November 4, 2025
When Code Becomes Conduct: What the Tornado Cash Verdict Means for DeFi
KEY TAKEAWAYS
- Roman Storm was convicted only for operating an unlicensed money transmitting business, with the jury split on money laundering and sanctions charges.
- The case signals that code developers can face criminal liability as “operators” even without custody or control over user assets.
- Prosecutors’ rejection of FinCEN’s 2019 guidance raises concerns over fair notice and due process for non-custodial builders.
- Industry leaders are backing the CLARITY Act to protect open-source and DeFi developers from outdated MSB rules.
- Despite ongoing enforcement, U.S. regulators and lawmakers are moving toward a more innovation-aligned crypto framework.
A MIXED VERDICT
In August 2025, the U.S. District Court for the Southern District of New York delivered a mixed verdict in United States v. Roman Storm[1]. The jury convicted Roman Storm of conspiracy to operate an unlicensed money transmitting business[2], but failed to reach a unanimous decision on the two more serious counts, i.e., conspiracy to commit money laundering, and conspiracy to violate U.S. sanctions.[3] The unlicensed-MSB count is punishable by up to five years in prison, while the other counts, if convicted, carry possible sentences of up to 20 years each.[4]
The jury’s inability to agree on money laundering or sanctions conspiracies suggests that jurors were reluctant to endorse the government’s broader theories. Even so, the conviction alone is consequential. It establishes that a code developer can be held criminally liable purely for operating an unlicensed money transmitting business, even if they do not hold or control user’s assets. This precedent has sent shockwaves through the DeFi and open-source software communities.
Critics argue the government’s interpretation stretches a statute originally written for traditional financial intermediaries to cover neutral software infrastructure. On the other hand, defenders of the government’s arguments insist that Roman Storm’s real-world conduct, his promotion and maintenance of Tornado Cash, and his alleged awareness of illicit use, justified the outcome. The legal debate now turns on a central question: when does writing or deploying code cross into “operating” a financial business?
DISSECTING THE PROSECUTION’S THEORY
The Money Transmission Paradigm
The government’s central theory was that Tornado Cash functioned as a money transmitting business (“MTB / MSB”), and that Roman Storm conspired to operate it without the required registration with FinCen. Therefore, the federal law should penalise anyone who knowingly conducts an unregistered money transmitting enterprise. The government argued that Roman Storm “operated” Tornado Cash by deploying, updating, promoting, and maintaining it, even though the smart contracts never took custody of funds or exerted any discretionary control over user deposits/withdrawals. The jury accepted that argument for the limited purpose of the § 1960 charge.[5]
A core challenge is that 18 U.S. Code §1960 (prohibition of unlicensed money transmitting businesses) was drafted long before decentralised protocols existed. Its original context was intermediation of fiat, wire transfers, or currency exchanges. Prosecutors thus pressed a broad reading: the statute applies to any mechanism or means that “transfers funds on behalf of the public,” whether by “wire, check, draft … or any means” including via smart contracts.[6]
This sweeping interpretation may have two key concerns:
- Absence of custody or control: Traditional money transmitters receive, hold, and then forward funds. They act as intermediaries. Tornado Cash, however, is a non-custodial mixer. Users deposit funds, the funds are commingled in a smart contract enabled liquidity pool, and withdrawals occur through cryptographic proof. The code developers, in this case, never hold private keys now do they have access to or control over the user’s The defendant’s counsel argued that without such control, Tornado Cash cannot be an MSB within the meaning of § 1960.[7]
- Misapplication: If mere deployment or maintenance of open-source code constitutes “operation,” countless developers of payments-layer software could face criminal exposure. Critics invoke the rule of lenity that ambiguous criminal statutes must be construed narrowly and caution against extending legacy laws to novel technologies without clear legislative authority.[8]
Academic commentary reinforces this view. A Stanford blockchain review analysis of section 1960[9] notes that FinCEN’s 2019 MSB guidance[10] (“Guidance”), though non-binding, distinguishes between custodial intermediaries and purely non-custodial software providers. Under that framework, developers of open-source code who do not handle funds are generally not MSBs. That guidance, while non-binding, should inform the statute’s interpretation rather than be ignored.
Mens Rea, Intent, and Conspiracy Allegations
To convict, the government had to prove not just action but intent, that Roman Storm knowingly and willfully violated the law. On the conspiracy counts, the prosecution sought to show Storm deliberately joined with other third parties to launder funds or evade sanctions through Tornado Cash. The defence contested this on multiple fronts:
- Lack of specific illicit intent: Roman Storm’s lawyers argued that he built a neutral privacy tool and did not intend or agree to facilitate criminal conduct. The mere fact that bad actors misused Tornado Cash does not establish deliberate participation in their schemes. His defence emphasised the lack of direct evidence tying him to particular laundering actors.[11]
- Statutory fit: Money laundering statutes require a “financial transaction” involving a “financial institution.” The defence argued that Tornado Cash was not a “financial institution”, as required for money-laundering liability. Users, not developers, controlled all transactions.
