The Clarity Act's new DeFi test asks who can change the code

What happened

Senator Cynthia Lummis, who chairs the Senate Banking Committee's digital assets subcommittee, published updated text of the Digital Asset Market Clarity Act on 10 September 2026, four days before a scheduled Senate vote. The document is an amendment in the nature of a substitute to H.R. 3633, printed as EHF26718 and running to 630 pages, and it is published on the senator's own site. The release names three changes. The first is 'Provisions addressing when non-decentralized finance (DeFi) protocols must register with the Commodity Futures Trading Commission (CFTC) and be subject to the Bank Secrecy Act'. The second is 'Specifying that DeFi provisions only apply to spot and cash digital commodity transactions, addressing tribal concerns about the potential impact of this legislation on prediction markets'. The third is 'Clarifications to the powers of credit unions to conduct digital asset activities'. Lummis said that 'Nearly a decade ago, Wyoming wrote the blueprint for digital asset regulation, and this bill finally brings that clarity to the rest of the country', that 'We have incorporated more than 114 separate provisions at my Democrat colleagues' request, and as a result, this bill is a strong bipartisan product', that 'Unlike rulemaking, legislation gives this industry a lasting solution that shields it from the whiplash of changes in the White House', and that 'It's time for a vote; America's financial leadership depends on it'. The release lists BlackRock, Fidelity, Franklin Templeton, Goldman Sachs, Charles Schwab and SoFi as supporters, along with the National Fraternal Order of Police and the National Organization of Black Law Enforcement Executives, and says the National Sheriffs Association and the Majority County Sheriffs Association have dropped their opposition. The senator's office published the same release twice, at two urls, with identical text and the same date. The bill itself carries the material the release summarises in two parallel places: section 10301, in the banking division, writes the rulemaking into the securities laws, and section 20209 writes it into the Commodity Exchange Act. Both use the same definitions. A 'decentralized finance trading protocol' is 'a distributed ledger system through which multiple participants can execute a financial transaction' both 'in accordance with an automated rule or algorithm that is predetermined and non-discretionary' and 'without reliance on a person other than the user to maintain custody or control of any digital assets subject to the financial transaction'. A 'non-decentralized finance trading protocol' is one of those which meets one or more of three tests: a person or group under common control 'has the authority, directly or indirectly, through any contract, arrangement, understanding, relationship, or otherwise, to control or materially alter the functionality, operation, or rules of consensus or agreement' of the protocol; the protocol 'does not operate, execute, and enforce its operations and transactions based solely on pre-established, transparent rules encoded directly within the source code of the distributed ledger system'; or a person or group 'has the authority, via operation of the decentralized finance trading protocol, to restrict, censor, or prohibit the use' of it. Two carve-outs sit beside the test. A decentralized governance system is not, 'solely by virtue of the operation of the decentralized governance system', a person or group under common control. And 'participation in an incident-response or security council' shall not 'by itself, be deemed to constitute control'. The bill also adds a new section 4v to the Commodity Exchange Act protecting activities rather than persons. A person is not subject to the Act solely for 'Compiling network transactions or relaying, searching, sequencing, validating, or acting in a similar capacity', for 'Providing computational work, operating a node or oracle service, procuring, offering, or utilizing network bandwidth', or for developing or publishing a distributed ledger system or wallet software. A further subsection protects 'Providing a user interface that enables a user to read and access data', administering a decentralized governance system, 'operating or participating in a smart contract-based liquidity pool', and distributing wallet software. None of it touches 'the anti-fraud, anti-manipulation, or false reporting enforcement authorities of the Commission'. Subsection (g) preempts state law: 'no securities, commodities, or digital assets law of any State or of any political subdivision of a State shall apply to an activity described in subsection (b) or (d)', with state anti-money laundering, anti-fraud and anti-manipulation authority preserved. Subsection (h) says the section 'shall apply to conduct occurring before, on, or after the date of enactment'. The rules themselves are left to the agencies. The CFTC, in consultation with the SEC and the Treasury, is to adopt 'tailored, clear, and specific rules' on how a controlling person complies with registration, conduct, disclosure, recordkeeping and supervision requirements, and the Treasury is to write rules defining Bank Secrecy Act compliance for those the CFTC determines must register. The rulemaking is to be activity-based: the Commission is to determine requirements 'only with respect to digital commodity-related activities, based on the functions performed by the controlling person or group of persons, including brokerage, dealing, trading, execution, clearing, or custody of digital commodities, without regard to technological form, distributed architecture, or purportedly decentralized characterization'. Nothing in it may be read to 'require a distributed ledger system or any software code to register with the Commodity Futures Trading Commission in its own capacity' or to 'prohibit the launch, deployment, or operation of a distributed ledger system', and the rules must 'protect the rights of software developers, publishers, and users to create, publish, and use code and software in a manner consistent with the First Amendment to the Constitution of the United States'.

