The Senate Rewrote DeFi's Definition. It Now Turns on Who Holds the Keys.

Senate Republicans circulated a revised Digital Asset Market Clarity Act on 10 September 2026, and most of the coverage counted things: 630 pages, more than 114 provisions requested by Democratic senators, one procedural vote on 15 September that needs sixty senators to clear. Page counts are not events. The event in this draft is a single new statutory category, and the one-sentence test underneath it that will decide which protocols sit inside the perimeter.

The draft creates a class it calls non-decentralized finance trading protocols. The registration trigger covers anyone who retains authority to control or materially alter a protocol's functionality or consensus rules. Those protocols would have to register with the Commodity Futures Trading Commission, and the bill directs the CFTC and Treasury to write the implementing rules.

The test is control, not decentralisation

Notice what the trigger does not ask. It does not ask how many addresses hold the governance token or how they are distributed. It does not count validators or nodes, set a floor for total value locked, measure how long the protocol has been running, or look at how much of the code came from a single team. Every one of those is a decentralisation metric. Every one has been floated in some earlier framework. None of them is the test here.

The test is retained authority, and it asks a question about capability rather than distribution: is there still anyone who can change how this thing works? That question usually has an unambiguous answer, discoverable by reading a contract. And it points directly at three pieces of infrastructure that sit inside a large share of live DeFi protocols.

• Upgradeable proxy contracts, where an admin address can swap the implementation the proxy delegates to. The ability to replace the logic is, on the plainest reading, authority to materially alter functionality.
• Admin multisigs and guardian keys, usually justified as an emergency brake — pause deposits, halt a market, freeze a vault mid-exploit. The justification is good. The authority is still retained.
• Governance timelocks, which delay an executed change rather than prevent it. A timelock constrains when authority is exercised and how visibly. It does not remove the authority.

These have been described for years as temporary safety measures — scaffolding to be dismantled once a protocol matures. In practice the dismantling rarely happens, because the same argument that justified the pause switch during the last exploit justifies keeping it before the next one. Under this draft, that unresolved scaffolding is the registration trigger. A protocol whose team sincerely believes it is decentralised, and which by most published metrics is, can still fail this test on the strength of a multisig nobody has touched in two years.

An old question arriving through a new door

This is a control test, and control tests are not new to US financial regulation. The efforts-of-others prong of the Howey analysis — the part asking whether investors depend on the managerial work of an identifiable group — has been the securities-law lens on crypto from the beginning, and it is fundamentally a question about who is steering. The CLARITY draft asks a structurally similar question and arrives at it from the commodities side, through a registration requirement rather than through the definition of a security.

The practical difference is who answers it, and when. Under the securities analysis the question gets litigated after the fact, case by case, with the burden on an enforcement agency. Under a registration trigger the question is answered in advance, by the protocol itself, on a form, with the consequences of getting it wrong landing on the filer. That is a real shift in who bears the cost of ambiguity, and it is the part of this that protocol counsel should read first.

Where the provision stops

Two things narrow it, and the honest case against the reading above rests on both. The DeFi provisions in this draft were cut back to cover only spot and cash digital-commodity transactions, a change reported to be aimed at tribal-government concerns about prediction markets. That is a genuine limit: a protocol outside that transaction perimeter is not swept in by the trigger regardless of who holds its keys. Reporting on the draft also indicates it preserves protections for software developers and for genuinely decentralised governance systems, which suggests the category is meant to catch the decentralised-in-name-only case rather than function as a general net.

The second limit is larger. The bill directs the CFTC and Treasury to write the rules, which means the operative scope of retains authority to control or materially alter does not yet exist. Whether a two-of-three multisig with a seven-day timelock and no unilateral upgrade path counts is not answered in the statute. It will be answered in a rulemaking that has not started, by agencies with their own views about what they want to supervise. Anyone reading the draft text as a settled compliance obligation is reading it too literally.

So the counter-argument is that this provision is both narrower than it looks and unknowable in detail until rulemaking, and both halves of that are correct. What it does not do is make the provision unimportant. Statutory categories are sticky. Rulemaking fills in a boundary; it rarely relocates one. Once non-decentralized finance trading protocol exists as a thing Congress has named, the argument shifts from whether protocols with retained authority are regulable at all to how much retained authority is too much. That is a substantially worse starting position than the one the industry held on 9 September.

Monday's vote is about something else entirely

None of the above decides the 15 September cloture vote. Senator Cynthia Lummis has said Republicans incorporated more than 114 provisions requested by Democratic senators. The ethics language that Democrats have made the price of their support is, according to reporting on the revised text, unchanged. That is the arithmetic that matters on Monday, and it means the bill can fail without a single senator having formed a view on the control test.

Which is exactly why the provision is worth reading now rather than afterwards. If cloture clears, the category ships inside 630 pages that nobody will re-litigate clause by clause. If it fails, the definition does not disappear — it returns to the drafting pool as settled language, the version everyone starts from next time. Either way, the test that appeared on 10 September is probably the one the industry argues about for the next two years. And the thing it asks about is not decentralisation. It is whether anyone still has the keys.