Cross-chain bridges sit at the highest-risk intersection of DeFi architecture and financial regulation. A cross-chain bridge (a protocol that locks assets on one blockchain and mints synthetic representations on another) simultaneously touches custody, transfer, settlement and, in many architectures, securities issuance. Boards that treat a bridge deployment as a purely technical decision are assuming legal risk they have not yet measured. This analysis maps that risk across the regulatory environments that matter most and draws practical lessons from how we see these questions resolved in practice.
What Makes a Cross-Chain Bridge Legally Distinct from Other DeFi Protocols?
A bridge is legally distinct because it performs, in sequence, three regulated acts that most DeFi protocols perform only one of: it takes custody of the originating asset, creates a new instrument on the destination chain, and settles a transfer between two network environments. Each step maps to a regulated activity in at least one major regime. Under MiCA, the concurrent performance of custody and transfer activities by the same entity or smart-contract system triggers CASP authorisation analysis. Under the VARA regime in Dubai, the transfer/settlement activity licence category is specifically designed to capture exactly this pattern.
The structural consequence is significant. Unlike a pure DEX, which matches willing counterparties in a single environment, a bridge is exposed to at least two regulatory perimeters at once – the perimeter of the originating chain's dominant user jurisdiction and the perimeter of the destination chain's dominant user jurisdiction. A bridge connecting an Ethereum-based asset to a Solana-based ecosystem could simultaneously attract scrutiny from ESMA-aligned regulators (if European retail flows transit the bridge), from FinCEN (if US persons are among the liquidity providers) and from MAS in Singapore if the wrapped asset is listed on a Singapore-adjacent exchange. This is not a theoretical stack of regulators; it is the operating reality for any bridge with meaningful volume.
In our practice, the first question boards fail to ask is not "do we need a licence?" but "in how many places simultaneously do we need to answer that question?" The cross-border exposure of a bridge compounds rather than adds.
Custody Risk: Who Actually Holds the Locked Asset?
The entity or multisig that controls the lock contract holds the asset – and that control is a regulated custody function in every major regime that has addressed it. In most bridge architectures, custody either sits with a multisig of named validators, a single smart contract with an upgrade key, or a fully decentralized threshold-signature scheme. Each model carries a different legal profile, but none is automatically unregulated.
Where a named entity controls the upgrade key or the guardian multisig, regulators applying the applicable VASP provisions or CASP regime can identify that entity as the custodian. The FSRA within ADGM and the MFSA in Malta have both signalled that the economic substance of custody – holding or controlling assets on behalf of others – is the test, not the label the protocol operator applies. A "non-custodial" bridge that has an operator-controlled emergency pause function is custodial in the regulator's view the moment that pause freezes user funds.
The practical lesson for boards is straightforward: map the control graph before you map the legal question. Who can pause the bridge? Who can upgrade the contract? Who controls the oracle that reports locked balances? The answers define who the regulator treats as the custodian. A board that cannot answer these questions in ten minutes at a meeting is not in a position to give a legal opinion to a regulator who can.
We have seen in our cross-border advisory work that operators often discover, mid-licensing conversation, that a vendor or third-party auditor retained contractual rights over the lock contract that were never disclosed to the board. That discovery changes the entity structure entirely.
Are Wrapped Assets Securities? The Classification Trap That Boards Miss
A wrapped asset – the synthetic representation minted on the destination chain – is a new instrument. Its legal classification depends on the rights it confers, not on the name of the underlying or the term "wrapped" in its ticker symbol. A common assumption is that a utility label on a whitepaper settles the legal classification. It does not. The substance of the rights governs.
The relevant analytical questions are: does the wrapped asset confer economic rights in an enterprise? Does it entitle the holder to profits, revenues or governance influence over a profit-generating protocol? Does the wrapping mechanism itself – locking the original and minting the synthetic – constitute a collective investment scheme where the operator exercises discretion over pooled assets? Under US federal securities law (administered by the SEC and CFTC), any of these features can convert a token into a security or a commodity derivative subject to registration or licensing requirements. Under MiCA, a wrapped asset that does not neatly fit the ART (asset-referenced token) or EMT (e-money token) categories still requires a whitepaper and may attract the general CASP regime for the entity offering it.
