Regulation of DeFi Across the Globe

Transcript

Is it good? Okay. Yeah. Okay good. Okay, we're good. Okay good. Thanks everybody for coming. It is so exciting for me to be here presenting to you all today. Um, ECC is my absolute favorite conference in all of the world precisely because of the devs and the builders here and the content you guys all share. Uh, the purpose of today's talk in terms of talking about DeFi regulation across the globe is to make sure we understand where we are on DeFi regulation, what's going to happen, and to make sure we know what we're going to do so that all of you guys can keep building cuz that's the most important thing we can do. Uh,

I'm Rebecca Rettig. I've been a lawyer in the crypto space for a long time and I've been a lawyer working on DeFi since before we called all the DeFi when we called it OpenFi. Um, but today I have the privilege of being the general counsel of the Aave companies, which is a group of software development companies that build blockchain-based software for the Web3 world. Uh, we built the Aave protocol, which is one of the most significant blue-chip DeFi protocols out there and we also launched the Lens protocol, which is a decentralized social media protocol that's out there now. Um, at the Aave companies we are dedicated to seeing the world transform into one that is really user-owned. Uh, and for that reason we've been pretty acutely attuned and really paying attention to what is

going on with regulation of DeFi across the globe precisely because DeFi and Web3 is permissionless and borderless. Um, one of the ways we do that is by actively engaging with regulators and policy makers everywhere. Um, this global paradigm shift into a user-owned world through the internet um, is undoubtedly going to occur because of all the technology everybody here is building. Uh, and however, in order to ensure that, um, there is space for you guys to keep building, we have to make sure that we know uh what uh and sorry, to, um, to to make sure the technology can grow and to make sure

that there's widespread user adoption around the world. And the only way that space is going to come is if we have greater legal and regulatory clarity for DeFi and Web3. One of the ways we're actively doing that is by educating regulators and policy makers about what DeFi actually is, how the technology works. There's a lot of repetition that goes into it. I have had, uh, a policy maker say to me, "I just don't get it." Uh, so you have to be dedicated to the cause. Um, but as of today, we don't have the legal and regulatory clarity that we need, uh, in the way of explicit regulation of DeFi in any major jurisdiction. So, Europe, UK, US, um, a- and and from what we're aware of, there's not any explicit

DeFi regulation anywhere else in the world. That does not mean, however, that when you build in Web3 or build DeFi protocols, uh, that there's no regulations that apply. So, we can dis- debunk the myth that this is the wild west and we're all riding around horses building technology. Um, at a minimum, when you are building in DeFi and just building technology in general, consumer protection laws do apply in terms of talking about how you're building and giving full and fair information about that. And as I'll talk about in a little bit, uh, if the protocol and the ecosystem around it is not meaningfully decentralized, you may actually, uh, have more regulations that apply to you.

But, uh, from both from what we know about what's publicly available and from engaging with regulators and policy makers, we know that they are more focused than ever on regulating DeFi. Um, there is a focus on DeFi, I think in particular. If you really look at the size of what DeFi is in relation to the rest of our economy today, it's a very, very small portion, maybe 1.5 or 2%. Uh, but I think given the explosive growth that happened in DeFi in such a short period of time, regulators are looking into it. So, the Europe the ECB, which is the main regulator for European banks, put out a report that said in January of 2021, there was about 18 billion euro locked in DeFi and as of the end of December 2021,

uh, there was 240 billion euro of TVL in DeFi. And so, that appears to be why regulators are really attuned to this. Uh, and given the growth, a lot of regulators across the globe, including the Bank for International Settlements, which is a global regulator, and the UK's Financial Conduct Authority, which is the main UK securities regulator, uh, have stated that the that DeFi can really or has the potential to, uh, increase risks in financial stability in our current markets, especially because they are seeing that legacy financial institutions are trying to find ways to integrate with DeFi.

