Regulators across the major hubs have spent the past two years testing a single proposition: that calling a protocol decentralized does not insulate its operators from regulatory accountability. The results are instructive. Enforcement actions brought under securities, commodity and money-services regimes have consistently looked past the smart-contract layer to identify the human actors who deployed, controlled or profited from a protocol. For any team building or scaling a DeFi protocol (a decentralized finance application operating through self-executing code on a public blockchain), the legal question is no longer whether regulators will look – it is whether your structure can survive the scrutiny when they do.
DeFi protocol legal structuring sits at the intersection of token classification, entity design, smart-contract governance and cross-border regulatory exposure. Getting that intersection wrong – misclassifying a token, selecting the wrong wrapper for a DAO (decentralized autonomous organization), or leaving governance control legally unaddressed – can convert a product launch into an unregistered securities offering. This analysis draws on recent enforcement patterns, comparative jurisdiction analysis and our cross-border practice to map what operators need to do now.
What Recent Enforcement Has Actually Established
Enforcement across multiple jurisdictions has established a clear working principle: the substance of control, not the architecture of code, determines regulatory exposure. Regulators in the United States – through the SEC and CFTC – have pursued protocol founders and governance token holders on the basis that meaningful control over a protocol's economic function brings the same obligations as operating a traditional financial intermediary. The FCA in the United Kingdom has reinforced financial-promotion rules that apply equally to DeFi-adjacent marketing. MiCA – the EU's Markets in Crypto-Assets Regulation, administered by ESMA and national competent authorities – explicitly addresses decentralized protocols in its scope provisions, leaving a narrow carve-out that turns on a genuine absence of any identifiable issuer or service provider.
What ties these approaches together is the substance-over-form test. Regulators are not persuaded by technical decentralization arguments when a founding team retains admin keys, holds a treasury allocation, or exercises governance power through a token majority. In our cross-border practice, we regularly see operators who built genuinely distributed systems held to a different standard than those who deployed a "decentralized" label over a structure that retained meaningful central control. The difference in outcome is significant.
The MiCA carve-out for fully decentralized protocols is the closest any major regime comes to a safe harbor, but ESMA guidance makes clear that even intermittent service-provider activity can pull a protocol back into scope. Operators relying on this carve-out need a documented, auditable case – not a marketing assertion.
Token Classification Controls Everything – and a Label Is Not an Answer
Token classification is the single most consequential legal determination a DeFi protocol will face, because it sets the regulatory regime that applies to every subsequent activity. A common assumption among early-stage teams is that a "utility" label on a whitepaper settles the classification. It does not. Regulators – and courts that have reviewed enforcement actions – apply a substance-over-label analysis that asks what rights the token actually confers, not what the issuer calls it.
Under MiCA, tokens fall into one of three primary categories: asset-referenced tokens (ARTs), e-money tokens (EMTs) or "other" crypto-assets, each carrying distinct issuer obligations. Governance tokens that carry profit participation rights, fee-sharing mechanics or priority redemption features may attract securities analysis in the United States under established federal doctrine, or asset-referenced token treatment in the EU depending on the basket of rights. The FINMA token taxonomy in Switzerland – distinguishing payment, utility and asset tokens – adds a third analytical lens for protocols with Swiss legal presence.
In our practice, we assess classification against the substance of rights conferred: economic entitlement, governance weight, redemption mechanics and the reasonable expectation of return that a purchaser in the market would form. That analysis runs in parallel across the relevant jurisdictions – because a token sold globally is classified globally, not just under the law of the founding entity's domicile.
A practical illustration: a governance token that entitles holders to a share of protocol revenue accruing from fees charged to users will face a materially different legal analysis than one that provides only voting rights on code upgrades. Both may be labeled "utility" in the whitepaper. Only one of them is likely to survive that label under rigorous regulatory scrutiny.
Mis-classifying a token can convert a product launch into an unregistered securities offering – with retroactive liability for all prior sales. That risk is not theoretical. It has materialized in enforcement actions under multiple regimes.
To map the token classification exposure across your target markets before launch, contact OBOLUS at info@oboluslaw.com. The process above describes the standard analytical path. Your token's specific rights, distribution mechanics and user base change the risk profile materially.
