Swiss DeFi Regulatory Approach: How FINMA Treats Decentralised Finance

Decentralised finance presents a fundamental challenge to financial regulation: how do you regulate an activity when there is no identifiable entity to regulate? Switzerland, through FINMA’s pragmatic approach, has developed a position that acknowledges the novel characteristics of DeFi whilst maintaining the core regulatory objectives of investor protection, market integrity, and financial system stability.

The Regulatory Challenge of Decentralisation

Traditional financial regulation operates on the premise that identifiable entities — banks, brokers, exchanges — perform financial functions and can be held accountable for compliance. DeFi protocols, in their purest form, operate as autonomous smart contracts on public blockchains, with no corporate entity, no employees, and no geographic nexus.

This creates a genuine regulatory gap. A decentralised exchange that automatically matches trades through an automated market maker algorithm, governed by token holders distributed globally, does not fit neatly into existing regulatory frameworks designed for centralised intermediaries.

FINMA has recognised this tension and adopted an approach that focuses on identifying and regulating the human actors within the DeFi ecosystem, rather than attempting to regulate the protocols themselves.

FINMA’s Position

Substance Over Label

FINMA’s fundamental position is that the label of decentralisation does not exempt an activity from regulation if it is substantively equivalent to a regulated financial service. A protocol that performs the same economic function as a securities dealer, exchange, or fund manager may trigger the same regulatory requirements, regardless of its technical implementation.

This substance-over-form approach means that FINMA evaluates DeFi activities based on their outcomes rather than their architecture. If a protocol enables trading, lending, or investment management, the applicable regulatory framework may apply to the identifiable parties involved in operating, governing, or distributing access to that protocol.

Identifying Responsible Parties

Where DeFi protocols involve identifiable participants who exercise control or influence, FINMA may hold those participants accountable for compliance:

Protocol developers — Teams that develop, deploy, and maintain smart contracts may be considered responsible for the activities those contracts enable, particularly before meaningful decentralisation is achieved.

Governance token holders — Participants who hold governance tokens and exercise voting power over protocol parameters may be considered to have control over the protocol’s operations. Concentrated governance control is more likely to trigger regulatory obligations than truly distributed governance.

Front-end operators — Entities that operate web interfaces, mobile applications, or other access points for DeFi protocols are clearly identifiable and may face regulatory obligations as financial intermediaries, even if they do not control the underlying protocol.

Liquidity providers — In some circumstances, professional liquidity providers who contribute significant capital to DeFi protocols may be considered to be operating a financial business.

Truly Decentralised Protocols

FINMA acknowledges that some protocols may achieve a degree of decentralisation where no single party or identifiable group exercises meaningful control. In these cases, the application of traditional regulatory frameworks is challenging, and FINMA has not attempted to assert jurisdiction over truly autonomous protocols.

However, FINMA has indicated that this assessment is stringent — many protocols that claim decentralisation retain significant centralised elements including admin keys, governance concentration, or identifiable development teams.

AML Obligations in DeFi

Financial Intermediation

The Anti-Money Laundering Act applies to financial intermediaries — entities that professionally facilitate financial transactions on behalf of others. FINMA has clarified that DeFi activities can constitute financial intermediation when:

• An identifiable entity operates a front-end or interface
• A service provider facilitates customer access to DeFi protocols
• A protocol operator retains control over user funds or transaction execution

In these cases, standard AML compliance obligations apply, including customer due diligence, transaction monitoring, and suspicious activity reporting.

Self-Hosted Interactions

When users interact directly with DeFi smart contracts through self-hosted wallets, without the involvement of a financial intermediary, the AML framework’s application is limited. There is no intermediary to impose KYC requirements, and the pseudonymous nature of blockchain transactions complicates monitoring.

This gap is recognised internationally and is driving discussions about potential regulatory responses, including on-chain identity solutions and protocol-level compliance mechanisms.

Specific DeFi Activities

Decentralised Exchanges

DEX protocols that operate through automated market makers raise several regulatory questions:

• Exchange regulation — Does the DEX constitute a trading venue requiring a licence?
• Market making — Do liquidity providers require market maker authorisation?
• AML compliance — Are there obligations for transaction screening and customer identification?

FINMA’s position depends on the degree of centralisation. A DEX with identifiable operators, admin controls, and a front-end interface is more likely to face regulatory scrutiny than a fully autonomous protocol with no identifiable points of control.

Lending and Borrowing

DeFi lending protocols that accept deposits and extend credit may trigger banking regulation. If the protocol involves an identifiable operator who accepts customer funds and deploys them for lending, this activity may constitute deposit-taking or credit provision requiring a banking licence.

