Partnered With:

Introduction a16z's proposal for the Web3 regulatory framework

Read this article in 71 Minutes

It is possible to see national regulators shackling CeFi in 2023, but not DeFi. a16z put forward suggestions on Web3 regulatory framework according to its own practice, which is worth our reference and learning.

原文标题：《一文导读 a16z 对 Web3 监管框架的建议（监管应用，而非协议）Part I，Part II》

The way of DeFi, the way of defi.

With the collapse of Luna/USDT, Three Arrows Capital, and FTX, the turbulent year of 2022 has come to an end, and global regulators have finally realized the urgency of regulating the Web3 crypto industry. For example, at present, all walks of life in the United States have gradually formed a unified attitude towards Web3 crypto assets and technological innovation: accelerate regulatory innovation, not miss any revolutionary opportunity, and ensure that Web3 revolution happens in the United States! Then, both at the federal and state levels, traditional finance and Web3 derivatives of the Internet -- centralized financial CeFi (such as CEX, Wallet service providers, stablecoin issuers, etc.) are incorporated into the regulatory framework of traditional finance. And targeted according to the Web3 crypto industry based on the characteristics of blockchain legislative supplement.

We could see regulators around the world shackle CEFIs by 2023, but they are flounder when it comes to DEFIs, such as the infamous OFAC "one-size-fits-all" sanctions against Tornado Cash. a16z's General counsel, Miles Jennings, responded by 'regulating Web3 Apps, Not Protocols' on 29 September 2022 and proposed the regulatory framework for Web3: It doesn't make sense to regulate smart contract protocols, but rather Web3 applications.

Since then, a16z has made recommendations for the Financial Stability Board's "Global Regulation of crypto Asset Activities" framework on 15 December 2022, including regulatory recommendations for DeFi, It believes that Web3 should not adopt its principle of "Same Activity, Same Risk, Same Regulation", because the current traditional financial regulatory framework is not suitable for decentralized Web3 applications. More recently, on 11 January 2023, Miles Jennings published "Regulate Web3 Apps, Not Protocols Part II: The paper Framework for Regulating Web3 Apps "further discusses in depth and detail the core of the Web3 regulatory framework: enterprise (business) should be the focus of regulation, rather than a decentralized software protocol which operates autonomously.

In the following, we will first understand the concept, characteristics and advantages of DeFi, so as to better understand the logic of Web3 regulatory framework in Miles Jennings' article. Then we will see why we should establish a regulatory framework for DeFi from the DeFi regulatory proposal of a16z to FSB. Finally, we further refine our understanding of the Web3 regulatory framework (applications should be regulated, not protocols) by referring to the current state of regulation in Miles Jennings' second article.

One, what is DeFi

DeFi stands for Decentralized Finance. DeFi project uses blockchain technology and smart contracts to realize various functions of traditional financial institutions, such as lending, trading, wealth management, derivatives, asset management and insurance. The biggest difference between DeFi and traditional financial institutions is that it is decentralized, does not rely on any third party intermediary to realize the financial function, is open and transparent, the transactions cannot be tampered with, and can be audited and traceable.

Marvin Ammori, Chief Legal Officer at Uniswap, Decentralized Finance: What It Is, Why It Matters "notes that some of the key features of the DeFi protocol, particularly Permissionless and Transparent, embody Ethereum's key values.

The "Permissionless" feature is available to both end users and developers: anyone in the world with an Internet connection can access the DeFi protocol, regardless of race, gender, age, wealth or politics. In addition, any developer can safely build on the agreement because no central authority can revoke their access. "Transparent refers to the auditability inherent in the DeFi protocol: Because the DeFi protocol is always open source, all underlying code is always reviewable, all related funds are auditable, and all transactions are recorded on the blockchain.

These features of DeFi will unlock huge potential in the future. For example: (1) Lower barriers to entry for developers and users based on the open source, license-free nature of Ethereum application code, such as "trading platform aggregators" directly accessed via public APIs; (2) The transparency and auditability of DeFi's accounting means that rigorous risk assessment and risk management can be achieved, such as setting the ratio of collateral and the degree of leverage; (3) Using smart contract escrow account without any trust endorsement, users can be guaranteed at the level of agreement, such as MakerDAO's risk compensation mechanism; (4) Blockchain infrastructure can solve the problem of instant settlement and payment more efficiently, which is more efficient than traditional finance; (5) Global liquidity pools and unified markets, which can provide higher liquidity and higher user access; (6) Open and transparent databases and real-time ledgers can provide more information to market participants; (7) DeFi's "self-custody" helps eliminate the credit risk of intermediaries and counterparties, and can bypass the supervision of CeFi custodian companies, such as FinCEN.

