Why Banks Can Legally and Securely Use Permissionless Blockchains Instead of Closed Networks

Why Banks Can Legally and Securely Use Permissionless Blockchains Instead of Closed Networks Financial institutions often gravitate toward closed, permissioned blockchains under the mistaken belief that financial integrity laws demand screened participants at every layer. In reality, existing Bank Secrecy Act and sanctions frameworks accommodate permissionless networks through risk-based controls applied at the application level rather than the underlying infrastructure. Institutions like Franklin Templeton, BlackRock, and Apollo have already deployed funds across permissionless networks such as Ethereum and Solana. Federal AML/CFT and OFAC sanctions enforcement operates on a risk-balanced model targeting systemic failures, rather than a zero-tolerance standard for inadvertent infrastructure-level touchpoints. Network consensus actions—such as pseudo-random validator selection and protocol fee distribution—function like neutral internet routing and do not constitute targeted dealings under sanctions rules. Advances in zero-knowledge proofs and cryptographic tools allow institutions to verify compliance, such as screening against SDN lists and encrypting balances, without publicly exposing proprietary transaction data. Legislative approaches like the GENIUS Act place compliance burdens on regulated application-layer issuers rather than the underlying blockchain network. The Misconception Driving Permissioned Adoption Many banks, broker-dealers, and asset managers default to permissioned networks with gatekeepers because institutional compliance teams assume that having a known, verified set of network actors is legally necessary under the Bank Secrecy Act (BSA) and U.S. sanctions regimes. However, existing legal frameworks do not require financial institutions to own, screen, or censor the base-layer infrastructure over which transactions and data move. Risk-Based Frameworks vs. Zero-Tolerance Standards Both FinCEN and OFAC require reasonably designed, risk-based compliance programs focused on systemic risks rather than the complete elimination of risk. FinCEN enforcement avoids a 'gotcha' approach, and Treasury guidance notes that major fines stem from systemic program failures rather than isolated lapses. Similarly, OFAC sanctions guidelines assess program adequacy, awareness, and willfulness, meaning inadvertent, attenuated interactions at the base layer should not expose institutions to liability. Neutral Protocol Infrastructure and Sanctions Precedents Transacting on a permissionless network resembles routing internet traffic over public routers or telephone switches. When submitting transactions, protocols automatically assign validators pseudo-randomly and set fees by computational demand, meaning institutions neither choose nor deal directly with the validator. Regulators have affirmed this dynamic: the OCC's Interpretive Letter 1186 confirmed banks may hold cryptoassets and pay blockchain network fees, and OFAC has never taken enforcement action against a participant merely for paying protocol-level fees or having a transaction included in a block proposed by a sanctioned validator. Addressing Privacy Concerns Through Cryptography Institutions also fear exposing client positions and strategies on public ledgers, but regulatory integrity only demands verification by the institution, its counterparties, and examiners. Emerging cryptographic methods, such as zero-knowledge proofs and confidential transfer designs with auditor viewing keys, allow institutions to verify that counterparties are not on the SDN list and that assets are not linked to illicit funds without broadcasting sensitive transaction details. Techniques like address rotation, account abstraction, and tiered custody are already in production to shield client data. Application-Layer Compliance and the GENIUS Act Effective blockchain compliance relies on transaction-level controls at the customer and counterparty layers rather than structural network restrictions. This approach mirrors U.S. legislative proposals like the GENIUS Act, which places AML/CFT, sanctions compliance, and asset-freezing obligations on application-layer stablecoin issuers rather than the underlying open networks, just as institutions historically adopted the open internet while maintaining controls at the business layer.

