Calling a project decentralized does not remove liability. US courts have already treated DAOs as associations or partnerships, and in July 2026 FATF tied DeFi regulation to whoever controls a protocol or has sufficient influence over it. In the EU, fully decentralised services with no intermediary fall outside MiCA, but that is rare in practice. We go through the approaches of the US, the EU and FATF and who is liable for a decentralized project.
Checked on 21 October 2026. Rules and sources are current as of this date.
The key question: who controls
In its report of 21 July 2026 FATF says DeFi falls within Recommendation 15 where a natural or legal person exercises control or sufficient influence over the arrangement. Many projects claim decentralised governance, but centralised elements frequently persist in practice.
Indicators of control
Governance token concentration, administrative privileges, control over upgrades, significant economic benefits, influence over development and infrastructure.
Three categories
FATF distinguishes arrangements with identifiable controllers, arrangements centralised in practice where controllers are not readily identifiable, and truly decentralised ones. The FATF Standards apply to the first two.
Scale of the problem
According to the report, 132 of 143 responding jurisdictions have not applied the Standards to such arrangements, and only two of 142 have licensed or registered one in practice.
Where compliance cannot be achieved, FATF says financial institutions and VASPs should refrain from interacting with the arrangement. This affects a DeFi project’s access to the market.
US: Ooki DAO and Lido DAO
In the US, courts and regulators decide on the facts of governance. Two cases show what that looks like.
CFTC v. Ooki DAO
On 8 June 2023 the Northern District of California (Judge Orrick, No. 3:22-cv-05416-WHO) entered a default judgment. It held that on the pleaded facts Ooki DAO is an unincorporated association and a “person” under the Commodity Exchange Act, because through its token holders it controlled the protocol by voting tokens.
Penalty in Ooki
The penalty was $643,542 (three violations at $214,514 each), with a permanent injunction and takedown of the website.
Samuels v. Lido DAO
On 18 November 2024 the same court (Judge Chhabria, No. 23-cv-06492-VC) found it plausibly alleged that Lido DAO is a general partnership under California law: an association of persons carrying on a business for profit as co-owners.
Investors
Paradigm and Andreessen Horowitz stayed in the case because of alleged governance involvement. The court called Dragonfly a closer call but did not dismiss, citing its vote to sell itself more tokens. The claim against Robot Ventures was dismissed because the complaint did not allege governance participation.
The Lido ruling was made at the motion to dismiss stage: the court took the plaintiff’s allegations as true and the case moved on. It is not a final ruling on the merits. But the direction is clear: governance participation can become a basis for liability.
EU: MiCA and the question of full decentralisation
Recital 22 of MiCA says the Regulation applies to services performed, provided or controlled, directly or indirectly, by natural and legal persons, including when part of the service is performed in a decentralised manner. Where crypto-asset services are provided in a fully decentralised manner without any intermediary, they fall outside the Regulation.
A narrow exception
The exception covers only services provided in a fully decentralised manner. If the protocol has a team that runs the interface, upgrades or the token, the exception is unlikely to apply.
The link with FATF
The FATF control test and the MiCA wording “performed or controlled” lead to the same question: does the service have someone who influences it.
Legal forms: the DAO LLC
To give a DAO a clear legal status, some jurisdictions have passed special laws. They provide a form but do not answer licensing questions.
Wyoming
The DAO Supplement has been in force since 1 July 2021. The name must include “DAO”, “LAO” or “DAO LLC (limited liability company)”, and the articles must state that the company is a DAO. If the project is run by a smart contract, its public identifier is listed and the contracts must be updatable. The Act applies the general LLC Act to the extent not inconsistent with the chapter.
Marshall Islands
DAO Act 2022: a DAO is an LLC organised under the Act. The name must include “DAO LLC” and a local registered agent is required. The DAO is member-managed or algorithmically managed, the documents list the smart contract identifier, and if documents and code conflict the documents prevail. For-profit DAO interests may be tied to governance tokens. Beneficial ownership reports are due at formation and annually.
The common rule
Under both laws members by default owe no fiduciary duties but must act in good faith, unless the documents say otherwise. This is only a form: licensing and securities issues remain.
We will review your situation and propose a solution for your project.
DAO liability: roles and risks in a DeFi project
Risk depends on the role. Here is the basic picture, assessed through the indicators of control.
