7.1 Introduction

The financial landscape is being transformed as emerging digital technologies increasingly integrate with decentralised financial assets. Technologies such as blockchain, artificial intelligence (AI), and the Internet of Things (IoT) are being incorporated to form new financial products and services that operate without traditional intermediaries (Divyashree and Mishra, 2025). This convergence promises substantial benefits: for example, blockchain provides a tamper-resistant ledger that enables peer-to-peer transactions and self-executing agreements (smart contracts) with transparency and security (Kmet, Reference Kmet2018). In financial contexts, AI largely means machine learning algorithms and data-driven models that perform tasks such as prediction, classification, optimisation, and anomaly detection (Pillai, Reference Odilla2023). AI algorithms can automate complex decision-making in lending, trading, and fraud detection, far beyond human speeds (Clarke, Reference Clarke2023).

The IoT refers to the network of physical objects equipped with sensors, software, and connectivity, enabling them to collect and exchange data (Laghari et al., 2021). Simple environmental sensors comprise one end of the IoT device range, while smartphones, smart appliances, vehicles, and industrial machines form the other end. IoT devices can transfer real-time data into blockchain networks (via oracles), letting smart contracts respond to real-world events – for instance, changing insurance payouts based on sensor data or triggering supply chain payments when goods are delivered (Ashfaq, 2022). Together, these innovations start a new era of financial inclusion, efficiency, and automation in financial services.

At the same time, these technologies provide dual functionality, which allows legitimate uses to co-exist with illegal and unethical activities. Money laundering, fraud, and criminal activities can occur on decentralised and anonymous platforms because these systems hide transaction data from regulatory oversight (Benson, Turksen and Adamyk, Reference Benson, Turksen and Adamyk2023). AI tools that enhance services present a risk for malicious activities since they can be used to manipulate markets while automating cyber-attacks (Sumner, Reference Sumner2025). The vulnerability of IoT devices enables attackers to inject adversarial data into smart contracts or reveal important financial data to unauthorised parties. Thus, the features that make emerging tech attractive for finance (speed, pseudonymity, automation) can become a ‘digital cloak’ for illegal activity if proper safeguards are not in place (George, 2024). Financial industry professionals and government regulators currently face the dual challenge of harnessing blockchain-based finance, AI, and IoT while mitigating the risks of misuse and maintaining stability and trust in financial markets.

The European Union’s regulatory move demonstrates this balancing act. Recently, the EU established a comprehensive framework, the Markets in Crypto-assets Regulation 2023 (MiCA), to oversee digital asset markets and the Artificial Intelligence Act 2024 to set rules for AI systems, alongside a new Anti-Money Laundering Authority (AMLA) to manage illicit financial risks. These initiatives aim to advance innovation in areas such as decentralised finance (DeFi) and AI, as well as address security, consumer protection, and financial crime concerns. Against this backdrop, this chapter provides a structured analysis of the dual-use phenomenon in emerging financial technologies.

Section 7.2 outlines a conceptual framework for understanding dual-use technologies in the financial domain. Section 7.3 explains the technological underpinnings of blockchain, DeFi, AI, and IoT. The benign applications and benefits of this integration are highlighted in Section 7.4, followed by the adversarial risks and malicious uses in Section 7.5. Section 7.6 discusses ethical considerations and evolving regulatory measures. Section 7.7 explores the state-of-the-art developments and initiatives at the time of writing. Finally, Section 7.8 presents a future outlook and concludes with strategies to handle the dynamic complexities of this ecosystem.

7.2 Conceptual Framework for Dual-Use Technologies in Finance

The term dual-use technology describes innovations that can serve both beneficial needs and destructive objectives. Financial dual use describes how modern innovative tools benefit legitimate economic actors and simultaneously provide opportunities for criminals and bad actors (David, Reference David2023). The dual-use concept can be observed through the convergence between DeFi, AI, and IoT technologies. Advanced technologies serve as dual-purpose tools that enable financial democratisation and improved efficiency, yet they also enable control of subversion and illegal operations. A structured approach must be established to handle the dual nature of these systems.

At its core, DeFi is a system that recreates traditional financial instruments – lending, trading, payments, insurance – on distributed blockchain platforms, reducing dependence on central intermediaries (Adamyk et al., Reference Meinzer, Harari, Lorenzo and Knobel2025). By design, DeFi protocols such as decentralised exchanges or lending platforms let peer-to-peer transactions be governed by code (smart contracts) rather than by banks or brokers. The absence of intermediaries and openness of DeFi are profoundly positive innovations: they can lower costs and barriers to access and foster the transparency of transactions (Vasishta et al., Reference Vasishta, Dhiman, Smith and Singla2025). For example, users can interact with DeFi platforms through the internet to loan money or withdraw funds without needing bank authorisation. Nevertheless, the same features which enable open access and eliminate financial intermediaries also create possible misuse opportunities. Users can execute large sums of money transfers via unidentified wallet addresses while concealing their payment sources, hindering anti-money laundering (AML) enforcement efforts (Kmieliauskas, Reference Kmieliauskas2025). The conceptual framework of dual use needs to address how user empowerment from direct access coexists with removing traditional risk management processes.