银行无需依赖许可制区块链：公链合规性与应用逻辑解析 许多传统金融机构误认为《银行保密法》与制裁法规要求完全消除合规风险，因而倾向于选择许可制封闭网络。相关研究与监管实践表明，现行法规遵循基于风险的防范原则，机构完全可以在无许可公链的应用层构建充分的合规机制。 反洗钱（BSA/AML）与OFAC制裁制度遵循基于风险的合理控制标准，而非不可达到的零风险要求。 公链验证节点由协议中立且伪随机分配，支付网络费用不属于制裁法打击的主动交易行为。 零知识证明与审计密钥等密码学技术已能支持在保护商业隐私的同时向监管机构验证合规性。 将合规控制置于应用层符合历史网络演进规律及美国《GENIUS法案》等最新立法思路。 监管体系强调合理防控而非零容忍 传统金融机构常误以为无许可公链与反洗钱法及制裁规定不兼容。然而，FinCEN与OFAC的监管框架核心是设计合理的风险防范体系，执法重点在于系统性缺陷而非孤立疏漏。美国货币监理署（OCC）在第1186号等解释函中已确认，银行可持有加密资产用于支付公链网络费用，并可运行节点验证交易，并未对许可链与公链进行歧视性区分。 公链属于中立基础设施性质 金融机构使用公链类似于使用公共互联网或电话网络。在无许可网络中，交易由协议根据规则伪随机分配给验证节点，机构既不挑选验证者也无法协商费用，缺乏主观选择或直接交易关系。《银行保密法》本身明确排除了仅提供中立传输服务的实体，且OFAC五年来从未因验证节点打包交易或收取协议层费用发起过执法行动。 密码学技术化解链上隐私顾虑 机构对公共账本暴露商业机密的担忧正通过密码学创新得到解决。通过零知识证明、综合托管结构和只读审计密钥，机构能够在不向竞争对手公开资产负债表或交易对手的前提下，向监管方证明其未与被制裁名单交互，使合规审查从全网透明转向可验证的隐私证明。 合规义务应落位于应用层实体 针对公链的合规方案主张将反洗钱和制裁审查置于直接接触客户的应用层。这一思路与美国《GENIUS法案》相契合，该法案要求作为明确监管实体的稳定币发行人承担合规与资产冻结能力，而非对流通底层公链施加限制。正如金融业当年将业务迁移至开放互联网一样，机构应在应用层构建控制措施，而非回避公链基础设施。

*This article was written by [Rebecca Rettig](https://www.linkedin.com/in/rebecca-rettig-8b90a284/), Chief Operating Officer and Chief Legal Officer of [Jito Labs](https://www.jito.wtf/), a technology startup that develops Solana blockchain software and infrastructure.* Financial institutions are taking advantage of one of the most innovative advancements in blockchain technology — permissionless networks. Franklin Templeton has kept the official share register of its onchain U.S. government money fund on permissionless blockchains since 2021 and added the Solana network in February 2025. BlackRock has issued shares of its tokenized money market fund on Ethereum since March 2024. And in January 2025, Apollo made tokenized access to its Diversified Credit Fund available across six permissionless networks. Additional announcements touting traditional financial institutions’ deployment of products on permissionless networks continue nearly weekly. Yet, some TradFi institutions still treat permissionless networks as somehow unavailable. Instead, many banks, broker-dealers, and asset managers have been trending toward *permissioned networks* — systems in which a gatekeeper or consortium decides who may validate transactions, who may use or participate in the network, and for what purpose. These institutions are currently choosing permissioned networks because they believe — wrongly — they must. The premise underlying that choice is that a known, verified set of actors is a precondition to compliance with financial integrity laws: the Bank Secrecy Act (BSA), with its anti-money laundering (AML) and countering the financing of terrorism (CFT) requirements; and U.S. sanctions laws. Simply put, institutional compliance departments think permissionless networks are irreconcilable with the BSA and sanctions laws. Our new paper, “[The Compatibility of Permissionless Networks and Financial Integrity: A Practical Guide for Financial Institutions](https://papers.ssrn.com/sol3/papers.cfm?abstract_id=7343938),” explains that financial institutions **can build and transact on permissionless blockchain networks**. Concerns about financial integrity laws should not deter such usage and can be addressed under existing law today. Institutions can satisfy their obligations through appropriate, risk-based compliance frameworks that place controls at the layer where institutions operate. There is no precondition — regulatory or otherwise — for financial institutions to own, screen, or censor the underlying infrastructure over which their financial transactions, and the communications about them, travel. In fact, regulators explicitly have recognized that financial institutions *can* adapt their financial integrity compliance programs to technological innovations like permissionlessness. The BSA and sanctions laws require financial institutions to have reasonable control over risks and put controls in place to mitigate them. They do not require total elimination of risk — an impossible threshold. Under the BSA, financial institutions’ AML/CFT programs must focus on detecting, documenting, and deterring illicit financial activity. These programs are not intended to prevent money laundering or terrorist financing wholesale, nor can they. The federal banking regulators and FinCEN have [explicitly stated](https://www.fincen.gov/news/news-releases/joint-statement-risk-focused-bank-secrecy-actanti-money-laundering-supervision) that the key to financial integrity is a “reasonably designed” AML program that includes “effective processes to identify, measure, monitor and control risks.” FinCEN stated this more plainly in its August 2020 Statement on Enforcement, describing its approach to BSA enforcement as something other than a “gotcha” game. Treasury’s report on de-risking addressed the underlying fear directly, observing that while banks believe any failure in banking controls exposes them to substantial fines, the regulators note that such fines are rare and follow the collapse of an entire AML/CFT program, rather than the limited shortcomings a risk-based approach will sometimes produce. The sanctions regime works on similar logic. [OFAC’s Framework for Compliance Commitments](https://ofac.treasury.gov/media/16331/download?inline) identifies five essential components of an