The Clarity Act, which has advanced out of the Senate Banking Committee, leaves material gaps in the AML/CFT regime across the digital asset ecosystem. First, while the bill would apply AML/CFT obligations to certain digital asset intermediaries – namely, digital commodity brokers, dealers and exchanges – other digital asset service providers (DASPs) remain underregulated, or free to operate outside the regulatory perimeter.[1] Depending on the facts and circumstances, certain custodians (including those operating offshore); service providers; exchanges, including those that facilitate the exchange of payment stablecoins; unhosted wallets; and decentralized finance (DeFi) developers, administrators and software providers would not be covered by the Clarity Act. As a result, the bill creates lighter-touch AML/CFT obligations for certain crypto actors performing bank-like functions, making them an attractive option for those looking to evade law enforcement or national security scrutiny. Second, the bill does not grant clear authority for the Secretary of the Treasury to sanction or regulate mixers, tumblers and other blockchain applications that facilitate money laundering, terrorist financing, and sanctions evasion. These gaps are not innovation-friendly; they are illicit finance-friendly. If Congress wants an effective market structure framework, it must close these gaps. Policymakers can support innovation without jeopardizing U.S. national security.
Resolving these shortcomings requires the following: (1) Ensuring all DASPs are subject to the Bank Secrecy Act (BSA) regime, with appropriate bank-like BSA obligations, (2) authorizing Treasury to address the money laundering threats presented by mixers, tumblers and other blockchain applications and (3) applying an economic benefit test to decentralized finance protocols to determine when the BSA would apply and eliminate proposed legislative loopholes.
Ensure All DASPs and DeFi Entities Are Subject to Appropriate BSA Obligations
The bill is inconsistent with a basic AML/CFT principle: the same activity presenting the same risks merits the same regulation. Departure from that principle means those looking to launder money, finance terrorism or evade sanctions will seek out the least regulated option. Customer identification program (CIP), know-your-customer (KYC), transaction monitoring and suspicious activity reporting (SARs) are all vital parts of any effective AML/CFT regime. Fraud proceeds, funds obtained through sanctions evasion, terrorist finance and other illicit funds have already moved from regulated exchanges to unhosted wallets, decentralized exchanges, liquidity pools, mixers, tumblers and cross-chain bridges, which have little to no AML/CFT oversight.[2] Codifying exclusions for these activities will further exacerbate the problem and impede law enforcement efforts to pursue bad actors by making attribution, tracing and recovery more difficult.
For example, the Clarity Act would not address gaps in AML/CFT controls that facilitate these types of transaction patterns:
- A scammer could trick a victim into wiring her life savings into bitcoin on a regulated exchange, then immediately move the coins to an unhosted wallet and push them through a DeFi liquidity pool. Although the regulated exchange has existing BSA obligations, unhosted wallets and DeFi liquidity pools do not, allowing the scammer to exchange the bitcoin for other coins without satisfying any KYC requirements. The funds could then be re‑aggregated using different cryptocurrencies across multiple wallets controlled by the scammer and off‑ramped through an offshore exchange with weak or non-existent AML/CFT controls. The Clarity Act would regulate few, if any, touchpoints in this chain and those requirements that would apply are less demanding than those that apply to banks , making it difficult for law enforcement to attribute, trace and recover the victim’s funds. The global, 24/7/365 nature of on-chain activities further increases these risks, as funds can quickly be moved and become untraceable.
- A software developer could deploy a DeFi trading protocol that enables peer-to-peer trading through automated algorithms. The developer could intentionally limit its ability to control the protocol but subsequently develop an application to allow users to access the protocol for self-directed trading of non-commodity digital assets and charge a monthly subscription fee. The Clarity Act would not require the developer to comply with AML/CFT requirements even though the developer is in the best position to monitor the trading activities it enables and is accruing an economic benefit via the subscription fee.
- North Korea’s Lazarus Group has used DeFi services, decentralized exchanges and mixers to launder proceeds from major cyber hacks. After these hacks, Lazarus swapped stolen tokens through liquidity pools, bridged them across chains and pushed them through mixers such as Tornado Cash, all without interacting with a KYC’d intermediary. In these flows, no single DeFi service was collecting customer identification information or filing SARs, even though the protocols were performing exchange‑like functions at scale.
As drafted, the bill would exclude from AML/CFT obligations many DeFi actors who claim decentralization while still exercising meaningful control over, or deriving profits from, the protocol. In those circumstances, no single entity is responsible for KYC or monitoring/reporting suspicious transactions, even though the DeFi protocol may be the best-positioned actor to do so, and even though the protocol operators or developers may be continuing to accrue economic benefits after development or deployment of the code. This deprives law enforcement of critical financial intelligence and creates even more blind spots in a global, real-time financial ecosystem already exploited heavily by terrorists, U.S. adversaries and transnational criminal organizations.