The dual-use problem is exacerbated by AI and IoT technologies. In finance, AI incorporates machine learning models, algorithms and autonomous agents that can analyse data or make decisions (Lakhchini, Wahabi and Kabbouri, Reference Lakhchini, Wahabi and Kabbouri2022). These range from credit scoring systems to high-frequency trading algorithms (Turksen, Benson and Adamyk, Reference Palmiotto, Ebers and Cantero Gamito2024). Integrated with DeFi, AI can automate complex financial strategies or detect transaction anomalies. Adversaries can repurpose the same AI tools that help banks detect fraud to evade detection, generate synthetic identities, or identify exploitable market patterns (Sumner, Reference Sumner2025). Likewise, the IoT – networks of sensors and smart devices generating real-time data – can feed invaluable information into DeFi systems (for example, an IoT sensor measuring crop growth might trigger an automatic crop insurance payout) (Ahamad et al., Reference Mészáros2022). However, those IoT devices, if subverted, can become entry points for cyber-attacks or sources of compromised data input, undermining integrity of financial contracts (Gummadi, Reference Nduka, Okenyebuno and Sechap2023). The IoT ecosystem often lacks effective security and is notorious for vulnerabilities such as weak authentication and unencrypted data streams. The attack capabilities of criminals increase substantially when IoT devices become integrated with financial transactions within a dual-use framework (Vaseashta, Reference Vasishta, Dhiman, Smith and Singla2025).

The dual-use issue becomes easier to understand by examining a spectrum of use cases from purely beneficial to completely malicious rather than two opposing categories. Most new technological applications exist in a ‘grey area’ between clear beneficial and harmful uses. For instance, an algorithmic stablecoin might promote financial inclusion in emerging markets, yet it could also facilitate capital movement or collapse and harm users if poorly designed (Clements, Reference Nandivada and Haan2021). Trading bots could bring trading liquidity, but unscrupulous AI algorithms can drive bots to perform market manipulation. The proposed framework needs to combine the functions of different stakeholders: developers (who create protocols and AI models); users (who may be legitimate or criminal); and law enforcement or regulatory agencies (who need oversight capabilities). Each stakeholder has a different incentive – innovators often prioritise openness and functionality, whereas regulators emphasise controls and safeguards. Governance mechanisms become vital in aligning these perspectives. For decentralised projects, governance may be algorithmic or community-driven (via token voting), raising questions about accountability for dual-use outcomes.

The timeline between technological adoption and implementation of regulatory measures is commonly known as the Collingridge dilemma because it becomes challenging to predict and control societal impacts during early development stages, yet the technology becomes highly entrenched when unfavourable consequences appear (Tigard, 2022). The same pattern exists in present-day DeFi and AI systems. They have swiftly overtaken traditional legal frameworks, creating a lag in regulatory response. Therefore, new regulatory framework must incorporate adaptive regulation and ethical design principles. For example, AI developers are encouraged to implement fairness and transparency measures to prevent biased or inscrutable models from causing harm. In the blockchain context, there are proposals for self-regulation through code – for example, smart contracts that enforce compliance (such as only allowing transactions if specific criteria are met or embedding identity verification credentials such as soulbound tokens (Adams, 2024) to user wallets). While such measures are still emerging, they represent efforts to resolve dual use by technical means.

In summary, the conceptual dual-use model in modern financial technologies depends on recognising how blockchain, AI, and IoT components function as both constructive elements and security threats. The framework demands analysis from three distinct viewpoints: technological aspects regarding system operations, legal/regulatory elements describing applicable rules, and ethical considerations of societal values.

7.3 Technological Underpinnings: Blockchain, DeFi, AI, and IoT

A sound understanding of the technologies is essential before exploring their dual uses. Blockchain is the foundational technology underpinning DeFi. The blockchain operates as a distributed ledger system while multiple computers (nodes) validate and record transactions through encrypted blockchains (Adamyk et al., Reference Meinzer, Harari, Lorenzo and Knobel2025). Bitcoin is the most well-known application of blockchain technology, introducing digital money through a decentralised system, while blockchain itself now underpins a wide range of platforms beyond cryptocurrencies. Smart contracts added onto Ethereum blockchain enable self-executing code to run on blockchain networks, which enforces agreements through automated processes such as payments after goods delivery. The key properties of blockchain networks include decentralisation, immutability, and transparency (Ali, Norman and Azzuhri, Reference Milojević and Redzepagic2023).