Why it matters

The interesting thing about the bill's DeFi chapter is that it does not try to define decentralisation. It defines the absence of it, and it does so with a control test whose three limbs are alternatives, so a protocol fails if any one of them is met. The first limb is the one the reporting has noticed, and it is the familiar one: somebody can materially alter how the thing works. The second is the one that will decide cases, because it holds a protocol to running 'solely on pre-established, transparent rules encoded directly within the source code', and almost nothing in production does. Upgradeable proxies, admin keys, fee switches, parameter votes that take effect without a redeployment, oracle selection, pausing: each of these is a way in which the rules are not wholly in the source code, and any one of them takes a protocol out of the safe category and into the registered one. The security council carve-out is the concession that stops the test collapsing entirely, and it is written narrowly enough that it may not survive contact with the second limb. The second thing to see is the bargain. This chapter is not only a registration requirement, it is a preemption clause, and the two are priced against each other. A developer who stays inside the protected activities gets every state securities, commodities and digital asset law lifted off, which is not a small thing for an industry that has spent three years being sued by state regulators one at a time, and this corpus has carried actions from Michigan, New Jersey, Washington, Wisconsin and Baltimore in as many months. The retroactivity in subsection (h) is the sharp end of the same trade: the protections reach conduct that has already happened, which is precisely what a defendant in a pending state proceeding would want. What the industry gives up in exchange is that whoever holds the keys registers, keeps records, supervises, and becomes a financial institution for Bank Secrecy Act purposes. Third, the drafting anticipates the obvious avoidance. Requiring the CFTC to determine obligations 'without regard to technological form, distributed architecture, or purportedly decentralized characterization' is an instruction to look at what the arrangement does rather than at how it describes itself, which is the same instinct as the Citadel Securities letter filed the day before on the other side of Washington: a firm should not choose its regulatory treatment by choosing its own label. Both documents, one legislative and one administrative, are attempts to take the naming power away from the party with the most to gain from naming. And finally, the narrowing of the DeFi provisions to 'spot and cash digital commodity transactions' is a smaller clause than it looks. It is there because tribal governments were worried about blockchain prediction markets, a live fight in this corpus with cases running in Michigan, New Jersey and the Ninth Circuit, and it means the DeFi registration machinery does not reach event contracts by accident. That is a carve-out obtained by a constituency with no obvious stake in DeFi, which is a fair description of how the rest of the 630 pages came to look as they do.

What is not settled

Whether the bill passes is the first question and the desk has no view: the vote on 15 September is procedural and needs sixty, and the reporting is that Democratic support is not there. Everything below assumes it does. The rules that decide who is caught do not exist, and the bill sets no date for them. Section 10102(b) gives the SEC 360 days for the ancillary asset rulemaking; sections 10301 and 20209(b) give the CFTC, the SEC and the Treasury no deadline at all for the rules that say which protocols must register and what Bank Secrecy Act compliance means for them, so the statute could be law for years with its central operative question unanswered. Nothing in the text says how the three limbs of the control test interact with one another in a hard case, and nothing says who bears the burden of showing that a protocol runs solely on rules encoded in source code. The interaction between the security council exclusion and the second limb is not addressed. It is not clear what happens to a protocol that is non-decentralized on the second limb but has no identifiable person to register, since the bill forbids requiring a distributed ledger system or software code to register in its own capacity. The preemption in subsection (g) reaches only activities described in subsections (b) and (d), so a person outside those lists keeps every state law and the boundary is the whole question; whether the retroactivity in subsection (h) reaches proceedings already filed is not stated and will be litigated. On the ethics provisions, which Democrats have said are the sticking point, the text has not moved and the detail is worth stating precisely: the ban covers a public official or employee and their spouse, applies only to issuing or sponsoring a digital asset 'in exchange for consideration', has safe harbours for a qualified blind trust or divestment, does not take effect until the earlier of 360 days after enactment or 60 days after the ancillary asset rule is published, applies only to conduct on or after that date, and ceases to have force at noon on 20 January 2029, which is the moment the current presidential term ends. The desk read the bill text and the senator's release; it did not find a section-by-section summary published for this version, and the summary on the site is the one issued with the July text.