DeFi: risks and compliance for operators

Decentralised finance (DeFi) promises financial services — exchange, lending, yield — without the classic intermediaries, run by protocols and smart contracts. But “decentralised” does not mean “beyond the rules”. Anyone who builds, runs or offers access to DeFi services meets the same principles that govern financial intermediation, applied to a new architecture. The question for the operator is not whether the rules apply, but where and to whom they apply in a system that declares itself intermediary-free.

”Decentralised” is a claim to be verified, not a given

The first mistake is to take decentralisation as an established fact. In economic substance, many “DeFi” projects have an effective point of control: a team that updates the smart contracts, holds admin keys, manages the user interface, controls the treasury or collects fees. Where there is a party that, in practice, governs or draws income from the activity, supervision tends to look at that party, regardless of the label. The decisive question is always the same: who has control and who, in concrete terms, carries out the activity?

DeFi activities and how they qualify

Depending on what the protocol does and who governs it, different regulatory profiles may be triggered:

• Token exchange (DEX). Facilitating the exchange of crypto-assets on behalf of third parties evokes financial intermediation and, with it, anti-money-laundering obligations.
• Lending and staking. Collecting funds, remunerating them or deploying them touches on deposit-taking, management of others’ assets and, potentially, the licensing perimeter.
• Token issuance. Launching your own token opens the question of qualification (payment, utility, asset) and the rules that follow from it.
• Interfaces and access. Even merely providing the front-end that gives access to a protocol can be relevant, if the operator plays an active role in the service.

Anti-money-laundering risks are the heart of the problem

The most concrete risk for a DeFi operator is the anti-money-laundering one. A system that allows values to be moved pseudonymously, without identification, is exposed by definition. Where the activity constitutes financial intermediation, the AMLA (Anti-Money Laundering Act) safeguards are not optional: customer identification, clarification of the beneficial owner, transaction monitoring, reporting obligations. The technical challenge — applying these safeguards to an on-chain architecture — does not remove the obligation: it turns it into a problem of design, to be solved upstream.

The other risks to budget for

Beyond regulatory compliance, the DeFi operator faces risks that must be governed:

• Smart contract risk. Bugs, exploits and code vulnerabilities can cause direct losses and liability.
• Operational and governance risk. Admin keys, upgrade processes, treasury management: points of fragility and, at the same time, points that reveal who really controls the system.
• Qualification risk. The model may be deemed regulated even if the project perceives itself as “pure code”: operating without having mapped this possibility exposes you to cease-and-desist orders and personal liability.
• Reputational and banking risk. Without credible safeguards, the relationship with banks and partners becomes fragile or impossible.

The correct sequence for an operator

Setting up a DeFi project sustainably means proceeding in order:

1. Photograph the real governance: who controls what, who collects income, who can modify the protocol.
2. Qualify the activities one by one against the perimeter of financial intermediation.
3. Design anti-money-laundering safeguards compatible with the architecture, before launch.
4. Design the corporate structure that supports the project and the relationships with partners.

How SIH ONE approaches the topic

SIH ONE handles structuring and advice: analysis of the project’s effective governance, qualification of DeFi activities against the regulatory and anti-money-laundering perimeter, setting up of safeguards and design of the structure. Where the activity requires a licence or affiliation with a self-regulatory organisation, the regulated activities go through authorised partners. The goal is for you to know, before launching, which risks you carry and how to govern them.

This content is informational and does not constitute legal or regulatory advice. The framework evolves: every project must be verified in the specific case.

Are you building a DeFi project and want to set up compliance before launch? Let’s talk: we map governance and activities and design the anti-money-laundering safeguards, with the right partners where a licence is needed.