Um, and we are already seeing that happen based on inbounds we see and just a lot of, uh, big banks having reports on crypto and really engaging and coming up with their own projects. Um, so for this reason, they are looking to regulate DeFi. We are not though in a complete black hole today when it comes to regulation of DeFi. Uh, as of October 2021, the Financial Action Task Force or FATF put out updated guidance for VASPs. And just to back up for a second, uh, FATF is an international organization that was founded by the G7 to develop policies to combat money laundering and terrorist financing. They've typically done that

for actors in the legacy financial space. Uh, they have updated regulation that applies to centralized crypto actors or what they call VASPs, virtual asset service providers. These are things like exchanges, custodians, brokers, what you're used to seeing in the legacy financial world. But, the 2021 guidance uh was meant to take on DeFi head-on. Uh, one of the things they stated was that a DeFi application itself is not a VASP because standards don't apply to the underlying technology. But, they also said that where creators, owners, and operators or some other persons who maintain control or sufficient influence

in the DeFi arrangements, even if those arrangements seem decentralized, could be considered a VASP and then subject to this new money laundering terrorist financing set of regulations. They also importantly said that self-identification as DeFi is not determinative, nor is the technology involved. And what they're saying is, and we've seen a lot of this of late, no matter what you call yourself, if you are centralized or otherwise have some semblance of control, there will be VASP regulations and other global regulations that apply to you.

In addition, on the global level, the International Organization of Securities Commissions, also called IOSCO, uh which is an international regulatory body that is made up of the SEC in the US, the UK's Financial Conduct Authority, Swiss FINMA, um and securities regulators in Australia and Africa and Asia, um recently put out a report relating to DeFi. And the other thing they importantly said was most DeFi protocols rely on centralization in one or more areas, and so regulators need to look at how to regulate.

So, there's the guidance we have so far on this more global level. In the EU, where we all are sitting today, um we also do not have explicit regulation of DeFi, but we came pretty close to it just a couple weeks ago. Uh the Markets in Crypto Asset Regulation, or MiCA, at one point was supposed to include DeFi. MiCA really today was meant to be a comprehensive set of regulations that covers centralized crypto actors. Again, exchanges, stablecoin issuers, brokers, uh custodians, uh but at one point thought about looping in DeFi into that.

Um luckily, due to work that we and others uh in Europe and elsewhere did with respect to the European Parliament, DeFi is excluded for the time being, uh and we also ensure that NFTs uh are excluded except those that are geared towards financial transactions. There is a very large catch-all provision there that covers stablecoins and may cover DeFi or decentralized stablecoins, so something like Dai, um depending on how you market it and depending on the representations you make relating to it.

Uh there's also, back in 2022, DG FISMA, which is the Directorate General for Financial Stability, uh it's the main regulator in the EU that's meant to preserve the financial markets, uh put out a report on DeFi. And they went through and they did a great job of talking about the technology and the benefits and the risks, but at the end of the report, they said, "DeFi presents a new stage in the development of the crypto asset ecosystems. Regulators have to remain vigilant and closely monitor the development of this ecosystem and consider appropriate action if necessary."

And we know that in the wake of MiCA, DG FISMA is writing a new report, and they will be engaging with stakeholders. This is something important that we'll talk about at the end of today's talk, but they will be engaging with stakeholders to talk about the technology and to learn about ways that it could possibly be regulated. Um in addition uh in the US, you have President Biden's executive order that came out in March asking for interagency cooperation and research on various aspects of the crypto and digital asset ecosystem. In uh last month's proposed bill from Senators Lummis and Gillibrand, they proposed a study on DeFi to be able to come up with a type of proposed

regulation. We have seen a lot of enforcement orders coming out of the SEC that deal with DeFi-related topics and there's litigation going on in the US right now that could give us some clarity around uh law relating to DAOs. The BZX DAO is subject to litigation in California and there's also ongoing litigation uh relating to Terra, Sol, and others in the DeFi ecosystem. And the UK is looking at this also from the gathering information and doing a study perspective. They're doing a great job engaging with stakeholders as well.

Uh so that's important to note um in terms of making sure you can connect and we can help you with that as you think about it and we'll talk about that more in a second. Um but the question is how can one regulate DeFi and why with all the inherent benefits and user protections built into the technology? Um and I would you regulate DeFi? And I think this is a particularly important question given what regulations are given that regulations today are really directed at centralized actors or intermediaries in financial transactions. Most regulations today use the word person and that's because humans have subjective judgment and you want to ensure that there are really

appropriate guardrails when they are touching other people's use, you know, other users' assets. But DeFi is very different. There's the automaticity that relates to it, as well as and no human judgment. When you engage with a DeFi protocol, you know that uh what the rules of the road are, you know how your transactions are supposed to work, and you do not have to worry about human judgment. Uh most recently, and this was recognized in some way uh by Peter Kerstens, who is an advisor to the European Commission and also really working and has been working with DG FISMA on DeFi. He said just last month, "We're currently not on track to regulate DeFi because it's very rare to have something truly decentralized, but

