Enforcement reality
Neither regulator has brought an enforcement action against a DeFi protocol as such. Both have acted against identifiable operators. FINMA has issued cease-and-desist orders and liquidated companies that operated front-ends and held keys while describing themselves as decentralised.1 MAS has refused licences and issued warnings to Singapore-based teams. In the United States, the Commodity Futures Trading Commission's 2023 action against the Ooki DAO and the Department of Justice's 2024 prosecution of the Tornado Cash developers have shown that governance token holders and developers can be reached. Both Swiss and Singapore regulators follow those developments closely.2 A client who relies on decentralisation as a shield should be told that the shield holds only if the facts of control support it. Those facts will be examined by a prosecutor with access to the chain, the code repository and the governance forum.
Notes
- FINMA enforcement practice is recorded in its annual Enforcement Reports (2021–2025); individual cases involving purported DeFi operators are discussed in Part E, Chapter IX and Part H, Chapter IV. ↩
- CFTC v Ooki DAO, N.D. Cal., default judgment of 8 June 2023 (DAO held liable as an unincorporated association); United States v Roman Storm, S.D.N.Y., indictment unsealed 23 August 2023. Part H, Chapter I compares the Swiss criminal-law position. ↩
For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of October 2026.