, no office hands you a DeFi permit. Regulators instead ask who sits between the code and the user. When they find a person or company that controls funds, runs an interface, or markets a service, they apply existing financial rules to that intermediary.
For founders who build or operate DeFi protocols, frontends, or DAOs, the triggers below map EU, US, and UK scope plus the global standards behind them: where the current lines sit, what rule changes are open now, and when you need a CASP license or perhaps other authorization.
The EU Markets in Crypto-Assets Regulation, known as MiCA, does not create a DeFi license. Recital 22 of the MiCA text states that crypto-asset services provided in a fully decentralized manner without any intermediary fall outside the regulation. The assessment happens case by case. A national regulator looks at how your service actually works, not at how you describe it in a white paper.
That exemption is narrow. Most of what founders call DeFi still has an intermediary somewhere. A team that hosts a frontend, holds admin keys, collects fees, or decides which tokens get listed looks like an intermediary to a supervisor. Tokens issued or listed through DeFi interfaces can also pull activity into scope, because firms that provide CASP services on those tokens still need authorization.
Our MiCA license list sets out which services count as CASP services and which approvals each one needs.
ESMA made this point concrete in its MiCA Q and A. The authority notes that a listing of crypto-assets on decentralized exchanges in the Union could amount to an offer to the public, while reiterating that fully decentralized services without any intermediary sit outside MiCA on a case-by-case assessment. In plain terms, calling the venue a DEX does not settle the question. Control and function settle it.
For founders, the EU test has three parts:
First, is there a person or company that provides a service named in MiCA, such as custody, exchange, order execution, or transfer?
Second, does that provider serve clients in the EU?
Third, is the service truly without any intermediary?
If the answer to the first two is yes and the third is no, you likely need authorization under our MiCA licensing pathway. Teams outside the EU should also check VASP registration duties in the countries where they operate, since non-EU regimes still use that term.
US DeFi regulation news today centers on the Securities and Exchange Commission. The current SEC posture treats code as neutral and people as responsible. At the June 9 2025 DeFi roundtable, Chair Paul Atkins said self-custody is a core American value, century-old frameworks should not freeze innovation, and the agency should study a conditional exemption for DeFi developers and services, sometimes called an innovation exemption. His roundtable remarks set the tone for everything that followed.
Commissioner Hester Peirce added the legal frame in her roundtable remarks. She argued that publishing open-source code is protected speech, that liability for misuse falls on the user rather than the mere publisher, and that centralized products dressed up as DeFi get no pass.
She later used the term onchain CeFi for centralized businesses that run on public rails. Her point was direct. Truly decentralized tools face one set of questions. Centralized firms that adopt DeFi labels face the same rules as any other intermediary. She returned to the speech theme in her June 2026 remarks, where she again separated publishers of code from operators of services.
Project Crypto is the vehicle for this agenda. In his July 2025 address, Chair Atkins announced the project as a commission-wide plan to write fit-for-purpose crypto rules. A November 2025 speech then published a taxonomy that matters for DeFi builders. Network tokens and digital commodities are not securities. Tokenized securities are securities. Investment contracts can stop being securities as a network matures and control disperses. That last point gives serious DeFi teams a path to argue, but it turns on facts about control, not on labels.
The most concrete proposal arrived on August 18 2026. The draft Regulation Crypto Assets release, summarized in the Chair statement, would create a startup exemption of up to USD 5 million raised over four years and a yearly fundraising exemption of up to USD 75 million, plus a safe harbor for certain investment-contract offerings. These are proposals, not final rules.
They show the direction of travel: lighter formation-stage relief paired with clearer lines around trading and custody. Founders should track them as DeFi regulation updates rather than rely on them today.
Two federal bills dominate DeFi regulation updates in the US. They do very different things, and founders often mix them up.
