Compliance for DeFi Users: What Actually Applies to You

Most of what ranks for this topic is written for exchanges and protocol teams: onboarding screens, transaction monitoring, reporting programs. That’s useful if you’re building a platform. It’s not much help if you’re a parent with a few years of Bitcoin or Ethereum who wants that holding to earn something without selling it.

So here’s the short version for you. As an individual DeFi user in the US, your compliance work comes down to three things: keeping records the IRS can follow, staying clear of sanctioned addresses and people, and checking a protocol’s risks before money goes in. Nobody will do the first one for you, because DeFi platforms mostly don’t send tax forms. This guide walks through each, in plain English.

TL;DR

• Your duties are different from a protocol’s. For AML-style platform duties, regulators look to the people who run, promote, or profit from a service, not to someone who simply uses it.
• In the US, the IRS expects you to report digital asset activity whether or not a form arrives, and decentralized brokers generally don’t file Form 1099-DA.
• Sanctions rules apply to US persons in crypto exactly as they do in dollars.
• Before you deposit, check who controls the protocol, what the contracts do, and what your exit looks like.
• Keep a ledger from day one. Rebuilding one a year later is miserable.

Table of Contents

• Who is responsible for compliance in DeFi?
• Taxes: the part that lands on you
• Sanctions: the rule that doesn’t care about the technology
• No KYC also means no safety net
• A pre-deposit check you can run in 15 minutes
• Keeping the paper trail without losing your weekends
• Where we fit
• FAQ
• Sources

Who is responsible for compliance in DeFi?

Start with a distinction that clears up a lot of confusion. When people say “DeFi compliance,” they usually mean what a platform has to do: verify customers, monitor transactions, report suspicious activity. Regulators are working out who that falls on.

The international securities regulators’ body, IOSCO, describes a ‘Responsible Person’ in DeFi as someone who maintains or updates a protocol, promotes its use through an interface, has custody or control over user funds, or profits from fees users pay. Once identified, that person should face the same rules as a traditional firm doing the same activity. IOSCO also notes that DeFi code isn’t self-running: people build it, deploy it, and carry out governance decisions.

The Financial Action Task Force (FATF), the global anti-money-laundering standard setter, sorts DeFi arrangements into three groups: those with identifiable controllers, those that are centralized in practice even if the controllers are hard to find, and truly decentralized ones. Its standards apply to the first two groups.

What does that mean for you? The heavy obligations sit on the people behind a service. Yours are narrower, but they’re real, and they’re yours alone: taxes, sanctions, and your own due diligence.

Taxes: the part that lands on you

This is where most individual DeFi users get in trouble, usually through neglect rather than bad intent.

What the IRS expects you to keep

The IRS says taxpayers must keep records of digital asset purchases, receipts, sales, exchanges and other dispositions, including the US dollar fair market value of anything received as income. For gains and losses you need the asset type, the date and time, the number of units, the fair market value, and your basis (what you paid, roughly).

You also report digital asset transactions whether or not they produced a gain or loss. Income from things like staking and mining often goes on Schedule 1 of Form 1040 (Schedule C if the activity is a business). Sales and other dispositions go on Form 8949.

On rewards, the IRS ruled in Revenue Ruling 2023-14 that staking rewards are income when you gain control of them. That ruling addresses staking. It doesn’t settle how liquidity-pool fees are treated. If you want the mechanics of income at receipt and gain or loss at sale, we lay them out in US crypto rewards: income at receipt and gain or loss at sale.

Why no form arriving doesn’t mean no duty

Form 1099-DA is the new form brokers use to report certain digital asset transactions made on or after January 1, 2025. But the IRS has said plainly that DeFi brokers and some foreign brokers aren’t required to file it or send you a statement, so you should know your obligations either way. Under current rules, DeFi and other non-custodial platforms that don’t take possession of your assets aren’t required to issue Form 1099-DA.

Translation: if you earn fees from a liquidity pool, no one is going to mail you a tidy summary. The ledger is your job. The same IRS notice stresses that records may be spread across several exchanges, wallets and accounts, and that all of it needs reconciling.