At the same time, Marvin Ammori also mentioned that DeFi needs a clear regulatory framework. Now, regulators are conducting an assessment of DeFi technologies, markets and players to determine the appropriate regulatory framework. The objectives of regulation are to: ensure adequate transparency for users and regulatory enforcement; Targeting fraud; Protect consumer freedom and privacy. In recent years, however, policymakers and regulators have focused more on the negative aspects of Web3 (such as the use of bitcoin for illicit financing and risky investments through Ethereum and early Token sales), often failing to recognize the more positive aspects of Web3. As a result, some regulators have misinterpreted DeFi (including DeFi's decentralization of the roles of different actors and the blockchain - and smart-contract-based technology) in much the same way that they tried to hold the inventors of SMTP responsible for every piece of spam ever sent, or HTTP for every illegal website.

Ii. Web3 Regulatory Framework proposed by Miles Jennings (regulatory applications, not protocols)

When you understand DeFi and its characteristics and advantages, you can further understand the logic of Miles Jennings' article "regulating Web3 Apps, Not Protocols" on coming up with a Web3 regulatory framework (regulating applications, not protocols). Miles Jennings first started from the main factor that led to the prosperity of Internet economy (the government did not regulate basic protocols, but regulated applications). He believed that the regulation principles of Internet should also be applied to Web3. The main question was which level of Web3 should be regulated. In combination with the decentralized and objective characteristics of Web3 protocol code (the protocol cannot comply with subjective rules and the protocol cannot comply with global regulations), it is concluded that the regulation at the protocol code level is not feasible and meaningless, and should be conducted at the more subjective and active application level.

Here is what is compiled, enjoy:

Regulate Web3 Apps, Not Protocols

Many early proponents of the Internet argued that it should remain free and open forever, a borderless and unregulated utopia for all mankind. But over the past two decades, as governments have increasingly regulated online activity, that vision has become clouded. Still, many of the Internet's underlying communications technologies, such as HTTP (the exchange of data for websites), SMTP (E-mail) and FTP (file transfer), remain as free and open source as ever.

Governments around the world have maintained their commitment to the Internet by embracing this open source, decentralized, autonomous, and standardized protocol technology. When the United States passed the Scientific and Advanced Technology Act of 1992, it paved the way for the Internet to flourish commercially and did not tamper with TCP/IP, the computer networking protocol. When Congress passed the Telecommunications Act of 1996, it did not interfere with the way data moved across networks, but still provided enough regulatory transparency to allow the United States to dominate the Internet economy alongside today's giants like Alphabet, Amazon, Apple, Facebook and others. While there is no perfect law, these legislative guarantees allowed the industry and innovation that gave birth to many of the Internet services we enjoy today.

The main driver of the Internet boom: Instead of regulating the underlying protocols, governments are trying to regulate applications, such as browsers, websites and other user-facing software programs, often called "clients," through which users access the Web. And Web3 -- the next generation of the Internet will yield new "clients" such as Dapps, wallets, and advanced decentralized protocols (including value-exchange settlement contracts via blockchain and smart contracts). Then the same regulatory principles should be extended to Web3, rather than debating whether Web3 should be regulated. While regulation is necessary, welcome, and reassuring to users, the real debate is about what level of technology regulation should go to that makes the most sense for Web3.

Today, web users can access regulated browsers, websites, applications, etc., through regulated Internet service providers, many of which have been developed relying on free and open protocols. Governments can regulate by imposing access restrictions on website content, or requiring compliance with privacy rules and copyright norms, such as the US government forcing YouTube to remove terrorist recruitment videos without interfering with Dash (video streaming protocol).

It is not feasible to regulate the protocol layer for the following reasons: (1) Technically, objective protocols cannot be subject to regulatory compliance by subjective judgment; (2) It is impractical and may even cause conflicts for the agreement to be subject to different regulatory regulations in different jurisdictions around the world; (3) Given that regulatory compliance is subjective at the application or client level, it is unnecessary and counterproductive to revise the code at the protocol level. Let's explain each reason in more detail.

1. The agreement cannot abide by subjective rules

No matter how well-intentioned the regulation, it would be disastrous for the agreement if it required subjective evaluation.

Take spam. Everyone hates spam, but what would the Internet look like today if regulations made it illegal for the email protocol (SMTP) to facilitate the sending of spam? The answer is: not well. Because spam is subjective, and opinions change over time. Big companies like Google spend huge amounts of money trying to eliminate spam from their email applications or clients like Gmail, but still fail. Moreover, even if some regulators force SMTP to filter spam by default, because the protocol is open source, malicious actors can simply reverse engineer the filter to break it. So for spam policing, banning SMTP is either ineffective or the end of email.

在 Web3，我们可以将电子邮件类比为去中心化自治协议（DEX）中的 Token （tokens）。如果监管希望在协议层面对它们认为可能构成「证券」或「衍生品」的某些 Token 进行交易禁止，它们需要阐明客观的协议层如何在主观上能够符合如此分类的技术规范。定义加密资产是「证券」还是「衍生品」的判断是主观的，需要对事实和法律进行分析，就连美国证券交易委员会（SEC）也在努力解决这个问题。因此，这种主观的分类技术标准是不可能的实现的。

Trying to embed subjective analysis in the underlying layer of code is a fool's game. Like SMTP, a decentralized autonomy protocol like DEX cannot make subjective analytical judgments without human intervention. If there is artificial subjective intervention, then the decentralization and autonomy of the protocol is violated. Therefore, if such regulatory regulations with subjective judgment rules are applied to DEXs, it will limit the technological innovation of Web3 as a whole and will endanger the vitality of all Web3 applications.