Decentralisation refers to the distribution of ledger maintenance across a network of independent nodes rather than a single trusted authority; this architecture mitigates single-point-of-failure risks and reduces the potential for unilateral control or censorship (Papadopoulos, Pitropakis and Buchanan, Reference Odeyemi2022). Immutability denotes the cryptographically enforced impossibility of altering validated records without network consensus, thereby providing a tamper-evident audit trail that underpins data integrity and legal verifiability (Vaigandla et al., Reference Papadopoulos, Pitropakis and Buchanan2023). Transparency arises from the public accessibility of ledger entries and validation rules, enabling any participant to verify past transactions and system behaviour, which in turn fosters accountability and trust among otherwise unconnected stakeholders (Sedlmeir et al., Reference Sedlmeir, Lautenschlager, Fridgen and Urbach2022).

Blockchain network operates without a single controlling authority because records become nearly impossible to modify after entry, and all transactions remain visible to participants through pseudonymous addresses. Blockchain technology provides ideal features that enable financial services to build their infrastructure. Traditional finance (TradFi) relies on central authorities (banks, clearing houses) to maintain ledgers and enforce contracts. By contrast, a blockchain-based system allows direct peer-to-peer value transfer and confirmable execution of logic without needing to trust a middleman. For instance, in a DeFi lending protocol, borrowers and lenders are matched through code, collateral is held in escrow by a smart contract, and interest rates adjust algorithmically based on supply-demand – all recorded on a public ledger (Harvey and Rabetti, Reference Nerantzi and Sartor2024).

DeFi refers to the ecosystem of financial applications built on blockchain networks that operate in a decentralised manner. Key components of DeFi include:

• Cryptocurrencies and tokens: The blockchain network operates through digital value transfer tokens and smart contract fuelling assets such as Ether for Ethereum transaction fee payment. Many DeFi platforms issue their own governance tokens, which confer voting rights to holders for protocol changes.

• Decentralised Exchanges (DEXs): Platforms such as Uniswap or SushiSwap that allow users to trade tokens directly from their wallets using liquidity pools and automated market-making algorithms rather than through a central exchange.

• Lending and Borrowing platforms: Platforms such as Aave and Compound enable users to earn interest through asset deposits, while others can borrow money by providing collateral under smart contract automation. Through programming code these platforms maintain real-time control over collateral ratios together with interest rates.

• Stablecoins: Stablecoins act as cryptocurrencies that maintain their value by linking to stable assets (primarily USD) thus providing the stability required for DeFi applications. Stablecoins exist mainly in two distinct types: asset-backed through reserve holdings and algorithmic foundations.

• Payment networks and remittances: Blockchain is used to send payments globally at a low cost and remove intermediaries such as correspondent banks.

• Derivatives and asset management: The decentralised environment enables users to generate derivative instruments and asset management tools, including synthetic assets that track real-world commodities and yield aggregation services (Adamyk et al., Reference Meinzer, Harari, Lorenzo and Knobel2025).

The combination of these features creates a parallel financial system operating continuously worldwide through computer code. DeFi platforms experienced substantial growth in early 2025 as tens of billions of dollars were locked into DeFi contracts worldwide (Kranjec, 2025). This growth shows the importance of understanding both the innovation and the vulnerabilities inherent in this new financial and technological architecture.

In traditional finance, AI is used for credit scoring, algorithmic trading strategies, fraud monitoring, customer service chatbots, and portfolio management, among other applications.

AI thrives on data, and the financial sector offers plenty of it – transaction histories, market data, customer profiles, and so on (Chang and Benson, 2023). Blockchain-based finance provides beneficial public access to structured transaction records that AI analysis can effectively use as valuable resources. Moreover, the deterministic nature of smart contracts means AI can constantly trigger financial actions by invoking those contracts as needed. The intersection of AI and DeFi thus creates autonomous financial agents and data-driven decision-making in a decentralised environment (Sumner, Reference Sumner2025). An example is the use of AI for real-time fraud analytics on a DeFi platform: the AI system could constantly monitor blockchain transactions and flag suspicious patterns (e.g., rapid large transfers between mixers and exchanges) for immediate intervention (Clarke, Reference Clarke2023). Another example is AI-driven lending: a DeFi lending pool might use an AI model to dynamically adjust collateral requirements or interest rates based on a borrower’s behavioural pattern and risk profile, computed from on-chain data and external credit data.