The mis-classification risk is acute for bridges that mint wrapped versions of real-world assets (RWAs) – tokenized treasury bills, tokenized equity or tokenized fund units. The moment the underlying is a security, the wrapped version inherits at least a portion of that regulatory burden, and no bridge operator has successfully argued otherwise to a regulator that has engaged substantively on the point.
We assess classification against the substance of rights, not the marketing label, and we have seen boards materially change their product designs after that analysis. The cost of rearchitecting a bridge pre-launch is always lower than the cost of enforcement post-launch.
CTA: The classification question is the first branching point for any bridge project. The answer drives licence strategy, entity structure and treasury design simultaneously. Map your options with the OBOLUS DeFi and tokenization team before the architecture is fixed.
AML and the Travel Rule: Does a Bridge Constitute a Transfer?
The Travel Rule (the obligation, derived from the FATF Recommendations, to pass originator and beneficiary data with a virtual asset transfer) applies to transfers between VASPs – and the central question for bridge operators is whether locking an asset on one chain and releasing a wrapped equivalent on another constitutes a "transfer" within the meaning of the applicable VASP provisions. Most leading regulators answer that question affirmatively when the economic result for the user is the movement of value between two environments.
Where the bridge operator qualifies as a VASP or CASP, it is obligated to collect and transmit Travel Rule data on transfers above the applicable threshold. The threshold is set by each jurisdiction and is deliberately left as a verify-before-use figure here; in practice, it varies between a nominal de-minimis and a figure that captures the overwhelming majority of retail flows. The practical compliance problem is that most bridge front-ends do not collect KYC data at the point of transfer – the architecture is permissionless by design. A regulated bridge operator therefore faces a structural conflict between the permissionless design goal and the Travel Rule compliance obligation.
Operators we advise routinely work through three design options: a front-end KYC gate (captures user data before the bridge call is made), an on-chain attestation model (users attest to a compliance status before a whitelisted interface routes the transaction), or a dual-track architecture (a permissioned institutional pool and a permissionless retail pool, with the institutional pool carrying the Travel Rule compliance burden). None of these solutions is frictionless, and regulators at the leading hubs increasingly expect to see the chosen approach documented and independently reviewed before they will engage on a licence application.
Smart Contract Exploit Liability: Who Bears the Loss?
When a bridge exploit occurs – and the record of cross-chain bridge security failures is extensive – the legal liability question follows the control graph that we described in the custody section. The entity that controlled the lock contract, operated the oracle and retained the upgrade key is the entity that a claimant's counsel will name first in a claim. The decentralized label is a starting point for the argument, not the conclusion.
In common-law forums – England and Wales, Singapore, Hong Kong and the DIFC Courts – the threshold question is whether the bridge operator owed a duty of care to the affected users. That analysis turns on proximity (did the operator know who the users were?), reliance (did users rely on representations about security?) and foreseeability (was the exploit scenario foreseeable?). England and Wales remains the leading forum for crypto asset recovery proceedings, and courts there have consistently found that digital assets constitute property capable of being frozen and recovered. A bridge operator facing a post-exploit claim will encounter a sophisticated judiciary that is not deterred by the technical complexity of the underlying architecture.
The contractual layer matters as well. Terms of service that purport to disclaim all liability for smart-contract failure have been tested in multiple jurisdictions, with mixed results. An exclusion clause that is not brought to the user's specific attention before a transaction may not be enforceable. More fundamentally, a regulator may treat an attempt to contract out of regulated-activity obligations as aggravating rather than mitigating a compliance failure.
DAO Governance Structures: Does Decentralization Limit Board Accountability?