- Section 201 of the Clarity Act should make clear that all DASPs are treated as “financial institutions” under the BSA/U.S. sanctions regime so that FinCEN applies risk-based AML/CFT requirements across the full digital asset ecosystem.
- The bill should make clear that businesses operating on, administering or deriving revenue from DeFi platforms remain subject to AML/CFT obligations, just like any other financial institution, and are not carved out simply because software or smart contracts are involved in the activity.
Authorize Treasury Authority to Regulate Mixers, Tumblers and Blockchain Applications
The Clarity Act must also ensure that Treasury has authority to meaningfully regulate mixers, tumblers and other blockchain applications that are used to obscure the source, destination and ownership of illicit funds. Under the current version of the legislation, there is only a requirement for Treasury to conduct a study on mixers and tumblers regarding their illicit finance usage. This is wholly inadequate. Additionally, recent court decisions have called into question Treasury’s authority for regulating mixer and tumbler use under the International Emergency Economic Powers Act (IEEPA), creating even more uncertainty regarding how to curb their illicit use. The use of mixers and tumblers to facilitate illicit financial transactions is a national security risk. For example:
In April 2026, suspected North Korea-linked crypto hackers stole $280 million from major DeFi platforms, primarily Aave. The hackers were able to trick a crypto intermediary – a cross-chain bridge – into minting unbacked cryptocurrency, sending it to a wallet that had been funded just 10 hours earlier, and using that fake crypto as collateral to extract real liquidity from Aave. The identity of the wallet holder was obscured by Tornado Cash, a well-known crypto “mixer.”
In January 2022, attackers stole about $34 million in crypto from the Singapore‑based exchange Crypto.com. The stolen Ethereum was laundered through Tornado Cash while stolen Bitcoin went through a separate Bitcoin mixer, breaking the direct link between the exchange and the thieves’ withdrawal addresses and complicating attribution for investigators.
Mixers, tumblers, cross-chain bridges and other tools are used by bad actors to obscure the source of funds. One way to limit financial institutions’ exposure to this type of illicit conduct is to issue sanctions under the authorities exercised by Treasury’s Office of Foreign Assets Control (OFAC). When OFAC blocks a person or property, it cuts the target off from the financial system. But following a Fifth Circuit decision in 2024,[3] OFAC cannot sanction code – the immutable smart contracts on which mixers and tumblers often run – under IEEPA and cannot prevent unsuspecting consumers from interacting with these tools. This bill could fix that by expressly giving OFAC sanctions authority over the code/protocols that facilitate mixers and tumblers – especially those that claim to be fully decentralized. At a minimum, though, the bill should require Treasury to issue a rulemaking on mixers and tumblers responsive to those gaps identified in the required study.
- Expressly authorize OFAC to designate code for sanctions purposes; or, at a minimum, require Treasury, following its study, to issue a rulemaking that would treat transactions involving mixers, tumblers and similar obfuscation tools as a class of transactions of primary money laundering concern under Section 311.
Apply an Economic Benefit Test; Eliminate Proposed Legislative Loopholes
The bill should apply an economic benefit test so that any entity that is benefiting from the ongoing operation of a decentralized finance protocol is not treated as a non-controlling developer or provider and therefore exempted from BSA requirements. Any party that is operating the service and deriving economic benefit from that service should be considered a financial institution (e.g., broker/dealer, money service business, etc.) under the BSA, not merely a software publisher issuing software for free use exempt from AML/CFT requirements. Traditional financial institutions also use code, and conduct automated transactions, but still must comply with the requirements of the BSA. Law enforcement has expressed concern that exemptions in the bill would inhibit its ability to effectively prosecute DeFi entities engaged in illegal money transmission.
[1] A DASP is a person who, for compensation or profit, engages in the business in the US (including on behalf of customers or users in the US) of exchanging digital assets for monetary value or other digital assets, transferring digital assets to a third party, acting as a digital asset custodian, or participating in financial services relating to digital asset issuance. 12 U.S.C. § 5901(7). Though some definitions of a Digital Asset Service Provider exclude distributed ledger protocols, development activities, immutable and self-custodial wallet interfaces, and liquidity pool participation, the Clarity Act should clarify that Digital Asset Service Providers include all digital asset companies that derive economic benefit from DeFi protocols and all such parties should be regulated under the BSA.
[2] Iran Moved Billions Through Binance to Fund Regime—Continuing Into This Month – WSJ
[3] See Van Loon v. Dep’t of Treasury, 122 F. 4th 539 (5th Cir. 2024).
