What was considered a niche segment within the broader cryptocurrency ecosystem just a few years ago has since evolved into a fully-fledged financial infrastructure. Decentralized Finance (DeFi) enables the provision of financial services without the involvement of banks or other traditional financial institutions. By leveraging blockchain technology and smart contracts, users can exchange assets, provide loans, or supply liquidity in a fully digital and largely automated environment.
This technological advancement offers undeniable benefits in terms of accessibility, efficiency, and innovation. At the same time, however, it raises fundamental questions regarding the applicability of existing anti-money laundering (AML) regulations.
The current AML framework is built upon a simple yet fundamental assumption: that there is always a central entity responsible for customer due diligence, transaction monitoring, and the reporting of suspicious activities. It is precisely this assumption that DeFi explicitly challenges.
The challenge for regulators therefore lies not merely in regulating a new technology, but in adapting an existing regulatory framework that was originally designed for a centralized financial system.
What Distinguishes DeFi from Traditional Financial Systems?
Decentralized Finance (DeFi) refers to financial applications that operate on public blockchains, with Ethereum remaining the dominant ecosystem. Instead of relying on banks or other intermediaries, transactions are executed through smart contracts—self-executing programs that automatically perform predefined actions once specified conditions have been met.
In practice, DeFi encompasses a broad range of applications, including decentralized exchanges (DEXs), lending platforms, stablecoins, staking services, and liquidity pools.
What distinguishes DeFi from traditional financial infrastructures is its permissionless nature. In principle, anyone with a digital wallet can access these services without prior identification or authorization.
This does not, however, mean that DeFi is entirely anonymous. On the contrary, transactions are permanently recorded and publicly visible on the blockchain. Rather, the challenge lies in the fact that wallet addresses are not automatically linked to natural persons, making the identification of users considerably more complex.
It is precisely this combination of transparency and pseudonymity that makes DeFi both innovative and challenging from an anti-money laundering (AML) perspective.
Why Does DeFi Pose a Risk to Anti-Money Laundering Efforts?
Just as in traditional financial systems, DeFi primarily plays a role during the so-called layering stage of money laundering, during which financial flows are split, transferred, and concealed. It is often assumed that blockchain transactions are entirely anonymous. In reality, however, this perception is more nuanced.
Blockchain analytics firms such as Chainalysis, Elliptic, and TRM Labs are now capable of clustering wallet addresses and reconstructing complex financial flows. Once crypto-assets ultimately reach regulated entities, users can often still be identified.
The greatest challenges arise when different techniques are combined. Mixing services, cross-chain bridges, and privacy-focused protocols make it possible to render transaction flows considerably more difficult to trace. In such scenarios, the effectiveness of blockchain analytics decreases, giving rise to genuine opportunities to conceal the origin of funds.
In addition, the speed at which transactions can be executed across different blockchains and protocols adds a further layer of complexity. Whereas traditional financial institutions serve as control points within the AML framework, such a central actor is often absent in fully decentralized environments. It is precisely here that the fundamental challenge arises.
How Is Europe Regulating Crypto-Assets?
Over the past few years, the European Union has placed a strong emphasis on developing a harmonized regulatory framework for crypto-assets. The best-known pillar of this framework is undoubtedly the Markets in Crypto-Assets Regulation (MiCA) (Regulation (EU) 2023/1114), which introduces a uniform regulatory framework for crypto-asset service providers (CASPs).
In addition, through the broader AML Package, the European Union has also implemented significant reforms, including the establishment of the Anti-Money Laundering Authority (AMLA), the new Anti-Money Laundering Regulation (AMLR), the Sixth Anti-Money Laundering Directive (AMLD6), and the extension of the Travel Rule to crypto-assets through the Transfer of Funds Regulation (Regulation (EU) 2023/1113). For more information, see our article AML Package 2024-2026: AMLA, AMLR and TFR.
Although these developments contribute to the further harmonization of the European supervisory framework, significant challenges remain when it comes to fully decentralized protocols.
Why Does DeFi Remain Largely Outside the Scope of MiCA?