A DAO (decentralized autonomous organization) governance structure does not, by itself, remove the legal accountability of the founding team, the development company or the foundation that deployed and maintains the bridge. Regulators applying the applicable VASP and CASP provisions focus on who exercises factual control, not who holds nominal governance tokens. Where a founding team retains a majority token allocation that can pass governance proposals, the argument that the protocol is "community-governed" will not satisfy an AML supervisor asking who the accountable money-laundering reporting officer is.
The MiCA regime explicitly addresses the attribution question: where a crypto-asset service is provided in a decentralized manner without a legal person that can be identified as the offeror, the obligations attach to those who make an offer to the public or who seek admission to trading. The legal wrapper – whether a Cayman foundation, a Swiss association, a BVI company or an unincorporated DAO – changes the liability profile significantly. The absence of a wrapper does not eliminate liability; it concentrates it on the individuals who signed the deployment transactions.
In our practice, we regularly advise founding teams that are surprised to discover how much factual control they have retained through admin keys, emergency pause functions and token-weighted governance. The board accountability question is therefore practical before it is legal: an honest control audit conducted before a regulatory engagement is far preferable to the same audit conducted in response to a regulatory investigation.
CTA: If a prior application stalled or a regulator has requested documentation on the control structure of a bridge or DAO, a structured review can surface the gap and map the route to a compliant posture. Map your options by reaching the OBOLUS DeFi team at info@oboluslaw.com.
Micro-Matter: Recovery After a Bridge Exploit
In a recent cross-border matter, a digital-asset fund had deployed a material portion of its treasury into a cross-chain bridge that suffered an oracle manipulation exploit. The locked assets – a seven-figure balance in a major stablecoin – were drained to multiple destination-chain addresses within hours of the exploit. We coordinated on-chain forensics tracing the funds through two intermediate protocols and identified a concentration point at a centralized exchange. We prepared the documentary package required for a disclosure order application in a leading common-law forum and engaged the exchange's compliance team under the applicable asset-freeze procedures. The exchange voluntarily cooperated ahead of the court application; the disclosure order was obtained within days and the frozen balance was preserved for the claimant's subsequent recovery action. The total elapsed time from instruction to freezing was under two weeks.
The lesson boards should draw is not that recovery is always possible – it is that the recovery window is short and that preparation matters enormously. A board that has retained forensic capability and legal counsel before an exploit occurs will always outperform a board that is searching for both at two in the morning after one.
Decision Matrix: Which Legal Structure Fits Which Bridge Operator Profile?
Legal structure for a bridge operator is not a single question. It is a stack of decisions that interact. The following matrix describes the principal profiles we see and the structural implications of each.
Profile A – Institutional-grade bridge targeting regulated venues. The operator wants to serve institutional counterparties and licensed exchanges. The indicated structure is a regulated entity in a recognized hub – ADGM, VARA's Dubai regime, MAS in Singapore, or an EU CASP under MiCA – with a formal custody framework, an AML programme, a Travel Rule compliance solution and an independent audit of the smart-contract architecture. The timeline to operational compliance is typically measured in months rather than weeks. The key risk is the capital requirement (which varies by category under each regime and must be verified against current legislation) and the ongoing regulatory reporting burden.
Profile B – Permissionless DeFi bridge with a developer foundation. The operator deploys an open-source bridge and retains a foundation (Swiss, Cayman or BVI are common) to fund development and governance. The indicated structure depends critically on the control audit: if the foundation retains admin keys or a governance majority, it will be treated as the operator for regulatory purposes, and the foundation must be structured for that accountability. The key risk is that the "decentralized" framing fails under the MiCA attribution test or the applicable VASP provisions in the users' jurisdictions.
Profile C – Bridge as a feature of a broader exchange or custodian. Where a licensed exchange adds bridging functionality as a feature of its existing product, the bridge activity is typically subsumed into the existing licence if the regulator agrees that the activity is ancillary. The key risk is assuming ancillary status without seeking a formal no-action or variation from the regulator. In our experience, regulators treat the addition of a material new function as a trigger for a fresh authorisation conversation, not an automatic extension of the existing one.
