Genuine DeFi as Critical Infrastructure: A Conceptual Framework for Combating Illicit Finance Activity in Decentralized Finance

Abstract

Combating illicit financial activity in permissionless blockchain-based financial systems — referred to as “decentralized finance” or “DeFi” — has challenged regulators and policymakers. Traditional financial integrity laws and regulations, comprised of antimoney laundering (“AML”)/countering the financing of terrorism (“CFT”) and sanctions, attach to intermediaries, including, with respect to AML/CFT obligations, those intermediaries the Bank Secrecy Act (“BSA”) defines as “financial institutions.” The current laws, however, are not amenable to intermediary-less systems like DeFi. This paper proposes a framework (see Section III) to effectively detect, deter and prevent illicit financial activity in DeFi, while preserving the technology as permissionless, neutral infrastructure. The three-part proposal (1) sets forth a definition of “independent control” in order to identify smart-contract based financial protocols that do not constitute DeFi; (2) seeks to classify genuine DeFi protocols — neutral, decentralized software — as “critical infrastructure,” subject to oversight and security coordination by the Treasury Department’s Office of Cybersecurity and Critical Infrastructure Protection (“OCCIP”); and (3) suggests that new laws could require certain businesses that are (a) necessary to the transmittal of communications about DeFi transactions, (b) transmit a material portion of such communications and (c) offer the service as a business to take on additional illicit finance risk management practices, without becoming “financial institutions” subject to the BSA. This paper is intended to begin a meaningful conversation about how to achieve the policy goals of combating illicit financial activities while allowing for continued innovation in DeFi, a nascent technological sector.