A liquidity pool is a smart-contract reserve of paired digital assets that traders swap against. In the United States, its legal risk falls on whoever designs, controls, markets or profits from it. The main exposures are securities law, commodities and derivatives law, Bank Secrecy Act (BSA) obligations and sanctions compliance. Fraud liability is a further exposure, and calling a pool "decentralised" does not remove any of them. This guide sets out how those regimes apply, what US agencies have done, and how founders, general counsel and boards can structure for supervision readiness.
Regulatory Mandate: Who Regulates a Liquidity Pool
No single US statute governs liquidity pools. Several agencies apply existing law to the facts of each pool:
- SEC: the Securities Act of 1933 and the Securities Exchange Act of 1934, covering investment contracts, broker activity and anti-fraud provisions.
- CFTC: the Commodity Exchange Act, covering derivatives, commodity pools and fraud in commodity transactions.
- FinCEN: the BSA, covering AML programmes, recordkeeping and suspicious activity reporting.
- OFAC: sanctions compliance for all US persons.
How a pool works matters. Participants deposit a pair of assets, and the protocol issues LP tokens that represent their share. The SEC's litigation release in the Eric Zhu matter describes this mechanic and alleges that insiders can abuse it where safeguards are absent. The legal question is rarely whether code is lawful. It is what the people around the code do, promise and control.
The Treasury Department's 2023 Illicit Finance Risk Assessment of Decentralized Finance frames the approach. It treats the degree of decentralisation as a facts-and-circumstances question. It also states that persons engaged in activities of BSA financial institutions carry the applicable obligations regardless of centralisation. The assessment observes that many DeFi services rely on centralised administration and governance. That undercuts the argument that purported decentralisation avoids financial institution status.
Licensable and Regulated Activities
A pool becomes a regulated activity through the functions around it. Four groupings recur.
Securities offerings and broker activity
The SEC's September 2024 order against Rari Capital Infrastructure found that Fuse pool interests were offered as securities without registration. It also found that the firm acted as an unregistered broker. In the related federal complaint, the SEC alleged that interests in the Earn and Fuse pools, and the RGT token, were investment contracts. The allegation rested on investors expecting profits from the efforts of Rari Capital and others.
The lesson for operators is practical. Marketing yields, curating pools, running a front end that steers deposits and retaining governance token upside all point towards an expectation of profit from managerial effort.
Derivatives and commodity pool activity
The CFTC's Enforcement Director has said that offering or facilitating digital-asset derivative transactions can require registration, including as a futures commission merchant. His 2024 remarks also report that by May 2024 the CFTC had resolved cases involving Polymarket, Derridex, Opyn and ZeroEx, each involving activity that required registration. Pools that offer leveraged, perpetual or option-like exposure deserve the closest review.
Separately, a pooled-funds arrangement can be a commodity pool. In 2020 the CFTC charged Venture Capital Investments Ltd. and Breonna Clark with fraud and failure to register. The CFTC alleged they solicited funds through a commodity pool for forex and digital-asset trading.
Money transmission and financial institution status
Where a service accepts and transmits value, or otherwise performs the functions of a BSA financial institution, AML duties follow. Registration depends on the activity performed, not the label used. State money transmitter licensing can also apply, and the facts of each pool decide that analysis.
Fraud and market conduct
Anti-fraud provisions apply whatever the classification of the asset. The CFTC's Commissioner Kristin Johnson described the Commission's enforcement jurisdiction as a critical mandate for policing fraud in interstate commodity transactions, digital assets included.
Capital and Prudential Standards
The US has no bespoke capital regime for liquidity pool operators. Prudential expectations arise from the regime the activity falls into. A registered broker faces net capital rules. A registered derivatives intermediary faces its own capital and segregation rules. A money services business is held to AML programme standards and state-level financial conditions. Operators should therefore:
- Map each function of the protocol and its affiliates to a candidate regime before launch.
- Model the capital that regime would require if the agency's view differed from yours.
- Document a liquidity buffer for operating costs, incident response and legal defence, held apart from pool assets.
- Run prudential stress scenarios covering exploits, oracle failures, depegs and mass withdrawals, and record board review of the results.
Where a firm also operates in the UAE, the same modelling must be repeated against the relevant UAE rulebooks. Those include the VARA Regulations and Rulebooks, the DFSA Rulebooks (COBS, AML, GEN and MIR where relevant) and the FSRA Virtual Asset Framework. Capital adequacy in those regimes is set per licence category, so group-level modelling should reconcile both sets of requirements.
