The DeFi Entity Stack in 2026: Foundation, Token Issuer, Operating Company
How to split a DeFi project across a foundation, a token issuer and an operating company in 2026, which structures fit, and where regulation stands.
Bad structuring destroys entrepreneurial value. In the worst case it puts identifiable people in front of a regulator with nothing between them and the protocol. A DeFi entity stack is how you put something there.
DeFi's promise is portability: open code, open access, fewer permissions. Its legal problem is that code has no legal personality, and the people around it do. Somebody signs the contracts, runs the front end, holds the treasury, sells the token and answers when something breaks. The question is whether that somebody is one exposed company, or a set of entities each doing a defined job.
That set of entities is what we call the entity stack. It is not a silver bullet. It is, in our experience, more legally sound than any single wrapper, and it is how most serious protocols end up organised.
Feb 2025
The SEC closed its investigation into Uniswap Labs with no enforcement action
Jul 2024
Wyoming's DUNA Act took effect, creating an entity built for token-holder communities
18%
Of responding jurisdictions have assessed DeFi risks (FATF, July 2026)
4
Jurisdictions that had imposed licensing or registration rules on DeFi arrangements, per the same FATF survey
The short version. Give each function its own entity: a foundation for the treasury and governance, a token issuer for the token-facing layer, and an operating company for the team, vendors and front end. Then a problem in one layer is less likely to become a problem in all of them.
1. Why one entity is rarely enough
The tempting answer is a single legal wrapper, for example a DAO LLC. It gives limited liability, a familiar corporate shape, and a name to put on a bank account. Wyoming and the Marshall Islands both offer DAO-specific LLC options, and for some projects that is the right call.
The weakness is concentration. When one entity does everything (builds, holds the treasury, issues the token, governs upgrades), every category of risk lands on that one company. A single LLC layer also adds rigidity on top of the decentralised decision-making it is meant to wrap, which can limit what the DAO can do without solving the underlying problem.
An entity stack separates the functions. Each entity gets one job, so a problem in one layer is less likely to become a problem in all of them.
2. The three layers
Job: holds the protocol's treasury and governs it for the benefit of the community.
A foundation has no shareholders and no owners. It is governed by a charter or, increasingly, by a DAO. Its purpose is to grow the network, not to generate profit. It can hold tokens, make grants and enter contracts.
Typical homes: Cayman Islands Foundation Company, BVI, Panama, Switzerland, and the UAE's Innovation City DAO Association. Wyoming's DUNA plays a similar role in the US.
Must not do: run day-to-day operations or employ the team. If it does, it starts to look like the company it was meant to be separate from.
Learn more: Cayman Islands Web3 Foundation, Best Jurisdiction for a Web3 Foundation, Switzerland Foundation.
Job: the token-facing layer. It issues or distributes the token and holds the token-related contracts, so the token's legal footprint sits in its own entity.
This is the layer where the legal status of the token matters most. Tokens fall broadly into security tokens, utility tokens and stablecoins, and each is treated differently by regulators. Where you issue, and to whom, changes the rules that apply.
Typical homes: BVI and Cayman come up repeatedly for this layer, because of common-law predictability and a tax-neutral setting. Some structures use a token SPV, a legal entity sitting between tokens and the assets or rights they represent. An SPV adds separation, but it still has to comply with the rules where it operates.
Must not do: share an entity with the operating company's equity. Our explainer on why: Token Pre-Sale and Issuance. For token classification, see Utility Token Legal Structuring.
Job: the entity that employs people, signs vendor contracts, runs the front end and receives grants from the foundation to cover costs. In Web3 this is often called the "Labs" or DevCo entity.
Typical homes: wherever the team actually is, often a Delaware or Wyoming LLC for non-US teams, or a C-Corp if raising from traditional venture investors. See What Is a "Labs" Company, Actually?.
Must not do: hold the community's treasury. If the operating company is the only entity with a name and a bank account, it should be the only thing exposed, not a stand-in for the whole stack.
3. The permutations
There is no single correct stack, only the one that fits what you are building. These are the setups we see most.
| Setup | Entities | Fits when | Watch out |
|---|---|---|---|
| Single wrapper | One DAO LLC (Wyoming or Marshall Islands) | Small, early projects with one clear purpose and a US or Marshall Islands nexus | One entity carries every risk. Rigid for evolving governance |
| Foundation plus DevCo | A foundation (Cayman, BVI, Panama) with a 100%-controlled operating company | Most token-governed protocols that want depth of case law and offshore optics | Two entities, two sets of filings. Founders must genuinely give up residual control |
| Foundation, issuer and DevCo | Foundation, a separate token issuer, and an operating company | Token launches where the token's legal footprint should be isolated | More moving parts. Needs a clear intra-group agreement set |
| DUNA plus DevCo | Wyoming DUNA for governance and treasury, separate operating entity underneath | US-comfortable communities that want one governance entity instead of a foundation and a trust | New entity type, thin case law, Wyoming-specific |
| Trust or private trust company route | Purpose trust with a private trust company, plus an operating entity | Projects that want the deepest body of trust law and a long-term holding layer | Only holds together if the founding team truly relinquishes control. See Trusts Demystified |
Many projects combine two: a DUNA or foundation at the governance layer, with a separate operating entity beneath it. For the full comparison of a trust, a foundation and a DUNA, read DAO Governance: Trust vs. Foundation vs. DUNA.