2. The agreement fails to comply with global regulations

Even if it were technically possible to construct protocols capable of making complex and subjective decisions, it would be impractical to implement them on a global scale.

Imagine a scenario in which SMTP enables us to send email to anyone in the world, but if the US government requires SMTP to filter spam, we can assume that foreign governments will take similar steps. Moreover, since the definition of spam is subjective, we can also assume that the definition will vary from government to government. So even if it is technically possible to construct protocols that make complex and subjective decisions, doing so runs counter to the idea of establishing a standard protocol that is practical on a global scale. It is not possible for SMTP to consolidate the ever-changing spam filter requirements of 195 countries and territories, and even if the protocol could, it would not be able to locate which country the user is in and how to fairly account for conflicting requirements. Adding subjectivity to the agreement undermines the bedrock on which it is built: standardization.

规则依赖于上下文。在 Web3，证券和衍生品法律法规对于 Token 的定义因国家而异，并且这些法律法规在不断变化。DEX 无法为这些法律法规建立一个全球标准，就像 SMTP 一样无法根据地理位置限制访问。归根结底，如果协议被要求建立在不断变化的全球监管之上，就不可能成功。

3. Monitor applications or clients

Now we can see why applications should be regulated rather than protocols. Application level regulation can achieve the goal of regulation without compromising the underlying technology, which has been successfully proven in the Internet age.

Because early protocols were open source, decentralized, autonomous, and standardized, they are still available more than 30 years later. But the government can limit the information passed through these protocols by regulating applications. Or as the United States does through Section 230 of the Communications Decency Act of 1996 to protect the free flow of information. Each country can set its own standards and require browsers, websites and applications in its own jurisdictions to be able to develop products that meet the standards.

The relationship between protocols and applications in the Internet era is the same as it was in Web3, so the principles governing Web3 should remain the same. Web3 applications, such as wallets, Dapps, and others, enable users to deposit crypto assets in liquid pools of loan agreements, purchase NFT through marketplace agreements, and trade crypto assets on DEX. These wallets, websites and apps could be regulated in the jurisdictions where they seek to provide access, and it would make sense to do so.

The first generation of the Internet gave us incredible tools in the form of networking, data exchange, E-mail, file transfer protocols, all of which made it possible for information to move across the Internet. Web3 makes it possible to transfer value over the Internet, as lending and asset exchange have become native features of this new generation of the Internet. This incredible public good must be protected. As Web3's decentralized finance (DeFi) spreads to video games, social media, the creator economy, and the gig economy, how regulation levels the playing field will become even more important. Weighing all the factors, the right approach becomes obvious:

Apps should be regulated, not protocols!

3. a16z Direction FSB's DeFi Regulatory Framework proposal (regulatory application, not protocol)

a16z made recommendations for the Financial Stability Board (FSB) 's "Global Regulation of crypto Asset Activities" framework on December 15, 2022. The main elements include regulatory proposals for DeFi, conflicts between privacy and illicit financial activities, and regulatory proposals for algorithmicStablecoins. a16z believes that the FSB should not adopt its regulatory principle of "Same Activity, Same Risk, Same Regulation" for the Web3 crypto market, because the current traditional financial regulatory framework is not suitable for decentralized Web3 applications. By comparing the differences between CeFi and DeFi, as well as the differences between DeFi protocol and DeFi application, a16z proposes a regulatory framework (regulatory application rather than protocol) suitable for DeFi, and draws the conclusion that traditional CeFi regulatory regulations cannot be applied to DeFi.

Here is what is compiled, enjoy:

Financial Stability Board, International Regulation of Crypto-asset Activities: A Proposed Framework -- Questions for Consultation

DeFi application is a crucial link in the blockchain ecosystem. As the traditional financial regulatory framework aims to eliminate the trust risk of financial intermediaries in order to reduce possible conflicts of interest or fraudulent behaviors, DeFi eliminates the existence of intermediaries in the market based on the open and transparent, open source, auditable and traceable characteristics of blockchain. It is no longer appropriate to use the traditional financial regulatory framework to supervise DeFi. Therefore, it is very necessary to develop a regulatory framework applicable to DeFi to avoid regulatory conflicts and excessive regulation. DeFi's regulation should focus on apps rather than smart contract agreements, because apps can subjectively comply with the regulatory laws and regulations of individual jurisdictions, whereas objective on-chain smart contracts cannot.

1. Differences between CeFi and DeFi

CeFi, or centralized finance, is run by a centralized management team, and users access the crypto market through third-party intermediaries such as CeFi. CeFi is usually a traditional corporate legal person, whose decision-making process and operation management are usually opaque. The company's decision-making represents the interests of a small group of people, which is in subjective conflict with the interests of market consumers. Typical CEFIs are like centralized trading platforms such as FTX.

