CertiK joins LF Decentralized Trust as regulation tightens

At a glance

What this is: CertiK’s move into LF Decentralized Trust frames decentralized infrastructure as a standards and governance issue, not just a code-security issue, with regulation now shaping how enterprise blockchain systems are built and reviewed.

Why it matters: IAM, PAM, NHI, and broader security teams should read this as a sign that decentralized platforms are being pulled into enterprise governance expectations, where assurance, accountability, and control design matter as much as technical implementation.

By the numbers:

• Related fines and settlements topped $900 million in H1 2025 alone, according to CertiK.
• CertiK says it has secured more than $600 billion in digital assets across more than 5,000 enterprise engagements.

Context

This announcement sits in the space where blockchain security meets enterprise governance. The practical problem is no longer whether decentralized systems are technically possible, but how security, assurance, and regulatory expectations are applied when the infrastructure is shared, open, and increasingly used in regulated settings.

For identity and security practitioners, the important signal is that decentralized infrastructure is being treated more like enterprise control surface than experimental technology. That brings lifecycle, trust, and accountability questions into view, including how access, verification, and auditability are governed across open ecosystems.

The article’s own data points show why this matters now: regulation is tightening, and security assurance is moving from optional to expected. That is a typical trajectory for technologies that cross from innovation into regulated operational use.

Key questions

Q: What governance gap appears when blockchain infrastructure moves into regulated enterprise use?

A: The main gap is that technical correctness is not the same as governed trust. Once blockchain infrastructure supports regulated business activity, teams need evidence of control ownership, auditability, and policy alignment across code, deployment, and operations. Without that, the platform may function but still fail enterprise assurance tests.

Q: Why does regulatory pressure change how digital asset security is managed?

A: Because compliance becomes part of the operating model rather than an external review. If audits, AML controls, and prudential expectations shape approval decisions, security teams must prove that access, key handling, and transaction controls are traceable throughout the lifecycle. That shifts the focus from isolated hardening to ongoing governance evidence.

Q: What are the signs that non-human trust objects are not being governed properly?

A: Common warning signs include unclear ownership of signing keys, weak revocation processes, inconsistent rotation, and automation accounts that cannot be tied back to a control owner. In decentralized environments, those gaps show up quickly because the trust layer is built on machine-held credentials rather than human review alone.

Q: Should organisations treat open-source blockchain infrastructure differently from proprietary platforms?

A: Yes, but not because open source is inherently riskier. The difference is that open, standards-based infrastructure demands stronger evidence of shared governance, reproducible assurance, and clear control accountability across participants. That is especially important when regulated workloads and non-human identities depend on the platform.

Technical breakdown

Why decentralized infrastructure becomes a governance problem

Decentralized systems spread trust across code, infrastructure, and multiple participants rather than a single centrally managed platform. That reduces reliance on one operator, but it also creates governance gaps around assurance, change control, and accountability. In enterprise settings, the challenge is not only whether the code works, but whether the surrounding controls make the system auditable, policy-aligned, and acceptable to regulators or internal risk owners.

Practical implication: assess decentralized platforms as governed control environments, not just as software deployments.

How standards-based trust changes assurance in blockchain systems

Standards-based infrastructure gives enterprises a shared way to evaluate security properties across ecosystems instead of treating each deployment as a one-off. That matters when systems span finance, supply chain, healthcare, and telecom, because policy teams need repeatable assurance evidence, not vendor-specific claims. In practice, this shifts emphasis toward open controls, documented review processes, and evidence that security checks can be reproduced by independent parties.

Practical implication: require repeatable assurance artefacts before decentralized components are approved for regulated use.

Where compliance pressure meets digital asset security

The regulatory layer in digital assets now affects design decisions as directly as threat models do. If audits are required or indirectly required in most jurisdictions, then security review becomes part of the operating model, not a post-build activity. That is especially relevant where privileged workflows, custodial functions, or transaction integrity depend on non-human identities, keys, or signing processes that must be traceable and revocable.

Practical implication: align key management, audit evidence, and access controls to the jurisdictional obligations that govern the platform.

