（Original Video in Japanese was published on the FINOLAB CHANNEL on Aug. 11, 2026 by Makoto Shibata）　https://youtu.be/sHzpXM4sHQw

Decentralized Finance, or DeFi, refers to financial services provided through automated programs, primarily smart contracts, on blockchain networks without relying on traditional centralized intermediaries such as banks, securities companies, or crypto-asset exchanges. Compared with conventional centralized finance, or CeFi, DeFi allows users to manage assets directly through their own wallets, interact peer-to-peer or with liquidity pools, and access financial services around the clock, often without conventional account-opening procedures or identity verification.

The underlying technology is blockchain, a distributed database in which transaction data is stored in interconnected blocks. Each block contains information linked cryptographically to the previous block, making unauthorized alteration detectable and allowing participants to verify the integrity of transaction records. This architecture provides the technological foundation for decentralized financial transactions.

DeFi has four important characteristics. First, smart contracts automatically execute transactions when predefined conditions are satisfied, reducing the need for manual intervention by third parties. Second, many DeFi services are permissionless, meaning that users can access them regardless of nationality, credit history, or whether they have a conventional bank account. Third, composability allows open-source DeFi protocols to be combined like building blocks to create new financial products and services. Fourth, DeFi is generally non-custodial, allowing users to retain control of their assets through their own crypto wallets rather than depositing them with a centralized institution.

These characteristics have enabled a wide range of financial services. Decentralized exchanges (DEXs) such as Uniswap allow users to exchange crypto assets directly with other users or liquidity pools. Lending protocols such as Aave enable users to earn interest by supplying assets or to borrow against crypto collateral. Other applications include stablecoins and synthetic assets, as well as yield farming, in which users provide liquidity to protocols in return for transaction fees or reward tokens.

However, the same characteristics that make DeFi innovative also create significant risks. With no centralized administrator, users may have limited protection when funds are mistakenly transferred, fraud occurs, or a protocol fails. Vulnerabilities in smart contracts can be exploited by hackers, resulting in large-scale losses. Moreover, the ability to transact without conventional identity verification and the pseudonymous nature of blockchain transactions can make DeFi attractive for money laundering, terrorist financing, and other forms of financial crime.

Against this background, the Financial Action Task Force (FATF) published a report on the regulatory challenges posed by DeFi in July 2026. The report reflects the rapid expansion of the DeFi ecosystem, including growing participation by institutional investors and virtual asset service providers (VASPs), while highlighting increasing risks related to money laundering, terrorist financing, and proliferation financing. Its objective is to clarify how FATF standards, particularly Recommendation 15, should apply to DeFi arrangements. A key principle is technological neutrality: regulation should focus not on a particular blockchain or smart contract itself, but on the individuals or legal entities that exercise control or sufficient influence over it.

The FATF framework therefore distinguishes among three types of DeFi arrangements according to their governance and control structures. The first is centralized DeFi, where identifiable developers, administrators, governance-token holders, or other parties exercise control. These arrangements are subject to FATF standards and may require licensing or registration. The second category consists of arrangements that are effectively centralized but whose controllers are difficult to identify because of pseudonymity or other factors. These are also considered within the scope of FATF standards, although enforcement can be difficult. The third category is truly decentralized DeFi, where no person exercises control or sufficient influence. Because technology itself cannot be regulated as a legal entity, such arrangements fall outside direct application of the standards, requiring alternative risk-mitigation measures.

This distinction is particularly important because calling a service “decentralized” does not necessarily mean that it is decentralized in practice. FATF therefore identifies both on-chain and off-chain indicators for determining who actually exercises control. On-chain indicators include possession of upgrade keys or backdoors, authority to change fees, interest rates or collateral ratios, control over price oracles, receipt of protocol revenues, and concentration of governance tokens or voting power. Off-chain indicators include control of websites and applications, authority over development roadmaps and infrastructure, management of trademarks and official communications, and employment or financing of developers by a company or foundation.

The need for such scrutiny is reinforced by the financial crimes associated with DeFi. These include fraud and Ponzi-type schemes, sophisticated laundering networks using combinations of cross-chain bridges, DEXs and mixers, hacking linked to proliferation financing, and governance attacks, where mechanisms such as flash loans may be used to temporarily acquire significant voting power and manipulate protocol decisions.

For national authorities, FATF recommends a risk-based approach. Countries should assess their exposure to DeFi risks, impose licensing or registration requirements where identifiable controllers exist, and consider embedding AML/CFT measures at the smart-contract level. Where controllers cannot be identified, authorities may need to rely more heavily on points of contact with the conventional financial system, including VASPs and stablecoin issuers, to conduct customer due diligence or freeze assets. FATF also emphasizes blockchain analytics, public-private partnerships, international cooperation, and mechanisms for rapidly tracing, freezing, and recovering illicit assets.

The report also places responsibilities on businesses. DeFi arrangements with identifiable controllers should comply with FATF Recommendation 15 and implement financial-crime controls. Governance structures, contact information, and the scope of control should be transparent. VASPs and financial institutions interacting with DeFi protocols are also expected to assess DeFi-related risks, conduct appropriate customer identification, and maintain real-time transaction monitoring.

Overall, the FATF report represents an important step toward establishing a more consistent international approach to DeFi regulation. Rather than treating all DeFi activities uniformly, it distinguishes between arrangements where identifiable parties exercise effective control and those that are genuinely decentralized. The emerging regulatory direction is therefore not to regulate decentralization itself, but to identify where actual control exists and apply proportionate, risk-based regulation accordingly. This approach seeks to preserve the innovative potential of DeFi while addressing its growing exposure to money laundering, financial crime, and other risks.