EN | Challenges of Regulation in DeFi | MERGE Madrid 2025

Okay guys, welcome to our legal defi stage uh panel. Um I'm here with uh me Lima from uh 1 inch and Mariana de la Rocha from Black For Consulting and we would really like uh to discuss with you today um what's exciting about DeFi and the legal implications and uh we will try to make it very easy and loose. I will let the ladies go go on about this and I try to stay away from this as possible because they're the experts and um maybe guys you want to quickly introduce yourself uh very briefly to the audience.

Yeah, I'll just say yeah very quick. So my name is Mey Ma. I'm the deputy general council of 1 in uh we're uh one of the largest uh dexes or dex aggregators in the world by volume. So very nice to meet you all.

So hi everyone, thank you for being here. My name is Mariana Laro. I'm the founder of Black Fogle. Black Fogle is a consultancy where we are like helping web three to just like navigate all the complexities around regulatory topics. Thank you.

Thanks for having guys. Um let's start with something easy. So there's apparently a regulatory paradox which we have uh around which basically is approach to uh everything that moves to regulate it. The question is now do we really need to regulate everything and and how does regulation apply to um DeFi? Maybe me if you want to start.

Yeah, thank you. Thank you Robert and Ariana. Um I think I'm I'm not here to educate everyone because I'm sure everyone uh has a good understanding but I think it's worth just clarifying what DeFi is, right? It's one it's it's decentralized uh finance which means we don't have a central custodian or intermediary that sit between users uh so you know I just opened a bank account in Spain the other day and I had to provide a lot of information because the bank that's my counterparty they have control of my funds so there's two things that's different between DeFi and traditional finance one is there is a central intermediary or a custodian and two is the custodian holds and controls the user's assets. Um so in D5 both of these are not true.

There is no central intermediary because the blockchain and the smart contracts controls everything and executes everything uh sort of automatically once you create the the code things you know you sort of press a button in in our minds and as an analogy right things kind of happen according to the code and there's no human intervention or changes um that can be made after that. And then the second thing is we as a D5 platform we don't custody user funds. Uh we don't we don't take us using personal identifiable information. We don't control these funds. So so actually it's a very different uh structure than traditional financial institutions.

And I think um maybe it's just worth repeating that it may be obvious to people. Um and then I also want to put into context the order of magnitude difference because I just did some quick research and of course depending on what sources you read and the methodologies the total value locked um in DeFi is between 150 to 200 billion you know again depending on methodology who you you know who you follow and the total volume locked in trfy so traditional financial institutions that includes all the money that's sort of under let's say asset under management by financial you know like by by funds by asset management firms the funds that are in trading, you know, including, you know, pensions, all of that is at least five to six hundred trillion. So that's, you know, several orders of magnitude larger. So DeFi is probably like 2% of tradi. So I think it's also worth mentioning that it's in terms of impact and size, it's uh very very small, right, in the greater SC scheme of things.

And therefore, um, it's worth bearing that in mind from a regulatory point of view that it's obviously less mature. It's a lot younger and it's it is still a lot smaller and less impactful to every people's everyday um, life so to speak. Um, so so I think I I think it's just worth bearing that in mind. I think that that's a great point if you look at market sty stability, right? like from that side of the regulation.

But going back to your question, I think that what we need to think is like why we regulate and the why we regulate should be in this case at least for me like consumer protection, right? And there is a question like do we really need to regulate in the same way that we regulate like not only Tati um but also the exchanges the centralized exchanges because I think that that portion was missing in your comparison. We have the banks and like all the traditional asset managers. Then we have like DeFi but we have like this in in the middle which is like also like in crypto assets but like centralized exchanges and then they have like also like certain level of compliance that they will need to focus. I think that at the end and I think that this is like the dichotomy that you were speaking and I think that this is where it becomes really interesting to talk about defi is that the industry itself has uh interest in presenting the solutions as a secure solution for the user and how it has been until now because it's a young uh industry that is not regulated and it was on purpose out of mikar um the industry had found ways in which they can create this security in a way that it it is not mandatory because of regulation but because it is convenient for the user and here I think that is where like the major potential is because we are even using our own technologies via certification like via like audits of the smart contracts to see like how secures they are.

