DeFi Protocols Under the Bank Secrecy Act: The Compliance Reckoning

The Rule That Changed the Conversation

On October 19, 2023, the Financial Crimes Enforcement Network (FinCEN) issued a Notice of Proposed Rulemaking that would designate international convertible virtual currency mixing as a class of transactions of primary money laundering concern under Section 311 of the USA PATRIOT Act. The proposal would have required covered U.S. financial institutions to keep records of and report transactions involving mixing; it did not itself treat mixers as financial institutions. But it built on FinCEN's position, set out in its May 2019 guidance, that anonymizing services that accept and transmit value are money transmitters under the Bank Secrecy Act (BSA), and that premise has direct implications for decentralized finance (DeFi) protocols operating in the United States.

FinCEN never finalized that rulemaking. Update (October 2026): FinCEN withdrew the proposal and its underlying section 311 finding as of October 6, 2026, citing commenters' concerns that its expansive definition of mixing could chill legitimate activity, while stating that it will continue to monitor mixer activity and may take further steps. The withdrawal does not change the 2019 guidance or the BSA itself, so compliance teams and general counsel at firms that interact with DeFi — whether as investors, liquidity providers, or platform operators — should still treat the underlying legal theory as live.

What the BSA Actually Requires

The BSA and its implementing regulations at 31 C.F.R. Chapter X impose a layered set of obligations on "money services businesses" (MSBs), including money transmitters. FinCEN's longstanding guidance, most recently synthesized in its May 2019 guidance on convertible virtual currencies, makes clear that the economic function of a business — not its technical architecture — determines whether it is an MSB.

The core obligations for a registered MSB include:

• Registration with FinCEN under 31 C.F.R. § 1022.380
• Anti-money laundering (AML) program requirements under 31 C.F.R. § 1022.210
• Suspicious Activity Reports (SARs) under 31 C.F.R. § 1022.320
• Currency Transaction Reports (CTRs) for transactions over $10,000
• Customer identification consistent with applicable Customer Due Diligence (CDD) rules

The unresolved question for DeFi is whether a protocol — a set of smart contracts running autonomously on a blockchain, with no central operator — can be a "money transmitter" at all, and if so, who bears the obligation.

The Operator vs. Protocol Distinction

FinCEN's 2019 guidance distinguishes between software developers who create tools and those who use or deploy them to transmit value on behalf of others. Under that framing, a developer who merely writes and publishes code is less likely to be an MSB than an entity that operates infrastructure and exercises control over how value moves.

This distinction is harder to apply in practice than it sounds. DeFi protocols are not always fully autonomous. Many involve:

• Administrative keys that can pause contracts, upgrade logic, or set fee parameters
• Governance token holders who vote on protocol changes
• Frontend operators who control the website or application through which users actually interact with the underlying contracts
• Liquidity providers who deposit assets and earn fees

FinCEN has not issued guidance that maps these roles cleanly onto BSA definitions as of 2026-09-03. But the Department of Justice's prosecution of Tornado Cash developers — Roman Storm was indicted in the Southern District of New York in August 2023 on charges of conspiracy to commit money laundering, conspiracy to operate an unlicensed money transmitting business, and conspiracy to violate sanctions — demonstrates that federal prosecutors are willing to reach the human beings behind ostensibly decentralized software.

In August 2025 a jury convicted Storm of conspiracy to operate an unlicensed money transmitting business and could not reach a verdict on the money laundering and sanctions conspiracy counts. As of 2026-09-03, his motion for a judgment of acquittal is pending, and the government's retrial of the two deadlocked counts is scheduled for April 2027. A jury verdict is not legal precedent. But the prosecution is a clear signal about prosecutorial theory.

Where OFAC Fits In

The Office of Foreign Assets Control (OFAC) added Tornado Cash smart contract addresses to the Specially Designated Nationals (SDN) list in August 2022 under 31 C.F.R. Parts 500–598. The U.S. Court of Appeals for the Fifth Circuit, in Van Loon v. Department of the Treasury, No. 23-50669 (5th Cir. 2024), held that OFAC exceeded its statutory authority under the International Emergency Economic Powers Act (IEEPA) because Tornado Cash's immutable smart contracts are not "property" that can be blocked. Treasury removed Tornado Cash from the SDN list on March 21, 2025, and Coin Center's parallel challenge in the Eleventh Circuit ended in July 2025 without an appellate ruling on the merits.

There is no circuit split: Van Loon is the only appellate merits ruling and it binds only within the Fifth Circuit, so the law remains unsettled as of 2026-09-03. Compliance professionals cannot simply point to Van Loon and conclude that sanctioning immutable code is categorically off the table. OFAC retains authority over persons, and mutable contracts or protocol operators may face different analysis.

Practical Pressure Points for Compliance Leaders

Know Your Touchpoints

Before assessing BSA exposure, map every point at which your organization touches a DeFi protocol. This includes direct investment, custody of LP tokens, treasury management through automated market makers, and any platform function that routes user funds through protocol contracts. Each touchpoint carries a different risk profile.

Governance Rights Are Not Passive

Holding governance tokens and voting on proposals is not the same as holding a passive equity stake. If a governance vote sets parameters that affect how the protocol processes user funds, counsel should analyze whether that level of control could support a theory of operational involvement under the BSA's "control or direction" language.

Frontend Operators Bear Real Risk

If your organization runs a website that serves as the primary user interface for a DeFi protocol, you are not merely a software company. You decide what wallets to geoblock, whether to display compliance warnings, and which pools to surface. FinCEN and DOJ have focused on frontend operators precisely because they exercise discretion that fully autonomous code would not.

Document Your Legal Analysis Now

In an enforcement action, a well-documented, contemporaneous legal memorandum analyzing BSA applicability — even one that concludes no registration is required — is materially different from the absence of any analysis. Document the reasoning, date it, and revisit it when FinCEN guidance or case law changes.

For compliance and legal teams building that analytical foundation, the Risky Business: Cryptocurrency, Money Laundering, and Smart Contracts course at Legal Cyber Academy covers the BSA, AML obligations, and smart contract mechanics in plain terms built for legal and compliance professionals.

If your team is also assessing how token issuance interacts with these questions, Introduction to Utility Tokens and Initial Coin Offerings provides grounding in the regulatory classifications that affect whether a token triggers securities or MSB analysis — or both.

The Questions That Do Not Have Clean Answers Yet

As of 2026-09-03, three questions remain genuinely open:

1. Can a DAO itself be an MSB? FinCEN has not addressed DAOs directly in formal guidance.
2. Does holding governance tokens without voting trigger any obligation? No agency or court has said.
3. Will other courts follow Van Loon on OFAC's smart-contract authority? Since the March 2025 delisting, no other court of appeals has decided the question on the merits.

The absence of clear answers is not comfort. Enforcement — both criminal and civil — has moved faster than rulemaking. Organizations that wait for final rules before building AML controls around DeFi activity are making a deliberate risk choice, not a legally safe one.