The connection between physical assets and digital ledgers in DeFi and blockchain operations relies on IoT as an interface between these domains. IoT sensors generate reliable data for blockchain smart contracts by using Oracle services, which serve as a data connection between external information and the blockchain (Al Sadawi, Hassan and Ndiaye, Reference Metelski and Sobieraj2022). Supply chain finance is an example: IoT trackers on shipping containers can log a shipment’s location and condition (temperature, shock, etc.) to a blockchain. The source data feeds into supply chain financing contracts, enabling instant transactions to suppliers once their products reach their destination without damage (Kmet, Reference Kmet2018). The blockchain supply chain platforms Maersk’s TradeLens and IBM were among numerous projects that demonstrated how IoT data updates blockchain ledgers while performing automatic trade operations.

When uniting IoT with blockchain, the main technological challenge lies in ensuring data integrity – confirmation that device-generated data remains accurate and without manipulation. Two methods for resolving this issue consist of trusted sensors with cryptographic hardware that authenticate their readings and consensus algorithms which verify multiple source data. The security of IoT remains a recognised vulnerability because resource-limited devices are unable to run complex encryption; they may be left with default passwords or outdated firmware that serve as easy entry points for cyber attackers (Kornaros, 2022). When such devices are connected to financial smart contracts, a compromised device could lead to false triggers – for example, a hacker simulating a sensor reading to illicitly trigger an insurance payout. Thus, for any significant implementation of IoT within DeFi networks, strong security measures for IoT devices and reliable Oracle systems must be the foundational elements.

Therefore, in terms of the way these technologies complement each other, blockchain offers a decentralised, immutable ledger and transaction logic; DeFi establishes the financial functions and instruments built on that ledger; AI contributes intelligence and automation in decision-making; and IoT brings external, real-world data and connectivity. Each technology on its own is powerful, but their combination is what enables truly innovative fintech applications.

7.4 Benefits of Integrating Emerging Technologies in DeFi

The fusion of blockchain, AI, and IoT with DeFi brings many potential benefits that could noticeably improve financial services and economic systems. These benefits span operational efficiencies, enhanced security and trust, new financial inclusivity, and innovative products.

Greater Efficiency and Automation: The most urgent advantage that emerges from this technology is the elimination of time-consuming manual procedures. By leveraging automation through smart contracts and AI, financial transactions that once took days or weeks and involved layers of intermediaries can be executed in seconds. For example, traditional trade finance requires documents to be verified by banks alongside customs and insurers, which results in both slow operations and high costs. Multiple verification steps in a blockchain-IoT system use automation to verify delivery through sensors and cheque conditions with smart contracts followed by immediate settlement of payments. The optimised process reduces management expenses and decreases the chances of manual errors. The digital world enables the redesign of standard back-office functions such as reconciliations, settlements, and compliance cheques (Kmet, Reference Kmet2018).

AI algorithms perform automatic real-time account matching and detect errors that legacy systems manage through monthly audits. AI monitoring of straight-through processing enabled by blockchain leads to transaction self-execution, which allows financial processes to execute with minimal human interaction, such as loan approvals, claim payouts, and cross-border payments. Such cost optimisation enables financial services to maintain continuous operations while expanding without needing proportional increases in staff numbers.

Improved Transparency and Trustworthiness: Blockchain-based finance delivers an important feature of increased transparency in financial systems. Any stakeholder can verify blockchain transactions because they are stored in a chronological and immutable manner on public blockchains. Financial transparency created by blockchain technology helps decrease both fraud and financial corruption. The blockchain receives IoT device data, such as machine usage records under leasing conditions, generating a unified, trustworthy database that both parties can rely upon. The analysis of transparent data repositories performed through AI systems enables fast irregularity detection. An AI system tracking DeFi platform activity instantly detects unusual transaction activities and suspicious addresses because it has complete visibility into the ledger database (Kute et al., 2021).

Traditionally, banks find fraud after the fact or require lengthy investigations into separate records. Openness in financial operations establishes stronger consumer trust since users can validate the paths their funds take and their contractual terms. Traditional finance derivative contracts remain difficult for ordinary people to understand, yet DeFi smart contracts provide public access to their open-source code base, which allows users to view their rules even if they must understand expert-level technicalities. The integration of AI can further explain some of these processes to users – for instance, AI chatbots can interpret and present the terms of a smart contract in plain language, improving user comprehension and empowerment (Rane, Choudhary and Rane, Reference Ogbeide, Thomson, Gonul, Onkal, Bhowmick and Bello2024).