We don't do that because it's mandatory by law. We do that because it's better for us and it's better for the users. um some of like the the DeFi liquidity pools that are like doing like certain type of KYC that is not like the mandatory KYC with like all the conditions that we have at the national level or like European level but they do it because they also want to give like certain security to the users that are interacting with those liquidity pools. So I think that there is a major potential here to also showcase which type of technological tools we have in the industry that can be used to bring like this level of security to the user that are actually effective because KYC at least for me like um I don't think that this really prevent what it should prevent right it's not as effective as the regulator or the industry would like so we live in a bubble where we have a fake feeling of security just because of the fact that we have a ton of regulations that we need to implement but that doesn't necessarily mean that what we are doing is protecting the users and preventing moneyaundering and financial of terrorism right but if this the industry itself the one that is using technology to try to achieve that I think that there is a major potential

I think we touched on a very important point the question now is if I would play devil's advocate now and be the regulators like that's nice talk right but how does it look in practice so what are you doing in practice to achieve these Yeah, I can go first. Um, so I think just to stress Mariana's point earlier, it's at the end of the day, right? It's about understanding why regulation is necessary or desirable. It's not for its own sake or to fill out papers or create jobs for bureaucrats, but it's to protect consumers, right? to create an environment where people can feel well have control over their own finances and their own money but be able to you know trade to swap to to invest to save to do whatever they want um in a secure environment right and that's why we have regulation is to provide that that security in that environment um so for us that's very important because obviously if our users don't feel secure then we lose business if they feel like DeFi is a dark space or they might get scammed hacked lose money no one cares you know there's there's no accountability, they can't call someone to help them, then they are not going to right use use use the platform.

They're just going to put their money with BBVA or Sentinere and earn like nothing. But, you know, hey, at least they won't lose it or there's some deposit depositor protection up to, you know, 100k euros or whatever it is. Um, so I think we really want to remove these, you know, blockers or friction points by having just creating a more secure riskmanage, risk mitigating environment. And some of the things that we do um you know which a lot of industry participants are doing is it's not KYC as such that a traditional bank or even a centralized exchange right like Binance or Kraken or Coinbase will do um but we do a lot of wallet monitoring um at the blockchain level. So um we employ based our own sort of tech backend solutions as well as security providers like the chain analysis TRM labs um that type of um security provider that has a lot of real-time monitoring um to help us basically identify suspicious wallet activities um and try to basically block them from using our platform.

So that way we're not a conduit for proceeds of financial crime, right? We try to prevent hackers from using our platform to launder the money, create, you know, additional wallets to further, you know, obscure the traces of of these funds. Um, so that that's very very important. And then we're always finding solutions to basically try to stay ahead of the game because with hackers, it's always a cat and mouse game, right? Who can figure out the smartest way to hack into a system, right?

To, you know, stop wallets or create fake commands. Um so it's really about staying on top of like hacks. Um sort of understand investigate immediately whe whether it's our own or someone else's hack, right? Because it's important to understand if if it's someone else's hack, what went wrong? What are the security measures that were breached?

How do we then update our own security measures to um hopefully you know that this doesn't happen on our platform for our users? And we also proactively refund users that are impacted um even though we don't have a legal obligation, right? because again we don't control user funds. They don't give us any information. So if they lost funds and and this happens very rarely.

There were a few cases where there were there was a front-end hack and some users did lose money and we proactively refunded them because again the the accountability and sort of the sense of security is very very important for the industry um to build. And then the other thing that Mariana touched on is we uh we're probably one of the most audited firms um in DeFi is in we invite 15 to 20 um smart contract auditors to audit our blockchain our smart contracts um on a continuous basis. So whenever we introduce new new products, new integrations for example this year we integrated with Salana uh and that is a very different code base because we're Ethereum based um to start with and Salana you know it's not an uh Ethereum um virtual machine based system. So it required a lot of new coding and we engage at least 15 auditors to audit the smart contracts to make sure that that is secure. Again it's not going to solve everything.

It doesn't mean that there's not going to be any bugs or hacks happening, but you know on a on a voluntary basis we do as much as we can because even without regulatory mandates, it's just it's important and it's good business, right? to make sure that users users feel secure um in the product and it's good business for everyone because it will only let's say mainstream this um this system more if people um feel like they can they have the ease and they have the security to use it just like they can with their banks and their other traditional financial institutions and centralized exchanges right which are under more regulation and do more

maybe as a follow-up question to you when we hear all these things I mean this sounds like we're on the right track but how do we make sure as Stepha is a global development and a and a global infrastructure basically. How do we make sure that the regulators acknowledge these things, know these things? Is there a way to maybe for a global best practice sharing or how do we achieve that? Because the biggest risk is probably the lack of understanding and the lack of education with regulators especially when it's uh such a complex topic uh as DeFi and such a new one as well, right?

I wouldn't say that it's just the lack of regulation of the regulators only. Um I think that like defi change a lot of like paradigms paradigm one of them is that you do not have where to run if something goes south because you did something wrong right so I think that there is a lot of education also at the user level because if something happens because or you forgot your passes you like you just like put yourself in danger it's like your responsibility and I think that like this like changing mindset like telling the people like okay your keys, your money,

not your kid, not your money.

