DeFi regulation in the United States is a patchwork of authority split across four federal agencies: the SEC handles tokens that qualify as securities, the CFTC oversees those treated as commodities and their derivatives, FinCEN enforces anti-money-laundering rules under the Bank Secrecy Act, and the IRS taxes every DeFi transaction the way it taxes other investment income. There is no single rulebook. Which agency matters for a given protocol, token, or user depends on what the asset is, how the platform operates, and who is on the other side of the trade.
Three shifts in 2025 and 2026 changed the picture materially: new SEC leadership pulled back from litigation-first enforcement, the GENIUS Act created the first federal framework for stablecoins, and IRS broker reporting on Form 1099-DA took effect, with cost-basis reporting following in 2026.
Is the Token a Security or a Commodity?
Classification comes first because it decides jurisdiction. The SEC applies the Howey Test: an asset is a security when there is an investment of money in a common enterprise with an expectation of profit derived primarily from the efforts of others. All four elements must be present.
The efforts-of-others prong is where most DeFi disputes turn. The SEC’s digital asset framework flags a development team that controls code and governance, marketing that emphasizes token appreciation, and a network that is not yet fully functional when tokens are sold. When a network has matured enough that its value depends on supply and demand rather than a founding team’s ongoing work, the asset looks more like a commodity.1SEC.gov. Framework for Investment Contract Analysis of Digital Assets
The CFTC has consistently treated Bitcoin and Ethereum as commodities. In early 2026, the SEC and CFTC jointly published a classification framework naming Bitcoin, Ethereum, Solana, and others as digital commodities, and it acknowledged that an asset can move from security to commodity as its network decentralizes.2CFTC. Digital Assets
What the SEC Expects From DeFi Platforms
The SEC’s approach shifted in 2025. Under Chair Paul Atkins, who took office in April 2025, the agency has favored formal rulemaking over enforcement litigation and closed investigations into a number of major crypto firms. A Crypto Task Force led by Commissioner Hester Peirce is developing registration paths for crypto intermediaries and clearer lines between securities and non-securities.
The retreat from aggressive enforcement is not a retreat from authority. Any DeFi platform that facilitates transactions in tokens meeting the Howey Test can still be required to register as a securities exchange or broker-dealer. Registration brings customer identification procedures, financial disclosures, and recordkeeping obligations that sit uneasily with permissionless design.3eCFR. 31 CFR 1023.220 – Customer Identification Programs for Broker-Dealers
Civil penalties are significant. Under the latest inflation-adjusted figures, an entity can face up to $118,225 per non-fraud violation, $591,127 per fraud violation, and $1,182,251 per fraud violation causing substantial losses.4SEC.gov. Adjustments to Civil Monetary Penalties
What the CFTC Regulates
Because Bitcoin, Ethereum, and other major tokens are commodities, the CFTC regulates futures, swaps, and options built on them. In the underlying spot market, the CFTC’s authority is narrower but still real: the agency can pursue civil enforcement against fraud and market manipulation under the Commodity Exchange Act.
The CFTC has been especially active against decentralized derivatives platforms that offer leveraged trading to U.S. customers. In the Ooki DAO case, the agency charged a DAO with operating an illegal trading platform without registering as a futures commission merchant or designated contract market. By treating the DAO itself as a liable entity, the CFTC established that decentralization does not, on its own, defeat enforcement.5CFTC. CFTC Order Finds, and Complaint Alleges, Ooki DAO is Liable
Anti-Money-Laundering Obligations Under FinCEN
FinCEN applies the Bank Secrecy Act to DeFi by classifying certain participants as money transmitters. A platform or service that meets the definition must build a formal AML program: written policies and internal controls, independent compliance testing, a designated compliance officer, and ongoing training. Suspicious Activity Reports must be filed when transactions appear to involve illicit funds.6U.S. Department of the Treasury. Illicit Finance Risk Assessment of Decentralized Finance
The Travel Rule
Financial institutions handling transfers of $3,000 or more must collect and pass along identifying information about both sender and recipient: names, addresses, account numbers, transfer amount, and execution date. Pseudonyms and code names are not acceptable; institutions must use the customer’s true name.7Financial Crimes Enforcement Network (FinCEN). Funds Travel Regulations Questions and Answers
For DeFi protocols this creates an obvious problem. Blockchain transactions are pseudonymous by default, and many decentralized platforms have no mechanism for collecting identity data. A protocol that qualifies as a money transmitter but cannot comply faces a widening compliance gap.