The GENIUS Act is law. Congress passed it and the President signed it on July 18 2025. It sets federal rules for payment stablecoins, including reserve, supervision, and issuer requirements. It does not regulate DeFi generally. If your protocol issues or handles a dollar-referenced stablecoin, GENIUS matters to you. If it does not, GENIUS is background, not your licensing answer. Our explainer on what the GENIUS Act covers walks through its scope in detail.
The CLARITY Act is not law. The House passed it 294 to 134 on July 17 2025. You can read the text and status on the Congress record for H.R. 3633. The Senate did not follow. A cloture vote on September 15 2026 failed 49 to 50 (Senate Record Vote No. 234 on H.R. 3633, with one senator not voting), short of the 60 votes needed to advance. That leaves the bill on ice before the midterms. Treat any claim that CLARITY already sets DeFi rules as wrong. Until the Senate acts, US crypto market structure still rests on existing securities and commodities law plus agency rulemaking such as Project Crypto.
The practical read is simple. Stablecoin issuance now has a federal statute. Broader questions, such as when a DeFi frontend is a broker or exchange, or when a governance token is a security, still sit with the SEC and the courts. Plan your structure around current law and open proposals, not around a bill that has not passed.
The UK takes a similar intermediary-first approach but on a longer timetable. The Financial Conduct Authority published draft crypto asset rules in consultation paper CP25/40 and finalized the regime in a series of cryptoasset policy statements (PS26/9 through PS26/13). The final rules published in June 2026 apply to firms authorized on or after October 25 2027. That date matters. It gives teams a defined window to assess scope and prepare applications.
DeFi sits in scope where an identifiable party controls the activity. The FCA assesses arrangements case by case. A protocol with no controlling entity and no UK-facing intermediary raises different questions than a hosted frontend run by a UK company that lists tokens, handles orders, or holds client assets. The FCA has said tailored guidance for DeFi will follow, which means the fact-specific control test stays central through 2026 and into 2027.
The Treasury added perimeter through the draft Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2025, laid in December 2025 and passed by Parliament on February 4 2026, which widen the set of regulated crypto activities. Founders with UK users or a UK operating company should map each function they perform against the new perimeter now, rather than wait for the 2027 application date. Authorization takes months, and banking and compliance setup takes longer. Teams that start the analysis in 2026 keep more options open.
Two international bodies shape how national regulators write rules for decentralized finance (DeFi). Their documents are not licenses, but supervisors cite them when they draft rules and examine firms.
The Financial Action Task Force set the anti-money-laundering frame in its October 2021 guidance on virtual assets. The guidance is functional and technology neutral. It asks who acts as a business for others, not what software they use. Owners or operators of a decentralized application can count as virtual asset service providers when they conduct covered activity as a business for or on behalf of someone else. That single sentence explains why so many DeFi teams face AML duties even where no crypto license seems to apply. If your frontend collects fees, markets to users, or exercises control over order flow or funds, expect a supervisor to test you against VASP definitions.
IOSCO, the global body of securities regulators, published its final DeFi report in December 2023. The report makes nine recommendations built on one idea: same activity, same risk, same regulation and regulatory outcome. Regulators should identify the persons responsible for a DeFi arrangement, hold them to standards that match the economic function they perform, and cooperate across borders. The report does not ban DeFi. It tells member regulators to look through the structure, find who can change the code, pause the protocol, or direct funds, and regulate that party.
Together these standards explain the pattern across the EU, US, and UK. Each regime phrases the test differently, but each asks the same question. Who controls the service that users rely on?
Use this checklist to locate the parts of your stack that regulators care about. Work through each layer separately, because one layer can stay outside scope while another pulls you in.
Protocol code and smart contracts sit at the base. Publishing open-source contracts, without operating an interface or holding user funds, presents the lowest regulatory load in most regimes. Still, code alone does not protect the rest of the stack. The moment a company or DAO treasury collects fees, holds upgrade keys, or can pause contracts, supervisors see a responsible party.