this could change." What he means here is there's this there's a it's what I ask her said. There seems to be at least one element of centralization, and because that's historically what's been regulated in the legacy financial world, they're going to look to do that today. Let's see what a few learnings we can take away on what true decentralization is, and things have not necessarily changed significantly from 2017, the DAO report, which is some of our very first learnings on decentralization, um where they talked about the DAO's investors relying on the managerial and entrepreneurial efforts of Slock.it and its co-founders, and the DAO's curators who were supposed to be and bring an

element of centralization. Uh to managing the DAO and then putting forth the proposals. And some of the elements of centralization that were called out in the DAO report are this control by curators was predetermined. That, and this is very important to think about as we build out DAOs and decentralization today, that DAO token holder votes were very limited and what they could effectuate, and that Slock.it actively oversaw the DAO. If you move on to 2018 and you think about the EtherDelta order. I think EtherDelta is one of the most similar things we can think of when we think about what DeFi is today. It really was a smart contract-based system, looked like a DEX. And so, the question is, how

can there be an enforcement order here? It's also because there were elements of control. So, Zac Coburn, who's one of the co-founders of EtherDelta, was found was fined in this enforcement order because he exercised complete and sole control over EtherDelta's operations. Certain of the things they pointed out was having control of the protocol through the admin key. We take that back to having the ability to affect and control other users' assets. All official listings on EtherDelta went through Coburn. And EtherDelta had an order book that was stored on a centralized server that EtherDelta maintained.

So, those are some of the elements there. And the last thing that was very, very recent is DMM or decentralized money market. Or DeFi money market, where they also retained elements of control. The co-founders had essential efforts in managing the DMM business. And this goes back to what they said about the DAO token holders, but the DMG token holders, so this was a DAO token, had no role in either running the business. I think what they really meant was, you know, no meaningful ability to affect change in the protocol.

The co-founders promised returns based on the assets that they bought and sold. They marketed tokens on their podcasts and at conferences. They went ahead and create and affirmatively created liquidity pools on DEXes. And they paid companies to list their tokens. So, with all that being said, the question then is, is decentralization a viable path to regulatory compliance still? I think the answer is it depends. That's the lawyer answer. But, I do think that there is an important part of decentralization in ensuring that we can create regulations that make the most sense for DeFi technology. But we do need to think about decentralization along three lines, especially given what we've seen in terms of past information

about where control comes in and current information in terms of how regulators are thinking about control in the DeFi world. You need to make sure the technology is decentralized. Is your code open source? Is it available for everybody to see? Is it available for everybody to audit and to use? Your governance also needs to be dispersed. Take the learnings from DMM and from the DAO and make sure that when or if you create a DAO and there is a token that the that the DAO token holders have meaningful governance rights, that they can make changes to the protocol, that they can make proposals on how to change it and can be actively involved. And the last piece of this is the ecosystem.

Make sure that if you are the software developer, you are not driving the ecosystem. You do not have complete control over the growth of it and that you can't be seen to be the only one who is building and growing your ecosystem. Aside from regulatory compliance, I think this is just good decentralization ethos, right? This is what it was all about back when Bitcoin was created. So I think we want to stick with that from an ethos perspective, but it is important from a regulatory perspective cuz you can see how global regulators are thinking about where control comes in and that that isn't an an appropriate place place to regulate.

So from everything we've talked about, what are the takeaways? No single point of control and no single point of failure. You want to make sure that there is a lot of diversity in who is building your ecosystem and who is able to make meaningful change and impact on your protocol. There should be no central actor or set of actors that can unilaterally affect or uh hurt or benefit user assets. You want to make sure that there is true dispersion, right? Having a lot of token holders who are all, let's say, in the same place and all end up coordinating with each other uh is not going to be the same as having true true decentralization or real meaningful governance. And the thing that I just

saw in something I was reading yesterday by an international regulator is this idea of geographic diversity. So, having people in multiple jurisdictions all over the globe who are involved in governance and who are involved in your ecosystem really makes for uh meaningful decentralization. The question though is, in terms of is decentralization a viable path to regulatory compliance, is will decentralization be enough? And the thing that I hear a lot from uh regulators and policy makers is who's responsible when something goes wrong. And for that reason, I don't think we can say decentralization on its own is enough and we can sort of wipe our hands clean and not have to think about regulators coming to, you know, to talk to us or to look to regulate DeFi.