Peer-to-peer lending through autonomous smart contracts, where users interact directly without an intermediary, presents a different regulatory picture. However, professional lending activity — whether conducted through traditional or DeFi channels — may trigger financial intermediary obligations.

Staking and Yield

Staking services and yield generation through DeFi protocols are assessed based on the custody and control arrangements. Where an identifiable service provider manages customer assets and deploys them into DeFi protocols for yield, that provider faces the same regulatory obligations as any custodian or asset manager.

Self-directed participation in DeFi yield opportunities, without the involvement of an intermediary, falls outside the current regulatory perimeter.

Tokenised Securities in DeFi

DeFi protocols that facilitate trading in tokenised securities raise particular regulatory concerns, as securities regulation is well-established and does not contain exemptions for decentralised implementation. Any protocol enabling the trading of assets classified as securities may trigger securities dealer or trading venue regulation.

Institutional DeFi Participation

Regulated Access

Swiss financial institutions interested in DeFi participation must navigate both their own regulatory obligations and the regulatory status of the protocols they interact with. Regulated institutions cannot simply interact with unregulated DeFi protocols without conducting due diligence and risk assessment.

Institutional DeFi access typically involves:

• Protocol due diligence — Assessment of smart contract security, governance structure, and regulatory risk
• Risk management — Compliance tools and processes for managing DeFi-specific risks
• Custody integration — Secure custody solutions that support DeFi interactions whilst maintaining institutional-grade security
• Reporting — Accurate tax reporting and regulatory disclosure of DeFi activities

Permissioned DeFi

A growing segment of the DeFi market is developing permissioned protocols that incorporate identity verification and compliance controls. These protocols restrict participation to verified entities, addressing AML concerns whilst maintaining the operational benefits of decentralised infrastructure.

Swiss institutions are well-positioned to participate in permissioned DeFi, as their regulatory status and compliance infrastructure enable them to meet the identity and qualification requirements imposed by these protocols.

Cross-Border Considerations

EU MiCA and DeFi

The European Union’s MiCA regulation does not directly address DeFi protocols, leaving a regulatory gap that is expected to be addressed in future legislative revisions. Swiss entities operating DeFi services accessible to EU users must monitor developments in EU DeFi regulation and assess potential compliance implications.

Global Regulatory Convergence

International regulatory bodies, including IOSCO and the Financial Stability Board, are developing frameworks for DeFi regulation that may influence Swiss regulatory practice. FINMA participates in these international discussions and may adjust its approach in response to emerging global standards.

Practical Guidance

For Protocol Developers

Swiss-based DeFi protocol development teams should:

1. Assess whether their protocol triggers financial market regulation based on its economic function
2. Evaluate the degree of decentralisation and whether identifiable parties retain control
3. Engage with FINMA early if there is uncertainty about regulatory classification
4. Consider implementing compliance features that may be required as regulation evolves
5. Document governance structures and decision-making processes

For Institutional Users

Swiss institutions engaging with DeFi should:

1. Conduct thorough due diligence on each protocol, including smart contract audits and governance assessment
2. Ensure their own regulatory compliance framework addresses DeFi-specific risks
3. Implement monitoring tools capable of tracking DeFi transactions
4. Maintain comprehensive records for tax and regulatory reporting
5. Assess the regulatory risk of protocol interactions, particularly for protocols with uncertain regulatory status

For Service Providers

Entities providing DeFi-related services (front-end hosting, API access, analytics, advisory) should:

1. Evaluate whether their services constitute financial intermediation
2. Implement AML compliance measures appropriate to their role
3. Consider SRO membership or FINMA licensing if financial intermediation obligations apply
4. Monitor regulatory developments that may affect their service scope

Outlook

Switzerland’s DeFi regulatory approach is necessarily evolving as the technology and market mature. Several developments are likely:

• Greater regulatory clarity on specific DeFi activities and the obligations they trigger
• Development of DeFi-specific regulatory tools and compliance frameworks
• International coordination on DeFi regulatory standards
• Growth of permissioned and compliance-integrated DeFi protocols
• Potential new regulatory categories specifically addressing DeFi activities

The Swiss approach — pragmatic, substance-focused, and open to dialogue — provides a constructive framework for the continued development of DeFi within appropriate regulatory boundaries. For market participants, understanding this framework is essential for navigating the intersection of decentralised technology and centralised regulation.

Donovan Vanderbilt is a contributing editor at ZUG TRADING, a digital asset trading and exchanges intelligence publication by The Vanderbilt Portfolio AG, Zurich. His analysis covers institutional market structure, OTC liquidity, and regulatory developments across Swiss and global digital asset markets.