FATF draws a line between the code and the human or organizational party controlling the service. The software itself is not treated as a VASP, but the owner or operator may be if they profit from the service, set rules, influence operations, or maintain ongoing control. That distinction matters because compliance duties attach to accountable parties, not to autonomous code.
Code may be autonomous, but accountability is not
The key distinction in FATF’s treatment is between a protocol’s software and the party that designs, controls, promotes, or economically benefits from it. If no one is exercising meaningful control, the code itself is not the regulated actor. Once a person or organisation is effectively steering the service, FATF can treat that party as the accountable operator for AML/CFT purposes.
That distinction is the practical hinge in the analysis: compliance obligations attach where governance, control, or profit-taking exist, not merely where a smart contract or application happens to run. The software can execute rules, but it cannot register customers, assess suspicious activity, or answer for ongoing oversight.
This is why the same protocol can look very different depending on who maintains it. A fully decentralised deployment with no controlling party sits in a different bucket from a protocol where a team sets parameters, upgrades code, curates interfaces, or selectively whitelists access. FATF’s focus is the human or organisational layer that can actually influence outcomes.
- Code that merely operates is treated as technology.
- A party that profits from the service or shapes how it runs may be treated as the accountable operator.
- Ongoing control, not branding, is what makes the difference.
Why the operator test matters for DeFi compliance
In practice, FATF’s operator test prevents firms from assuming that decentralised architecture alone removes legal responsibility. If a project has a development team, admin keys, upgrade authority, governance leverage, or fee capture tied to active control, regulators may look through the protocol and assess the party behind it.
That matters because the compliance burden is tied to who can change the service, influence access, or benefit from activity. When those levers exist, the operator may need to think in terms of onboarding controls, monitoring, sanctions exposure, and suspicious-activity escalation, even if the user-facing product feels non-custodial.
The point is not that every DeFi protocol becomes a VASP. It is that the more a project resembles a managed service with real control points, the less credible it is to argue that the software is acting on its own. For the FATF view, function outweighs labels.
That is consistent with FATF’s emphasis on virtual asset service accountability in the FATF Recommendations, AML and KYC framework, which ties obligations to the entity able to perform control functions.
What practitioners should look for in the control boundary
The useful practitioner question is not “is this DeFi?” but “who can actually exert meaningful control over the service?” If the answer includes upgrade authority, fee-setting power, admin permissions, governance dominance, interface control, or selective participation rules, the control boundary is likely to be regulatory relevant.
When reviewing a protocol, map the real operating model, not the whitepaper language. A protocol may present as autonomous while still having a central team, privileged multisig, external host, or dependency chain that can alter execution, restrict users, or shape flows. That is the kind of fact pattern FATF is concerned with.
For background on the broader identity and control issues that arise when software depends on accountable operators, NHIMG’s Ultimate Guide to NHIs is useful for the governance, lifecycle, and visibility lens. For protocol-level abuse paths that can follow from compromised or over-privileged operational control, see Codefinger AWS S3 ransomware attack.
Practitioner takeaway: Treat “decentralised code” as an implementation detail, not a compliance conclusion; the decisive question is whether a person or organisation can still steer the service in a way that creates accountable control.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | DeFi operator control creates governance and legal exposure that should be risk-managed. |
| Recommendation — Document who can change, benefit from, or operate the protocol under your risk governance model. | ||
| CIS Controls v8 | 6 — Access Control Management | Operator authority depends on who can administer the protocol and related systems. |
| Recommendation — Review and remove unnecessary administrative access to protocol infrastructure and control planes. | ||
| MITRE ATT&CK | T1078 — Valid Accounts | Operator-controlled accounts and keys can become the path to unauthorized protocol control. |
| Recommendation — Hunt for misuse of privileged operator accounts and keys across protocol management surfaces. | ||
| NIST SP 800-63 | IAL1 — Identity Assurance Level 1 | Where operator accountability is at issue, identity proofing and assurance support who is responsible. |
| Recommendation — Apply assurance appropriate to the operator role before granting control over protocol functions. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Secrets and Credential Exposure | DeFi control often depends on operational keys and secrets that can shift accountability and risk. |
| NHI-03 — Excessive Permissions | Operator power often arises from over-privileged admin paths in protocol infrastructure. | |
| Recommendation — Inventory and protect operator keys, tokens, and admin secrets tied to protocol control. Constrain protocol admins to the minimum access needed to run and govern the service. | ||
Related resources from NHI Mgmt Group
- What is the difference between software supply chain risk and NHI risk?
- What is the difference between SaaS supply chain security and software supply chain security?
- What is the difference between code review and access review in AI-generated software?
- What is the difference between authentication protocol choice and access governance?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on September 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org