DeFi, or decentralized finance, is composed of software protocols and deployed on blockchain. It provides users with a large number of non-intermediary financial products and services through smart contracts. Users interact directly with smart contract protocols without any intermediary trusted endorsement. Anyone can check and audit the DeFi protocol ledger on the blockchain as well as a record of the price and quantity of each transaction. A well-known DeFi loan protocol Compound, for example, has a transparent, unalterable blockchain ledger that publicly checks all transaction histories.

The DeFi protocol has proved resilient to market pressure during the wild volatility of the crypto market in recent years. The bulk of the crypto market blowout was concentrated in CefIs like Celsius Network, Voyager Digital, and FTX, while truly decentralized DeFi protocols like Compound and Uniswap were operating as normal. This shows the advantage of DeFi smart contracts.

2. DeFi's regulatory framework (regulatory applications, not protocols)

The DeFi protocol is software code made up of smart contracts that provide peer-to-peer lending and other financial transactions. Hosted or integrated on blockchains such as Ethereum, the DEFI protocol is open-source, decentralized, autonomous and censoring resistant. Among them, decentralization and censorship resistance have special regulatory and legal significance.

Decentralization has multiple meanings, including governance, decentralization at the legal level (because no one controls the public chain), and decentralization at the software architecture level. a16z points out in its article "Principles & Models of Web3 Decentralization" that Web3 application can decentralize Legally by meeting the following two points: (1) All operational management information is transparent and available for all to consult at any time (through transparent blockchain distributed ledger); (2) No additional management effort by a centralized team is required to drive project success or failure (through smart contracts, decentralized economic models, and DAOs).

The fact that no one controls the agreement and the very objective reality that "Code is Law" makes it difficult for DeFi to conduct subjective legal compliance operations as required by the traditional financial regulatory framework. In addition, once deployed, DeFi protocols run permanently on the blockchain and cannot be taken down like apps, such as Tornado Cash protocols that operate autonomously on Ethereum even if the wallet address is sanctioned.

DeFi applications are front-end products built on top of the DeFi protocol, allowing users to interactively access the DeFi protocol. Unlike the protocol layer, the developer of a Web3 application can make a subjective decision as to whether the application needs to comply with a country's regulations, or can flexibly design to avoid a country's regulations and compliance risks.

3. Traditional CeFi statutes should not apply to DeFi

The traditional financial regulatory framework designed for CeFi should not be applied to DeFi because the two are fundamentally different. For CEFIs, regulations are designed to remove trust risks from financial intermediaries in order to reduce potential conflicts of interest or fraud. As for DeFi, blockchain technology has the characteristics of openness, transparency, decentralization and no trust endorsement. It directly eliminates the financial intermediation in the market, which naturally solves the problem that CeFi aims to solve, and DeFi does better than CeFi in many aspects. For example, blockchain's open, transparent, auditable and traceable features directly address the SEC's lifelong pursuit of complete information disclosure. Therefore, it is illogical to apply CeFi regulation on a large scale to decentralized Web3 applications that do not have financial intermediation. Decentralized Web3 applications have already achieved the goals of CeFi regulation such as transparency, auditability, traceability, and responsible risk management.

4. Proper regulation can ensure the development of DeFi industry

This regulatory principle of DeFi (regulating applications rather than protocols) allows smart contract protocols to be used as network infrastructure to continuously improve the Web3 ecosystem, benefiting DeFi's millions of users. Because the DeFi protocol runs autonomously on the blockchain, it is open and accessible to anyone anywhere in the world, creating unprecedented opportunities for financial inclusion, especially for emerging markets where trust in political authorities and financial institutions has been compromised. Latin American countries lead the world in the use of DeFi protocols, and DeFi is also gaining ground in some African countries, such as Nigeria and Kenya.

4. Miles Jennings & Brian Quintenz further explains Web3's regulatory framework (regulating applications, not protocols)

On January 11, 2023, Miles Jennings, a16z's General Counsel, and Brian Quintenz, General Policy Counsel, published "Regulating Web3 Apps, Not Protocols Part II: Framework for Regulating Web3 Apps ", which is a derivative of the Web3 regulatory framework proposed by Miles Jennings and the DeFi regulatory framework proposal proposed by a16z for FSB. The aim is to establish an appropriate Web3 regulatory framework for Web3 that preserves the innovation and advantages of Web3 while preventing harm to consumers from illegal risk activities.

This article continues the point made in Part I - applications (enterprises) can customize compliance applications based on the regulatory requirements of the place where they operate, whereas globally common and autonomously run software protocols cannot be subject to subjective judgment based on the regulatory requirements of the place where they operate. In addition, focusing on the policy objectives of Web3 regulation -- reducing the risk of illegal activities, providing strong consumer protection to achieve the policy objectives, and eliminating behaviors that run counter to the policy objectives, it is concluded that regulation at the level of Web3 applications can achieve the regulatory objectives and promote the innovation at the level of Web3 protocols. This regulatory framework is in the best interest of the public.

