The European Central Bank published Working Paper WP3208 on March 26, 2026, titled "Who to regulate? Identifying actors within DeFi's governance." The paper analyzed token ownership and voting power distribution across four major DeFi protocols — Aave, MakerDAO (now Sky), Ampleforth, and Uniswap ...
"A small number of entities holds a majority of the supply... governance power is concentrated, opaque and structurally resistant to change." — European Central Bank, Working Paper WP3208 (March 2026)
The European Central Bank published Working Paper WP3208 on March 26, 2026, titled "Who to regulate? Identifying actors within DeFi's governance." The paper analyzed token ownership and voting power distribution across four major DeFi protocols — Aave, MakerDAO (now Sky), Ampleforth, and Uniswap — and found governance control concentrated in a narrow set of wallets. The top 100 addresses held more than 80% of governance token supply across all four protocols studied.
The findings arrive 96 days before the EU's Markets in Crypto-Assets regulation (MiCA) final CASP authorization deadline on July 1, 2026. MiCA's Recital 22 exempts services "provided in a fully decentralised manner without any intermediary" from licensing requirements. The ECB paper directly challenges whether any of the four studied protocols can credibly claim that exemption, given that roughly 50% of voting power traces back to protocol insiders — founders, developers, and DAO treasuries — while centralized exchanges hold an additional 3% to 22% of governance tokens.
The paper has already triggered responses across the DeFi sector. Aave's founder faces accusations of governance manipulation after a $10 million token purchase ahead of a contested vote. Uniswap's governance structure was questioned in a U.S. congressional hearing. Multiple DAOs have initiated buyback programs and structural reforms. The collective response suggests the industry recognizes the problem but lacks consensus on solutions.
The ECB researchers analyzed governance token distribution using on-chain data snapshots from November 2022 and May 2023. While the data predates current market conditions, the structural findings align with more recent observations from multiple sources.
Core findings across all four protocols:
| Metric | Aave | MakerDAO | Uniswap | Ampleforth | |--------|------|----------|---------|------------| | Top 100 holders' share of supply | >80% | >80% | >80% | >80% | | Top voters controlling majority of delegated power | Concentrated | Top 10: 66% | Top 18: 52% | Top 20: 96% | | Exchange token holdings | 3-22% | 3-22% | 3-22% | 3-22% | | Insider-linked voting power | ~50% | ~50% | ~50% | ~50% |
Approximately 50% of voting rights across the studied protocols traced to entities closely linked to the protocols themselves: founders, core developers, and treasury accounts managed by the DAOs. Binance was identified as the largest centralized exchange holder of governance tokens across all four protocols.
The paper's authors recommended improving "traceability of token holdings" and establishing "tailored legal structures specifically for DAOs."
Ampleforth exhibited the sharpest concentration. The top 20 voters controlled 96% of delegated voting power. For a protocol whose rebase mechanism is designed to be algorithmic and decentralized, the governance layer tells a different story.
MakerDAO (rebranded as Sky Protocol) showed the top 10 voters holding 66% of delegated votes. MakerDAO's governance has undergone significant restructuring under the "Endgame" plan, creating SubDAOs intended to distribute decision-making. The ECB data predates this restructuring, though the concentration pattern reflects deeper structural issues tied to early token distribution.
Uniswap showed somewhat less concentration at the delegated voting level — the top 18 voters held 52% of power. However, Uniswap's governance has drawn its own scrutiny. The Uniswap Foundation delayed a vote on diverting protocol revenue to UNI token holders, prompting accusations of centralized control. After passing its "UNIfication" proposal, Uniswap burned $600 million worth of UNI and activated its fee switch.
Aave governance concentration was significant enough to spark an internal crisis described in detail below.
The ECB paper flagged a critical transparency gap: approximately one-third of top governance voters across the four protocols could not be publicly identified. Researchers found that the most active voters were predominantly delegates rather than direct token holders, and many delegates operated pseudonymously.
Among identifiable voters, the composition included individuals and Web3 companies (the largest groups), followed by university blockchain societies and venture capital firms. The presence of VC firms as governance participants raises questions about the distinction between "decentralized governance" and traditional corporate board dynamics conducted through token proxies.
This opacity creates a regulatory blind spot. If regulators cannot identify who controls governance decisions, they cannot determine whether a protocol meets the "fully decentralised" threshold under MiCA — or any other regulatory framework.
MiCA's Recital 22 contains a deliberate exemption: crypto-asset services provided in a "fully decentralised manner without any intermediary" fall outside the regulation's scope. This carve-out was intended to avoid regulating pure protocol code. The ECB paper challenges its applicability to any DAO with concentrated governance.
The European Securities and Markets Authority (ESMA) has published a "spectrum of decentralization" framework, acknowledging that decentralization is not binary. ESMA evaluates centralization points including front-end websites, infrastructure providers (Infura, Alchemy, relying on AWS hosting), and governance structures. No definitive threshold for "full decentralization" has been established.