We need to think about what our goals are. And I think there are two of them when we're thinking about what regulation is. We want to allow for continued innovation in Web3, so we can't have regulation that looks to stifle how we create and what all of you are building, but we also need to create software and systems for building that software that protects users and promotes regulatory goals. Now, some of that is inherent in the technology uh but we have to make sure that it's clear that it's inherent in the technology.

So, how do we achieve these two goals? One, we cannot have regulators uh or policy makers looking to regulate the writing of code. And we do not want to have software developers regulated as financial intermediaries where you have true decentralization. But, uh I think there's an intermediary position, especially because regulators want an answer of who's responsible and are used to seeing certain legacy financial structures. And so, we'll be finding ways or try to find ways to regulate DeFi. There's this intermediary position where we have technology neutral standards that are set to protect users.

But, how do we get the intermediary position to be able to be the way DeFi is actually regulated? And I am hoping that there will be a global standard for how this comes to pass. But, we need to mobilize to do it. You are all building and I see firsthand from our developers at the Ave companies that building is a tireless project. But, there is no rest for the weary. You need to also be advocating because you are the ones who understand how the technology works best. And by imparting that knowledge, you will play a key role in making sure the technology is built out in a way that actually works with how you're building. I think there are

three important things we all need to do to get this done. One is to educate. You need to explain the value proposition of DeFi in really simple terms. We all understand words like smart contracts and DAOs and things like that, but you need to make it easily understandable for people who don't do this day in and day out or just don't talk to each other about all of it day in and day out like we do. And you need to talk about it to anyone who will listen. If you want some to talk about what simple terms can be used, you can definitely reach out to me. I'm on Twitter.

Um but the other thing the other two things we need to do is engage. You need to be meeting with regulators, policy makers, policy influencers, law enforcement to explain DeFi, explain decentralization, and talk about an intermediary position or what rational regulation will really look like for DeFi. And lastly, it's something you're all good at. You need to innovate. You need to consider DeFi best practices. There are certain things that we do inherently that will protect users. Things like security audits, right? We know that's good practice in building out software.

We do it and that is something that will be there for user protection and we should promote those things in themselves. We need to talk about how DeFi can protect users and how all of what we do today can be turned into regulation or meaningful standards that we can all live with. I will take questions at the end, but I one thing I want to do before I finish is to say thank you to my legal team. Everybody at Maria Ribavari, Christina Frazier, and Nicole Butler who helped with this presentation and always help in engaging with regulators. I want to thank all the developers and creators and builders at Aave because everybody is amazing and always engages to talk about the technology and is always available to talk to regulators and

policy makers. And I of course want to thank Stani because it is really his vision of being leaders in every way that has allowed us to go out and really talk to policy makers and regulators about what makes sense for DeFi regulation. So, I'm happy to take some questions. [applause] Okay. I can't promise there will be easy answers though, but I'm happy to try. Okay.

Okay. Question. Hello. Oh okay. Hi, thanks for the talk. It's awesome. So, I have a question. So, usually in the beginning a protocol is very centralized to the core team and then protocols starts to return control to the community through governance. So, I'm wondering how does regulation play in that process and what should founders do to handle that? Uh well, you should have good legal counsel who actually understands how DeFi works to start. But in all seriousness, there is that I think that having a a limited period of time where the founders are ensuring that the protocol

works as it should is actually good and meets consumer protection goals. So, one of the things we talk about is having either a you know, a brief you know, grace period or something like that to have a launch where you're not heavily regulated as software developers and that you can continue building. Do you Sorry, I'll follow up a question on that. Do you have a recommendation on the the time the range of the of the grace period? I think it depends on what your protocol does. I also think if you do a gated launch and you have only a certain amount of TVL, only a certain amount of users, that may change things in terms of the timeline. So, I think it may be

less time specific like a month and more you know, amount of user assets that can be affected specific. Hi there. Um so, I have a question on a recent thing that was issued by the I think it was the SEC about a redefinition of dealer and it was aimed at electronic trading and investment banking, but there was a little footnote which snuck in there about applying to all of DeFi. So, what's your kind of feeling on that and how it might apply to the other businesses and the similar businesses? Um without being specific as to how it applies to specific businesses. I mean, we're still in the rule making process.

There has been a lot of response to that SEC proposed rule. I think it will probably go up to be challenged most likely at the highest level if it actually gets enacted. But it is I mean this electronic communication system and and that proposal looks to at least capture lots of different things and not just defy as well. So I think there'll be a lot of pushback against it. Okay. Oh. I think they're people down there. Okay. Okay.

Thank you. [applause] Woo! [applause]