DeFi Regulation Explained: Is DeFi Legal in 2026?
How DeFi regulation works in 2026: the FATF control test, MiCA's decentralisation carve-out, SEC and CFTC moves, Tornado Cash, front-end geoblocking, and what stays your responsibility.
DeFi is legal to use in the US, the EU and the UK as of October 2026, but no country has a single DeFi law: regulators apply existing financial, anti-money-laundering and sanctions rules to the people and companies around a protocol. Those include whoever controls the code, runs the website or holds user funds, plus the exchanges where you cash out. The open question in every jurisdiction is how much control makes someone responsible. This guide explains how DeFi regulation works today and what stays your own responsibility.
For the wider picture of crypto laws by country, see our crypto regulation in 2026 guide.
How regulators decide who is responsible
Most rules start from the international anti-money-laundering standard. The Financial Action Task Force's October 2021 guidance on virtual assets treats a DeFi application, as software, as outside the definition of a virtual asset service provider (VASP), while its creators, owners and operators can fall inside it if they keep "control or sufficient influence" over the arrangement, even when that control runs through a smart contract or a governance vote. Calling a product DeFi doesn't decide the question.
The factors regulators look at are practical. Can someone upgrade or pause the contracts, or change fees and parameters? Do they profit from the service, and do they have an ongoing relationship with users? The more of these that point to an identifiable team, the more likely that team is treated like an exchange or broker and has to register, run KYC and follow the travel rule.
That test lands on the operator. Using a protocol as an individual, from your own wallet, is not a licensed activity in any of the jurisdictions below.
EU: MiCA's decentralisation carve-out
MiCA, the EU's crypto law, does not regulate DeFi by name. Recital 22 says that where crypto-asset services are provided in a fully decentralised manner without any intermediary, they should not fall within its scope. The same recital adds that MiCA applies where only part of an activity is decentralised. "Fully decentralised" is not defined, so national regulators judge it case by case. Our MiCA explainer covers the rest of the law.
Article 142 of MiCA asked the Commission to report on whether DeFi needs its own regulation. The EBA and ESMA sent their input in a joint report in January 2025, which flagged smart-contract and money-laundering risks. The next step came on September 30, 2026, when ESMA, in its response to the MiCA review, asked for clearer criteria for what counts as "genuinely decentralised" and for a new licensed service covering firms that give users access to DeFi protocols. Those are recommendations. If adopted, they would most likely reach front-end operators and apps, not the contracts themselves.
Two other EU rules touch DeFi users indirectly. The Transfer of Funds Regulation makes licensed exchanges collect information when you move more than €1,000 to a self-hosted wallet, and from July 2027 the AML Regulation bars licensed firms from handling privacy coins and anonymous accounts (see our AMLR post). Neither bans self-custody.
US: agencies, courts and a stalled bill
The US has no DeFi statute. In 2025 and 2026 the direction has been to pull back from treating DeFi interfaces like exchanges, while keeping criminal and sanctions law fully in force.
- Tax reporting. Congress repealed the IRS rule that would have made DeFi front ends file broker reports. President Trump signed H.J.Res. 25 on April 10, 2025, per the House Ways and Means Committee, and the resolution bars the IRS from reissuing a similar rule. Centralized exchanges still issue Form 1099-DA, and users still owe tax on DeFi activity.
- Front ends. On April 13, 2026, SEC staff said they would not object to certain interfaces that help users transact in crypto asset securities through their own self-custodial wallets operating without broker-dealer registration, subject to conditions. It is staff guidance, not a rule, and lapses after five years unless the Commission acts.
- Token offerings. On August 18, 2026, the SEC proposed Regulation Crypto Assets, with offering exemptions of up to $5 million and $75 million and a safe harbor for when a token stops being part of an investment contract. It is still a proposal.
- Congress. The House passed the CLARITY Act 294 to 134 on July 17, 2025. The Senate Banking version includes developer protections, including language that developers who never control customer funds are not money transmitters. The Senate failed to advance the bill 49 to 50 on September 15, 2026. Details are in our CLARITY Act explainer.
Tornado Cash shows both sides. On November 26, 2024, the Fifth Circuit ruled in Van Loon v. Department of the Treasury that Tornado Cash's immutable smart contracts are not "property" that OFAC can sanction, as Mayer Brown summarized. Treasury delisted Tornado Cash on March 21, 2025. The criminal case against developer Roman Storm continued anyway. A jury convicted him in August 2025 on the unlicensed money transmitting conspiracy count and deadlocked on money laundering and sanctions charges, and the retrial on those counts is set for April 26, 2027.
More on the federal agencies is in US crypto regulation in 2026.