At the same time, this paper continues the conclusion that application rather than protocol should be regulated in Part I, and combines the actual regulatory situation in the Web3 industry: (1) Whether the regulation can meet the policy objectives (for example, because DeFi's decentralization features replace the regulatory objectives of traditional financial regulation which need to eliminate the risks of financial intermediaries, then it is no longer appropriate to apply the traditional financial regulatory framework to DeFi); (2) Features of Web3 applications (consider whether the application is for profit and whether the main purpose of the application is legitimate); (3) The constitutional significance of regulatory regulations (such as whether the freedom of speech and the constitutional right to protect private property are violated due to excessive regulation), to further discuss the circumstances in which Web3 applications need to be regulated and in which cases they do not need to be regulated. Finally, further refine and clarify the core of the Web3 regulatory framework: enterprises (applications) should be the focus of regulation, not decentralized software code that runs autonomously.

Here is what is compiled, enjoy:

Regulate Web3 Apps, Not Protocols Part II: Framework for Regulating Web3 Apps

There are two extreme groups on Web3 regulation. At one extreme is the application of the existing regulatory framework to Web3. This group ignores the key technical features of Web3 and fails to recognize the significant differences between Web3 product services and traditional product services. This perception led directly to the advocacy of this group to regulate the DeFi in the same way that the CeFi was regulated. At the other extreme, Web3 should be completely excluded from the existing regulatory framework. This group ignores the economic realities of many Web3 products and services and tries to escape the regulatory framework that has successfully enabled the US capital markets to flourish.

The right approach to regulating Web3 is somewhere in between. In this article, we will explore a pragmatic framework for Web3 regulation that follows the principles of previous articles -- namely, regulation of Web3 must only apply at the application level (programs that provide user access to protocols) and not at the protocol level (underlying decentralized blockchains, smart contracts, and network infrastructure).

In short: regulate businesses, not software.

Whereas an enterprise can tailor its applications to the regulatory requirements of the place where it operates, globally common and autonomously run software protocols are not subject to the regulatory requirements of the place where it operates. This is why, throughout the history of the Internet, government regulation has always chosen to regulate applications such as email providers, such as Gmail, rather than the protocols underlying email, such as SMTP. Global regulatory conflicts and inconsistent subjective judgments will hinder the ability of software protocols to operate autonomously and interact, making them ineffective.

During the explosive growth of the Internet over the past few decades, the public interest was best served by regulating applications rather than protocols. While the complexity at the technical level of Web3 adds regulatory challenges, the regulation of Web3 applications does not need to address illegal activity at the protocol level. Just as we don't regulate SMTP because email can facilitate illegal activities. However, the regulatory framework for Web3 must reduce the risk of illegal activity, provide strong consumer protection to achieve policy objectives, and eliminate behaviour that runs counter to policy objectives -- all of which can be done most effectively at the application level.

We believe that the regulatory framework for Web3 should focus on three interrelated factors:

l The policy objectives of regulatory formulation must be clear. If a regulation does not achieve a reasonable purpose, it should not be adopted.

l Regulation must take into account the characteristics of Web3 applications to determine the scope of regulation.

l must consider whether Web3 regulations are unconstitutional, and a detailed analysis based on facts can provide reference for regulatory enforcement and judicial opinions.

Based on these factors, our proposed initial regulatory framework is as follows (it is important to note that any regulatory implementation and implementation will depend on specific circumstances), and in light of our proposed regulatory framework for Web3, we will discuss it in more detail below to better understand how and why regulations should be applied to Web3 applications.

1. Policy objectives of Web3 regulation

Regulation should be consistent, as the phrase "same activity, same risk, same rules" seems to apply to many Web3 applications. A closer look, however, shows that this statement does not apply to all Web3 applications because Web3 has different functionality and risk control Settings at the application level and protocol level. Therefore, we must clarify the policy objectives of the regulatory regulations to understand whether differences in functionality and risk control require a different regulatory approach to Web3.

A regulation can achieve multiple policy goals, including protecting investors and consumers, encouraging innovation, promoting capital formation and the efficiency of capital markets, encouraging (or limiting) competition, and protecting national interests. Sometimes, however, regulations fail to achieve their purpose. This may be because a regulation exceeds its original purpose, it may be applied too broadly for its intended purpose, it may create negative factors that were not considered, or it may be that implementing the regulation stifles the value of technological development. In these cases, the continuation of a regulation may be to protect vested interests or to regulate for regulation's sake, neither of which is acceptable.

A historical example illustrates this point. In 1865, the British Parliament passed a locomotive Act, which restricted the speed of cars in cities to two miles per hour and required a man to wave a red flag in front of the car. While a "red flag bill" may be appropriate in an age of few cars and ubiquitous pedestrians, it would be absurd if it were required to be enforced today and would be very detrimental to the development of a currently well-functioning transportation economy. With advances in automotive technology, road infrastructure, transportation and traffic control agreements, it is clear that the act is out of date. Similarly, given the technological advances that Web3 represents, any one-size-fits-all approach to regulation would be as anachronistic as the locomotive bill. This will greatly undermine the rationality and effectiveness of regulation.

