Decentralised finance (DeFi)

Financial services, such as trading, lending, borrowing, derivatives and yield products, implemented through smart contracts rather than provided solely by a conventional intermediary. DeFi protocols are often permissionless and do not routinely collect users' identity data, although some impose access restrictions or KYC requirements. Front-ends, wallet services and RPC providers may retain other information, such as IP addresses and records linking network activity to wallet addresses.

Many protocols have privileged roles that can pause contracts, upgrade code, change parameters, mint tokens or restrict addresses. Contract ownership, proxy administrators and role assignments can often be identified from on-chain state and events. Control may rest with an individual key, a multisignature arrangement, a timelock or a governance contract. A multisig does not by itself prove that control is genuinely shared, a timelock delays execution but does not identify who decides, and governance power may be concentrated among a small number of token holders. Upgrade authority is particularly significant because it may allow fundamental changes to a protocol's rules, potentially including how deposited funds can be accessed.

For attribution, investigators should identify who controls privileged keys or roles, examine governance and voting-power concentration, and investigate front-end operators and other identifiable participants. The existence of administrative control may also be relevant when assessing whether a protocol or its operators fall within the FATF's VASP framework or the EU's MiCA regime. MiCA excludes crypto-asset services provided in a fully decentralised manner without an intermediary, but the application of that exclusion depends on the actual arrangement, not merely on the protocol's label.