Continuous enforcement against three DeFi protocols, have scarier enforcers than the SEC arrived?
Original author: Will Wang
Original source: Web3 Xiaolü - WeChat Official Account
On September 7, 2023, the U.S. Commodity Futures Trading Commission (CFTC) once again focused its enforcement efforts on the decentralized finance (DeFi) sector and imposed penalties on three U.S.-based blockchain companies, Opyn, Inc., ZeroEx, Inc., and Deridex, Inc., which ultimately admitted guilt and reached a settlement.
Before being able to enjoy the "fruits of victory" brought by Uniswap in court for the DeFi industry, CFTC immediately smashed it one week later and directed its regulatory cannon directly at the DeFi derivatives market, and even the entire DeFi industry.
This article will analyze the impact and response strategies on the DeFi industry by combing through the background of this CFTC regulatory enforcement case and the internal opposition within CFTC.
TL;DR
CFTC may be a more formidable regulator than the SEC, and it may aim its regulatory cannon directly at DeFi;
CFTC imposes regulatory penalties on developer companies directly because DeFi violates derivative trading regulations;
CFTC directly attributes the responsibility of malicious third parties to developers, even if developers cannot control the occurrence of malicious third-party behavior;
Gabriel Shapiro, head lawyer of Delphi Labs, said, "100% of DeFi will be illegal."
The SEC aims its cannon at CeFi, the CFTC aims its cannon at DeFi, and FinCEN is in charge of global cryptocurrency circulation's KYC/AML/CTF. This should be the regulatory framework for cryptocurrency assets before the 2024 U.S. presidential election.
1. Case background
According to the CFTC press release, Opyn and Deridex have developed and deployed their own blockchain-based protocols and websites, which provide token derivative trading and perpetual contract trading. These transactions are considered retail commodity transactions involving swaps/leverage/margin, and can only be offered to retail users on registered exchanges in compliance with the Commodity Exchange Act (CEA) and CFTC regulations. However, Opyn and Deridex have never registered with the CFTC and have illegally provided services without performing customer identification procedures required by banking secrecy laws. In addition, although Opyn has implemented measures to restrict the use of its services by US users, these measures have not been effective in practice, while Deridex has not taken any measures.
ZeroEx has developed and deployed the 0x Protocol and the Matcha application, which is similar to a decentralized exchange (DEX) for users to trade between multiple tokens. However, there are some tokens with leverage/margin properties deployed by unrelated third parties on the DEX for investors to trade. The CFTC believes that such transactions can only be offered to retail users on registered exchanges in compliance with the CEA and CFTC regulations. ZeroEx has illegally provided services without registering with the CFTC.
Therefore, Deridex and Opyn are accused of failing to register as Swap Execution Facilities (SEFs) or Designated Contract Markets (DCMs); failing to register as Futures Commission Merchants (FCMs); and failing to implement customer identification procedures as required by FCMs (as part of compliance with banking secrecy laws). In addition, ZeroEx, Opyn, and Deridex are also accused of illegally providing leveraged and margined retail commodity transactions for cryptocurrency assets.
According to the allegations, CFTC is requesting Opyn, ZeroEx, and Deridex, the three developer-operated companies, to pay civil fines of $250,000, $200,000, and $100,000 respectively, and to cease their violations. According to the settlement agreement, these three companies have agreed to pay the civil fines to avoid further legal action.
CFTC Enforcement Director Ian McGinley said, "There used to be an inherent belief among DeFi project participants that decentralization and the blockchain were beyond the reach of the law. However, this is not the case. While the DeFi industry may be innovative, complex, and constantly evolving, law enforcement agencies will also keep up with the times and actively pursue violations by unauthorized platforms that allow U.S. users to engage in derivative transactions."
2. CFTC Commissioners' Dissenting Views
2.1 Conflict with CFTC Regulatory Principles
Despite the aforementioned regulatory enforcement decisions made by CFTC, CFTC Commissioner Summer K. Mersinger still expressed her dissenting views. She stated: This regulatory enforcement is targeted at DeFi protocols and applications in a decentralized environment, which CFTC has never dealt with in this field before. Therefore, the regulatory approach to this field for the first time is particularly important.
Last year, in the 2022-2026 Strategic Plan, CFTC stated that regulation of DeFi would involve increased engagement with stakeholders and recognition of the need for broad stakeholder involvement in innovative industries such as DeFi. However, this regulatory enforcement action is completely different from the strategic plan. CFTC's "enforcement first, communication afterwards" approach goes against the strategic plan and contradicts the spirit of "responsible innovation" required by Congress.