Financial Inclusion and Accessibility: The emerging DeFi ecosystem offers access to financial services through two key features – direct service provision without intermediaries and using technology to assess risk in novel ways. Billions worldwide do not have banking services because they lack credit history and geographic limitations. Users need only an internet connection combined with a digital wallet instead of traditional bank accounts to use DeFi platforms, which decreases entry requirements. The inclusion process receives AI enhancements through alternative data assessment, which supports creditworthiness evaluation and product customisation. A decentralised platform grants loans to users who lack traditional credit records when AI algorithms detect stable wallet fund flows and timely micro-loan repayments in their blockchain transactions.

Traditional credit scoring processes overlook many people, but this approach allows them to obtain credit. Through IoT technology, farmers from lower-income groups gain access to micro-insurance services that automatically pay out smart contracts activated through sensor data collection without dealing with traditional insurance red tape. Automation-based cost efficiencies enable profitable small-scale operations to provide services, thus making micro-transactions possible even when expenses are minimal. The combination of blockchain technology and smart contracts enables financial services that banks have struggled to support economically in the past. Through technological unification, people gain ‘smart finance for everyone’, which provides them with easy-to-use mobile features and AI-powered interfaces to manage savings, borrowing, and investments.

Enhanced Security: While security is a double-edged problem, there are ways in which integrated tech can increase security. Blockchains, by design, provide effective protection against data tampering – once the network confirms a transaction, it cannot be retroactively altered or forged. Such security measures minimise the occurrence of double-spending attacks and protect ledgers from single-point failures (because they lack central databases that could be hacked). IoT and AI can augment security by providing continuous monitoring and immediate incident response. For example, AI-based anomaly detection can identify a cyber-intrusion or suspicious trading activity on a DeFi exchange the moment it happens (Mazhar et al., 2023).

Contrast this with a typical bank, where a breach might go unnoticed for days or fraudulent transactions only flagged after clearing. Additionally, emerging techniques such as AI-driven identity verification can strengthen user authentication. Biometric data from IoT devices (such as a phone’s fingerprint reader or face recognition) combined with AI analysis can securely authenticate users in a decentralised system without relying on passwords (often weak links). There are also projects where AI assists in smart contract verification, scanning contract code for vulnerabilities or compliance with regulatory requirements before deployment – essentially an automated audit. Widespread implementation of this security measure would stop numerous potential attacks while creating basic protection for DeFi protocols.

New Financial Products and Innovation: The combination of these technology elements resulted in brand-new creative outputs that were beyond human reach. For instance, dynamic insurance is an innovation wherein insurance coverage and premiums can adjust in real time based on IoT data and AI risk assessments. Insurance premium calculation in a smart contract policy depends on mileage usage, while the rate adjustment depends on monitored driving safety through telematic devices installed in the car. Real-time driving safety would decrease rates, while reckless acceleration would increase them through smart contracts and AI automation instead of traditional premium readjustments. Such insurance design establishes both fairness and individualised policies between customers. This creates a more equitable and personalised insurance model.

Similarly, in investment management, there is the rise of robo-advisers, which, when connected to DeFi, can not only advise but directly execute portfolio changes through smart contracts, offering retail investors sophisticated strategies such as automated rebalancing and yield farming that previously required expensive active management. The tokenisation of assets is another product innovation: real-world assets (RWA) such as real estate, commodities, or even art can be tokenised on blockchain and managed or traded by AI algorithms (Gottschalk, Reference Gottschalk2023). This could unlock liquidity in traditionally illiquid assets, allowing someone to buy a tiny fraction of a rental property as easily as buying a stock, with AI platforms managing the asset’s income distribution and maintenance via IoT monitors. Indeed, forecasts suggest RWA tokenisation in DeFi has the potential to grow exponentially, potentially bringing trillions in value on-chain over the next decade as legal frameworks catch up (Dioquino, Reference Nash, Kennedy-Mayo, Swire and Antón2025). The process enables more people to access investment opportunities through decentralised markets that might operate more efficiently.

Compliance and Regtech Solutions: Integrating AI and blockchain can also foster regulatory compliance and anti-fraud efforts (the ‘good side’ of dual use). AI-driven analytics on transparent blockchain data can let regulators or financial institutions to monitor compliance with AML/CFT (anti-money laundering and counter-terrorist financing) rules in near real-time. Suspicious transaction reports that used to be filed after delays could become immediate algorithmic alerts. Cryptographic identity solutions on blockchain might modernise know-your-customer (KYC) processes – for instance, a user could have a verifiable digital identity token that AI systems accept across platforms, reducing duplication of checks. Some DeFi projects are exploring on-chain KYC attestations so that participants retain privacy but can prove to decentralised applications that they are not sanctioned or of a specific jurisdiction (Malhotra, Saini and Singh, 2022).