4. Who does what
| Function | Foundation | Token issuer | Operating company |
|---|---|---|---|
| Holds the treasury | Yes | No | No (receives grants) |
| Issues or distributes the token | No | Yes | No |
| Governs upgrades and parameters | Yes (via the DAO) | No | No |
| Employs the team and signs vendor contracts | No | No | Yes |
| Runs the front end | No | No | Yes |
| Touches fiat on-ramps and banking | No | Sometimes (token sale proceeds) | Yes |
5. Where regulation stands in November 2026
The enforcement picture moved. In February 2025 the SEC closed its multi-year investigation into Uniswap Labs without taking action. That does not repeal the test: the Howey analysis still asks whether a buyer expects profit from the efforts of an identifiable team. Our DAO Governance guide covers the SEC and CFTC guidance of March 2026 on that framework.
On developer liability, FinCEN's 2019 guidance has long distinguished software developers from money transmitters. The CLARITY Act's developer provisions would write that into statute, but the bill's progress in the Senate was contested at the time of writing. Treat it as pending, not as law.
MiCA says services provided in a fully decentralised manner without any intermediary fall outside its scope (recital 22). The term is not defined in the operative text. In January 2025 the EBA and ESMA reported that very few DeFi systems reach full decentralisation. In May 2026 the Commission opened a targeted consultation on MiCA's review, and in September 2026 ESMA asked for a clear DeFi definition in the law and a narrower exemption.
Practical reading: do not assume you are outside MiCA because your protocol is permissionless. Run the five-minute scope check.
The FATF's July 2026 update found that only 18% of responding jurisdictions had assessed DeFi risks, and only four had imposed licensing or registration requirements on DeFi arrangements, with just two having licensed one in practice. It also flagged that most governments have not yet identified DeFi arrangements that would count as VASPs under the FATF Standards.
This is early-stage oversight, not absent oversight. Expect it to tighten.
The cautionary tale from the criminal side is Tornado Cash: a Dutch court sentenced developer Alexey Pertsev to 64 months in May 2024, and a US jury reached a mixed verdict against Roman Storm in 2025, with a retrial set for April 2027. Those cases turn on specific facts and are contested. What they show is enforcement appetite toward identifiable people behind financial protocols with no AML controls. For the KYC side, read KYC for Web3 Projects in 2026.
6. Six design rules
- Separate the front end from the protocol. The smart contract has no legal personality. The interface does not either, but the company that runs it does, and that is usually where claims land. Keep it distinct from the foundation. See 5 Recommendations for Structuring a DEX.
- Keep equity and token apart. Different entities, different investors, different regulatory treatment.
- Decentralise governance for real, and on a schedule. The more control an identifiable team visibly retains, the more the token looks like a security. Governance concentration is a design problem a legal wrapper does not fix. Voting thresholds, timelocks and distributed multisigs do.
- Put the token-facing layer where the law is predictable. BVI, Cayman and Panama are the usual homes for this layer.
- Build KYC and AML where fiat or custody touches the stack. Even if the swap itself is permissionless. See our on-ramp and off-ramp guide.
- Get a legal opinion on the token before it lists anywhere. Not after.
7. How Otonomos helps
We form and maintain each entity in the stack, in whichever jurisdictions fit, and run them from one dashboard: foundation, token-facing entity and operating company, with KYC, registered office and annual filings handled for you. You pick the structure, give us your KYC and pay. We do the rest.
What we do not do: license you as a VASP or CASP, or issue the legal opinion on your token. That is specialist counsel's job, and we will say so plainly. What we can do is make the entities your counsel works with exist, correctly, and stay in good standing.
Cayman Web3 Foundation
The governance and treasury layer used by many token-issuing protocols.
BVI Trust
A trust layer for non-US settlors, with a settlor-controlled private trust company.
Talk to us
Tell us what you are building and we will propose the stack.
❓ 8. Frequently asked questions
Do I need three entities for a DeFi project?
No. Early projects can start smaller. The point of the stack is that functions are separated, so you can add layers as the token launches and the community grows. A DUNA or foundation plus an operating company is the most common starting point.
Is a DAO LLC enough on its own?
It can be, for small and simple projects. It gives limited liability, but it keeps the building, the treasury and the token in one entity, which concentrates risk.
Which jurisdictions work best for the token-facing layer?
BVI, Cayman and Panama are the ones that come up most, for common-law predictability, tax neutrality and clear treatment of virtual assets. The right choice depends on where your token holders are and what the token does.
Does a legal wrapper make my protocol decentralised?
No. A wrapper answers the liability question. Decentralisation is a design choice enforced by governance mechanics. Regulators look at who actually controls the protocol.
Are DeFi protocols outside MiCA?
Only if they are genuinely decentralised and have no intermediary. The term is undefined in the law, and EU regulators said in 2025 that very few systems qualify. See the scope check linked above.
What is a token SPV?
A special purpose vehicle that sits between a token and the assets or rights behind it. It adds separation, but it still has to follow the rules where it operates.
Related reading
DAO Governance: Trust vs. Foundation vs. DUNA
The full comparison of the three wrappers.
Best Jurisdiction for a Web3 Foundation
Where to put the governance layer.
Legal Guide to Building a Scalable dApp in 2026
Structuring a dApp end to end.
Can a DAO Run Itself Without a Labs Entity?
Mostly, but not entirely.
What Is a Wyoming DAO LLC?
The single-wrapper option explained.
The Innovation City DAO Association
A UAE option for the foundation layer.
Sources: Otonomos Helpdesk, DAO Governance and Web3 Foundation guides; Wyoming DUNA Act (2024); SEC closure of the Uniswap Labs investigation (February 2025); MiCA recital 22; EBA/ESMA Joint Report under Article 142 MiCA (January 2025); ESMA response to the Commission's MiCA review consultation (September 2026); FATF, Seventh Targeted Update on Virtual Assets and VASPs (July 2026). Updated November 2026.
This is a structural overview, not legal advice. Talk to qualified counsel before relying on any structure or exemption.
Updated about 3 hours ago