Frontends and interfaces come next. The team that hosts the website or app, curates listings, routes orders, or earns spreads looks like an operator. EU supervisors test this activity against CASP service definitions. US regulators test it against broker, dealer, and exchange definitions. UK supervisors ask whether an identifiable UK-linked entity controls the arrangement. If your frontend does more than display public data, assume it needs its own analysis.
DAOs and governance need the same treatment. A DAO that votes on fee switches, treasury spending, listings, or upgrades exercises control. Anonymous token voting does not remove the question. Supervisors then ask who proposed the change, who holds enough votes to decide it, and who benefits.
Token issuance is its own trigger. Issuing a governance, utility, or stablecoin token can create prospectus, securities, or stablecoin duties separate from any question about the protocol. In the EU, stablecoin issuance has hard issuer requirements. In the US, the token taxonomy and the open Regulation Crypto Assets proposal set the live questions. Map the token where you will offer it, not only where you incorporated.
Custody and fiat touchpoints almost always require authorization. Holding private keys, pooling user funds, staking on behalf of users, or converting fiat to crypto are classic regulated activities. If your flow includes any of these, plan for a license application and for banking that accepts the model.
When the checklist points to a license, start with the service definitions. Our team maps protocol, frontend, DAO, and token functions to authorization options as part of legal services for crypto founders, and we tell you when no license is needed. If you already know you need one, the next step is usually a scoped call to confirm the jurisdiction and the fastest viable pathway.
DeFi regulation in 2026 rewards teams that sort their stack early. Separate the code from the company, the interface from the protocol, and the token from the venue. Classify each piece where your users live. Where a license is needed, pick the jurisdiction that fits the business model and start the file before launch pressure builds.
If you want a direct read on your triggers, schedule a free consultation. We will map your protocol, frontend, DAO, and token against current EU, US, and UK rules and tell you which authorizations you need and which you do not.
No. DeFi is not illegal in the US. No federal statute bans decentralized finance. Whether a specific DeFi activity breaks the law depends on what it does and who controls it. A team that operates an unregistered exchange, broker, or securities offering can face enforcement even if the product runs onchain. Publishing open-source code, without operating a service for others, presents a different question under current SEC thinking. Check each function against securities, commodities, money transmission, and sanctions rules before you launch.
MiCA covers crypto-asset services in the EU, including services connected to DeFi tokens, but it exempts services provided in a fully decentralized manner without any intermediary. Supervisors apply that exemption case by case. A protocol with a team that runs the interface, controls upgrades, or earns fees will struggle to qualify. CASPs that list, trade, or custody DeFi tokens remain in scope regardless of how decentralized the underlying protocol claims to be.
Sometimes. A frontend that only displays public onchain data, without order handling, custody, or token listing decisions, has the strongest case for staying outside licensing. A frontend that matches orders, routes trades, holds assets, converts fiat, or selects markets looks like a regulated intermediary in the EU, the UK, and the US. The operator of the interface, not the protocol name, carries the licensing question. Get the frontend activity classified in each country you target.
In the EU, MiCA supervision continues to bed in, with ESMA Q and A updates refining edge cases such as DEX listings. In the US, watch the Regulation Crypto Assets proposal from August 2026, including the USD 5 million startup exemption, the USD 75 million yearly fundraising exemption, and the investment-contract safe harbor, plus any Senate movement on market structure after the failed September 2026 cloture vote. In the UK, firms should prepare for the October 2027 authorization date under the finalized FCA regime.
Our team of experts will be glad to provide you with answers and a one-stop-shop solution to all your legal corporate needs.
Crypto custody explained for founders: models compared, institutional requirements, and the MiCA Class 2 path to offer crypto custody services in the EU. see more...
Stablecoin regulation for founders: GENIUS vs MiCA EMT rules compared, plus UK, Singapore and Hong Kong notes and a six-step issuer checklist. see more...
What tokenized gold is, how PAXG (Paxos Gold) and XAUt (Tether Gold) work, vault custody and audit, and how issuers launch a compliant tokenized gold product. see more...