Governance and Control Requirements
Control is the variable agencies test. Courts and regulators look at who can upgrade contracts, change fees, pause withdrawals, list pairs, hold admin keys or direct treasury funds.
The CFTC's remarks on the Ooki DAO matter show the consequence. The agency litigated the status of a DAO as a "person" under the Commodity Exchange Act and held it liable for failing to register and to conduct KYC/AML. Token-holder governance does not remove exposure, and where the DAO's own conduct brings it within scope, the structure that was meant to diffuse accountability can concentrate it. The liability of a DAO for missing registration or compliance is also a payments-adjacent question. Operators routing fiat on and off ramps typically need payment processing built for crypto exchanges alongside the legal structure.
Governance controls a board should be able to evidence:
- A written decentralisation analysis, updated at each material protocol change, recording who holds each control.
- Key management policy covering admin keys, multisig signers, timelocks and emergency powers.
- A conflicts policy for team members who also provide liquidity or hold governance tokens.
- A defined approval path for new pools, new asset listings and parameter changes.
- Board-level ownership of the compliance programme, with reporting lines to a named compliance officer.
Our own material on DAO legal structures covers how these controls translate into wrappers and decision rights.
AML/CFT and Travel Rule Implications
The Treasury assessment identifies DeFi services that fail to comply with existing AML/CFT obligations as the most significant current illicit-finance risk in this domain. Where a service qualifies as a BSA financial institution, it must keep an AML programme, meet recordkeeping and reporting requirements including suspicious activity reports, and ensure US persons comply with OFAC sanctions.
In practice, a pool operator that is in scope should have:
- Risk assessment of products, geographies, wallets and counterparties.
- Customer due diligence and enhanced due diligence triggers proportionate to that risk.
- Transaction monitoring that includes on-chain analytics and sanctioned-address screening.
- Suspicious activity reporting procedures with documented escalation.
- Travel Rule processes for transfers that fall within the FinCEN recordkeeping and transmittal rules, which apply where an entity is a covered financial institution.
- Independent testing and training records.
For teams also serving UAE users, the equivalent baseline is Federal AML Law (Decree-Law No. 20 of 2018 and amendments) with FATF-aligned standards, together with the VARA, DFSA and FSRA AML requirements. For UK and EU exposure, see our guide to FCA crypto AML requirements. Our AML tips for crypto firms sets out programme design in more detail.
Technology and Custody Controls
Legal and technical risk overlap in a pool. An academic 2024 private-law study of liquidity pools distinguishes legal exposure, such as contractual compensation claims under Swiss law, from technical exposure such as smart-contract errors and hacks that drain funds. It also notes that disparities in technical knowledge can leave users unable to see contract defects. That is a disclosure issue as much as an engineering one.
Controls that support a defensible position:
- Independent smart-contract audits before launch and after material upgrades, with findings and remediation retained.
- LP token handling: the SEC's Zhu allegations involved unlocked LP tokens under the founder's control used to withdraw liquidity. Lock liquidity where the design allows, and record who can move LP tokens.
- Segregation of client and treasury assets: where any custodial element exists, hold customer assets separately from proprietary funds and document the custody model.
- Incident response plan with defined disclosure, pause and recovery decisions.
- Oracle and bridge risk review, recorded at board level.
Enforcement Exposure and Penalty Framework
Exposure depends on the regime. Securities violations can lead to cease-and-desist orders, disgorgement and civil penalties, as in the Rari order. Fraud allegations, as in the Zhu matter, bring anti-fraud charges under the securities and exchange provisions. CFTC actions can include registration-related findings, as in the cases the Enforcement Director listed. BSA failures can attract civil and criminal consequences. We do not summarise penalty amounts here because they change by statute and by case, and the agencies' own releases give the current figures.
The pattern across the matters above:
| Matter | Agency | Core allegation or finding |
|---|---|---|
| Rari Capital Infrastructure (2024) | SEC | Unregistered securities offering of pool interests; unregistered broker |
| Eric Zhu (2025) | SEC | Rug pull using unlocked LP tokens; anti-fraud violations |
| Venture Capital Investments Ltd. (2020) | CFTC | Fraud and failure to register in connection with a commodity pool |
| Ooki DAO and others (to May 2024) | CFTC | Activity requiring registration without registration; DAO treated as a person |
The common thread is that agencies pursue identifiable people and entities behind a pool, whatever the protocol's formal governance says.
