How should DeFi be regulated? A European approach to decentralization

Decentralized finance, known arsenic DeFi, is simply a caller usage of blockchain exertion that is growing rapidly, with implicit $237 cardinal successful worth locked up successful DeFi projects arsenic of January 2022. Regulators are alert of this improvement and are opening to enactment to modulate it. In this article, we concisely reappraisal the fundamentals and risks of DeFi earlier presenting the regulatory context.

The fundamentals of DeFi

DeFi is simply a acceptable of alternate fiscal systems based connected the blockchain that allows for much precocious fiscal operations than the elemental transportation of value, specified arsenic currency exchange, lending oregon borrowing, successful a decentralized manner, i.e., straight betwixt peers, without going done a fiscal intermediary (a centralized exchange, for example).

Schematically, a protocol called a DApp (for decentralized application), specified arsenic Uniswap oregon Aave, is developed successful unfastened root codification connected a nationalist blockchain specified arsenic Ethereum. This protocol is powered by astute contracts, i.e., contracts that are executed automatically erstwhile definite conditions are met. For example, connected the Uniswap DApp, it is imaginable to speech wealth betwixt 2 cryptocurrencies successful the Ethereum ecosystem, acknowledgment to the astute contracts designed to execute this cognition automatically.

Users are incentivized to bring successful liquidity, arsenic they person a information of the transaction fee. As for lending and borrowing, astute contracts let those who privation to lend their funds to marque them disposable to borrowers and borrowers to straight get the wealth made disposable by guaranteeing the indebtedness with collateral (or not). The speech and involvement rates are determined by proviso and request and arbitrated betwixt the DApps.

The large particularity of DeFi protocols is that determination is nary centralized instauration successful complaint of verifying and carrying retired the transactions. All transactions are performed connected the blockchain and are irreversible. Smart contracts regenerate the intermediary relation of centralized fiscal institutions. The codification of DeFi applications is unfastened source, which allows users to verify the protocols, physique connected them and marque copies.

The risks of DeFi

Blockchain gives much powerfulness to the individual. But with much powerfulness comes much responsibility. The risks DeFi are of respective kinds:

Technological risks. DeFi protocols are babelike connected the blockchains connected which they are built, and blockchains tin acquisition attacks (known arsenic "51% attacks"), bugs and web congestion problems that dilatory down transactions, making them much costly oregon adjacent impossible. The DeFi protocols, themselves, are besides the people of cyberattacks, specified arsenic the exploitation of a protocol-specific bug. Some attacks are astatine the intersection of exertion and finance. These attacks are carried retired done "flash loans." These are loans of tokens without collateral that tin past beryllium utilized to power the terms of the tokens and marque a profit, earlier rapidly repaying the loan.

Financial risks. The cryptocurrency marketplace is precise volatile and a accelerated terms driblet tin occur. Liquidity tin tally retired if everyone withdraws their cryptocurrencies from liquidity pools astatine the aforesaid clip (a "bank run" scenario). Some malicious developers of DeFi protocols person "back doors" that let them to due the tokens locked successful the astute contracts and frankincense bargain from users (this improvement is called "rug-pull").

Regulatory risks. Regulatory risks are adjacent greater due to the fact that the scope of DeFi is global, peer-to-peer transactions are mostly anonymous, and determination are nary identified intermediaries (most often). As we volition spot below, 2 topics are peculiarly important for the regulator: the combat against wealth laundering and violent financing, connected the 1 hand, and user protection, connected the other.

The FATF "test": Truly decentralized?

As of Oct. 28, 2021, the Financial Action Task Force (FATF) issued its latest guidance connected integer assets. This planetary enactment sought to specify rules for identifying liable actors successful DeFi projects by proposing a trial to find whether DeFi operators should beryllium taxable to the Virtual Asset Service Provider oregon "VASP" regime. This authorities imposes, among different things, Anti-Money Laundering (AML) and Counter-Terrorist Financing (CFT) obligations.

The FATF had initially considered, past March, that if the decentralized exertion (the DApp) is not a VASP, the entities "involved" successful the exertion whitethorn be, which is the lawsuit erstwhile "the entities prosecute arsenic a concern to facilitate oregon behaviour activities" connected the DApp.

The caller FATF guidance drops the word "facilitate" and alternatively adopts a much functional "owner/operator" criterion, whereby "creators, owners, and operators ... who clasp power oregon influence" implicit the DApp whitethorn beryllium VASPs adjacent though the task whitethorn look decentralized.

Related: FATF guidance connected virtual assets: NFTs win, DeFi loses, remainder remains unchanged

FATF, nether the caller "owner/operator" test, states that indicia of power see exercising power implicit the task oregon maintaining an ongoing narration with users.

The trial is this:

• Does a idiosyncratic oregon entity person power implicit the assets oregon the protocol itself?
• Does a idiosyncratic oregon entity person "a commercialized narration betwixt it and customers, adjacent if exercised done a astute contract"?
• Does a idiosyncratic oregon entity nett from the work provided to customers?
• Are determination different indications of an owner/operator?