Applying regulatory regulations to protocols (as opposed to Web3 applications) leads to equally absurd results. Just as the car brought about faster mobility, the new computing paradigm brought about by Web3 technology also brought about new networking capabilities (lending, trading, social media, etc.). The ability to deliver value at the speed of the Internet is an incredibly powerful primitive capability, and still in its infancy. If regulators impose subjective requirements on Web3 protocols as well as regulatory requirements that impose global conflicts (such as restricting trading in certain assets that require subjective judgments, such as securities or derivatives, or reviewing categories of speech), then regulatory compliance requirements may put development teams through a centralized process, To create the illusion of Web3 protocol governance command and control. While it is understandable that regulators look for centralized control and accountability bodies, governance of blockchain protocols is generally globally distributed and decentralized, to do otherwise would undermine the function and utility of Web3 protocols.

To be truly "technology neutral", regulation should not restrict or harm the technology it seeks to regulate. This is the fundamental reason why regulation should only apply to Web3 applications, because they are run by enterprises, which can abide by subjective rulemaking, whereas the underlying protocols as software code cannot. Similar ideas should be held further in the technology stack to protect the underlying functions of the blockchain (e.g., validators, miners, etc.). Regulation that undermines the value of technology is more Luddite than law.

Decentralization is one of the advantages of blockchain technology and has significant regulatory implications. Detractors often deride decentralization as an excuse, but blockchain decentralization is real, and it's a big deal.

Consider the difference between CeFi and DeFi. In the CeFi world, many regulations are designed to eliminate the risk of financial intermediaries requiring trust endorsements, with the aim of reducing the potential for conflicts of interest or fraud, especially if one has to trust others to deliver money or assets (see: FTX & Alameda, Celsius, Voyager, 3 AC, MF Global, Revco, Fannie Mae, Lehman Brothers, AIG, LTCM, and Bernie Madoff).

In DeFi's world, traditional financial intermediation services are eliminated and there is no need to trust any financial intermediation. True DeFi, therefore, eliminates much of the risk that many CeFi regulations are designed to address through the decentralization, open transparency, and no-trust endorsement that blockchain technology enables. By removing trust and reliance on financial intermediation, DeFi can distance users from the centralized risky behavior prevalent in CeFi and do a better job than any of the "self-regulatory" or "public regulatory" regimes in CeFi. In other words, it makes no sense to apply CeFi's "red flag behavior" -like regulation to DeFi, or: Don't be evil.

Therefore, it is illogical to apply CeFi regulations to all Web3 applications that do not provide similar mediation services. Moreover, any regulatory intervention would be counterproductive. Regulatory intervention will prevent DeFi from achieving the legitimate policy objectives pursued by many financial regulations, such as openness and transparency, auditability, traceability, responsible risk management, etc. Such regulation should be firmly resisted.

Nonetheless, given the multiple policy objectives of regulation, it is difficult to exclude all regulation from Web3, even in intermediate-focused areas such as financial services that DeFi has replaced.

Consider, for example, the difference between the "Broker" (BD) regulation under the US Securities Act and the "Introducing Broker" (IB) regulation under the US Commodity Derivatives Act. One purpose of the regulatory regulations related to BD is to protect investors from the inherent risks of intermediaries that hold investor assets in custody, while the rules of the regulatory laws related to IB focus on how conflicts of interest can lead intermediaries to influence transactions in the absence of custodial investor assets. While the decentralized nature of Web3 technology eliminates the hosting requirements associated with BD, this alone may not eliminate the hosting requirements associated with IB, especially if DeFi applications are making decisions on behalf of users (such as routing transactions).

Consider regulations that restrict the issuance and sale of securities and derivatives in the United States. These regulations serve multiple purposes, some of which have not been replaced by decentralization or Web3 technologies, such as those related to investor protection. If the same risks and considerations apply to centralized and decentralized businesses and technologies, the default position may be that the regulatory rules should be consistent unless there is some overwhelmingly sound policy purpose. For example, it might be possible to say that a centralized enterprise (such as a centralized trading platform like Coinbase) should be prohibited from earning commissions on securities and derivatives trades, but allow another decentralized protocol (such as a decentralized trading protocol like Uniswap) to earn commissions on these same types of trades. Such a regulatory approach may result in DEX having a significant competitive advantage over CEX and will lead to regulatory arbitrage. Therefore, this difference in regulatory approach needs to be justified by a compelling policy purpose, such as promoting decentralized innovation (which we discuss further below).

The above case is just the tip of the iceberg when it comes to the range of regulations that may apply to Web3 applications. However, as can be seen from the above cases, effective regulation should have clear policy objectives, appropriate scope of regulation, and fruitful effect. Taxonomies and classification problems like the one above are the bottom line of analysis: you must understand how DeFi works at a granular level. What every good-faith regulator learns as they embark on their blockchain learning journey is that the apparent essential similarities between traditional and blockchain finance mask deep operational, organizational, and functional differences.