The development team
If the team has administrative privileges, control over upgrades or an economic benefit, that is the clearest indicator of control.
Token holders who vote
Active voting and token concentration can make a holder a participant in governance. For large holders the risk is higher.
Funds and investors
Public commitments to take part in governance, voting and influence on decisions were the basis of the claim in Lido.
Passive holders
Mere ownership and holding of tokens without governance participation was not at issue in Lido. The risk is lower, but the assessment depends on the facts.
Comparison of approaches
Based on the FATF report, court decisions, MiCA and the DAO laws.
| US (courts, CFTC) | EU (MiCA) | FATF (2026) | Wyoming and Marshall Islands | |
|---|---|---|---|---|
| Key test | Control through token voting, business for profit | Service fully decentralised, no intermediary | Control or sufficient influence | Registration as a DAO LLC |
| Who is liable | The DAO as association or partnership, active participants | Providers and persons who control the service | Persons with control | The LLC under general rules, with caveats |
| Role of tokens | Voting tokens that run the protocol | Not a test in itself | Governance token concentration as an indicator of control | Member rights; in the Marshall Islands interests may be tied to tokens |
| Status of the document | Court practice | Regulation | Recommendations, not law | State or national law |
What a project should do
Map control
Who can upgrade the contracts, who holds admin keys, how governance tokens are distributed. This is what regulators and courts look at.
Start hereChoose a form
If the project has a team, revenue and counterparties, settle the legal entity question before the first risks arise: a DAO LLC, a foundation or a wrapper entity for banking.
Separate the roles
The interface developer, the managing team and voting token holders carry different risks. Record this in documents and in communications.
Check your markets
If you serve EU clients, assess whether MiCA applies and take account of the FATF position. For the US, check whether anything points to activity requiring registration.
Assuming code replaces a legal entity: in Ooki the court relied on token voting. Relying on the MiCA exception without analysis: it covers only fully decentralised services. Ignoring token concentration: FATF treats it as an indicator of control. Confusing form with regulation: a DAO LLC does not exempt you from licensing. Underestimating public statements by investors about governance involvement.
The law looks not at what a project calls itself but at who runs it.The LegalBit team
FAQ
Can a DAO be liable?
Yes. In CFTC (US Commodity Futures Trading Commission) v. Ooki DAO the court held the DAO to be an unincorporated association and a “person” under the Commodity Exchange Act.
Are token holders liable?
In Lido DAO the court accepted the argument that a DAO can be a general partnership and that active participants in governance can be partners. That is a ruling at the motion to dismiss stage, not a final conclusion in the case.
Does MiCA take DeFi out of regulation?
Only services provided in a fully decentralised manner and without an intermediary. If someone controls the service, the exception is unlikely to apply.
Does a DAO need a legal entity form?
If the project has a team, revenue or outside counterparties, yes. Options: a DAO LLC in Wyoming or the Marshall Islands, a foundation, a wrapper entity.
Does a DAO LLC shield members from liability?
The DAO LLC laws set the form and apply the general LLC rules. They do not remove financial services or securities regulation, and the extent of protection must be checked under the law of the specific jurisdiction.
What does FATF expect from exchanges that deal with DeFi?
Where compliance cannot be achieved when interacting with a DeFi arrangement, FATF recommends that financial institutions and VASPs refrain from interacting with it.
See also: SAFT vs SAFE; Privacy Coins: Legal Status; Travel Rule for Crypto Businesses; P2E game token: security, payment instrument or in-game currency. Services: legal services for crypto projects.
- FATF: Targeted Report on Regulatory Challenges from Decentralised Finance (21 July 2026)
- CFTC v. Ooki DAO, No. 3:22-cv-05416-WHO (N.D. Cal., 8 June 2023): order
- CFTC: Press Release 8715-23
- Samuels v. Lido DAO, No. 23-cv-06492-VC (N.D. Cal., 18 November 2024): Order re Motions to Dismiss
- Regulation (EU) 2023/1114 (MiCA), recital 22
- Wyoming Decentralized Autonomous Organization Supplement (SF0038, W.S. 17-31-101 et seq.)
- Marshall Islands: Decentralized Autonomous Organization Act 2022
This is what we do
How we help projects with this topic:
