Title 3 primer – PolicyPartner

Executive Summary

Title III establishes a two-tier framework distinguishing truly decentralized protocols from those with centralized control. Only non-decentralized protocols trigger SEC/BSA registration. Distributed ledger application layers (web front-ends) face AML/sanctions screening mandates under §302. Digital asset intermediaries must implement risk management before routing through DeFi under §308. Protocols, nodes, validators, and self-hosted wallets are explicitly exempt. Key rulemaking on "common control" and "materially alter" thresholds will determine operational scope.

Two-Tier Framework

§301 — Decentralized Protocol (Exempt)

Distributed ledger executing transactions via predetermined, non-discretionary automated rules without third-party custody reliance. No person/group can unilaterally control, alter functionality, or censor users.

§301 — Non-Decentralized Protocol (Regulated)

Meets any exclusion: (A) person/group can control or materially alter functionality; (B) operations not solely on pre-established transparent code; (C) unilateral censorship authority exists. Triggers Exchange Act registration.

Key Definitions Pending Rulemaking

"Common Control"

Not defined in Title III. References §2 and §104(b) rulemaking. SEC controls outcome.

"Materially Alter"

Threshold unspecified. Determines when upgradability triggers non-decentralized status.

Application Layer Obligations

§302 — Distributed Ledger Application Layer

Web-hosted software enabling user instruction submission to DeFi protocols. Excludes: protocols, nodes, validators, wallets. U.S. persons owning/operating covered.

Required Compliance (360-Day Deadline)

• Blockchain analytics screening for sanctioned wallets

• Block/reject transactions prohibited by U.S. sanctions

• Restrict ransomware-pattern and illicit-finance transactions

• Implement risk-based AML/CFT measures

• Comply with Treasury §5318A special measures

§308 — Intermediary Risk Management

SEC/CFTC registrants must conduct risk analysis (AML, fraud, cyber, operational) and disclose risks in plain language before routing through any DeFi protocol.

Compliance Triggers by Entity Type

Entity Type	Section	Trigger / Obligation	Status
DEX front-ends (web-hosted)	§302	Sanctions screening mandate; analytics vendor integration; transaction blocking infrastructure	COMPLIANCE REQUIRED
Self-hosted wallets	§302(a)(1)(B)(vi)	Explicitly excluded from application layer definition	EXEMPT
Protocol smart contracts	§301(e)(1)	Software code cannot be required to register; distributed ledger applications excluded	EXEMPT
Nodes / Validators	§302(a)(1)(B)	Computational infrastructure explicitly excluded from application layer obligations	EXEMPT
Centralized exchange DeFi routing	§308	Risk analysis documentation; customer disclosure templates; transaction accept/reject procedures	COMPLIANCE REQUIRED
Protocol security councils	§301(g)(2)	Safe harbor for emergency measures if pre-disclosed via on-chain authorization mechanism	CONDITIONAL SAFE HARBOR
DAO governance participants	§301(g)(1)	Treated as separate persons absent common control or agreement to act in concert	CONDITIONAL EXEMPT

Example Product Impact Assessment

Uniswap Interface

§302

Compliance Required

Web-hosted front-end operated by U.S. entity. Must implement sanctions screening, wallet blocking, transaction monitoring. Analytics vendor contracts required.

Coinbase DeFi Routing

§308

Compliance Required

SEC registrant routing customer orders through DeFi protocols. Must complete risk analysis and customer disclosures before any DeFi trading activity.

Aave Security Module

§301(g)(2)

Conditional Safe Harbor

Emergency pause capabilities may qualify for safe harbor if pre-disclosed, limited in scope/duration, and authorized via on-chain governance mechanism.

Uniswap Protocol

§301(e)(1)

Exempt

Smart contract code cannot be required to register. Immutable, permissionless protocol with no unilateral control vector. Front-end separate from protocol.

MetaMask Wallet

§302(a)(1)(B)

Exempt

Self-hosted wallet explicitly excluded from distributed ledger application layer definition. User retains independent control over assets.

MakerDAO Governance

§301(g)(1)

Conditional Exempt

Governance participants treated as separate persons unless acting in concert. Token holder voting on protocol parameters does not create common control.

Implementation Timeline

360

Days Post-Enactment

§302 Treasury guidance on application layer sanctions obligations

360

Days Post-Enactment

§905 General effective date for Title III provisions

1 Yr

Post-Enactment

SEC/Treasury rules on non-decentralized protocol Exchange Act compliance

+60

Days After Final Rule

Provisions requiring rulemaking become effective

Structural Assessment

What Survives

Truly decentralized protocols with immutable code and no control vectors. Self-hosted wallets. Protocol-level smart contracts. Node operators and validators. DAO governance participation absent coordinated action. Security council emergency measures with pre-disclosure.

What Changes

Web-hosted front-ends face sanctions compliance burden. Registered intermediaries need documented risk frameworks before DeFi routing. Protocols with upgrade keys or admin functions face heightened scrutiny under "materially alter" analysis pending SEC rulemaking.

Open Questions

"Common control" and "materially alter" thresholds undefined—SEC rulemaking determinative. Whether desktop/mobile native apps escape "web-hosted" definition. How Treasury applies §5318A special measures to DeFi. Amendment 64 (Ricketts) compatibility outcome.