The United States Treasury Department has some strong words to share in its risk assessment on decentralized finance, also known as DeFi, as it also seeks to start a conversation on industry guidance.
The Treasury’s most recent report assesses risk, discussing myriad illicit finance challenges such as scams, ransomware, hacks, and money laundering. However, the biggest takeaway from the 40-page report is what it says about potential regulatory requirements for DeFi. While the Treasury clarifies that the assessment does not “establish new supervisory expectations,” the report advances the view that even truly (and somewhat) decentralized services should implement anti-money laundering compliance under the Bank Secrecy Act – the U.S. AML regime.
The U.S. Treasury, which uses the term “should” 17 times and “obligations” 53 times in the assessment, is sending a message to anyone involved with “DeFi services” – that they “should” implement AML controls under existing BSA “obligations.”
The BSA requires covered financial institutions to keep records, file reports of transactions, and to report suspicious activity that might signify money laundering, tax evasion, or other criminal activities. Actively implementing traditional AML compliance is, in some respects, at odds with the potential of DeFi – that is, the reliance on disintermediated software rather than teams of compliance officers.
The report sends mixed messages. For example it states that “money laundering, proliferation financing, and terrorist financing most commonly occur using fiat currency or other traditional assets as opposed to virtual assets.” However, the report spends 40-pages digging into potential AML risks in a relatively inconsequential space for illicit finance today.
That said, the Treasury’s ambitions are clear – to send a message to the DeFi space that the BSA applies today and to kick off a discussion with industry players on how to implement AML in a more decentralized space.
U.S. Treasury Says AML Applies To DeFi
“The report is a signal that the Treasury is trying to encourage industry and developers to integrate AML compliance into DeFi services,” Yaya Funasie, Director of Policy for AML and Cyber Risk at the Crypto Council for Innovation, told me in an interview. “While it does not offer any new legal standard, it emphasizes that Treasury believes that much of the activity already happening in the DeFi space falls under the BSA even if a project is truly decentralized.”
The Treasury does not make a distinction between wholly decentralized and “DeFi-in-name-only” services as other policy makers such as the Financial Action Task Force (FATF) have done. Rather, the report is stating that anyone or thing offering financial services falls under the BSA and its onerous AML requirements.
In my interview with Treasury Senior Policy Advisor Caroline Horres – one of the authors of the assessment – she hammered home this point explaining that there is a “misunderstanding” that you can essentially decentralize-your-way-out of AML obligations.
“Insofar as you are providing the services of a covered financial institution, you have BSA obligations, centralized or decentralized,” Horres says.
Regulators Want To Cooperate With The Crypto Industry
Despite all the “message sending,” the Treasury report also makes clear that regulators seek industry input and engagement as it builds toward potential industry guidance on AML for DeFi.
While most of the report lays out risks and vulnerabilities, the final few pages call on the U.S. government to work with industry to “further explain how applicable regulations apply to DeFi services,” and issue additional guidance based on feedback. In addition, the Treasury calls on the U.S. government to engage with private sector entities building tools in an effort to promote innovative solutions.
“We would really benefit from engagement with industry,” says Horres, that engagement will “inform how we are moving forward with the recommended actions that are identified in the risk assessment and we certainly welcome input on them. I think this is, in a lot of ways, a conversation starter.”
This likely means that we will see industry engagement resulting in guidance rather than a series of enforcement actions as we have seen from other agencies.
U.S Treasury Points To Technology Solutions For Risk Mitigation
In a section on risk mitigation, the report points to technology solutions such as blockchain intelligence tools, digital identity and zero knowledge proofs to “support various elements of compliance with AML/CFT obligations while maximizing user privacy, including through digital identity technology to support identity verification by DeFi services that can be informed by a user’s transaction history on the public blockchain.” This raises a question of how these emerging tech tools could be implemented for the compliance requirements the report describes as the tools and the technology are rapidly evolving.
“A huge challenge remains with precisely how to implement AML compliance in many DeFi platforms that are governed by code and do not have traditional concrete responsible parties,” Fanusie says.
All things considered, the U.S. Treasury has now, unequivocally, clarified that it believes all financial service platforms should comport with the BSA.
However, as we move into a more decentralized world, where financial services are facilitated automatically by disintermediated software rather than by intermediary financial institutions with robust compliance teams, it’s unclear how or if DeFi platforms are even able to comply with this requirement today. Luckily, that’s why the assessment is justjust a conversation starter.