She stated that in this case, there is no indication of client funds being misappropriated, nor is there any indication that any market participants have been harmed by DeFi protocols/applications. The CFTC's unreasonable regulatory approach, while able to protect "imaginary" investors, does not promote responsible innovation and will only drive the DeFi industry out of the US market.
2.2 Conflict with Uniswap Case Precedent
In addition, she raised a very practical question through the regulation and enforcement of ZeroEx: If a DeFi protocol is developed and deployed for legitimate purposes, but is used by unrelated third parties for purposes that violate the CEA and CFTC regulations, who should be responsible for this? Should the developers of the DeFi protocol bear the responsibility forever?
These questions have actually been answered in the previous Uniswap precedent (refer to the article: The Tragedy of DeFi Regulation, Uniswap in Heaven, Tornado Cash in Hell). The court tells us from a judicial perspective: the developers and investors of Uniswap should not be held responsible for any damage caused by third-party use of the protocol, because the underlying smart contract of Uniswap and the token contracts deployed by third parties are completely different.
Therefore, I believe that this precedent of Uniswap can also be applied to the regulatory enforcement of ZeroEx, and CFTC's regulatory enforcement completely violates judicial precedent.
2.3 There is No Compliance Path for DeFi by CFTC
In opposition, Commissioner Summer K. Mersinger stated that the existing CFTC regulations are aimed at centralized intermediaries, and the regulatory requirements are for centralized institutions to register as compliant intermediaries (such as futures brokers FCM), and then fulfill the KYC/AML/CTF procedures required by banking secrecy laws, as well as compliance requirements for corresponding regulatory requirements.
This kind of regulatory requirement is not suitable for decentralized and intermediary-free DeFi protocols. How can a DeFi protocol be required to register as a futures commission merchant (FCM), which is designed for intermediary institutions, in a decentralized environment? This is an unresolved issue, and the CFTC has not provided a clear response in this regulatory enforcement.
However, regardless of the strength of opposition, the CFTC's regulatory enforcement remains.
3. Will have a huge impact on the derivative trading market
3.1 CFTC may be a more formidable regulator than SEC
Due to the SEC's previous regulatory enforcement and legal challenges in the crypto industry, people mistakenly thought that the CFTC might be a more crypto-friendly regulatory agency, so more regulatory authority should be given to the CFTC. However, in the recent regulatory enforcement against DeFi projects, the CFTC has gradually revealed its true nature — the CFTC may directly destroy the entire DeFi industry.
The CFTC's regulatory enforcement this time sounded the alarm for DeFi protocols involved in derivative trading or with derivative trading functionality (including DEX based on the AMM mechanism). If these protocols provide services to U.S. users, they may directly expose themselves to the CFTC's regulatory crackdown. Gabriel Shapiro, the Chief Legal Officer of Delphi Labs, even stated, "100% of DeFi will be illegal in the U.S."
He said in an interview: First of all, DeFi protocols with derivatives trading functionalities have already caught the attention of CFTC. Whether it is in the CFTC v. Ooki DAO case (refer to the article: The Regret of DeFi Regulation, Uniswap in Heaven, Tornado Cash in Hell) or in this regulatory enforcement, it is aimed at DeFi protocols' non-compliance with CEA and CFTC regulations.
Secondly, according to CEA and CFTC regulations: "individuals or entities cannot engage in leverage/margin/financing transactions of commodities unless they obtain relevant registration or permission from CFTC." However, basically all DeFi protocols engage in leverage/margin/financing transactions of crypto assets (Crypto Commodity), and commodity swap transactions can be understood as a type of derivative contract arrangement whose value is based on the value of the underlying commodity. Therefore, DeFi protocols like Lido, which generate wETH by pledging ETH, fall under the definition of commodity swap trading.
Therefore, theoretically, almost all DeFi should be included in the regulatory scope of CFTC. This is a very scary theory. Currently, CFTC is only targeting three small-volume DeFi protocols in this regulatory enforcement (based in the United States, facilitating regulatory enforcement), but in the future, they may target Sizable Ones.
Although Gabriel Shapiro's theory is terrifying, in practice, unilateral regulatory enforcement by institutions like the SEC, CFTC, and DOJ can still be addressed through judicial and legislative means. Because regulation cannot interpret or create laws.
3.2 What regulations were violated and who is responsible?
Since CFTC already has the ability to attack DeFi protocols within its jurisdiction, what are the reasons? Who is responsible?
Commissioner Summer K. Mersinger stated that in this case, it is not evident that customer funds have been misappropriated or that any market participant has been harmed by the DeFi protocol. The CFTC only stated that there has been a violation of the requirements related to the CEA and CFTC compliance registration.