NHI Mgmt Group analysis

Open-source decentralized infrastructure is now an assurance problem, not just an engineering choice: once regulated enterprises depend on shared blockchain infrastructure, governance expectations move upstream into architecture and controls. The decisive question becomes whether the ecosystem can produce repeatable evidence of trust, not whether it can scale technically. Practitioners should treat infrastructure openness as a control design requirement.

Regulatory pressure is turning digital asset security into a lifecycle discipline: the article’s strongest signal is that audits and compliance obligations are no longer edge cases in digital assets. That creates a permanent requirement for evidence, review, and accountability across code, deployment, and operations. Security teams should expect assurance to be demanded throughout the system lifecycle, not only at launch.

Non-human trust objects remain central to this domain: wallets, signing keys, service credentials, and automation accounts are the practical trust layer in decentralized systems. When those identities are not governed with the same rigor as human access, the result is brittle assurance even if the underlying protocol is sound. Practitioners should bring NHI governance into blockchain control design early.

AML and prudential expectations are pulling blockchain closer to mainstream financial governance: the article shows that the category is being measured against institutional standards for segregation, liquidity, and compliance. That means identity, entitlement, and audit controls now sit alongside transaction security as board-relevant issues. Teams should reframe decentralized infrastructure as a regulated operating environment.

Standards-driven ecosystems will outlast tool-centric narratives: LFDT’s model reflects where the market is heading, toward shared infrastructure and common governance patterns. That favours organisations that can align control objectives across participants instead of relying on isolated implementation decisions. Practitioners should invest in control portability, not just deployment speed.

What this signals

Blockchain governance is converging with mainstream security governance: as decentralized systems enter regulated enterprise environments, practitioners should expect the same scrutiny applied to any other shared control plane. The key programme question is whether audit evidence, identity governance, and responsibility boundaries are defined before the platform is adopted.

NHI governance now belongs in digital asset architectures: signing keys, wallets, and automation accounts are operational identities, even when the industry does not label them that way. Teams that fail to treat them as governed trust objects will struggle to prove revocation, accountability, and segregation when regulators or auditors ask.

For security leaders, the practical signal is clear: choose control models that can survive external review. If a blockchain platform cannot produce repeatable evidence for access, traceability, and assurance, it is not ready for regulated production use.

For practitioners

• Map decentralized workloads to control owners Assign ownership for security, compliance, and audit evidence across the full lifecycle of blockchain-related systems, including development, deployment, and operating governance.
• Treat keys and signing processes as governed non-human identities Inventory wallets, signing keys, service credentials, and automation accounts so their issuance, rotation, and revocation can be controlled and reviewed.
• Build repeatable assurance evidence into platform selection Ask for audit artefacts, security review records, and standards alignment evidence before approving decentralized infrastructure for regulated workloads.
• Align blockchain controls to regulatory obligations Translate jurisdiction-specific audit, AML, and prudential requirements into explicit control checks for access, segregation, and traceability.

Key takeaways

• CertiK’s move into LF Decentralized Trust reflects a broader shift: blockchain security is becoming a governance and assurance issue as much as a code-security issue.
• The article points to a tightening regulatory environment in which audits, AML pressure, and prudential expectations increasingly shape how digital asset systems are built and reviewed.
• Practitioners should treat keys, signing workflows, and other non-human trust objects as governed assets if they want decentralized infrastructure to pass enterprise scrutiny.

Key terms

• Decentralized Infrastructure: Infrastructure built to distribute trust and operation across multiple participants rather than a single central operator. In practice, this shifts assurance from one platform owner to a shared control environment where governance, auditability, and accountability must be designed into the ecosystem.
• Digital Asset Regulation: Digital asset regulation is the legal and supervisory framework that governs how virtual assets are issued, exchanged, held, and monitored. It typically covers licensing, custody, market conduct, consumer protection, anti-money laundering controls, and reporting duties for firms operating in regulated financial ecosystems.
• Non-Human Trust Object: A machine-held credential or identity artifact that enables a system, automation workflow, or service to act with authority. Wallets, signing keys, service accounts, and similar objects need lifecycle governance because their compromise or misuse can undermine both security and compliance.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It is a practical fit for practitioners who need to govern trust objects that underpin regulated systems.