What Are the Practical Legal Lessons a Board Should Act on Today?
The practical lessons for boards are concrete and sequential. They do not require waiting for regulatory clarity to improve; they require acting on what is already clearly demanded by existing regimes.
First, conduct a control audit before any regulatory engagement. Map who can pause, upgrade, redirect or freeze the bridge – by function, not by job title. The control graph is the legal accountability graph.
Second, classify the wrapped asset before you issue it. The classification exercise should be conducted by counsel applying the substance-of-rights test in each jurisdiction where the wrapped asset will be accessible. A whitepaper that describes a token as a "utility" does not insulate the board from a regulator that finds economic rights embedded in the smart contract.
Third, design the AML/Travel Rule solution into the architecture, not onto it. A retroactive compliance layer on a permissionless bridge is expensive, user-hostile and rarely satisfies a sophisticated AML supervisor. The preferred solution – whatever its form – should be reviewed by counsel familiar with the applicable VASP provisions before the bridge launches.
Fourth, retain incident-response capability before you need it. A bridge exploit that drains user funds will be measured in hours. A board that can act within that window – forensically and legally – preserves options that are gone by the following morning.
Fifth, brief the board, not just the technical team. Bridge legal risk is board-level risk. It encompasses securities law, AML, custody regulation, tort liability and potential personal accountability for founders. A board that receives only engineering updates on bridge architecture is not governing the legal risk it is assuming.
Related at OBOLUS
- DeFi, Tokenization and Smart-Contract Law – how OBOLUS structures legal advice for protocol operators, DAO foundations and token issuers
- DeFi Protocol Legal Structuring in Lithuania – the EU licensing entry point for DeFi operators under MiCA and the Bank of Lithuania framework
- Licence Renewal and Variation in El Salvador – maintaining and adapting a digital-asset licence as a protocol's product scope evolves
FAQ
Can a DeFi protocol be regulated?
Yes. Regulatory perimeter analysis focuses on whether a protocol performs a regulated activity – custody, transfer, exchange, issuance – and whether a legal person or identifiable individual exercises sufficient control to be held accountable. A fully autonomous, immutable contract with no admin keys or governance tokens presents the strongest argument for exclusion. Most real-world bridges do not meet that standard. Under MiCA and the applicable VASP provisions in leading jurisdictions, the economic substance of the activity, not the "DeFi" label, determines whether authorisation is required.
What legal wrapper suits a DAO?
The appropriate wrapper depends on the control profile, the user base and the desired liability insulation. Common options include a Cayman Islands foundation company, a Swiss association, a BVI company and, in the US context, a Wyoming LLC with DAO provisions. Each carries different tax, governance and regulatory recognition implications. A wrapper that does not match the factual control structure of the DAO offers limited protection: if the founding team retains a governance majority, the wrapper's nominal decentralization is unlikely to satisfy a regulator scrutinizing accountability under the applicable VASP or CASP regime.
Who is liable when a smart contract fails?
Liability follows control. The entity or individuals who deployed the contract, retained upgrade or pause rights, or made representations about its security are the primary candidates for a claim. In common-law forums – England and Wales, Singapore, Hong Kong and the DIFC Courts – digital assets are recognized as property, and courts can freeze and compel disclosure of assets. Terms of service that disclaim liability for smart-contract failure have mixed enforceability. A board should not assume that a disclaimer resolves the liability question before specific legal advice is obtained for the relevant jurisdiction.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around every digital-asset structure. We advise crypto exchanges, custodians, token issuers and funds across more than seventy licensing jurisdictions, and we assess classification against the substance of rights, not the marketing label. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Victor Olsen, Regulatory & Compliance Analyst – specialising in cross-border VASP and CASP regulatory perimeter analysis for bridge operators, protocol developers and token issuers.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.