Yeah. But like your kids, your money means it's like alo your responsibility and there needs to be a lot of education here because if something goes out then they will just like say like ah but yeah it was like their fault because they didn't tell me right and it's like well you know that there is an inherent risk here because there is no centralized place to go if something something happens. So I don't think that is for everyone. I don't think that crypto is for everyone. I don't think that banks are for everyone.

Right? like there is different like solutions for everyone. What I like right now is that we have options as users and it really becomes about like our own responsibility to understand the solutions and the systems that we want to use and actually like take ownership of that if I do something wrong and I lose my money because I didn't protect my keys that was my responsibility not the one of the protocol and I think that there has been a lot of like lack of understanding also on that that has ended in a scandals in the media that at the end also impact how the regulator see right because they will say like it is not secure because some people lose the money like do they lose the money because it was a scam it was a hack or they lose the money because they didn't took responsibility of their actions and didn't protect their keys or just simply lose their keys.

So I think that there is a lot of like education that needs to be done but also from the from the user level. Now the way that I always like to approach regulatory topics with regulators is with examples and good examples and normally they are more open to speak to you if it's not just only about the financial part but also like the impact of those solutions in the real economy. So um social impact is one of the best cases to talk about that when you were like mentioning like different things that you have been doing to actually protect users. I was actually like thinking on a project called ethics hub that is basically using uh crypto to finance uh people in the global south small farmers like coffee farmers that are completely excluding from the traditional financial sector. They they don't have bank accounts.

They cannot access loans because they don't have collateral and if they have collateral is probably a piece of land in the middle of nowhere that the bank doesn't want. So put some interest that are so high that these people will never going to be able to be profitable. Right? So these type of solutions are really interesting for them and they do have like a decentralized component in a liquidity pool where they also created an stable coin that like works as a collateral for the loans that they are getting from the investors to the people and they they have like all like um their own native processes of how to on board the farmers in order to guarantee that they're going to pay back. And this is a whole system that they have created on their own not because there was compliance requirements but because it's a good practice for the farmers to start to using like new technologies like DeFi and like crypto to make themselves sustainable.

It's a good practice for the investors. So they want to reinvest and continue supporting the project. And it's a great example to approach a regulator and say like look I'm actually like doing financial inclusion. look like I'm actually like generating like new economical models here and I'm doing all of this with technology. I cannot do that with the traditional financial sector.

So putting this like ideas in concrete projects that you take to the regulator will help them also to say like hm or maybe this is not just shady and scammers they're actually like doing something good and they're just like pushing economy in a different direction bringing also people that was traditionally bankked. So I would say I'm not saying it's easy. I'm not saying that all the examples are that good as this one. But I think that that's how we can start to just like making sure that the regulator understand. I also believe that like partnerships are really important for that when it comes to the regulator like I'm doing quite a lot of work right now with the BGA that is uh working also with BBIT and also with like UNDP on implementing use cases on blockchain and also like bringing like DeFi into the equation to try to see how we use blockchain crypto and DeFi to try to solve some of the issues that the United Nations offices are having at the local level and have not been able to solve in decades.

So how we actually like make something valuable with these technologies to start implementing and defy is one of the most powerful systems we have right now to bring people into economical activities. So I will say like that's kind of the part that I will push forward not only because I really like everything that has to be with impact but because I think that you need to materialize and prove that these technologies can do something good and bring something different. there is value added because otherwise well we just like simply use like microloaning and banks and then that's it. What else? Right?

There needs to be a new value added. It needs to be something new and we need to prove that we can do it.

So let's assume we have those regulators that are educated understand these things there's still the question of uh once we achieve compliance in this new type of regulatory environment is this a threat to the DeFi values at its core?

Yeah. Yeah. That's a great question and we we you know thought a lot about this I think before the presentation. Um yeah and I think it's worth clarifying it's not that we think the industry should have no regulation or should just be purely self-regulating. I mean we welcome regulation.

We want to have clear rules. I think it's just important to have the same to talk from the same place right that we have the same background baseline understanding of what is the technology that we're facing. It's not the same as kind of I guess what I'm saying is using financial regulatory framework traditional financial regulatory framework is like trying to fit a you know square peg in a round hole or whatever the analogy is right it's not really fit for purpose so I think it's again just setting the stage but as Robert's saying assuming we have this common understanding among regulators and industry um I think the answer because again right defi is about l not having a central authority or central intermediary or custodian. So how do you regulate something that is that doesn't really have a let's say an accountable central party right to start with um and I think it could start with regulating at the code level and we uh we spoke with Jialter they're doing um Jialter financial services they're triing a sandbox regime where basically they would uh regulate smart contract auditing firms so firms like open Zeppelin for example can basically get a license or be let's say certified under this sandbox regime and then we can't use open zeppelin or you know hack and proof or a number of security audit firms to audit our smart contracts and then we would because we've been audited by a certified um auditor then we can show sort of an increased level of security and reassurance to our counterparties um you know if we're working with banks or other financial institutions or even the likes of Coinbase Finance we can say well look even though we don't have a strict regulation the way you do we have some regulation Right? We've been audited by a firm that undergone a certification process with a regulator.