AI can verify documents and perform background checks faster and more precisely than humans in many cases, and doing this, in combination with decentralised identity on the blockchain, offers a path to embedded compliance by design. Theoretically, this could lessen the tension between DeFi and regulators by making decentralised platforms at least as capable of enforcing financial regulations as centralised ones, although through code and AI rather than human compliance departments. While these solutions are nascent, they highlight a benefit often overlooked: emerging tech can strengthen the financial system’s integrity when applied constructively (Chainalysis, 2020).

Integrating blockchain, AI, and IoT in finance can lead to faster, cheaper, more inclusive, and perhaps more transparent financial services. It aligns well with the goals of increasing efficiency and access in the EU’s Digital Finance Strategy, which seeks to adapt regulatory frameworks to digital innovation and promote data-driven finance (Berger, Reference Moldovan2021). The benefits, however, do not come without trade-offs. As the next section will discuss, the very features that produce these advantages – openness, automation, immutability – also create new vectors for risk and exploit (Khan et al., Reference O’Neil2024). The dual-use dilemma thus becomes apparent: how to harness these benefits while controlling the corresponding risks.

7.5 Dual-Use Risks: Illicit Exploitation of DeFi and Emerging Tech

Conducting financial operations through innovative technologies creates serious problems with their improper use. Malicious actors can repurpose the same innovations that streamline and democratise finance to bypass controls, perpetrate crime, or destabilise markets. This section outlines the significant dual-use risks, focusing on how blockchain/DeFi, AI, and IoT can be exploited in illicit or harmful ways.

Financial Crime and Money Laundering via DeFi: The decentralised finance platforms often miss out on performing customer identification and transaction monitoring measures that traditional financial institutions use. The combination of user anonymity and missing intermediaries provides ideal conditions for money launderers and terrorists to carry out their illegal activities, including fraud and sanctions avoidance. Europol has warned that cryptocurrencies, DeFi platforms and AI-driven automation ‘facilitate greater anonymity’ for criminals seeking to obscure illicit transactions (Kmieliauskas, Reference Kmieliauskas2025). The real-world use of DeFi allows criminals to execute different types of abuse. One common tactic is using ‘chain-hopping’ and mixers: criminals move illicit funds through multiple cryptocurrencies and DeFi protocols, swapping from Bitcoin to Ether to privacy coins, using mixers (tumbling services that pool and reallocate crypto) in between, to sever tracing links (Benson, Turksen and Adamyk, Reference Benson, Turksen and Adamyk2023). For example, the mixer service ChipMixer managed to launder 152,000 Bitcoins worth approximately $13 billion until its shutdown in 2023 (Kmieliauskas, Reference Kmieliauskas2025). Dark web markets, together with ransomware operations and additional serious offences, received most of those funds.

DeFi provides criminals with another option for fund transfer through liquidity pools and complicated token swapping procedures to obscure tracking. These transactions move at the speed of the internet and without borders, so law enforcement agencies (LEAs) find it hard to step in before it is too late. Additionally, DeFi has experienced a surge of fraudulent activities, including rug pulls, when developers drain funds after gaining user investments and hosting Ponzi schemes disguised as profitable farming opportunities. Users lack proper protection because there is no centralised control system. These incidents not only harm victims financially but also undermine trust in the ecosystem at large (Trmlabs.com, 2022).

Cyber-attacks and Exploits: The complex smart contract code and open nature of DeFi platforms present technical risks, which skilled attackers exploit. Many high-profile DeFi protocol hacks have occurred over the past few years, and hackers have stolen hundreds of millions of dollars from users. The Ronin Network suffered a $600 million loss in 2022, while Poly Network faced a $610 million theft attempt in 2021 but recovered part of the funds (Yao et al., 2025). Criminals discover logical bugs in smart contracts through their code analysis, for instance, identifying collateral value calculation or permission setting issues to execute malicious transactions that remove funds from systems.

The decentralised nature of blockchain means no authority is capable of halting suspicious transactions since code runs automatically according to its programming even when it results in total asset transfer to attackers. Attackers exploit DeFi protocols through flash loans, which provide unsecured one-blockchain-transaction financing to manipulate asset prices for profit and empty lending pools (Harvest Finance and other platforms fell victim to this attack method in 2020) (Oosthoek, Reference Ocampo, Branzoli and Cusmano2021). The decentralised automated nature of DeFi enables attackers to conduct particular types of attacks, which have no parallel in traditional financial systems.