The regulatory timeline creates urgency. MiCA's final CASP authorization deadline is July 1, 2026 — approximately three months away. Any DeFi protocol that ESMA or national competent authorities determine is not "fully decentralized" faces three options:
DeFi protocols collectively hold approximately $97.6 billion in TVL as of March 2026, according to DefiLlama. EU-based users represent a meaningful share of this capital. The regulatory determination could trigger significant capital flows.
The ECB paper and broader governance scrutiny have prompted structural responses across the DeFi sector:
Lido Finance proposed a $20 million LDO token buyback using 10,000 stETH from its treasury, linking staking revenue directly to governance token demand. TVL: approximately $27.5 billion.
Balancer DAO cut its core team by 50% following a November 2025 exploit, reduced its annual budget by 34% to $1.9 million, eliminated its veBAL governance model, and directed all collected fees to the DAO treasury.
Lista DAO introduced Tokenomics 2.0, eliminating its veLISTA lockup mechanism and replacing it with a buyback and revenue-sharing model — departing from the popular veToken governance trend.
P2P.me introduced a futarchy governance model using market mechanisms for decisions and proposed a $500,000 USDC buyback at 8% below ICO prices.
The Uniswap Foundation responded to the ECB paper's findings by noting that the 2022-2023 data does not reflect current conditions. The Foundation claimed that removing exchange cold storage wallets from the analysis reduces top-100 concentration to "no more than 43%." This rebuttal raises its own question: if exchange-held tokens are excluded from concentration calculations, who exercises the governance rights attached to those tokens?
Aave provides the most acute case study of governance concentration risk. In early 2026, founder Stani Kulechov purchased $10 million worth of AAVE tokens ahead of a contested governance vote. Critics alleged the purchase was designed to increase voting power on a proposal "directly against the token holders' best interests," according to a DeFi strategist quoted by Cointelegraph.
Kulechov responded that the purchased tokens were not used to vote, framing the purchase as a long-term commitment: "This is my life's work."
The controversy surfaced deeper tensions. Community members had flagged since December 2025 that fees from Aave were being sent to Aave Labs without a governance vote from token holders, triggering accusations that community revenue was being privately captured. The top three voters in Aave governance control more than 58% of all votes cast.
Aave DAO has since approved deployment of Aave V4, featuring a hub-and-spoke architecture, and adopted the "Aave Will Win Framework" competitive strategy. Whether these structural changes address governance concentration or further entrench core team control remains an open question.
Aave holds approximately $27 billion in TVL — the second-largest DeFi protocol. Its governance decisions affect a substantial pool of user capital.
Uniswap's governance structure reached U.S. legislative attention when Representative Sean Casten (D-IL) questioned Uniswap Labs Chief Legal Officer Katharine Minarik during a House committee hearing on crypto legislation. Casten asked whether the Uniswap Foundation's ability to make unilateral decisions undermines decentralization claims.
Minarik responded: "I am fairly certain that the Uniswap Foundation cannot make any unilateral governance change."
The exchange highlighted a recurring tension. Uniswap has adopted Wyoming's DUNA legal framework, creating "DUNI" — a legally-recognized entity for its DAO. The proposal allocated $16.5 million in UNI to settle past tax burdens and fund legal defense. Despite 18 months of availability, only three organizations have adopted DUNA: Syndicate, Uniswap, and WYDE.
The DUNA framework offers DAOs the ability to own property, enter contracts, and gain legal personality without becoming corporations. It represents one path toward regulatory clarity, but adoption remains minimal.
The governance concentration data intersects with DeFi's economic model. Protocols that generate significant fee revenue — Aave's lending fees, Uniswap's trading fees, Lido's staking commissions — route economic value through governance decisions. When governance is concentrated, fee distribution, treasury management, and protocol upgrades reflect the preferences of a narrow set of holders rather than the broader user base.
Kavi Jain, Senior Research Associate at Bitwise, confirmed that many DeFi protocols "were not as decentralized in practice as they might appear." Academic research corroborates: empirical analyses reveal that in many DAOs, governance decisions are determined by less than 10% of eligible token holders.
The $97.6 billion in DeFi TVL is effectively governed by a few thousand wallets. The economic value generated by these protocols — transaction fees, lending interest, liquidation revenues — flows through governance channels controlled by concentrated interests. This represents a structural misalignment between the economic participation of depositors and the governance power of token holders.
The ECB paper quantifies what on-chain observers have long suspected: DeFi governance is an oligarchy dressed in democratic language. The data shows a small number of insiders, exchanges, and professional delegates controlling the vast majority of voting power across protocols managing tens of billions in user deposits.
The regulatory implications are immediate. MiCA's decentralization exemption was drafted for a version of DeFi that may not exist in practice. With the July 1 deadline approaching, European regulators face a binary choice: accept that "decentralized" governance with 80% concentration in 100 wallets qualifies for exemption, or force protocols into CASP licensing frameworks designed for centralized entities.
Neither option maps cleanly onto DeFi's hybrid reality. The protocols are not centralized corporations. But they are not decentralized democracies either. The ECB has provided the data. The regulatory response — and the industry's structural adaptation — will determine whether DeFi's $97.6 billion in locked capital remains accessible to European users after July 1.