Perhaps the most notable observation is that MiCA does not provide a clear answer to the question of how fully decentralized protocols should be treated. Recital 22 of the Regulation provides that crypto-asset services offered "in a fully decentralized manner without any intermediary" fall outside the scope of MiCA. This immediately raises a fundamental question: when is a protocol truly fully decentralized? The answer proves to be less straightforward than it may seem.
ESMA also acknowledged in its second consultation package that the scope of this exemption remains uncertain and must be assessed on a case-by-case basis (ESMA75-453128700-438, paragraph 108). The reality is that decentralization is not a black-and-white matter. Many protocols exist somewhere along the spectrum between full decentralization and traditional centralization. Development teams, governance mechanisms, front-end interfaces, and DAO structures may still exert a certain degree of influence over the operation of a protocol. It is precisely this diversity that makes it particularly difficult to develop uniform rules.
Paradoxically, the flexibility of DeFi is both one of its greatest strengths and one of its greatest regulatory challenges.
From Problem to Solution: The Rise of RegTech
Whereas blockchain technology was initially viewed primarily as a threat, regulators are increasingly seeking to leverage the transparency of blockchains. Blockchain Analytics, Artificial Intelligence, and Real-Time Monitoring make it possible to detect suspicious patterns more rapidly and to reconstruct complex financial flows.
This evolution forms part of a broader trend in which technology is no longer regarded solely as a source of risk, but also as a tool for enhancing the efficiency of compliance. The establishment of AMLA will further support this technological evolution by strengthening coordination among European supervisory authorities.
Tornado Cash: A Turning Point for DeFi Regulation?
Few cases illustrate the tension between decentralization and anti-money laundering more clearly than the Tornado Cash case.
Tornado Cash was developed as a mixing service designed to obscure the origin of crypto-assets. According to the U.S. Department of the Treasury, the protocol was used to launder more than USD 7 billion in virtual assets, including funds linked to the North Korean Lazarus Group.
The sanctions that followed, together with the prosecution of several individuals involved by the U.S. Department of Justice have sparked a global debate that extends far beyond anti-money laundering alone.
The central question is no longer whether illicit activities should be combated—there is little disagreement on that point—but rather to what extent software developers can be held responsible for the way third parties use their technology.
This debate touches upon fundamental questions concerning liability, decentralization, and the role of decentralized autonomous organizations (DAOs).
As discussed earlier in our article Why is cash prevalent in money laundering?, such governance structures are likely to receive increasing attention from regulators in the years ahead.
Where Does the Future of DeFi Compliance Lie?
As the direct regulation of fully decentralized protocols remains particularly challenging, attention is increasingly shifting toward alternative approaches. Regulators continue to focus on the regulation of access points such as centralized exchanges, while growing attention is also being paid to so-called compliance-by-design solutions.
Under this approach, compliance is not imposed retrospectively but is instead integrated directly into the technology itself. On-chain identity standards, programmable compliance, and zero-knowledge proofs are increasingly being identified as potential building blocks for future regulatory models.
It remains uncertain which solutions will ultimately prevail, but one thing is becoming increasingly clear: the existing AML framework will need to adapt to a financial infrastructure that is fundamentally different from the one for which it was originally designed.
Does the AML Framework Need to Be Fundamentally Reconsidered?
The European reforms of recent years have undoubtedly taken important steps toward greater harmonization and more effective supervision.
Yet, the challenge posed by DeFi appears to run deeper than merely a question of stricter rules. The current AML framework is founded on the assumption that there is always a responsible actor capable of exercising oversight and reporting relevant information. DeFi challenges precisely that assumption. Perhaps the greatest challenge for regulators, therefore, lies not in further refining the existing rules, but in rethinking the fundamental assumptions upon which the current AML framework is built. This will inevitably require new forms of liability, technological innovation, and a continuous search for an appropriate balance between effective risk management and workable compliance.
As we discussed in our article "How to reduce compliance burden", an increasingly complex regulatory landscape must not result in a disproportionate administrative burden. The future of anti-money laundering in the DeFi ecosystem will therefore not be determined solely by stricter regulation, but above all by the extent to which technology and regulation succeed in reinforcing one another rather than working against each other.