UK: decentralisation guidance on the way
The UK's new crypto regime starts on October 25, 2027, and the FCA opened applications on September 30, 2026. Its final perimeter guidance, PS26/18, came out on September 16. In October the FCA published consultation CP26/36, which proposes guidance on how far decentralisation affects whether an activity is inside the regime, according to A&O Shearman. Responses are due November 18, 2026. Until then the FCA's stated approach is case by case. See our UK crypto regulation guide.
DeFi regulation by jurisdiction
| Jurisdiction | Main rule for DeFi | Who it reaches | Status (Oct 2026) |
|---|---|---|---|
| Global (FATF) | 2021 VASP guidance, "control or sufficient influence" test | Owners and operators with control | Standard that countries apply in national law |
| EU | MiCA Recital 22 carve-out for fully decentralised services | Any intermediary, including partly decentralised services | ESMA proposed a DeFi access licence on Sep 30, 2026 |
| US (SEC) | Staff statement on user interfaces; Regulation Crypto Assets | Front ends and token issuers | Statement in effect since Apr 13, 2026; rule proposed |
| US (Congress) | CLARITY Act DeFi and developer provisions | Developers, DeFi trading protocols | Failed Senate cloture Sep 15, 2026 |
| US (sanctions) | OFAC rules apply to crypto as to fiat | Everyone, including individual users | In force; Tornado Cash delisted Mar 21, 2025 |
| UK | New cryptoasset regime and PERG 18 | Firms arranging or dealing for UK users | Regime starts Oct 25, 2027; CP26/36 open |
Front ends, geoblocking and sanctions
The contracts on a blockchain don't check where you are, but the websites that people use to reach them often do. OFAC's 2021 guidance for the virtual currency industry says sanctions obligations apply equally to crypto and fiat, and it recommends geolocation tools and IP address blocking to keep users in sanctioned jurisdictions out. That is why many DeFi front ends block certain countries and screen wallet addresses against the OFAC sanctions list.
A geoblock is the operator's legal decision. Getting around one with a VPN usually breaks the front end's terms, and it changes nothing about the law that applies to you. If you are a US person, US sanctions apply to your transactions whether you use a website, a command line or a contract call.
What stays your responsibility
Using DeFi moves some duties from an institution to you. Tax is the clearest: swaps, rewards, liquidity positions and loan liquidations can all be taxable events, and no exchange sends you a tidy annual form for on-chain activity. Our DeFi taxes guide walks through each one. You also need to keep records, avoid sanctioned addresses and assess smart-contract risk yourself. A short checklist is in how to check a DeFi protocol is safe.
DeFi as a legal alternative: what it solves and what it doesn't
For many people DeFi is a lawful alternative to a custodial platform. You hold your keys in a non-custodial wallet, so no one can freeze an account or close it, as happens when a bank or exchange debanks a customer. There is no sign-up, the markets run around the clock, and the rules of each contract can be read on-chain.
It is not a way around the rules that apply to you. Fiat on-ramps and off-ramps still go through regulated exchanges with KYC. Front ends may block your country. There is no deposit insurance, no ombudsman and no chargeback. A contract bug, a stablecoin depeg or a liquidation can cost you money with no one to complain to, which is why KYC in DeFi and on-chain screening keep coming up in policy debates.
JewelSwap is a non-custodial protocol on MultiversX, Sui and Radix. You connect a self-custody wallet, with no account. It offers liquid staking tokens (JWLEGLD and SJWLEGLD, JWLSUI and SJWLSUI, JWLXRD and SJWLXRD), auto-compounded yield farms including Scallop leveraged farms on Sui and AshSwap, xExchange, OneDex and Hatom farms on MultiversX, and NFT lending on MultiversX. Like every DeFi protocol, it sits inside the rules above, and your tax and sanctions obligations apply when you use it.
Frequently asked questions
Is DeFi legal?
Using DeFi from your own wallet is legal in the US, the EU and the UK as of October 2026. Some countries restrict crypto as a whole, and sanctions law bars dealings with sanctioned people and places everywhere it applies.
How is DeFi regulated?
Through existing laws applied to whoever has control: developers who can change or pause contracts, companies running front ends, and exchanges at the fiat edge. The FATF "control or sufficient influence" test and MiCA's carve-out for fully decentralised services are the two main reference points.
Does MiCA apply to DeFi?
Not to services that are fully decentralised with no intermediary, under Recital 22. It does apply where part of the service is run by an intermediary. ESMA proposed a new licence for DeFi access providers on September 30, 2026, which is not yet law.
Was Tornado Cash's developer convicted?
Roman Storm was convicted in August 2025 of conspiracy to operate an unlicensed money transmitting business. The jury deadlocked on money laundering and sanctions counts, and the retrial is set for April 26, 2027.
Do I pay tax on DeFi?
Yes, in most countries. The US repealed the DeFi broker reporting rule in 2025, which removed a reporting duty for front ends, not the user's tax liability. Rules differ by country, so check with a tax professional.
Educational only, not legal, tax or financial advice. Rules checked on October 29, 2026, and they change often.