- Sanctions: For the sanctions charge, the defence invoked a 2024 Fifth Circuit precedent, holding that immutable smart contracts are not “property,” under the International Emergency Economic Powers Act thereby limiting OFAC’s reach.[12]
The jury’s inability to reach a verdict on those conspiracy counts suggests reluctance to infer criminal intent solely from code design or marketing behavior.
Prosecution’s Use of Marketing, Public Statements, and “Washing Machine” Metaphors
To further its theory, the government introduced several provocative pieces of evidence and narrative framing:
- Marketing materials and public statements: Prosecutors pointed to promotional materials, websites, public presentations, and statements by Roman Storm (for example, wearing a Tornado Cash “washing machine” shirt at conferences). The suggestion was that such acts indicated knowledge and deliberate encouragement of illicit use.[13]
- User misuse and statistics: The government attempted to show that a significant portion of Tornado Cash usage was illicit, citing laundering of over USD one billion, including funds tied to North Korea’s Lazarus Group. The narrative was that Storm knew about and tolerated or endorsed criminal use.[14]
- Rejection of FinCEN guidance: One notable tactic was sidelining the Guidance, which had been more developer-friendly. The Department of Justice (“DOJ”) framed that guidance as nonbinding and irrelevant in criminal cases. This raises due process concerns, if agencies issue guidance that is widely relied upon by industry, can prosecutors later ignore it in criminal actions, therefore completely undermining the Guidance’s interpretative value.[15]
The defence replied that marketing materials were ambiguous and that humor or hype is not a criminal act. Turning open-source advocacy into conspiracy evidence, they warned, risks chilling innovation across the tech sector.
CALLS FOR LEGISLATIVE CLARITY AND DEVELOPER PROTECTIONS
In the wake of Storm’s verdict, crypto firms and advocates have pressed Congress to provide clear safe harbours for non-custodial software developers. Within days of the decision, over 115 industry participants, ranging from DeFi Education Fund and Andreessen Horowitz to Coinbase, Kraken, Galaxy Digital, and Ripple, urged lawmakers to amend the emerging CLARITY Act[16] to protect open-source code developers from money-transmitter liability.[17] They emphasised that Tornado Cash never held or controlled user funds, arguing that subjecting neutral code to MSB regulations stretches the law beyond its intent. The letter warned that “failing to provide legal clarity could drive software developers to more accommodating jurisdictions,”[18] undercutting U.S. leadership in blockchain innovation. Citing declining domestic code developer participation (down from 25% to 18% of global open-source contributors), signatories cautioned that unclear regulations risk pushing talent abroad and stifling the U.S. crypto economy.
Legal commentators echo these industry concerns, for example, Coinbase chief legal officer Paul Grewal and others have called for a “policy brake” on prosecutions of non-custodial code.[19] Blockworks and CoinDesk editorials have urged passage of the Blockchain Regulatory Certainty Act (BRCA) now tracked onto the CLARITY Act to explicitly state that simply writing or deploying open-source protocol code does not constitute operating an MSB.[20] As Blockworks points out, Hester Peirce and other officials have warned that privacy-enhancing code should not be treated as criminal, in Peirce’s words, “denying people financial privacy…undermines the fabric and freedoms” of society.[21] In essence, policymakers and practitioners alike are seeking statutory clarity that protects legitimate code development while preserving tools against genuine financial crime.
WHITE HOUSE AND WORKING GROUP CRYPTO POLICY
Meanwhile, the new administration has signaled a pro-crypto shift. On 30 July 2025, a White House report from President Trump’s crypto working group (“Working Group”) urged Congress to enact a comprehensive crypto market-structure bill, building on the House’s bipartisan CLARITY Act, that explicitly fills regulatory gaps and embraces digital-asset innovation.[22] The report recommends[23] :
- Granting the CFTC authority to oversee spot trading of digital commodities
- “Embracing DeFi” by recognising smart-contract protocols in mainstream finance.
- SEC and CFTC to “immediately enable the trading of digital assets at the federal level” by clarifying the registration, custody, and trading rules that apply to crypto.
- Encouraging regulatory “sandboxes” and safe harbors for ensuring new tokenised products can reach consumers without bureaucratic delay.