AI can supercharge cybercrime in this realm by helping find and exploit vulnerabilities at scale. For example, an AI agent could be trained to scan hundreds of smart contracts for known bug patterns far faster than a human, automatically execute multi-step attacks (such as the flash loan manipulation sequence) and even adapt to defences. Ransomware groups use AI capabilities to develop better malware and phishing techniques, which produce higher rates of success when stealing private keys and exchange account data from users. The development of self-operating hacking AI systems presents a concerning future scenario because they may discover unknown vulnerabilities in DeFi code while running attacks independently of human supervision (TRM, Reference Oyewole2025).

Market Manipulation and Stability Risks: AI and algorithmic tools in the wrong hands can distort markets. AI-powered trading bots, already prevalent in crypto markets, can be employed to conduct manipulative strategies such as pump-and-dump schemes or flash crashes. Advanced bots exploit the collaboration between multiple DeFi platforms by linking decentralised exchanges and lending protocols to carry out wash trading or spoofing through false order placement, resulting in price manipulation for bots to profit (Sumner, Reference Sumner2025).

The speed and complexity of AI-driven strategies can outpace the ability of human traders or regulators to react, potentially leading to amplified volatility. Any implementation of algorithmic stablecoins that utilises automated algorithmic systems to manage pegs must be appropriately designed to prevent systemic risks from occurring. An algorithmic stablecoin suffered a total collapse in 2022, destroying tens of billions in value and spreading panic throughout the market (Metelski and Sobieraj, 2022). The pursuit of profit by an AI agent could potentially trigger attacks against these systems (as some traders did with Terra by shorting it during a moment of weakness and accelerating the death spiral) (Dearing, Reference Dearing2025).

Privacy Invasions and Surveillance: The advantages of anonymity through these technologies come with the danger of extensive monitoring and improper use of personal data. AI systems that operate with DeFi platforms possess the ability to identify users through on-chain activities and off-chain information such as IP addresses and behavioural data. The technique helps police capture offenders, yet it poses a threat to privacy protection when handled by unauthorised entities.

There is also concern about algorithmic bias and unfairness: if DeFi platforms start using AI for credit decisions or pricing, and those AI models are trained on biased data (perhaps reflecting historical discrimination or inaccuracies), they could reinforce inequities – denying certain groups loans or charging higher fees unjustly. Unlike a regulated bank, a decentralised platform has no equal opportunity laws governing its code. If an AI model exhibits bias, it might go unaddressed, especially if its workings are a ‘black box’ (opaque neural network) (Hassija et al., 2024). The implementation of biased algorithms leads to both ethical concerns and legal risks because they violate anti-discrimination standards while damaging the reputation of these technologies.

Financial systems that depend on IoT devices also generate privacy and safety problems. The majority of IoT devices acquire valuable personal data and environmental data. If those data are published to a blockchain (even in processed form) or used by AI, questions arise: Who has access to the raw data? Is personal data being adequately anonymised? The system presents an opportunity for unauthorised tracking of people as well as the development of profiles without authorisation. The continuous observation of car insurance policyholders through IoT systems in smart contracts allows insurers and authorised users to track driving behaviour and locations, resulting in privacy concerns. A compromised attack on IoT devices creates threats that result in physical damage along with financial losses.

Automation at Scale and Loss of Human Oversight: The adoption of AI and automation creates a hidden threat to finance because human supervision becomes reduced. Financial systems with ‘self-driving’ capabilities tend to generate behavioural outcomes that humans do not expect, as well as collective operational malfunctions. The chaotic behaviour of automated trading has been shown through flash crashes in stock market trading. Users in DeFi worry about cascading failures: for instance, an AI agent liquidator might aggressively liquidate collateral on one platform, crashing prices that trigger liquidations on other platforms in a cascade. Traditional trade suspensions for panic control would have been possible through human intervention, but decentralised protocols lack built-in stopping mechanisms unless developers build them in. The May 2022 crypto market crash had elements of this, where automatic liquidations across lending platforms accelerated the price declines in a feedback loop (Avgouleas and Seretakis, Reference Mittelstadt, Allo, Taddeo, Wachter and Floridi2023). Similarly, highly complex AI-driven derivatives might create hidden interdependencies and tail risks that are not well understood – akin to the CDOs (Collateralised Debt Obligations) and synthetic derivatives that contributed to the 2008 financial crisis, but potentially even more opaque if driven by AI.

