The European Central Bank published Working Paper No. 3208 on March 26, 2026, presenting empirical evidence that governance in four major DeFi protocols — Aave, MakerDAO (now Sky), Ampleforth, and Uniswap — is concentrated among a small number of token holders. The top 100 addresses across these ...
"Many large DeFi protocols were not as decentralized in practice as they might appear, especially in the earlier stages, where a small group still has meaningful influence over decisions." — Kavi Jain, Senior Research Associate, Bitwise
The European Central Bank published Working Paper No. 3208 on March 26, 2026, presenting empirical evidence that governance in four major DeFi protocols — Aave, MakerDAO (now Sky), Ampleforth, and Uniswap — is concentrated among a small number of token holders. The top 100 addresses across these protocols control more than 80% of governance token supply. Approximately one-third of the most influential voters cannot be publicly identified.
The findings carry regulatory weight. The EU's Markets in Crypto-Assets Regulation (MiCA) exempts services provided in a "fully decentralised manner without any intermediary." If Europe's primary central bank concludes that major DAOs do not meet this threshold, the protocols face a binary outcome by July 1, 2026: restructure governance to satisfy a yet-undefined decentralization standard, apply for Crypto-Asset Service Provider (CASP) authorization, or exit the European market.
The paper examined governance data across two snapshot periods — November 2022 and May 2023 — covering protocols that collectively represented approximately 32% of total value locked on Ethereum at the time of study.
ECB Working Paper 3208, titled "Who to regulate? Identifying actors within DeFi's governance," analyzed on-chain token distribution and voting behavior across four protocols: Aave, Uniswap, MakerDAO, and Ampleforth. Researchers used on-chain distributions rather than corporate records to map where voting power sits.
The methodology combined blockchain analytics (via Crystal Intelligence), web searches, GitHub activity, social media profiles, and governance forum participation to identify token holders. The study catalogued 248 governance proposals across the four protocols, categorizing them by type: risk parameters (28%), asset listings (23%), and governance structure changes (1%).
The paper operates on a concept described in prior academic literature as "timocratic governance" — a system where political power correlates directly with wealth holdings. In this case, the wealth is governance tokens, and the political power is protocol-level decision-making authority over billions of dollars in locked assets.
The numbers are stark. Across all four protocols, the top 100 addresses hold more than 80% of governance token supply, despite tokens being distributed across tens of thousands of addresses.
Delegation, the mechanism by which token holders assign their voting power to representatives, amplifies rather than reduces concentration:
At the top-holder level, the concentration is even more pronounced. In Aave and Uniswap, the top 5 holders captured approximately 50% of all tokens. In Ampleforth, the top 5 controlled approximately 60%.
The ECB researchers stated: "While these tokens are technically distributed across a large number of unique blockchain addresses, a small number of entities holds a majority of the supply."
The paper maps token holders into categories. The findings challenge assumptions about broad community ownership:
Andreessen Horowitz (a16z) was identified as the top voter in Uniswap governance across both snapshot periods. By May 2023, a16z's voting power was delegated from 125 separate addresses.
The concentration of tokens among protocol-affiliated entities is significant for regulatory purposes. If founders, core developers, and treasuries controlled by small multisig committees hold half the voting power, the "decentralized" label becomes a description of architecture, not governance.
Roughly one-third of top voters across the four protocols could not be publicly identified using the ECB researchers' methodology. This anonymity creates what the paper describes as a transparency problem that "complicates efforts to assess accountability and reinforces concerns about the concentration of power."
The opacity is not incidental. Pseudonymous governance participation is a feature of permissionless systems, not a bug. But from a regulatory perspective, it creates an unbridgeable information gap. Regulators cannot determine whether anonymous voting blocs represent independent actors, coordinated groups, or centralized exchanges voting on behalf of custodied tokens.
For MiCA enforcement, this matters. If a protocol cannot demonstrate who controls governance, European regulators have no mechanism to assess whether it meets the "fully decentralised" exemption threshold.