These recommendations dovetail with recent legislative actions. In mid-2025, Congress passed the GENIUS Act[24] and approved the CLARITY Act in the House. The White House statement explicitly encourages the Senate to follow suit on CLARITY, noting Congress should include provisions allowing regulated platforms (like certain CFTC-licensed exchanges) to custody crypto for customers.[25] The administration’s focus on market structure was underscored in the President’s Executive Order 14178 (January 2025), which established the President’s Working Group on Digital Asset Markets. That order tasked the Working Group – and its associated Financial Policy Advisory Subcommittee (“FPASC”), with proposing rules to make the U.S. a “crypto capital.” The FPASC, a multi-agency panel, is expected to advise on further reforms to trading and clearing, bringing bank regulators and market participants into the discussion. Indeed, industry insiders note that FPASC is likely to play a prominent role in crafting the final details of any market-structure legislation.
EXPANDING U.S. TRADING VENUES AND CFTC INITIATIVES
Beyond broad policy, regulators are taking specific steps to bolster U.S. crypto markets. In late August 2025, the CFTC issued a Staff Advisory clarifying how foreign boards of trade (“FBOTs”) can legally serve U.S. traders.[26] Acting Chairman Caroline Pham explained that the advisory “provides the regulatory clarity needed to legally onshore trading activity” that had moved overseas, giving crypto firms a “path back to U.S. markets”. In practice, this means that overseas crypto exchanges can register under the FBOT framework (rather than as domestic DCMs) to offer products to U.S. customers, provided they meet CFTC oversight requirements. The move was explicitly tied to the administration’s goal of making America a leader in crypto by making it easier to operate exchanges in the U.S. without onerous new licensing. In parallel, the SEC under Chair Paul Atkins has signaled a more welcoming stance, it has taken steps to issue new guidance for token trading, and has dropped or slowed some enforcement actions against major exchanges like Coinbase and Binance.[27]
In sum, federal officials are pushing for a federal-level trading regime. They want digital assets to trade on registered U.S. venues, with federal protections and disclosures, rather than via unregulated offshore markets. The FBOT advisory and CLARITY Act together aim to expand sanctioned trading venues, while safe-harbour language and tokenisation rules (discussed in the Working Group report) are intended to encourage banks and fintechs to build products for the crypto sector.
FUTURE ENFORCEMENT AND IMPACTS
Looking ahead, crypto participants should brace for an enforcement landscape in flux. With the DOJ and FinCEN still on the case, law enforcement will likely continue to pursue serious offenders – but perhaps not small open-source developers, after new protections are implemented. Trump’s crypto leadership has already signaled a deprioritization of petty enforcement. Still, the Roman Storm verdict shows prosecutors are willing to apply old statutes in new ways unless Congress intervenes. Some experts predict more litigation to test these boundaries, for example, Samourai Wallet’s developers recently struck a plea deal in a similar matter[28]. It remains to be seen whether Storm’s conviction will be overturned on appeal or upheld, but either outcome will influence DOJ’s calculus on future charges.
On Capitol Hill, the bipartisan CLARITY Act and companion bills remain under active consideration. If Congress follows the Working Group’s playbook, we can expect a final crypto-market-structure bill that includes protections for software developers. Legal experts caution, however, that any such law is unlikely to apply retroactively to Storm, but it would prevent similar prosecutions going forward.[29] Even without Congress, regulators are issuing sub-regulatory guidance and using enforcement discretion to shape industry behaviour. Companies and lawyers in this space must therefore navigate a patchwork, advising on existing money-transmitter rules, AML/KYC obligations, and the evolving crypto framework
CONCLUSION
The Roman Storm verdict illustrates a system caught between technological innovation and legal inertia. While the jury’s split decision curbed the most expansive theories of criminal liability, the conviction itself warns that code alone may not insulate developers from prosecution under outdated laws. For now, one lesson stands clear: legal certainty is as vital to innovation as technical ingenuity. Without clear rules, developers risk punishment for building the very privacy and transparency tools that regulators claim to value. Whether the law evolves to reflect that balance will shape the future of financial technology and perhaps, the legacy of Tornado Cash itself.
For technology innovators and founders, the big picture is clear, legal clarity is urgently needed to avoid chilling the very creativity regulators want to foster. If U.S. law eventually shields non-custodial DeFi developers as promised, American projects may flourish without fear of prosecution. If not, developers may indeed look offshore. In the meantime, everyone in the crypto ecosystem, from open-source coders to investors, will watch closely as the Trump Administration’s crypto-friendly agenda unfolds and as courts interpret the ambiguous verdict left by the Tornado Cash case.
*** DISCLAIMER: This article is provided for informational and educational purposes only and does not constitute legal advice. Readers should not act upon this information without seeking professional legal counsel tailored to their specific circumstances. The analysis presented herein reflects the authors’ interpretation of legal developments as of the date of publication and may not reflect subsequent changes in law or regulation.