FATF makes wide that a authorities indispensable construe the trial broadly. It adds:

"Owners/operators should undertake ML/TF [money laundering and violent financing] hazard assessments anterior to the motorboat oregon usage of the bundle oregon level and instrumentality due measures to negociate and mitigate these risks successful an ongoing and forward-looking manner.”

The FATF adjacent states that, if determination is nary "owner/operator," states whitethorn necessitate a regulated VASP to beryllium "involved" successful DeFi project-related activities… Only if a DeFi task is wholly decentralized, i.e., afloat automated and extracurricular the power of an owner/operator, is it not a VASP nether the latest FATF guidance.

It is regrettable that a rule of neutrality of blockchain networks has not been established, akin to the rule of neutrality of networks and method intermediaries of the net (established by the European directive connected physics commerce much than 20 ago).

Indeed, the purely method developers of DeFi solutions often bash not person the carnal anticipation to execute the checks imposed by the AML/CFT procedures successful the plan of existent DApps. The caller FATF guidance volition apt necessitate DApp developers to enactment successful Know Your Customer (KYC) portals earlier users tin usage the DApps.

Application of information law?

We are each acquainted with the ineligible statement that has go classical erstwhile it comes to qualifying a token: Is it a inferior token, present taxable to the regularisation of integer assets (ICOs and VASPs), oregon is it a information token that is apt to beryllium governed by fiscal law?

We cognize that the attack is precise antithetic successful the United States wherever the Securities Exchange Commission (by applying the celebrated "Howey Test") qualifies tokens arsenic securities that would beryllium seen arsenic integer assets successful Europe. Their attack is, therefore, much severe, and this volition surely effect successful much prosecutions of "owners" of DeFi platforms successful the U.S. than successful Europe.

Thus, if DeFi services bash not impact integer assets, but tokenized fiscal securities arsenic defined by the European Markets successful Financial Instruments Directive (MiFID Directive), the rules for concern services providers (ISPs) volition person to beryllium applied. In Europe, this volition beryllium a uncommon lawsuit arsenic the tokens traded would person to beryllium existent fiscal securities (company shares, indebtedness oregon concern money units).

Related: Collateral damage: DeFi's ticking clip bomb

However, nationalist regulations are apt to apply. For example, successful France, it volition beryllium indispensable to find whether the regularisation connected intermediaries successful assorted goods (Article L551-1 of the Monetary Code and following) applies to liquidity pools.

Indeed, pools let clients to get rights connected intangible assets and enactment guardant a fiscal return. Theoretically, it would nary longer beryllium excluded that the Autorité des marchés financiers (AMF) decides to use this regime. As a consequence, an accusation papers volition person to beryllium approved by the AMF earlier immoderate marketing.

However, successful practice, determination is not 1 idiosyncratic who proposes the investment, but a multitude of users of the DApp who bring their liquidity successful a astute declaration coded successful unfastened source. This brings america backmost to the trial projected by the FATF: Is determination an "owner" of the level who tin beryllium held accountable for compliance with the regulations?

The MiCA regulation

On November 24, the European Council decided its presumption connected the "Regulation connected Cryptoasset Markets" (MiCA), earlier submitting it to the European Parliament. It is expected that this cardinal substance for the cryptosphere volition beryllium adopted by the extremity of 2022 (if each goes well...).

The draught EU regularisation is based connected a centralized attack by identifying a supplier liable for operations for each service, which does not enactment for a decentralized speech level (like Uniswap) oregon a decentralized stablecoin.

Related: Europe awaits implementation of regulatory model for crypto assets

We should deliberation astir a ineligible strategy that takes into relationship the automated and decentralized quality of systems based connected blockchain, truthful arsenic not to enforce obligations connected operators who bash not person the worldly anticipation of respecting them oregon who tally the hazard of hindering innovation by removing the crushed for progress: decentralization.

Europe has already shown itself susceptible of subtle arbitration successful matters of technological regularisation if we refer successful peculiar to the connection for a European Union regularisation connected artificial intelligence. This attack could service arsenic a root of inspiration.

Regardless of the equilibrium chosen by the regulator, investors should go arsenic informed arsenic imaginable and wage attraction to the technological, fiscal and compliance risks earlier undertaking a DeFi transaction.

As for DeFi exertion developers and work providers successful this field, they indispensable stay attentive to regulatory developments and cultivate a civilization of transparency successful their operations to expect regulatory hazard arsenic overmuch arsenic possible.

This nonfiction was co-authored by Thibault Verbiest and Jérémy Fluxman.

This nonfiction does not incorporate concern proposal oregon recommendations. Every concern and trading determination involves risk, and readers should behaviour their ain probe erstwhile making a decision.

The views, thoughts and opinions expressed present are the authors’ unsocial and bash not needfully bespeak oregon correspond the views and opinions of Cointelegraph.