A worked example of what to log

Say you provide ETH and a stablecoin to a pool. Depending on the protocol, fees may arrive in your wallet or build up inside the position until you claim or withdraw. Log the deposit and the withdrawal too, since how those steps are taxed isn’t settled. For each fee receipt or claim, you’d want:

1. The date and time it arrived.
2. The token and the number of units.
3. The dollar value at that moment.
4. The wallet address and the transaction hash, so you can prove it later.

Then, when you move or sell those tokens, a second row with the new dollar value and what you did. That’s a ledger. It’s boring, and it’s the difference between a clean return and a weekend of forensic archaeology. We walk through setting one up in DeFi tax reporting for US holders: build a ledger.

If you’re borrowing against BTC or ETH rather than selling, the tax questions are different again, and they’re worth understanding before you start. Our guide on accessing cash without selling BTC or ETH covers the US picture. For your specific situation, a CPA who handles digital assets is the person to confirm the treatment.

Sanctions: the rule that doesn’t care about the technology

Sanctions are the one area where “it’s just code” won’t help you. The US Treasury’s sanctions office, OFAC, states that all US persons must comply with OFAC regulations regardless of whether a transaction is in dollars or virtual currency. A US person includes US citizens and permanent residents wherever they are, anyone in the United States, and US-organized entities.

In practice, that means:

• Don’t send funds to or receive them from a sanctioned person or address, and screen counterparties against the official OFAC list.
• Be careful with interfaces and pools where you can’t tell who is on the other side.
• Remember that the rules change. In March 2025, Treasury removed the sanctions on Tornado Cash, which shows that the list moves in both directions. Check the official OFAC list rather than relying on memory or a forum post.

Why do regulators care so much? FATF’s 2026 report says DeFi features such as pseudonymity, permissionless access and cross-border reach create structural vulnerabilities that fraudsters and money launderers increasingly exploit. The US Treasury published its own Illicit Finance Risk Assessment of DeFi in April 2023 on the same theme. If you want a primer on the pools themselves, here is an outside explainer on how liquidity pools work.

The practical upshot isn’t paranoia. It’s that when a pool or interface is anonymous, nobody has screened anyone for you, so the screening is on you.

No KYC also means no safety net

Here’s the flip side of permissionless access. The European markets regulator ESMA points out that DeFi is attractive to scammers partly because anyone can use it without identity checks, and that having no clearly identifiable responsible party and no recourse if things go wrong is a major source of risk for users.

That’s the compliance gap most people miss. A bank or a regulated broker comes with a complaints process, and a person to call. A protocol often doesn’t. So “compliance” for you is partly about replacing, by hand, some of the protection a regulated intermediary would have provided: knowing who’s behind a protocol, what could break, and how you’d get out.

This is a US-focused article, but if you live elsewhere, rules differ. The EU, for example, has had MiCA fully applicable since 30 December 2024, and it generally leaves fully decentralized services without an intermediary outside its scope. That’s a reminder to check your own country’s rules, not to assume the US ones travel.

A pre-deposit check you can run in 15 minutes

This is the piece nobody hands you, so build it yourself. Before you put BTC or ETH into any protocol, work through these questions.

1. Who controls it?

Can you find the team, the governance process, and any admin keys that could change the contracts? Using IOSCO’s framing, ask who maintains the code, who profits from fees, and who could touch user funds. If the honest answer is “no idea,” that’s information.

2. How does it earn its yield?

On lending platforms, the Philadelphia Fed explains that interest rates are set algorithmically by the pool’s utilization, the ratio of borrowed to deposited assets, and lenders get what borrowers pay minus the platform’s spread, sometimes plus token rewards. If you can’t say where the yield comes from in one sentence, you don’t understand the risk yet.

3. What’s the price risk?

ESMA found that Bitcoin’s and Ether’s 30-day volatility averaged 3.6 and 4.7 times that of the Euro Stoxx 50 between June 2021 and June 2023, and that DeFi adds market, liquidity and counterparty risk on top. If you borrow against your coins, a sharp drop can push your position toward liquidation. Size positions so a bad week doesn’t force your hand. Our guides on sizing BTC and ETH income positions and crypto collateral management go deeper.