Entity and DAO Wrapper Options: What Works and What Does Not
Choosing the right legal wrapper for a DeFi protocol or DAO is not a formality – it determines who bears liability, how governance rights are held, and whether the structure can survive regulatory challenge or litigation. There is no single answer. The right choice depends on the protocol's function, user geography, token distribution and the degree of genuine decentralization in operations.
The most commonly used structures in our cross-border practice fall into four categories:
- Foundation (Switzerland, Cayman Islands, Panama): A non-share capital entity that holds protocol intellectual property, administers treasury and interfaces with regulators. Swiss foundations supervised by the relevant authority are well-tested for DeFi contexts; FINMA has engaged with foundation-based protocols on token issuance questions. Cayman foundations offer common-law flexibility and judicial familiarity.
- Cayman Islands exempted company or LLC: Used frequently as a holding entity for a development company sitting beneath a foundation. Under the Cayman VASP Act, certain activities require registration with CIMA (Cayman Islands Monetary Authority), so activity scope must be mapped before entity selection.
- BVI company: The BVI FSC administers the VASP Act 2022; for protocols with meaningful service-provider activity, registration requirements must be assessed. BVI entities remain widely used for token-holding vehicles and as intermediate holding companies.
- Marshall Islands DAO LLC / Wyoming DAO LLC: Jurisdiction-specific structures that give a DAO recognized legal personality. They are useful for protocols that want member-limited liability and governance documentation without a conventional corporate hierarchy. However, they do not resolve securities or AML obligations – they are a liability-management tool, not a regulatory carve-out.
The cross-border reality is that a foundation in one jurisdiction does not insulate a protocol from regulatory scrutiny in the jurisdictions where its users transact. A Swiss foundation running a protocol actively marketed to EU retail investors operates within MiCA's perimeter regardless of where the legal entity sits. Similarly, a Cayman holding company does not prevent US regulatory analysis of a token sold to US persons.
The entity structure is the starting point, not the destination. It needs to be designed in conjunction with the token classification analysis, the governance model and the AML posture of the protocol.
Governance Design and Admin-Key Risk: The Control Test in Practice
The control test – the regulatory inquiry that looks for identifiable human actors exercising meaningful authority over a protocol – runs directly through governance design and admin-key architecture. A protocol that retains a multisig admin key held by the founding team, even if described as a temporary security measure, provides regulators with a concrete anchor for jurisdiction and liability.
Enforcement has repeatedly identified admin-key retention as a central factor. Where a small group can pause the protocol, upgrade contracts, redirect treasury funds or override governance votes, regulators have treated that group as the functional operator – regardless of the on-chain voting mechanisms described in the whitepaper.
Governance token distribution matters equally. A token structure where the founding team, a VC syndicate and a foundation collectively control a governance majority is, in substance, centrally governed. The legal consequences follow the economic and operational reality, not the nominal architecture. In our cross-border practice, we see this issue arise most acutely when protocols approach institutional market-makers or banking counterparties who are performing their own regulatory due diligence on the governance layer.
The practical design question is: at what point in the protocol's maturity does genuine decentralization become achievable, and how is the transition structured and documented? That is not a technology question – it is a legal and governance question, and it requires a plan that regulators can follow.
AML and Travel Rule Obligations: The DeFi Interface Problem
AML and the Travel Rule (the FATF obligation requiring originator and beneficiary information to accompany virtual asset transfers) do not disappear simply because a protocol is non-custodial. The legal analysis turns on whether any identifiable entity is providing a virtual asset service – and enforcement has shown that "identifiable entity" can mean the founding team, the protocol DAO, or the front-end operator, depending on the facts.
FATF Recommendation 15 on virtual assets applies to VASPs (virtual asset service providers), and FATF guidance acknowledges the complexity of applying it to DeFi. The resolution, at least in the guidance, is the same substance-over-form test: where a natural or legal person exercises control or sufficient influence over a DeFi protocol, they may be treated as a VASP and carry Travel Rule obligations.
The practical AML interface issue for most DeFi protocols is the front-end. A web application that routes users to the protocol may itself be the regulated touchpoint – particularly if it aggregates, routes or facilitates transfers in a way that resembles a money-services or payment function. The FCA in the UK and ESMA-aligned authorities in the EU have both signaled that front-end operators are within scope for financial-promotion and AML obligations even where the underlying protocol is non-custodial.
