Yesterday the Technology Advisory Committee (TAC) of the U.S. Commodity Futures Trading Commission (CFTC) published a 79-page report on policy recommendations for Decentralized Finance (DeFi). This paper does not represent the opinions of the CFTC because TAC participants are drawn from the DeFi sector, traditional finance (TradFi) and academia. Most press coverage stated that the CFTC demands that identity be implemented in DeFi. Identity was one aspect of an expansive report.
The identity headline perpetuates the myth that for DeFi protocols to be compliant, they simply need to implement know-your-client (KYC) procedures. That may protect against illicit finance, but that is only one of many DeFi risks and regulatory objectives. Others include:
- Protecting consumers
- Promoting market integrity
- Ensuring individual protocols don’t take too much risk
- Mitigating financial stability risks
- Expanding access to affordable financial solutions
- Encouraging innovation in the U.S.
In 2023, several regulators published papers on the topic of DeFi. Perhaps because of the industry’s involvement, this one is rather good. Despite the DeFi’s sector participation, it doesn’t pull any punches about the risks of decentralized finance and challenges in regulating it.
A spectrum of DeFi decentralization
One of the more novel aspects is the report suggests a model to measure the degree of decentralization of a DeFi protocol. It identifies both functional and technology dimensions. However, most DeFi protocols – including those that use so-called DeFi theatre – would score well on the technology front. It is the functional dimension that seems most relevant.
These criteria include:
- Access – particularly the nature of permissionless networks
- Development – are the software engineers working at a single firm?
- Governance – decisions made by core developers or passive token holders?
- Balance sheets – distribution of beneficial ownership rights to assets in the DeFi project
- Operations – one vendor or many?
However, most regulations are technology agnostic. So why does a spectrum of decentralization matter?
“Identifying these dimensions can help illuminate the diversity of DeFi, along with the perils of attempting to craft a single, all-encompassing definition,” the paper states. It points to the challenge of having a bright line rule of ‘sufficiently decentralized.’
“Using decentralization to enhance operational resilience in the face of cyber threats and malicious actors may be desirable from a policy perspective, using it to evade responsibility for regulatory compliance is most certainly not.”
Later, the paper explores policy issues. Some aspects of most DeFi projects fall within regulatory perimeters and enforcement is possible. However, that’s not always the case, so policymakers might want to consider expanding the regulatory perimeter. That might include drawing in actors at the network, protocol, and governance layers. Before doing so, the Committee suggests considering whether new regulations are feasible and practical and should perform a cost-benefit analysis of their usefulness based on the degree of risk. Otherwise, there’s the issue of inhibiting innovation.
Other DeFi policy recommendations
Another key recommendation is that regulators map the sector. That includes mapping service providers within different DeFi projects and mapping counterparty exposures. Given the risk of contagion, including for TradFi, mapping counterparties is an important task. However, it’s also tricky given the pseudo-anonymous nature of DeFi and the degree of interconnectedness resulting from composability.
On a constructive front, another policy recommendation is to ensure that DeFi lives up to its promise of expanded access and affordable services. The aim is to avoid a scenario where it “just imports all of the problems of centralization, exclusion, and poor visibility and security from earlier iterations of finance and the internet.”
