a16z Crypto and Jito Labs say many financial institutions are making a basic compliance mistake: treating permissioned networks as if they were required by law, even though current U.S. rules do not impose that condition. In their paper, Compatibility of Permissionless Networks and Financial Compliance: A Practical Guide for Financial Institutions, the firms argue that banks, broker-dealers and asset managers can build products and conduct transactions on permissionless blockchains as long as they apply risk-based controls in the parts of the stack they can actually control.
The paper says a large share of institutional hesitation comes from a reading of anti-money laundering, counter-terrorist financing and U.S. sanctions rules that assumes only closed systems with known participants can satisfy compliance obligations. The authors reject that view. In their telling, financial compliance law requires institutions to manage and reduce risk, not erase it entirely.
Traditional finance is already using open blockchain networks
The report points to several examples of mainstream financial firms already operating on permissionless infrastructure. Franklin Templeton began using a permissionless blockchain in 2021 to record share ownership information for its on-chain U.S. government money fund, then added Solana as a supported network in February 2025. BlackRock started issuing tokenized money market fund shares on Ethereum in March 2024. Apollo, according to the paper, began offering tokenized access to its Diversified Credit Fund across six permissionless networks in January 2025.
The authors say announcements like these appear almost every week. Even so, some traditional financial institutions still view permissionless networks as effectively off-limits. Many banks, broker-dealers and asset managers have instead moved toward permissioned systems where a consortium or gatekeeper decides who may validate transactions, who may participate and what the network may be used for.
a16z Crypto and Jito Labs argue that this turn toward closed systems is driven less by law than by institutional assumptions. They say financial institutions are not required to own the underlying infrastructure that carries their financial activity, nor are they required to screen, vet or restrict every part of that infrastructure.
FinCEN and OFAC do not enforce a zero-risk standard
The paper grounds that claim in existing U.S. compliance doctrine. Under the Bank Secrecy Act, anti-money laundering and counter-terrorist financing programs are meant to identify, record and deter illicit financial activity. They are not designed to stop all money laundering or terrorist financing in every instance, and the authors say regulators have acknowledged as much.
They cite federal banking regulators and the Financial Crimes Enforcement Network, or FinCEN, as having made clear that compliance turns on a "reasonably designed" AML program with processes that can "identify, measure, monitor, and control risk" effectively. They also point to FinCEN's August 2020 enforcement statement, which said enforcement is not about punishing firms for every isolated mistake.
The paper makes the same case on sanctions. It references the Office of Foreign Assets Control, or OFAC, and its Framework for Compliance Commitments, which lists five core components of an effective sanctions compliance program: management commitment, risk assessment, internal controls, testing and auditing, and training. OFAC adjusts expectations based on an institution's size, products, customer base and geography.
It also notes that the Economic Sanctions Enforcement Guidelines weigh factors such as whether conduct was willful, whether the institution knew about it, the harm to sanctions targets, and the adequacy of the firm's compliance program. Taken together, the authors say, FinCEN and OFAC enforcement is aimed at reasonably identifiable systemic defects, not accidental one-off failures.
Permissionless networks should be treated as infrastructure
That distinction matters, they argue, because many banks worry they could unknowingly interact with sanctioned or illicit actors through a public blockchain. Examples include paying network fees to a validator run by a sanctioned party, transacting without knowing that a counterparty is sanctioned, or receiving crypto assets that at some point touched illicit actors.
The paper says those concerns often overstate what sanctions law actually covers. If a validator or other network participant is located in a sanctioned jurisdiction, or is itself a sanctioned person, an institution using the network has still not necessarily chosen that validator, signed a contract with it, exported goods or services to it, financed it, or otherwise entered into a deliberate transactional relationship.
a16z Crypto and Jito Labs say permissionless blockchains should be understood the same way financial institutions understand the public internet or telephone networks: as shared infrastructure. Banks do not screen every router operator or every other user on the internet. In the authors' view, the compliance approach to permissionless networks should follow the same logic.
OCC letters addressed blockchain fees and node activity
The report leans heavily on guidance from the Office of the Comptroller of the Currency. It says OCC Interpretive Letter 1186, issued in November 2025, confirmed that banks may pay network fees on blockchain networks and may hold the crypto assets needed to pay those fees in their own name.
That letter followed OCC Interpretive Letter 1174 from January 2021, which concluded that banks may validate, store and record payment transactions by operating nodes. The paper argues that if banks may run nodes and participate in recording transactions, then earning the fees associated with node activity follows naturally from that logic.
It notes that the OCC used Ethereum as an example. Ethereum is a permissionless network where validators are selected by protocol in a pseudorandom process. According to the paper, those interpretive letters did not draw a distinction between permissioned and permissionless systems.
When a financial institution sends a transaction on a permissionless network, the protocol assigns block proposal rights to a validator, usually through a pseudorandom process linked to stake. The fee is then set by the protocol based on network demand and the computational resources consumed by the transaction. The institution does not pick the validator, negotiate the fee or know in advance which validator will process the transaction.