For protocols with genuine user volume, a documented AML risk assessment – even in the absence of a formal licence – is an important structural defense. It demonstrates that the control persons engaged with the regulatory question, which is a material factor in enforcement discretion and settlement posture.
If your protocol's AML posture or front-end structure has not been assessed against the applicable regime, write to OBOLUS at info@oboluslaw.com. If a prior compliance review stalled or produced an inconclusive result, a second read can surface the structural gap and the path forward.
Cross-Border Exposure: Where Your Protocol Is Regulated, Not Where You Are Incorporated
A DeFi protocol is regulated where its economic effects are felt, where its users reside and where its marketing reaches – not only in the jurisdiction of its founding entity. This cross-border reality is the defining challenge of DeFi legal structuring, and it is the point most frequently underweighted by founding teams focused on a single domicile decision.
The MiCA perimeter covers any CASP (crypto-asset service provider) offering services to EU clients, regardless of where the CASP is established. VARA in Dubai covers virtual asset activities conducted in or from the Emirate of Dubai. The SFC's VASP regime in Hong Kong applies to platforms targeting Hong Kong investors. The SEC's regulatory reach has historically followed US-person access, irrespective of the issuer's domicile.
For a protocol with a global user base, this means the cross-border exposure map must be drawn before entity selection, token design and governance documentation – not after. The sequence matters. Choosing a Cayman foundation and then discovering that the protocol's largest user cohort is in the EU creates a restructuring problem, not just a compliance adjustment.
The practical cross-border matrix for a mid-sized DeFi protocol will typically address: the jurisdiction of the legal entity and its regulatory obligations; the jurisdictions of the primary user base and their regulatory implications for token access and marketing; the jurisdiction of banking and treasury management; and the jurisdiction of key governance participants for DAO-liability purposes. Each axis interacts with the others. In our practice, we map these axes in sequence before advising on structure.
In Practice: A Governance Restructure Ahead of Enforcement
In a recent matter, a protocol team approached us after receiving informal correspondence from a financial regulator in a leading common-law jurisdiction. The protocol had been operating for approximately two years under a foundation structure, with governance tokens widely distributed but with admin keys retained by three founding members through a multisig wallet. The regulator's correspondence focused specifically on the admin-key arrangement and on the token's fee-sharing mechanic, which it described as a potential securities concern.
We conducted a rapid cross-jurisdiction classification analysis covering the EU MiCA perimeter, the applicable common-law jurisdiction and the US-person exposure profile of the token distribution. We then designed a phased governance transition plan: a documented admin-key handover to an on-chain governance mechanism with a defined transition timeline, a fee-mechanic redesign that separated the revenue-sharing element from the governance-token rights, and an AML risk assessment for the front-end operator entity. The regulator's engagement concluded without formal action. The protocol continued operating with a materially stronger legal footing and a documented regulatory response record.
The outcome was not guaranteed. But the speed of the structural response and the quality of the documentation were the decisive factors in the regulator's decision not to escalate.
Decision Matrix: Which Structure Fits Which Protocol Profile
The right legal structure for a DeFi protocol depends on four intersecting variables: the protocol's function (exchange, lending, derivatives, stablecoin, infrastructure), the token's rights profile, the user geography and the governance maturity. No single structure fits all profiles.
Profile A – Early-stage protocol, global user base, governance token not yet distributed: The priority is classification clarity before distribution. A Swiss or Cayman foundation holds IP and treasury; a separate development company (BVI or Singapore) employs the team; token distribution is deferred or geofenced pending MiCA and US-person analysis. Indicative timeline to a defensible structure: a matter of weeks for the entity stack, longer for the token analysis depending on rights complexity. Key risk: pressure to distribute quickly before the legal work is complete.
Profile B – Operational protocol, admin keys with founding team, EU user cohort: The MiCA perimeter is likely already engaged. The priority is an admin-key transition plan and a CASP assessment for the entity that interfaces with EU users. A front-end operator entity may need to seek CASP authorization in a passporting-eligible EU member state. Key risk: delay creates a longer period of unaddressed exposure and a weaker enforcement posture.