4. Is the wallet side locked down?

Many losses come from approvals you shouldn’t have signed or keys that weren’t protected. That’s why OverseasDeFi teaches wallet security before any income strategy. Run through seven wallet security checks before moving anything.

5. Any warning signs?

Anonymous team, copied code, yield that looks too good, pressure to hurry. Our 5 to 10 minute rug pull check is a fast first pass, and the liquidity pool risks checklist covers the pre-deposit questions in more detail.

6. What’s your exit?

Write down, before you deposit, how you’d withdraw, what it might cost, and what you’d do if the protocol froze. Honest uncertainty beats false confidence here.

None of this guarantees anything. It just means that if something goes wrong, it won’t be because you skipped the obvious questions.

Keeping the paper trail without losing your weekends

For a busy professional, the habit matters more than the tool. A few that work:

• One wallet per purpose. A wallet for long-term holdings and a separate one for DeFi activity makes your records far easier to read.
• Log as you go. Five minutes after each transaction beats five hours at tax time.
• Save the proof. Screenshots of rates, transaction hashes, and the date a position opened.
• Track your health factor and LTV ratio. If you borrow, a position you only check monthly isn’t really being managed. See crypto portfolio tracking for DeFi borrowers.
• Book a CPA check once a year. Not because you can’t read a form, but because treatment of newer DeFi activity is still evolving.

The IRS describes detailed recordkeeping as critical to getting basis right, and with no DeFi broker sending a 1099-DA, your own spreadsheet or portfolio tool is likely the only place all of it comes together.

Where we fit

OverseasDeFi teaches long-term Bitcoin and Ethereum holders how to earn income from what they already own, including wallet security, borrowing against crypto, earning fees by providing liquidity, and managing the risks involved. Members keep control of their assets and make their own decisions. We don’t take custody of funds or manage investments for anyone.

The platform combines portfolio tools, a portfolio-aware AI coach and live human guidance such as coaching, community and macro calls. Community and Accelerator offer different levels of support. You can see current details at overseasdefi.com.

If you’d rather start with a free read, the 15-minute DeFi compliance check is a good first step, and the full learning library is there when you want more. No pressure either way.

FAQ

Do I have to report DeFi activity if I never get a 1099-DA?

Yes. The IRS says taxpayers must report digital asset transactions whether or not they result in a gain or loss, and that DeFi brokers aren’t required to send a Form 1099-DA. The form is a convenience for some transactions, not the source of your duty. Keep your own ledger and ask a CPA how specific activities are treated.

Does anti-money-laundering law apply to me as a DeFi user?

Mostly it applies to the people running a service, not to you as an individual user. What does apply to you is sanctions law: OFAC rules cover all US persons in crypto as in dollars. Avoid dealing with sanctioned parties and check official lists.

Is DeFi regulated in the US?

The picture is still developing. Regulators such as IOSCO and FATF are focused on identifying who is responsible for a given arrangement and applying existing rules to that person. Truly decentralized arrangements may fall outside some standards, which is exactly why risk checks are on you.

What records should I keep for liquidity pool rewards?

For each reward, keep the date and time, token, units, US dollar value at receipt, wallet address and transaction hash. Add a matching row for any later sale or swap. That captures the fields the IRS lists for income and for gain or loss. Log the pool deposit and withdrawal as well, and confirm with a CPA how and when LP income is taxed.

Sources

• IRS: Digital assets
• IRS newsroom: preparing for Form 1099-DA reporting
• OFAC FAQ 1021
• U.S. Treasury: Tornado Cash delisting, March 21, 2025
• U.S. Treasury: Illicit Finance Risk Assessment of DeFi
• IOSCO FR14/23 Final Report
• FATF Targeted Report on Decentralised Finance, 2026
• ESMA: Decentralised Finance in the EU
• Philadelphia Fed: Making Sense of Decentralized Finance
• EU legislative framework on virtual assets

Recommended

• DeFi Compliance: 15 Minutes to Check Risk for BTC and ETH Holders
• Read Smart Contract Audits: 5 Checks for DeFi Beginners
• Run 7 DeFi Wallet Security Checks Before Moving BTC or ETH
• Custody Risk in DeFi: What You Control and What You Don’t