MiCA's Recital 22 exempts crypto-asset services provided in a "fully decentralised manner without any intermediary." The regulation does not define what "fully decentralised" means. That ambiguity is the core issue.
The European Commission is required to deliver a DeFi assessment report by mid-2026. The ECB paper positions itself as input to that process. If the Commission adopts the paper's analytical framework — measuring governance concentration, token holder identification, and proposal control — most major DeFi protocols would fail the decentralization test.
The CASP authorization deadline is July 1, 2026. As of March 2026, only 13 of 27 EU member states have fully transposed MiCA into national law. Poland vetoed its transposition in January 2026 under President Karol Nawrocki. The regulatory landscape remains uneven across the bloc.
The stakes are measurable. Protocols that fall within MiCA's scope face licensing requirements, capital adequacy standards, and compliance obligations that mirror those of centralized crypto-asset service providers. For governance structures built around anonymous, permissionless token voting, meeting these requirements would require fundamental restructuring.
The Uniswap Foundation pushed back on the ECB's methodology. According to statements reported by CoinTelegraph, the Foundation noted that the current largest single holder is the Uniswap DAO Treasury governance contract. Removing exchange cold storage wallets (Binance, OKX) from concentration calculations reduces the top-holder share to "no more than 43%."
This rebuttal highlights a methodological tension. Exchange-held tokens may represent custodied assets of thousands of individual holders, not the exchange's own governance power. Whether Binance votes those tokens — or whether it can — is a separate question from whether it holds them.
Uniswap has taken structural steps to address the legal ambiguity. In 2025, it became the first major DeFi protocol to adopt Wyoming's Decentralized Unincorporated Nonprofit Association (DUNA) framework, creating a legal entity called DUNI. The Foundation requested $16.5 million in UNI to fund a legal defense reserve and settle potential U.S. tax liabilities. This structure is designed to enable the long-debated protocol fee switch while providing liability protections for token holders.
The DUNA approach represents a pragmatic middle path: accepting some degree of legal identity without conceding centralized control. Whether European regulators will view it as sufficient evidence of decentralization remains untested.
The governance concentration documented by the ECB is not unique to these four protocols. According to broader DAO research, the top 10 DAO governance tokens all carry Gini coefficients between 0.97 and 0.99 — where 0 represents perfect equality and 1 represents total concentration. For context, South Africa, the most income-unequal country on earth, has a Gini coefficient of 0.63.
The comparison is imperfect — token distribution and income distribution measure different things. But the scale of concentration is informative. DeFi governance is not moderately unequal. By the standard metrics of distribution analysis, it is among the most concentrated allocation systems measured.
Voter participation compounds the problem. Most Ethereum-based DAOs average under 10% participation in governance votes. In a system where 80% of tokens are held by 100 addresses and 90% of eligible voters do not participate, effective governance control rests with a handful of active, large holders.
The convergence of regulatory deadlines creates urgency:
The ECB paper is explicitly positioned to inform these processes. It is not binding policy. It is a research contribution from the euro area's central bank, published three months before the critical regulatory deadline. The timing is not incidental.
The ECB paper does not propose specific regulation. It maps a governance reality that regulators will now use as input. The data shows that DeFi governance is not decentralized by any standard quantitative measure. Tokens are distributed. Voting power is not.
For protocols operating in or serving European users, the question is no longer theoretical. The MiCA framework requires a binary classification: fully decentralized or regulated entity. The ECB's data suggests most major protocols fall into the second category.
The industry's response will likely follow two tracks. Some protocols will pursue legal wrappers — like Uniswap's Wyoming DUNA — that provide regulatory identity while preserving on-chain governance mechanics. Others may attempt to demonstrate decentralization through governance reforms: broader token distribution, time-locked voting, or participation thresholds.
Neither path is straightforward. The fundamental tension between token-weighted voting and distributed governance has no technical solution. It is a structural feature of systems where financial stake equals political power. The ECB has now quantified what the industry has long known. What regulators do with that data will shape DeFi's operating environment in Europe for years to come.