Practical Structuring Considerations
For liquidity providers, legal exposure is generally lower than for operators, but it is not zero. A provider who also promotes the pool, holds privileged information or controls governance may be treated differently from a passive depositor. Institutional providers should add sanctions screening of the pool's contracts and counterparties, and record the basis for any classification view they have taken.
For operators, a structuring checklist:
- Classify the pool's tokens and interests under the investment contract analysis before launch, and record the reasoning.
- Separate roles: development company, foundation, front-end operator and any treasury should be distinct entities with documented authority.
- Control audit: list every admin power and decide which to remove, timelock or place under multisig.
- Marketing discipline: avoid yield promises and statements that stress team effort as the source of returns.
- Geographic limits: decide whether to restrict US persons, and implement it technically rather than through terms alone.
- Regulatory map: prepare for multi-jurisdiction supervision, including how a US view interacts with the UAE regulators and with frameworks such as MiCA.
- Supervision readiness: keep a data room containing audits, governance minutes, the decentralisation analysis, AML policies and incident logs.
In the US, the regulatory position has also moved with enforcement priorities. Our note on DeFi regulation, the CFTC and the SEC tracks the current direction, and our DeFi legal process guide for founders sets out the sequencing.
Our View: Treat the Pool as a Regulated Business Plan
We advise founders and institutions across the UAE's five crypto regulators, VARA, SCA, DFSA, FSRA and CBUAE, and across more than 30 jurisdictions. Our consistent observation is that legal risk in a liquidity pool is decided at design stage. Teams that map functions to regimes before deployment can answer a regulator's questions. Teams that wait for an enforcement letter must reconstruct decisions that were never recorded.
We therefore recommend that the legal analysis is built into the product roadmap. Classification, control allocation, AML scope and jurisdictional strategy should each have a named owner and a written record that the board has reviewed. Our lawyers are crypto-native, so the analysis starts from how the contracts, keys and front end actually work. For teams that will operate in the Gulf, we also recommend deciding the regulator early. Our guide to UAE DeFi licensing and filing evidence explains how to choose it.
— CRYPTOVERSE
How We Support Liquidity Pool Projects
We advise on regulatory classification, licensing strategy, AML/CTF framework design, corporate structuring and cross-border coordination for DeFi and Web3 businesses. A typical engagement for a pool project covers the role and control analysis, the licensing route in each target jurisdiction and the compliance documentation a supervisor would expect. Pricing is set per mandate.
To discuss a specific protocol, start with our regulatory and compliance advisory team. For projects requiring a licence in the UAE or elsewhere, see our VASP licensing service, or contact us through our main site.
FAQ
Can a liquidity provider be liable in the US?
Passive providers face less exposure than operators, but liability depends on the facts. A provider who controls the pool, promotes it or abuses privileged access can face fraud or registration claims. The SEC's Zhu action concerned a person alleged to have controlled LP tokens and withdrawn liquidity in a rug pull.
Are LP tokens securities?
There is no blanket rule. The SEC alleged in the Rari matter that pool interests and the related governance token were investment contracts, based on the expectation of profit from others' efforts. Each pool's marketing, control and economics must be analysed individually.
Does decentralisation exempt a pool from the BSA?
Not by itself. Treasury's 2023 assessment says degree of decentralisation is a facts-and-circumstances question. It adds that anyone performing the activities of a BSA financial institution has the applicable obligations regardless of centralisation.
What is the difference between legal risk and impermanent loss?
Impermanent loss is a financial outcome from price movement between the pooled assets. Legal risk concerns regulatory classification, enforcement, contractual claims and compliance duties. Technical risk, such as smart-contract exploits, is a third category, and the three often interact.
Can the CFTC pursue a DAO?
Yes. The CFTC's Enforcement Director has said the agency successfully litigated the status of DAOs as persons under the Commodity Exchange Act in the Ooki DAO matter. It held the DAO liable for failing to register or conduct KYC/AML.
Sources
- Illicit Finance Risk Assessment of Decentralized Finance, US Treasury
- Remarks of CFTC Enforcement Director Ian McGinley
- SEC order, Rari Capital Infrastructure LLC
- SEC complaint, Central District of California
- SEC litigation release, Eric Zhu
- CFTC press release 8118-20
- Speech of CFTC Commissioner Kristin N. Johnson
- Private law aspects of liquidity pools in decentralised finance