And if of course you have to have faith in the regulator, right? If you know if the US has no faith in the Gibralar regulator, then that doesn't work. But assuming there's a baseline level of faith um among regulators, then that could be a start, right? to kind of preserve the sort of self custody and a lack of let's say central author authority values in DeFi which for us is it's very it's kind of the core of what we're doing right without these things then we wouldn't be pushing the projects that we're pushing we believe that self-custody is important to for people to take control of their money right it's their freedom it you know your financial let's say control is kind of integral in today's world to your freedom as a as an individual right if you don't control your money you don't control your finances is you it's very difficult to move, right? It's difficult to get things done.

So, we think that's that's very important and we don't like the idea of putting your money and your future in somebody else's account or wallet, right? We don't custody our funds in other people's wallets. It's always self-custodial and we never custody our customers wallets because we believe in that value. So, I I suppose one one way to get around this regulation but still preserving the core value is to act to to regulate the code, right? by certifying by regularly auditing to to make sure it's safe at that level

and I I need to echo this because I think that having these tools is really important especially when we have like democratic crisis we have seen like how also like sanctions has been used to jeopardize like and actually like attack defenders of human right like in the case of Israel against Palestine what is happening right now with like the United Nations um people that they have been targeting and sanctioning and then they are completely excluded from the traditional financial sector I'm not saying that sanctions also not work all the time but I think that it is super important to have certain tools that really belong to the people and that in case of democratic crisis they can still access financial services. So I think that like not going into the whole regulatory package that we have for the traditional financial sector is really really important more considering the global context that we have right now. So I do echo the the the need to just like have in mind what were the principles and the original ideas of of these technologies. Like funny enough, I was asked to just like define DeFi uh like couple of minutes before jumping in this in in in in this panel and I actually like said that like beyond just yeah not having the centralized party like having the smart contracts doing everything automated um it's like um like a new financial services without like this like more like peer-to-peer that what like always like caught my attention of DeFi is actually there is a return to the original ethos of the first white paper of Bitcoin and it's just like having like these peer-to-peer interactions where our our financial like assets are ours and no to those that have custodies of them, right? And I think that this in the crisis that we have right now at the level of values, democracy and human rights, this becomes even more important nowadays that we can have like these tools available for for civilians and basically for everyone.

I would totally agree to that. We unfortunately at the end of our time we have one last question for you guys. It's like if you could have one wish to regulators regarding DeFi, what would that be?

Go and taste it. I mean, it's really hard to regulate something that if you don't even know how it like works, right? I super quick. I normally I tend to do like that. Like it's like with like having cars.

You need like if you want to drive a car, you need to take a license. You need to do a course and you need to go and practice and you probably still will make accidents, but you will have an insurance that will respond for this. And you will have like certain rules in the street of how to drive. Those that made the rules of how to manage the cars in the streets probably also know how to drive because otherwise they couldn't be able to do it, right? So we need regulators to also go and taste how these technologies works and like get a sense of like where are like the vulnerabilities like do I really need to regulate here what is the impact because otherwise they're regulating something that is completely out of the scope of what they understand

melee any final addition

I think distinguishing obviously between the centralized exchanges and platforms and the decentralized exchanges and platforms and then even among the decentralized exchanges platforms service providers there's a huge variety and we talked about tornado cash. And I'm just going to quickly touch on it because um we disagree with the outcome, but it was important to know that actually the jury didn't find Roman Storm, the co-founder of Tornado Cash, guilty of moneyaundering, which was the biggest concern. The the thing that he was found guilty of, which is being appealed, is uh money transmission. And then I the question is, well, do developers have a responsibility? Are they actually controlling or custodying user funds if if it's just the code?

and and they they already said that they don't you know custody but um I think it's worth bearing in mind that tornado cache at least at the time they didn't do any sort of KYC they didn't check that they were there were no blockchain sort of analytics or securities checks I mean anyone can go and and use it they were not actively monitoring wallet suspicious wallet activities or blocking them um so there is a big difference actually between different DeFi players and the level of security and sort of risk mitigation they want to do or they choose to do and some maybe thinks that there it's there's no need or they rather not do it for whatever reason and some like us feel like well it's just better for business and better for everyone if we do do it whether there's regulation or not so I think it's very it's important to distinguish between sort of different types of players right even if the technology is the same

indeed

so I think we left the regulators some homework thanks for taking the time thanks uh for listening in I think we also made the organizers happy because we were right on time

thanks for that thank you guys

thank Thank you everyone.