Concerns Over DeFi 'Access Restrictions' Discussion... "Regulation by Function is Necessary"

DeFi. Source=ChatGPT generated

A report commissioned by financial authorities has proposed measures to restrict access to decentralized finance (DeFi), leading to backlash and concerns in the market.

The Korea Financial Institute submitted a report titled 'Phase 2 Legislation and Supplementary Report on Anti-Money Laundering (AML) Systems Related to Stablecoins' to the Financial Services Commission at the end of last year. The institute stated, "For decentralized and over-the-counter transaction support providers, it is preferable to actively interpret the application of AML/Counter-Terrorism Financing (CFT) regulations to virtual asset (digital asset) businesses rather than explicitly designating them as direct regulatory targets."

The institute further added, "Considering that most decentralized and over-the-counter transaction support providers have unclear regulatory jurisdiction and it is difficult to exercise supervisory authority from specific countries, it is necessary to classify these providers as unlicensed virtual asset businesses and actively utilize measures such as restricting access for domestic users and transaction limitations for providers."

The contents of this report contain stringent regulations that could limit domestic users' access or transactions by viewing DeFi as unlicensed virtual asset businesses, drawing renewed attention from the market ahead of discussions on the Digital Asset Basic Law at the end of the year following the National Assembly audit.

Examining 'Who Controls'

However, looking at major overseas regulatory frameworks, the approach is not to uniformly block user access solely because it is DeFi; rather, the regulation varies depending on whether there is an actual controlling entity and what financial functions are being performed. Fully decentralized entities, which are difficult to regulate directly, are excluded from regulatory targets, and methods to manage AML risks through existing regulated entities such as digital asset exchanges are also utilized.

The Financial Action Task Force (FATF) states that if a natural person or legal entity exercises 'control or sufficient influence' over DeFi, the regulations for virtual asset service providers (VASP) should apply. Key criteria include administrative authority, protocol upgrade authority, governance token concentration, and economic benefits.

Simply being labeled as DeFi does not exempt one from regulatory targets. If developers or foundations can change smart contracts or halt transactions, they can be viewed as actual controlling entities. Conversely, pure protocols where no one can change core functions or control transactions are difficult to apply existing business regulations.

The European Union's Markets in Crypto-Assets (MiCA) regulation also excludes services provided in a completely decentralized manner without intermediaries from regulatory application. However, if a specific entity directly or indirectly provides or controls the service, regulations may apply.

Exchanges as 'Gatekeepers'

In areas that are difficult to regulate directly, such as fully decentralized systems, the role of exchanges becomes more significant. The FATF recommends that financial institutions or VASPs apply existing AML standards, including customer verification and money laundering risk management, when dealing with DeFi.

In the EU, this approach has been concretized into regulations on personal wallets. The EU Transfer of Funds Regulation (TFR) requires that when virtual asset service providers (CASPs) transfer digital assets exceeding 1,000 euros to personal wallets, they must verify whether the address is actually owned or controlled by the customer.

Hong Kong does not prohibit personal wallets themselves. Instead, licensed exchanges are required to assess money laundering risks when transferring assets to and from personal wallets and to conduct additional verification and enhanced transaction monitoring if necessary.

If such a system is introduced domestically, the AML responsibilities of exchanges may also expand. This is because they may need to distinguish whether the address a customer wishes to withdraw to is a general personal wallet, a foreign exchange, or a DeFi smart contract, and assess the risk level of that address or protocol.

In particular, DeFi is characterized by complex transaction paths. When assets withdrawn from an exchange to a personal wallet pass through decentralized exchanges (DEX), lending protocols, bridges, etc., and then return to the exchange, the exchange may need to analyze on-chain data to check if they are linked to hacked funds or sanctioned addresses.

DeFi Regulation. Source=AI generated

Proposal for Function-Based Regulation in Korea

In Korea, research has suggested that DeFi should not be viewed uniformly as a single regulatory target but should be differentiated by function. Choi Ja-yu, a senior examiner at the Financial Supervisory Service, recently proposed in a paper titled 'Responsibility Attribution Structure of Decentralized Finance' that it is necessary to divide responsibilities based on 'control' and 'intermediation' rather than merely formal decentralization.

In the paper, control refers to the authority to change, stop, block, or bypass transactions. This includes influence over management keys, upgrade authority, domains, and application programming interfaces (APIs). Intermediation refers to the extent to which transactions are organized and mediated, such as token listing composition, transaction support and recommendations, transaction path design, and fee collection.

Accordingly, services with high control and intermediation can be subjected to regulations equivalent to those for existing virtual asset businesses. For front-end services with low control but high intermediation, obligations such as risk warnings and disclosure of token selection criteria can be imposed.

Conversely, if intermediation is low but control over risk structures is exercised through management keys, oracles, or bridges, technical infrastructure regulations such as security audits and disclosure of key information can be applied. Pure protocols with both low control and intermediation are suggested to be held accountable for individual actors rather than imposing traditional financial regulations directly.

The paper also proposed introducing a conditional safe harbor for fully decentralized systems. This would involve objectively verifying the relinquishment of management keys and upgrade authority, non-exclusivity of front-end, decentralization of oracles and bridges, and transparency of fee structures before recognizing certain regulatory exemptions.

Examining Regulatory Targets and Responsibility Scope

Ultimately, the common issue emerging from both overseas and domestic research is not whether to block access to DeFi, but rather 'who controls what and at what point regulations will apply.' If discussions on DeFi regulation are to be seriously undertaken domestically, it will be essential to determine how to distinguish between fully decentralized systems and services that effectively have operators, as well as how far exchanges will be responsible for verifying personal wallets, conducting on-chain analysis, and assessing DeFi risks. The key issue will likely be to finely delineate regulatory targets and responsibility scopes rather than simply deciding on access restrictions.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.