2. Features of Web3 applications

The characteristics of a Web3 application determine the risks that can arise from this application, and these characteristics should be used to determine whether and to what extent regulation should apply. For example, many Web3 applications may not be fully distrustful because they host user assets, mediate user transactions, and promote or advertise certain assets, products, or services to users. Applications with these characteristics are the most likely to need regulation, as they are more likely to pose a legacy centralized risk to users and, if left unregulated, would be contrary to policy objectives. In addition to the risk characteristics of centralization, two important characteristics of Web3 applications also affect whether they should be regulated if Web3 technology does not interfere with the purpose of regulation: (1) Whether the application is operated by the enterprise for profit; (2) whether the intended primary purpose of the application is to evade regulation (i.e. whether the primary purpose is legal or illegal). We'll analyze many other factors in future articles, but for now, it's good to start with these two.

2.1 For-profit and non-profit

如果 Web3 技术不能替代监管的政策目标，那么无论该 Web3 应用程序是否是去中心化协议，如果它是由企业运营并以盈利为目的的，现有的强有力的推定是：这种企业应该受到监管。首先，应用程序是由企业以盈利为目的而运营的事实本身就可能使用户面临风险。例如，如果这样的应用程序为某些类型的金融交易提供便利，运营企业从这些交易中获利可能会产生固有的利益冲突。其次，如果监管法规不适用，未能禁止企业从非法活动中获利，那么这种监管法规实际上是在鼓励促进这种非法活动，并可能导致这种非法活动的增加。例如，允许企业对 Token 化证券或衍生品的非法交易收取佣金，可能会导致这种非法交易的增加，这将与这种监管背后的政策目标（减少这种交易的普遍性）相悖，协助和教唆的法律将这一论点作为核心原则。

Nonetheless, a more flexible approach to regulating Web3 applications for profit may make sense because of the benefits of Web3 technology. In particular, since Web3's decentralized protocols add native features to the Internet and are available to anyone, they can effectively function as a common infrastructure (similar to SMTP/ email). A flexible regulatory approach to Web3 applications that operate for profit can drive these agreements forward, facilitate development, and even allow developers to self-fund by operating for-profit applications. On the contrary, onerous access regulation or regulation of scale will prevent this technology from realizing its full future potential. Requiring developers to register under an overly burdensome regime, or to obtain expensive, time-consuming licenses to deploy a front-end site that provides access to a decentralized protocol, can significantly limit the growth of innovation in Web3 in the United States. Therefore, there is a strong public policy argument in favor of protecting embryonic Web3 applications from regulatory constraints to incentivise the development and adoption of Web3 infrastructure in the United States.

The argument for not regulating Web3 applications is even stronger if they are not run by a business for profit. For example, many Web3 applications operate as social public goods (that is, as pure unregulated communication and consensus software interacting with decentralized protocols). These Web3 applications may not raise the same concerns as above, because if no one is profiting, the incentive to create conflicts of interest or encourage operators to promote illegal activities is reduced or nonexistent. As noted above, the objective of any Web3 regulatory framework should be to reduce the risk and suppress illegal activity, not to eliminate its possibility. Therefore, if Web3 applications are not run by businesses for profit, then as much as possible, it is important to resist regulatory constraints that would undermine the important policy goals of fostering innovation in the United States.

2.2 Main Purpose

Even if a Web3 application is not intended for profit, its primary purpose may be important and may have significant regulatory implications. If the application is specifically designed to facilitate regulated activities, it can be assumed that such an application should be regulated. Indeed, many of these applications may already be regulated, even if they are simply front-end websites that display blockchain information and assist users in interacting with such blockchains. For example, through its enforcement actions, the CFTC has determined that certain communications systems are swap execution facilities (SEFs), which are managed by a centralized entity, established for trading derivatives, and provide enhanced functionality that meets the SEF definition, and should be regulated. However, it is important to note that other similar communication systems with SEF capabilities are not identified as SEFs because they are not built to facilitate derivatives trading, even though such derivatives trading is conducted on such communication systems.

Based on these examples from the CFTC, one might see a difference between the regulation of a front end built specifically for derivatives trading protocols, such as the much-maligned Ooki protocol, and a front end of a decentralized trading platform that enables the unlicensed listing and trading of any digital asset, such as the Uniswap protocol, Simple blockchain browsers, such as Etherscan, should be subject to the most lenient regulation. This different regulatory treatment makes sense because the primary purpose of the Ooki front end was allegedly to facilitate illicit transactions in the United States, while the primary purpose of the Uniswap front end and Etherscan was to facilitate activities that were legal in nature.

However, even if an app is specifically designed to promote regulated activity, it may be in the public interest to exempt the app from regulation. For example, if the trading of digital assets is regulated in the US and all trading platforms are required to register, there are good reasons why the full scope of this regulation should not be extended to an app that specifically provides users with decentralized trading protocols (assuming it is not operating for profit or is in the early stages of development). In particular, the decentralized nature of the protocol and the characteristics of application implementation may eliminate many of the risks that regulation was intended to address (according to the previous section), and the potential social benefits from giving the Internet unconstrained transaction capabilities may significantly outweigh all regulatory policy objectives.

