FATF DeFi Report 2026: 12 Control Indicators Mapped to Code
Quick answer. The FATF's July 2026 DeFi report says its Standards apply to any person with “control or sufficient influence” over a DeFi arrangement. It lists 12 indicators, seven onchain and five offchain, and is non-binding.
Video transcript
DeFi software is not a VASP, but the people who control it can be. The FATF's July 2026 report lists twelve indicators of control.
The report is non-binding, and it documents a gap. Of 142 jurisdictions surveyed, only 26 had assessed DeFi risks.
It sorts DeFi into three categories. Centralized arrangements, and those whose controllers cannot be readily identified, are in scope. Truly decentralized ones are not.
Seven indicators are onchain. Upgradeability, parameter setting, oracle control and critical infrastructure map to proxy admins, setters, feed functions and deployer keys.
The rest follow the money, the access and the votes: fee flows, allowlist admins, and concentrated voting power.
Five are offchain: signers and upgrade key holders, front ends, corporate entities, roadmap control, and branding.
Disclosed emergency functions kept for safety may or may not indicate control. Undisclosed or unilateral access held by specific persons often does.
The report asks protocols to document who holds control. Build that inventory from chain state. Counsel decides what the facts mean, the inventory makes sure they are right.
Guardian maps every role, key and signer behind your funds. Read the full article, or book a system review at guardian.security.
In July 2026 the Financial Action Task Force (FATF) published its Targeted Report on Regulatory Challenges from Decentralised Finance.
It answers when a DeFi arrangement has someone in control, so that the FATF Standards for virtual asset service providers (VASPs) apply.
The software is not a VASP, but the persons who control or sufficiently influence it can be.
Most of the 12 indicators of control sit in contract storage, multisig configurations and corporate records. A team can inventory them before a regulator, bank or exchange asks.
This article explains the technical and security side of the FATF's Targeted Report on Regulatory Challenges from Decentralised Finance. It is not legal advice; confirm how it applies to you with counsel.
What the Report Is
The report says that, as with all FATF Targeted Reports, it is non-binding (paragraph 12).
It updates and complements the DeFi analysis in the FATF's 2021 Updated Guidance on virtual assets and VASPs (paragraph 11). Jurisdictions keep discretion over the criteria they use to find a controller (paragraph 9).
It also documents a gap. Of the 142 jurisdictions that answered the FATF's 2026 survey, only 26 had assessed the risks linked to DeFi (paragraph 20).
Only two had licensed or registered a DeFi arrangement.
Who Counts as a Controller
Control is the ability to take key decisions within the arrangement (paragraph 34).
A controller is any person who, in practice, can determine or materially influence key protocol operations or the delivery of services, or who derives significant economic benefit from them.
Broadly distributed returns to token holders who exercise no control do not count. The report then sorts arrangements into three categories (paragraph 7).
| Category | What it means | In scope? | Consequence |
|---|---|---|---|
| Centralized | Identifiable controllers or persons with sufficient influence, even if marketed as decentralized | Yes: “should always be regulated” | Licensing or registration (paragraph 45) |
| Controllers not readily identified | Control exists, but the controllers cannot be readily identified | Yes | Where regulation cannot be applied, treated in practice as unregulated |
| Truly decentralized | No person maintains control or exercises sufficient influence | No | Handled through stablecoin issuers, VASP ramps, front ends and financial institutions (paragraph 43) |
Supervisors are told not to rely only on what an arrangement says about itself, and to analyze its control structure independently (paragraph 42).
Paragraph 41 names three scenarios in which control could be retained despite a claim of decentralization: nominal DAO transfers, token concentration and delegation.
The 12 Indicators, Mapped
Paragraph 37 lists the indicators as indicative and non-exhaustive. The right-hand column is our mapping to what an inventory should capture.
Seven onchain indicators
| Para. 37 | Indicator | What the FATF says | Functions and roles to inventory |
|---|---|---|---|
| i | Upgradeability | Upgradable contracts, proxy patterns or kill switches, and back-door privileges | Proxy admins, beacon owners, kill functions, pause and emergency roles |
| ii | Parameter setting | Unilateral rights to set risk limits, fees, rewards or collateral factors | Role-gated setters for fees, caps, collateral and rates; bounds in code |
| iii | Oracle control | Selecting or changing feeds, including manual pricing or overriding oracle inputs | Feed and registry setters, fallback configuration, manual price functions |
| iv | Critical infrastructure | Exclusive or dominant control of deployment keys, registries, keepers or settlement contracts | Deployer keys, factory and registry owners, keeper and executor allowlists |
| v | Fee flows | Addresses receiving fees, MEV rebates, liquidation penalties or token emissions | Fee recipient and treasury setters, and who controls each receiving address |
| vi | Gatekeepers | Persons who administer permissioned pools, functions or whitelists | Allowlist and access-gate admins, KYC gate configuration |
| vii | Voting power | Concentrated holdings, influential delegated blocs, or low participation | Governor and timelock settings, top holders and delegates |
Five offchain indicators
| Para. 37 | Indicator | What the FATF says | Evidence to gather |
|---|---|---|---|
| viii | Custody and operations | Signatories for governance or admin decisions, and upgrade key holders | Multisig owner lists and thresholds, signer identities and affiliations |
| ix | Front ends | Control over web front ends, mobile apps and tools such as wallets | Domain registrant, DNS and hosting accounts, app store accounts |
| x | Corporate entities | Companies, foundations or labs that employ core contributors or hold IP | Entity chart, service agreements, IP ownership, treasury mandates |
| xi | Development and roadmap | Persons who set priorities, control releases, or run indexers and automation | Repository admins and release rights, who runs keepers and indexers |
| xii | Branding | Control of official branding, messaging, documentation and risk disclosures | Trademark and domain ownership, docs site, official social accounts |
Several controllers running different components does not dilute anyone's obligations (paragraph 38).