Profile C – DAO with distributed governance, treasury in multi-sig, institutional partners: Legal personality for the DAO is the structural priority – either a Marshall Islands or Wyoming DAO LLC, or a Cayman foundation with explicit DAO governance documentation. Institutional partners are increasingly requiring this before participating in governance or liquidity. The Travel Rule and AML posture of any centralized front-end operator must be separately addressed. Key risk: treating legal personality as optional rather than as a prerequisite for institutional engagement.
Profile D – Protocol seeking to raise institutional capital via a token offering: The token is likely to be analyzed as a security in US-person contexts regardless of its functional design. The offering structure – Reg D, Reg S or equivalent – must be selected before any marketing commences. MiCA whitepaper obligations apply for EU-directed offerings. Key risk: marketing commencing before the securities analysis is complete, triggering retroactive liability for prior sales.
Addressing the Most Common Structural Assumptions
A common assumption among DeFi operators is that genuine technical decentralization resolves the regulatory question. It narrows the regulatory risk – but it does not eliminate it. ESMA's guidance on the MiCA decentralization carve-out sets a high bar: the carve-out applies where no identifiable issuer or service provider exists. For most protocols with a founding team, a treasury, a front-end and a governance token, some identifiable actor exists. The question is whether that actor's activities bring them within a regulated category.
A second common assumption is that structuring offshore – in the Cayman Islands or BVI – eliminates regulatory reach. It does not. Offshore domicile affects which regulator has primary supervisory jurisdiction over the entity. It does not eliminate the regulatory analysis in the jurisdictions where users access the protocol. VARA, MiCA, the SFC and the FCA all assert jurisdiction based on where the service is received, not where the service provider is incorporated.
A third assumption is that a DAO structure, by distributing decision-making across token holders, eliminates the control-person analysis. It may distribute it – but regulators and courts have shown willingness to look through DAO governance structures to identify the participants who exercised meaningful influence over a specific decision or period. Proper DAO documentation and governance records are a defense, not an immunity.
We assess classification and structure against the substance of rights and the facts of control – not the marketing label or the nominal architecture. That is the standard regulators apply, and it is the standard we work from.
Related at OBOLUS
- DeFi, Tokenization and Smart-Contract Law – our full practice scope for protocol operators, DAO structurers and token issuers
- DeFi Protocol Legal Structuring in Jersey – how the Jersey regime addresses DeFi entity and token questions
- Economic Substance for Licensed VASPs in Estonia – substance requirements that affect DeFi entities with EU regulatory touch-points
FAQ
Can a DeFi protocol be regulated?
Yes. Regulators across the EU (under MiCA), the US (SEC, CFTC), the UK (FCA) and the major Asian hubs apply a substance-over-form test. Where any identifiable natural or legal person exercises meaningful control over a protocol – through admin keys, treasury authority or governance-token majority – that person or entity may be treated as a regulated service provider. Technical decentralization narrows but does not eliminate the analysis.
What legal wrapper suits a DAO?
There is no single answer. Common options include a Swiss or Cayman foundation (for IP and treasury holding), a Marshall Islands or Wyoming DAO LLC (for legal personality and member liability limits), or a Cayman exempted company as a development-company subsidiary. The right choice depends on the protocol's function, the token's rights profile and the user geography. Each structure must be assessed against the regulatory regime in the jurisdictions where users transact, not only where the entity is domiciled.
Who is liable when a smart contract fails?
Liability depends on the facts of control and the legal relationship between the protocol operators and its users. Where a founding team or DAO retains admin-key authority or governance control at the time of failure, those parties face the strongest exposure. The entity structure – foundation, LLC or company – determines whether liability attaches to individual members or to the legal entity. In most common-law forums, courts look to who deployed, controlled and benefited from the contract to anchor tortious or contractual claims.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers, protocol teams and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the entirety of our practice. We assess classification and structure against the substance of rights and the facts of control – the same standard regulators apply. To discuss your DeFi structuring question, contact info@oboluslaw.com.
By Victor Olsen, Regulatory & Compliance Analyst – specialising in cross-border DeFi protocol structuring, token classification and regulatory exposure mapping for protocol operators.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.