The theoretical basis of the CFTC can be referenced from Brian D. Quintenz (former CFTC commissioner, now a16z partner) in a speech in 2018: For smart contract protocols, it is first necessary to clarify what type of protocol it is, whether it falls under the category of swaps/futures/options agreements, and whether it is targeting US users. If it does, then regardless of whether it is software code or any other form, it should comply with the CFTC's regulatory requirements.
If the regulatory requirements are violated, who should bear the responsibility?
There is a significant space for full discussion and debate on this issue. Most lawyers share the same perspective as the judge in the Uniswap case, which is that the responsibility should be borne by the malicious third party causing the damage, not the developers who cannot control the actions of the malicious third party. The developers are only responsible for publishing and submitting the code.
However, considering the US Department of Justice's criminal charges against the founder of Tornado Cash, the case of CFTC v. Ooki DAO, and this regulatory enforcement by the CFTC, it can be seen that the regulators do not hold the same view. The CFTC still attributes the responsibility of the malicious third party to the developers, even if the developers cannot control the actions of the malicious third party. Just like in the regulatory enforcement against ZeroEx, the regulators do not consider whether the protocol developers are associated with the listed derivative tokens or whether the protocol developers have the ability to control the listing of derivative tokens.
Chapter 4: How to Proceed with DeFi Projects in the Future?
The most direct answer is: escape from the United States and block US users.
Of course, the method of blocking also requires some finesse. For example, although Opyn has implemented some measures to restrict US users from using its services, these measures have not been effective in practice, and Opyn still faces penalties from the CFTC. It may be necessary to strengthen the measures of blocking US IPs and also block VPNs and wallets from the US. These technical means are relatively easy to implement.
Of course, there are several factors related to the US that need to be noted:
(1) It can be used by US users (including accounts, wallets, transactions, etc.);
(2) The website or product uses servers in the US (AWS?);
(3) The service is promoted or marketed in the US;
(4) The company, employees, executives, agents, etc. in the US are Americans;
(5) There are transactions with third-party service providers in the US;
(6) It involves financial accounts in the US.
In summary:
(1) Blocking must be comprehensive, including declarations in the Terms of Use, to avoid falling within the scope of regulation;
(2) Try to provide legal protection for the development team and DAO to avoid individual liabilities for DeFi protocols;
(3) Escape from the United States. Even giants like Coinbase are hesitant to expand their derivatives business under US regulations. They have established offshore derivatives businesses and actively applied for licenses from the CFTC.
The scope of applicable operations is very broad, and individual cases need to be examined.
Chapter 5: Conclusion
CFTC has achieved the determination of violations in DeFi business and the responsibility of on-chain DAOs and DAO token voting members through the precedent of Ooki DAO. Previously, in the article "CFTC wins lawsuit against Ooki DAO, creating a precedent for DAOs to assume legal responsibility," it was mentioned that "after DAOs can be sued, the on-chain is no longer a lawless place, and regulatory authorities can use this as a breakthrough to regulate on-chain DAOs, DeFi, and DEX projects." But it seems that nobody pays attention???
Therefore, the regulatory enforcement by CFTC precisely confirms the above viewpoint. CFTC directly steps on three DeFi protocols with the precedent of Ooki DAO, and requires the developer companies to bear the primary responsibility based on the same violation reasons.
SEC aims at CeFi, CFTC aims at DeFi, and FinCEN focuses on the global circulation of encrypted assets with KYC/AML/CTF. This should be the regulatory landscape for encrypted assets before the 2024 US presidential election.
(https://cryptoslate.com/cftc-settles-charges-against-companies-behind-0x-zrx-two-other-defi-protocols/)
REFERENCE:
[ 1 ] CFTC Issues Orders Against Operators of Three DeFi Protocols for Offering Illegal Digital Asset Derivatives Trading
https://www.cftc.gov/PressRoom/PressReleases/8774-23
[2] Dissenting Statement of Commissioner Summer K. Mersinger Regarding Enforcement Actions Against: 1) Opyn, Inc.; 2) Deridex, Inc.; and 3) ZeroEx, Inc.
https://www.cftc.gov/PressRoom/SpeechesTestimony/ mersingerstatement 090723
[3] Remarks of Commissioner Brian D. Quintenz at the 38 th Annual GITEX Technology Week Conference
https://www.cftc.gov/PressRoom/SpeechesTestimony/opaquintenz16
[4] Gabriel Shapiro, 100% of DeFi Could Become Illegal
https://thedefiant.io/100-of-defi-could-become-illegal