effective risk-based sanctions compliance program: management commitment, risk assessment, internal controls, testing and auditing, and training. OFAC scales its implementation expectations to an institution’s size, products, customers, and geography. The [Economic Sanctions Enforcement Guidelines](https://ofac.treasury.gov/media/913571/download?inline) weigh willfulness, awareness of the conduct, harm to sanctions objectives, and the adequacy of the compliance program when the agency decides how to address an apparent violation. The agencies’ respective enforcement regimes and history support the “risk-balanced-not-zero-tolerance” approach. FinCEN and OFAC focus enforcement efforts on reasonably knowable, systemic deficiencies rather than isolated slips. This posture bears directly on the inadvertent-violation concern institutions raise about permissionless networks. Both AML/CFT and sanctions regimes ask for control proportionate to identified risk, which institutions can achieve on a permissionless network. Any attenuated or inadvertent violations of those regimes should not create risk for financial institutions. Financial institutions should understand the use of permissionless networks as akin to the use of infrastructure, much as they already treat the public internet and the telephone network. Both of these are shared systems whose other users and operators they neither know nor screen. They should calibrate their compliance approach accordingly. Instead, financial institutions’ hesitation to engage with permissionless networks focuses on potential inadvertent or unknowing interactions with sanctioned or illicit actors — for example, paying network fees to a validator operated by a sanctioned actor, unknowingly transacting with a sanctioned actor, or receiving or transacting with cryptoassets that may have touched illicit actors at some point in their history. But inadvertent, unknowing interactions with validators or other network participants in a sanctioned jurisdiction are not the kind of activity the sanctions laws were written to address. The concern is broader than geography, since a validator could be a designated person operating from anywhere: The institution has not selected, contracted with, exported to, financed, or otherwise dealt with the operator, and the fee reaches it through rules that apply identically to every network user. Regulators have confirmed this. For example, in November 2025, the OCC addressed this concern by issuing [Interpretive Letter 1186](https://www.occ.gov/topics/charters-and-licensing/interpretations-and-decisions/2025/int1186.pdf), confirming that a bank may pay network fees on blockchain networks and may hold as principal the crypto-assets needed to pay them. The letter reasons from [Interpretive Letter 1174](https://www.occ.gov/news-issuances/news-releases/2021/nr-occ-2021-2a.pdf) of January 2021, in which the OCC concluded that a bank may validate, store, and record payment transactions by serving as a node. Accepting the fee paid to a node follows from that conclusion. The letter uses the Ethereum blockchain as an example, a permissionless network whose protocol selects validators pseudo-randomly. None of the letters in this line distinguishes permissioned networks from permissionless ones. When an institution submits a transaction via a permissionless network, the protocol assigns the right to propose the block that will include that transaction to a unique validator, generally pseudo-randomly and in proportion to stake. Protocol-defined rules set the fee as a function of network demand and the computational resources the transaction consumes. As a result, an institution does not choose the validator that will process its transaction. It cannot bargain over the fee, and it has no way to learn who the validator is before or after the transaction. Every other user of the network transacts under identical rules. This bears some resemblance, as mentioned above, to the relationship between an email sender and the owners of the routers that carry the message, or between a caller and the owners of the switches that complete the call. A U.S. financial institution whose internet protocol packets traverse infrastructure in a sanctioned jurisdiction is not considered to violate sanctions on that basis: The same analysis of neutral, protocol-mediated carriage applies to a permissionless network’s consensus layer. The BSA’s own regulatory definition codifies that distinction, expressly excluding those who “merely provide the delivery, communication, or network access services used by a money transmitter to support money transmission services.” The BSA also distinguishes neutral carriage from transacting, and the sanctions analysis turns on the same feature of the relationship, the absence of selection, direction, or dealing. Although an institution transacting on a permissionless network does have some contact with operators it has not screened, that contact is different from what sanctions laws police: In these network interactions, no party involved selected any other. To put this in perspective, in the nearly five years since OFAC published its Sanctions Compliance Guidance for the Virtual Currency Industry, no enforcement