Mixers
FinCEN has proposed designating transactions involving cryptocurrency mixers as a “primary money laundering concern,” which would require financial institutions to monitor and report activity involving these services. The proposal is not final, but the direction is unmistakable: tools that sever the on-chain link between sender and recipient are a priority target.6U.S. Department of the Treasury. Illicit Finance Risk Assessment of Decentralized Finance
Stablecoin Rules Under the GENIUS Act
The GENIUS Act, signed into law in July 2025, created the first federal framework for stablecoins. Issuers must back tokens with 100% liquid reserves such as U.S. dollars or short-term Treasury securities and publish monthly disclosures of reserve composition. Issuers are explicitly subject to the Bank Secrecy Act, so they must run full AML and sanctions programs, verify customer identities, and screen against sanctions lists.8The White House. Fact Sheet: President Donald J. Trump Signs GENIUS Act Into Law
The law aligns state and federal frameworks so issuers face consistent rules regardless of where they are chartered. For DeFi protocols that route lending, borrowing, and liquidity through stablecoins, the effect is a regulated counterparty at the stablecoin layer even when the protocol itself remains decentralized.
Tax Reporting for DeFi Users
The IRS treats digital asset income like any other income. Tokens earned through staking, airdrops from a hard fork, or liquidity rewards are taxable in the year received and reported on Schedule 1 of Form 1040. When those assets are later sold, swapped, or transferred, gains and losses are capital in nature if the asset was held as an investment.9Internal Revenue Service. Digital Assets
Form 1099-DA
Starting with transactions on or after January 1, 2025, digital asset brokers must report gross proceeds on Form 1099-DA. Beginning with transactions on or after January 1, 2026, brokers must also report cost basis for certain transactions, closing off a common underreporting path. The IRS provided penalty relief for 2025 transactions where brokers made a good-faith effort to file correctly; that cushion is transitional.10Internal Revenue Service. Final Regulations and Related IRS Guidance for Reporting by Brokers on Sales and Exchanges of Digital Assets
Brokers are not yet required to file 1099-DAs for staking or liquidity provider transactions pending further IRS guidance. That exception applies to the broker’s reporting obligation only. Taxpayers still have to report the rewards and compensation earned through those activities.9Internal Revenue Service. Digital Assets
The $10,000 Cash Threshold
The 2021 Infrastructure Act expanded the definition of “cash” under IRC Section 6050I to include digital assets, which would ordinarily require anyone receiving more than $10,000 in digital assets through a trade or business to file Form 8300 within 15 days. The IRS suspended that requirement for digital assets specifically. Until final regulations are published, you do not need to count digital assets toward the $10,000 threshold. Cash received in traditional form still triggers filing.11IRS.gov. Transitional Guidance Under Section 6050I With Respect to Reporting of Information on the Receipt of Digital Assets
Who Is Liable When a Protocol Breaks the Law
Traditional enforcement assumes an identifiable company with officers who can be sued or fined. DAOs distribute decision-making across token holders, and the developers who write the code may have no formal relationship with the entity that deploys it. This is one of the most unsettled areas of DeFi regulation.
The Ooki DAO case tested the question directly. By charging the DAO rather than only its founders, the CFTC signaled that a DAO can be treated as a liable entity under existing law. If a court treats a DAO as an unincorporated association or general partnership, every member could face personal liability for the organization’s violations.5CFTC. CFTC Order Finds, and Complaint Alleges, Ooki DAO is Liable
Some states have created special-purpose LLC structures for DAOs, letting them register in a form that shields individual members much the way a traditional LLC protects its owners. The operating agreement or smart contract defines member roles and authority. Without that kind of registration, a DAO’s members operate without a legal safety net.
Developers carry their own exposure. Regulators focus on who retains meaningful control: the ability to push code updates, adjust fee structures, or manage administrative keys. A developer who keeps those privileges looks less like a neutral software author and more like an operator of a financial service. The SEC’s framework treats ongoing development work, governance control, and market-making activity as indicators that a project is not truly decentralized.1SEC.gov. Framework for Investment Contract Analysis of Digital Assets
What Is Still in Flux
The GENIUS Act settled the stablecoin question, but broader market-structure legislation is still working through Congress. The Financial Innovation and Technology for the 21st Century Act passed the House in May 2024 and would give the CFTC primary authority over spot digital commodity markets while leaving securities-type tokens with the SEC. Similar bills have been introduced in the 119th Congress; none had been signed into law as of early 2026.
The SEC’s Crypto Task Force is expected to produce rulemaking that could create formal registration pathways for digital asset exchanges and broker-dealers. Until that framework arrives, the regulatory picture depends on which agency takes interest in a given protocol, how the underlying tokens look under the Howey Test, and whether U.S. customers are involved. Waiting for the last rule to be final before thinking about compliance is a strategy with real risk attached.