The authors compare that setup to an email sender whose message is carried by routers, or a caller whose phone connection is completed by switching infrastructure. If an internet packet from a U.S. financial institution happens to pass through infrastructure in a sanctioned jurisdiction, that alone does not establish a sanctions violation. They say the same neutral, protocol-driven transmission analysis can apply to the consensus layer of a permissionless blockchain.
The paper adds that the Bank Secrecy Act itself recognizes this distinction by excluding entities that merely provide delivery, communication or network access services used to support funds transfers.
No enforcement actions have targeted validator inclusion or protocol fees
The authors say that nearly five years have passed since OFAC released its Sanctions Compliance Guidance for the Virtual Currency Industry. Over that period, they say, there has not been an enforcement action based on the fact that a validator proposed a block that happened to include a sanctioned party's transaction. Nor, they write, has there been an enforcement action because a market participant paid protocol-level network fees.
That point is used to challenge the idea that incidental validator contact, by itself, creates the sort of sanctions exposure some institutions fear.
Privacy tools are changing the institutional calculus
The paper also addresses a second major institutional concern: whether banks can transact on a public ledger without revealing customer positions, counterparties and trading strategies to competitors.
According to the authors, early support for permissionless ledgers often rested on the idea that full transparency was itself a compliance advantage. They argue that the real legal requirement is narrower. What matters is that necessary information can be verified by the institution, its counterparties and regulators or supervisors.
They say cryptographic tools have now advanced far enough to let institutions prove compliance-relevant facts without exposing all of the underlying data. A firm could prove that a counterparty is not on the Specially Designated Nationals list, for example, or show that reserves exceed liabilities, without disclosing its full ledger data or counterparty identities.
Provenance proofs, the paper says, can show that an asset did not come from an identified illicit pool without revealing the full transaction graph. Confidential transfer systems can encrypt amounts and balances on-chain while preserving a viewing key that regulators or examiners can inspect when needed.
Put together, the authors argue, those technologies could give regulators stronger verification than closed systems while still shielding information from competitors. On that basis, privacy is no longer just an obstacle to institutional use of permissionless networks; it could become a reason to adopt them.
The paper distinguishes between technologies already in use and those still being developed. Address rotation and account abstraction are already seeing practical deployment. Omnibus accounts and tiered custody structures can keep customer-level detail off-ledger. Messaging protocols can transmit Travel Rule data alongside on-chain transfers. Confidential transfer systems with audit keys have started to be deployed, though institutional use remains limited. Sanctions-status proofs and source-of-funds proofs tied to specific blacklists remain at the pilot and research stage.
GENIUS Act places compliance duties at the application layer
The paper cites Privacy Cash, a privacy protocol deployed on Ethereum and Solana that uses zero-knowledge proofs to support confidential transfers and redemptions, as one example of the available design space. From there, the authors propose a financial compliance framework for activity on permissionless networks with nine components.
In that framework, transaction-layer controls are aimed at customers and counterparties and largely resemble controls institutions already use. Network-layer controls address the underlying infrastructure. The authors stress that none of these measures requires institutions to identify validators, enter service-level agreements with a protocol or apply to a gatekeeper for network membership. Those are hallmarks of permissioned systems, they say, not demands imposed by current financial compliance law.
The paper says the same structure appears in the recently passed GENIUS Act in the United States. Under that approach, AML, CFT and sanctions controls belong at the application layer and are carried out by the party that knows the customer and can control the assets.
As described in the article, the law requires approved issuers of payment stablecoins, acting as identified and regulated application-layer entities, to show that they maintain AML and sanctions compliance programs and have the technical ability to freeze or destroy circulating stablecoins pursuant to lawful orders. Those obligations fall on the issuer, not on the permissionless network where the stablecoins circulate.
The paper argues that staying away is not a compliance strategy
The authors close by drawing a parallel to the early internet. Decades ago, regulated financial institutions were confronted with another open, global and permissionless network, one that any user could join and that carried both lawful and unlawful communications. Banks ultimately built on open internet protocols and placed their controls at the application layer.
They argue that permissionless blockchain networks can be approached the same way. Walking away from them, in their view, is not a financial compliance strategy. It means giving up the role U.S. financial institutions have long played in strengthening the resilience, transparency and risk management capacity of the dollar-based financial system.
The paper says dollar-denominated activity is already taking place on permissionless networks and will continue whether U.S. financial institutions participate or not. How effectively U.S. financial enforcement can reach that activity depends on whether regulators can see those flows. And the design, execution and enforcement of compliance law also depend on U.S. institutions observing and monitoring them.
If financial institutions keep avoiding permissionless networks because they misread the law or remain anchored to older regulatory assumptions, the authors say, they will forgo the chance to offer clients more products and services through open networks.