action has been predicated on a validator having proposed a block that happened to contain a sanctioned party’s transaction, and none has rested on a market participant’s payment of protocol-level fees. The second concern institutions raise is privacy: Can a bank transact on a public ledger without exposing client positions, counterparties, and strategies to its competitors? The early case for permissionless ledgers rested on total transparency as a compliance asset. Financial integrity requires something narrower: that the necessary information be verifiable by the institution, its counterparty, and its regulator or supervisor. Cryptography has advanced far enough that an institution can prove a compliance-relevant proposition without publishing the data that establishes it: for instance, that a counterparty sits outside the Specially Designated Nationals (SDN) List, or that reserves exceed liabilities, with the book and the counterparty’s identity remaining undisclosed. Proofs of provenance permit a party to show that an asset never came from an identified illicit set without exposing its transaction graph. Confidential-transfer designs encrypt amounts and balances on the ledger while retaining a viewing key an institution can furnish to an examiner. Together, these cryptographic advances give a supervisor better assurance than a closed system provides. And they do so while giving a competitor nothing at all, turning privacy from an objection into a reason to build on permissionless networks. Some of these techniques are in production today; some are still in the research and development phase. Address rotation and account abstraction are in production, as are omnibus and tiered custody structures that keep client-level detail off the ledger and the messaging protocols that carry Travel Rule data alongside an onchain transfer. While confidential transfers with an auditor key are shipping, they are currently thinly used at institutional scale. Proofs of unsanctioned status and provenance proofs against a designated set remain in pilot testing and research. Yet solutions do exist: Privacy Cash, for example, is a privacy protocol that sits on top of Ethereum and Solana and uses [zero-knowledge proofs](https://a16zcrypto.com/posts/tags/zero-knowledge-succinct-proof-systems) to enable confidential transfers and swaps. We [set out](https://papers.ssrn.com/sol3/papers.cfm?abstract_id=7343938) nine components of a financial integrity program adapted to permissionless-network activity: Transaction-level controls that apply to the institution’s customers and counterparties in largely the same form they take today, and network-level controls that address the infrastructure itself. These controls do not require validator identification, service-level agreements with a protocol, or petitions to a gatekeeper for membership, among other features of permissioned networks; current financial integrity laws require none of this. The proposed framework is also consistent with recent U.S. legislation, [the GENIUS Act](https://a16zcrypto.com/posts/tags/genius-act). GENIUS likewise adopts a framework where AML/CFT and sanctions controls sit at the application layer, operated by entities with knowledge of customers and control over assets. GENIUS requires permitted payment stablecoin issuers, as identifiable regulated entities at the application layer, to certify the existence of AML programs and sanctions compliance programs, and to maintain the technical capability to execute lawful orders to freeze or burn outstanding stablecoins. These obligations run to the issuer, not to the permissionless networks on which stablecoins circulate. \*\*\* A generation ago, regulated financial institutions confronted an open, global, permissionless network that anyone could join and that carried the traffic of legitimate and illegitimate users alike. Institutions moved their businesses onto the open protocols of the internet and built their controls at the application layer. The same can be done now for permissionless networks. Avoiding permissionless networks is not a financial integrity strategy; it is an abdication of the role that U.S. institutions have always played in making the dollar-based financial system resilient, data-enriched, and risk-based. And dollar-denominated activity on permissionless networks is already happening and will continue, whether or not U.S. institutions take part. The reach of U.S. financial enforcement rests on line of sight into financial flows, and the architecture behind the financial integrity laws — their implementation and enforcement — depends on U.S. institutions observing the activity they are asked to monitor. Not participating in the innovation and benefits borne by permissionless networks — based on a misinterpretation of relevant laws or concerns rooted in past regulators’ positions — unnecessarily limits the choices traditional financial institutions make in serving their customers’ needs. *This article is adapted from [The Compatibility of Permissionless Networks and Financial Integrity: A Practical Guide for Financial Institutions](https://papers.ssrn.com/sol3/papers.cfm?abstract_id=7343938), by Rebecca Rettig, Omid Malekan, and Michael Mosier.*