TLP Advisors is a legal consulting firm specialising in providing cutting-edge solutions to our diverse clientele. With our roots deeply embedded in the Web3, financial services, gaming, and emerging tech sectors, we offer tailored legal support to these rapidly evolving industries’ facing unique challenges and opportunities. TLP Advisors has consistently been the firm of choice for web3, fintech, financial services companies, and family offices in the UAE. We have built a reputation for excellence through our frequent collaborations with key regulators in this region. http://www.techlawpolicy.com
***
[1] 23 CRIM 430
[2] 18 U.S. Code § 1960 (Prohibition of unlicensed money transmitting businesses)
[3] Mayer Brown, Hiral D. Mehta and others, https://www.mayerbrown.com/en/insights/publications/2025/08/the-tornado-cash-trials-mixed-verdict-implications-for-developer-liability
[4] Reuters, Luc Cohen, https://www.reuters.com/legal/government/us-jury-deadlocks-tornado-cash-founders-money-laundering-charge-2025-08-06/
[5] Mayer Brown, Hiral D. Mehta and others, https://www.mayerbrown.com/en/insights/publications/2025/08/the-tornado-cash-trials-mixed-verdict-implications-for-developer-liability
[6] Standford Blockchain Club, https://review.stanfordblockchain.xyz/p/57-tornado-cash-and-the-limits-of
[7] DLA Piper, David Stier and others, https://www.dlapiper.com/en-us/insights/publications/blockchain-and-digital-assets-news-and-trends/2024/shelter-for-the-storm-indicted-tornado-cash-founder
[8] Standford Blockchain Club, https://review.stanfordblockchain.xyz/p/57-tornado-cash-and-the-limits-of
[9] ibid
[10] See: https://www.fincen.gov/system/files/2019-05/FinCEN%20Guidance%20CVC%20FINAL%20508.pdf
[11] DLA Piper, David Stier and others, https://www.dlapiper.com/en-us/insights/publications/blockchain-and-digital-assets-news-and-trends/2024/shelter-for-the-storm-indicted-tornado-cash-founder
[12] See: Mayer Brown, Gina M. Parlovecchio and others, https://www.mayerbrown.com/en/insights/publications/2024/12/federal-appeals-court-tosses-ofac-sanctions-on-tornado-cash-and-limits-federal-governments-ability-to-police-crypto-transactions
[13] Joel Khalili, https://www.wired.com/story/tornado-cash-developer-roman-storm-guilty-on-one-count-in-federal-crypto-case/
[14] Reuters, Luc Cohen, https://www.reuters.com/legal/government/us-jury-deadlocks-tornado-cash-founders-money-laundering-charge-2025-08-06/
[15] Blockworks, Peterson M., https://blockworks.co/news/opinion-tornado-cash-conviction-raises-alarm/
[16] See: https://www.congress.gov/bill/119th-congress/house-bill/3633/text
[17] Invest, https://www.ainvest.com/news/crypto-firms-push-legal-clarity-save-defi-future-2508/
[18] ibid
[19] Blockworks, Peterson M., https://blockworks.co/news/opinion-tornado-cash-conviction-raises-alarm/
[20] ibid
[21] ibid
[22] The White House, https://www.whitehouse.gov/fact-sheets/2025/07/fact-sheet-the-presidents-working-group-on-digital-asset-markets-releases-recommendations-to-strengthen-american-leadership-in-digital-financial-technology/#:~:text=,on%20issues%20such%20as%20registration
[23] ibid
[24] See: TLP Advisors, The GENIUS Act Becomes Law: A Landmark in U.S. Stablecoin Regulation, https://techlawpolicy.com/2025/07/the-genius-act-becomes-law-a-landmark-in-u-s-stablecoin-regulation/
[25] Reuters, Hannah Lang, https://www.reuters.com/legal/government/white-house-crypto-policy-report-calls-sec-action-new-legislation-2025-07-30/#:~:text=In%20a%20factsheet%20ahead%20of,for%20issuers%20of%20crypto%20securities
[26] FXstreet, Michael E., https://www.fxstreet.com/cryptocurrencies/news/cftc-guideline-invites-foreign-exchanges-under-fbot-framework-202508290216#:~:text=,Pham
[27] Reuters, Hannah Lang, https://www.reuters.com/legal/government/white-house-crypto-policy-report-calls-sec-action-new-legislation-2025-07-30/#:~:text=In%20a%20factsheet%20ahead%20of,for%20issuers%20of%20crypto%20securities
[28] See: CoinDesk, https://www.coindesk.com/policy/2025/07/30/samourai-wallet-devs-plead-guilty-to-conspiring-to-run-unlicensed-money-transmitter
[29] Blockworks, Peterson M., https://blockworks.co/news/opinion-tornado-cash-conviction-raises-alarm/