Market freedom and specific responsibilities

People should be able to hold their own keys, run software and participate in digital life without surrendering every personal detail. Those freedoms matter. So does the distinction between publishing a tool and operating a business that handles other people's transactions.

We need responsibility tied to actual roles. Neither treating every developer as a financial institution nor treating every decentralized label as immunity produces a workable result. This chapter examines materials available through September 26, 2026. It does not classify a particular asset, business or individual; operating decisions require jurisdiction-specific counsel.

The United States: what activity is actually performed?

FinCEN's 2019 CVC guidance distinguishes software development from business activities involving acceptance and transmission of value. Its P2P exchanger analysis and the Eric Powers enforcement action show why informal tools or individual accounts do not automatically remove business obligations. Guidance, Powers action

The SEC Trading and Markets staff statement of April 13, 2026 concerns a narrower class of self-custodial interfaces. Its conditions distinguish objective presentation from recommendations, negotiating terms, handling orders and execution. It conditionally permits certain user-paid fixed or percentage fees; it does not authorize third-party order-flow payments. The statement is nonbinding staff guidance, not a Commission rule or a universal noncustodial exemption. SEC statement

For our proposal, the unanswered question is especially important: an agent actively negotiating and recommending cannot simply borrow the status of an interface displaying user-selected information. A user running a personal tool and a company operating a public agency service present different facts. Counsel would need to assess control, customers, compensation, assets and actual conduct.

Sanctions are a separate dimension. OFAC's virtual-currency guidance discusses risk-based screening and controls; digital assets do not erase applicable sanctions duties. OFAC guidance

Tornado Cash illustrates why legal processes must be separated. OFAC removed the relevant listings in March 2025. In August 2025, DOJ reported Roman Storm's conviction on one money-transmission conspiracy count, not every charge. An August 25, 2026 court order, available through a public mirror, still addressed a pending motion and postponed retrial to April 26, 2027. The case was not wholly concluded. OFAC action, DOJ announcement, court-order mirror

“Only writing software” should describe verifiable conduct. Who runs and upgrades a service, chooses routes, collects revenue or intervenes in transactions matters. At the same time, general-purpose cryptographic software should not be presumed criminal merely because it can protect privacy.

Europe and Asia offer different institutional paths

MiCA recital 22 distinguishes fully decentralized services without intermediaries from activity only partly decentralized. A DeFi label does not settle whether a person actually provides or controls a covered service. EBA Travel Rule guidance addresses covered service-provider transfers, including interactions with self-hosted addresses; it should not be paraphrased as a requirement that all private wallet exchanges use one identity database. MiCA, EBA

Hong Kong's 2023 platform regime has a defined centralized-platform business scope. The SFC's ASPIRe roadmap also recognizes opportunities in market infrastructure, including atomic settlement. A policy roadmap is not blanket authorization for a DEX design. SFC circular, roadmap

Singapore's MAS clarified in June 2025 that certain overseas-only digital-token services fall under its DTSP licensing regime, with licenses generally not issued because of the relevant risks and supervisory challenges. This is neither an offshore escape hatch nor a prohibition on all overseas-facing software development. MAS clarification

Japan introduced a service-intermediary registration framework in June 2026 for specified mediation activities performed under arrangements with eligible businesses. It illustrates role differentiation, not automatic qualification for a personal agent. These examples are not an exhaustive survey of Asia, and one jurisdiction's approach cannot stand in for another's. Japan FSA

Compliance need not mean disclosing everything

Atomic delivery reduces first-sender exposure but does not establish lawful provenance. Stolen funds, ransomware proceeds, laundering and sanctions evasion remain part of the threat model.

A participant could require a current credential from an acceptable issuer: eligibility, jurisdiction, completed identity checks or a defined risk assessment. Selective disclosure may reveal only the necessary attribute rather than a passport or tax identifier. A DID identifies a signing subject; a VC carries an issuer's claim. W3C VC model

A screening claim is time-bound, not an eternal mathematical fact. The issuer, covered lists, beneficial-ownership analysis, revocation and holder binding all matter. Zero-knowledge methods can minimize disclosure without making bad inputs trustworthy or ensuring legal acceptance.

Publishing general software, running one's own agent, and operating a public brokerage therefore require separate factual descriptions. ArcBlock’s current preference for providing infrastructure is a choice of role, not an advance legal conclusion about every future activity. Taking on market operations later would require a fresh assessment of the actual conduct. Users and operators retain applicable responsibilities.

The opportunity is to make those responsibilities more precise while preserving privacy, portability and exit. We should design for lawful participation without assuming that universal collection of personal data is the only responsible architecture.