Emergency Powers Versus Back Doors
Under indicator (i), transparently disclosed emergency functions kept for safety “may or may not, in themselves, indicate control”. Undisclosed or unilateral access rights held by specific persons “often indicate control”.
Paragraph 69 notes that many protocols rely on admin key holders and multisig participants to pause contracts and stop an attacker. It asks law enforcement to identify and engage those people in advance.
Our recommendations, not the FATF's:
- Disclose every emergency function, who holds it, and the threshold needed to use it.
- Keep pause powers narrow: able to stop activity, not to move funds or replace code.
- Hold pause and upgrade authority in separate keys or roles.
- Log and publish every use, with the reason.
What the FATF Asks of Protocols
Its recommendations say centralized arrangements, including those whose controllers cannot be readily identified, should fully comply with Recommendation 15. All DeFi arrangements should:
- name a point of contact for law enforcement and financial intelligence units;
- keep documentation for competent authorities on control and decision-making structures, identifying the persons with operational influence, governance authority or protocol-level controls;
- conduct regular audits related to protocol cybersecurity, and monitor for suspicious trends and potential exploits.
Truly decentralized arrangements should explain the features that substantiate the claim.
For jurisdictions, paragraph 51 says they may consider making smart contract audits mandatory for certain arrangements. It points particularly to those handling significant user funds, using complex cross-chain bridges, or relying on multisig administrative keys and proxy patterns.
Build a Control Inventory
The documentation recommendation is, in effect, a control inventory. Build it from chain state and records, date it, and keep it current:
- Contracts and roles: every contract on every chain, each privileged role and its holder, read at a recorded block.
- Holder types: EOA, multisig (threshold and signers), timelock (delay and who can bypass it) or governor.
- Parameters and oracles: every setter, the bounds the code enforces, and any manual price or override function.
- Economic flows: every address receiving fees, penalties or emissions, and who controls it.
- Access gates: allowlists and who administers them.
- Governance: token distribution, top holders and delegates, who submits proposals, turnout.
- Offchain control: signer identities, front-end operators, entities, release rights, brand owners.
- Emergency powers: what exists, how it is disclosed, and every past use.
Counsel decides what the facts mean; the inventory makes sure the facts are right.
The same inventory answers the SEC's central party test, the FCA's draft PERG 18 and the others in decentralization tests compared.
How Guardian Maps Control
Guardian's system architecture review is an hour with a Guardian engineer on your live contracts, the services that can reach them and who holds the keys that can change either.
Risk Monitoring keeps the inventory current: who holds owner, pauser, upgrader and parameter rights, and drift from the reviewed configuration.
In Managed Security, Guardian maps every path to a protocol's funds, from the contracts that hold them to the roles, keys, signers and multisigs behind each one.
Frequently Asked Questions
Does the FATF DeFi report create new legal obligations?
No. The report says that, as with all FATF Targeted Reports, it is non-binding. Obligations arise only when a jurisdiction puts them into national law or supervisory practice.
Is a DeFi protocol a VASP under the FATF Standards?
The software is not: the Standards do not apply to underlying software or technology. They apply to persons with control or sufficient influence over a DeFi arrangement, and to persons who provide or actively facilitate VASP services.
What are the FATF's 12 indicators of control in DeFi?
Seven onchain: upgradeability, parameter setting, oracle control, critical infrastructure, fee flows, permissioned access and voting power. Five offchain: signatories and upgrade key holders, front ends, corporate entities, development and roadmap, and branding.
Sources
- FATF: Targeted Report on Regulatory Challenges from Decentralised Finance (July 2026), official page
- Diritto Bancario: hosted copy of the FATF report PDF (July 2026), the copy read for this article because fatf-gafi.org blocks automated access
- A&O Shearman FinReg: FATF report on regulatory challenges from decentralised finance (21 July 2026)
- Guardian: System architecture review
- Guardian: Risk Monitoring and Ratings
- Guardian: Managed Security
Map who controls your protocol before someone else does
Guardian builds the role, key and signer inventory the FATF indicators turn on, from chain state rather than documentation.