Finally, whether or not Web3 applications are for profit, and whether or not their primary purpose is legal, all applications should continue to be subject to existing legal frameworks, such as the new narrowly defined consumer protection requirements that many applications should be subject to. First, there is value in maintaining the existing legal framework relating to fraud and other prohibited malicious activities. But enforcement actions against protocol or app operators who are not engaged in malicious activity violate basic concepts of due process and justice. Second, consumer protection regulations, such as disclosure requirements, can help inform users of the risks of using a particular DeFi protocol, while code audit requirements can protect users of an application from smart contract failures of the underlying protocol. However, any such requirements also need to be customized so that Web3 applications and their developers can comply, even if they do not control the decentralized protocols they provide access to.

3. Meaning of the Constitution

The regulation of Web3 has potential constitutional implications, and there is every reason to believe that the courts will ultimately defend Web3. While the constitutional arguments in defense of Web3 today focus on the single issues raised, they all presage a series of arguments about the nature of individual, collective, and national sovereignty and important national and global law.

Now, consider these trends and inferences. Although they are based on the U.S. Constitution, they are also similar to other constitutions and international legal frameworks:

Many argue that the First Amendment protects software developers because code is speech. So is the right to cryptocurrency transactions included in the First Amendment? Does free association include a fundamental right to privacy on the chain? Many also believe that the Fourth Amendment may protect DeFi protocols from having to meet the burden of using intermediaries to gather KYC information or to meet regulatory compliance. Do people have a right to security against unreasonable searches and seizures in their on-chain identities, gaming, social networks and assets (for example, by expanding the global civil asset forfeiture regime)? Recent case law further suggests that it may be unconstitutional for regulatory agencies to extend their jurisdiction to cover Web3 rulemaking without specific authorization from Congress. What should multi-institutional cooperation look like to ensure the norms, transparency, legitimacy, and ultimately effectiveness of the Constitution? This applies not only to the SEC and CFTC, but also to the US Treasury, the Federal Reserve, the Federal Trade Commission, the Department of Justice and regulators around the world.

All of this discussion is realistic and raises fundamental civil rights issues. In any case, however confident these constitutional challenges may seem, their impact remains uncertain. It is therefore foolish for participants in the Web3 industry to refuse to participate in the formulation of policy, or to reject all regulation on the grounds that the Constitution will protect Web3, even though such protection may not ultimately materialize. Web3 industry participants must work with policymakers and regulators to develop regulatory policy and rely solely on the courts to uphold constitutional rights against specific excessive overreach.

Given the potential for constitutional challenges, Web3 regulation needs to be carefully crafted. Otherwise, policymakers' well-intentioned efforts to provide regulatory transparency to industry could inadvertently create greater uncertainty because of unconstitutional violations. Moreover, regulators' rulemaking needs to be taken seriously and addressed openly on the basis of a complete analysis of costs and benefits, rather than being regulated through opaque enforcement actions or mapped into a broader set of existing regulations.

Step 4: Conclusion

Effective policing of Web3 applications is a major task. This will require a reassessment of existing regulatory schemes, a deep understanding of Web3 technology, and a delicate balancing of policy objectives. It is vital that these efforts are carried out. If Web3 applications remain subject to the existing regulatory framework of existing legacy businesses, and there is no room to re-evaluate the differences between Web3 technologies, then the development of the Internet in the US will stall. Outdated "red flag laws" must be reviewed and new regulations imposed to meet policy goals.

The process must begin by establishing clear policy objectives for Web3. Importantly, these goals need to be tailored so that the social benefits created by Web3 technologies far outweigh their costs. This does not require the elimination of the potential for Web3 technology to be used for illegal activities, but requires measures aimed at reducing the risk of illegal activities and inhibiting illegal activities. Future installations in this series will explore ways to further curb illegal activities, as well as other important topics related to Web3 policy, including discussion of specific regulatory programs, applications, and differences between protocols, and the importance of U.S. leadership.

Ultimately, leveraging Web3 technology and its ability to transfer value at Internet speeds will lead to the emergence of many new forms of local Internet functionality and the creation of millions of new Internet businesses. Doing so, however, requires careful application of regulation to support innovation and limit the creation of unnecessary gatekeepers. To achieve this goal, policymakers, regulators, and Web3 participants should continue to engage in respectful, open, good-faith, and deliberative discussions.

5. Write Last (Regulatory application, not protocol)

After the above long article, I believe I have some understanding of the Web3 regulatory framework proposed by a16z. But the question I've been thinking about is whether Web3 decentralized applications (DeFi to be more specific) really need to be fully regulated by government agencies, and whether this violates our ideal of Network State The original intention of For the economic system DeFi in the Web3 world, innovation technologies such as on-chain audit, supervision and governance of DAO, and privacy application can become an innovative way to deal with Web3 regulation. The future is in store.