In summary, the risk landscape of dual use is broad: from straightforward criminality (money laundering, fraud, hacking) through market integrity issues (manipulation, volatility) to systemic concerns (cascades, loss of control) and ethical pitfalls (bias, privacy breaches). The European Union, in its 2025 Serious and Organised Crime Threat Assessment, explicitly labels crypto-assets, DeFi and AI as offering a ‘digital cloak’ for money laundering and criminal finances (Kmieliauskas, Reference Kmieliauskas2025). This underscores that law enforcement perceives a growing threat posed by rising levels of illicit activity linked to emerging technologies. Criminal networks composed of private and nation-state actors (such as the North Korea-affiliated Lazarus Group) exploit DeFi bridges and exchanges to wash cryptocurrency stolen through hacks before moving the funds, for example, into weapons programmes (Yun and Wood, Reference Yun and Wood2025). This scenario represents the perfect dual-use threat when emerging technology supports worldwide security challenges.

7.6 Ethical and Regulatory Considerations

The dual-use character of emerging financial technologies raises profound ethical questions and regulatory challenges. Financial technology stakeholders must handle ethical matters such as privacy concerns, fairness issues, accountability requirements, and social technology effects. Regulators, for their part, are tasked with creating frameworks that mitigate harms (financial crime, consumer abuse, systemic risk) without unduly hampering innovation. The European Union has taken a proactive stance by drafting and implementing comprehensive regulations such as MiCA, the General Data Protection Regulation (GDPR), the AI Act, and a new AML regime to address these concerns in a coordinated manner.

Ethical Considerations: The main ethical dilemma exists between maintaining privacy and assuring transparency. The combination of blockchain-based finance transparency with analytics reduces user financial privacy because transactions become detectable. Is it ethical to have every transaction one ever makes be potentially traceable and analysed by AI? The crypto ethos often emphasises pseudonymity to preserve privacy and individual freedom (Zhuk, Reference Peters, Vanderhallen and Nelen2025). The ability of criminals to conceal their identity through pseudonyms creates a dilemma that prompts experts to demand transaction de-anonymisation for security purposes. Striking the right balance is difficult.

The EU’s approach to privacy is anchored in the GDPR, which enshrines data protection as a fundamental right. The permanent nature of blockchain records creates difficulties when applying GDPR regulations because the GDPR’s right to erase data conflicts with this characteristic. Designers of DeFi systems hold an ethical duty to evaluate data minimisation practices together with assessing the necessity to store sensitive personal data (such as IoT-collected health or location data for insurance or lending) either on-chain or off-chain through proof and aggregated results transmission (El Mestari, Lenzini and Demirci, Reference El Mestari, Lenzini and Demirci2024).

Closely related is the issue of algorithmic fairness and bias in AI. AI applications in finance must strictly avoid discriminatory practices and biased outcomes to fulfil ethical requirements. However, AI models learn from existing data, which may reflect societal biases. A lending AI, for example, could unintentionally eliminate applicants who belong to specific postal areas or backgrounds even though each applicant poses no risk of default because these areas show higher default rates in historical data, which amounts to digital redlining (Tilmes, Reference Tilmes2022). The AI might not explicitly use protected characteristics such as race, but proxy variables could introduce bias. The EU’s draft AI Act addresses this by classifying credit scoring algorithms as ‘high-risk AI’ that will be subject to strict requirements on data quality, transparency, and human oversight (Regnier, Reference Regnier2024). When using AI in DeFi deployment, all companies must conduct bias tests and maintain diverse data representations to prevent discriminatory results. The system must include explainability features that enable users to understand and question why AI denies loan requests. New legal requirements point in this direction since the AI Act plans to mandate documentation together with decision explanations for high-risk AI systems, and GDPR provides rights to individuals regarding automated decision-making.

A significant ethical issue arises from the matters of responsibility and accountability. In decentralised, autonomous systems, who is responsible when things go wrong? If an AI-run smart contract causes a massive loss or behaves unpredictably, the traditional accountability model (holding a company or individual liable) becomes blurred. Code is law, but someone writes code – should developers bear responsibility for unforeseen abuses of their smart contracts? The open-source nature allows others other than authors to deploy the code, while anonymous token holders could potentially govern the DAO (Decentralised Autonomous Organisation). This diffuse responsibility challenges legal and ethical norms. The developers and governors who create protocols are required to provide safety protocols through proper auditing and emergency pause functionality in a manner similar to product liability standards.

The EU’s trustworthy AI ethics guidelines require accountability through human involvement or another entity that takes responsibility for AI actions. DeFi protocols require similar safety mechanisms to guarantee human control and backup systems when making essential decisions concerning major updates or active security threats. The implementation of ‘ethical by design’ principles means establishing code-based protective measures which stop dangerous conduct. For example, the code architecture of lending smart contracts includes defensive programming features that prevent users from leveraging excessively even if they are not explicitly prevented from doing so, thus prioritising safety above efficiency (Vionis and Kotsilieris, Reference Vionis and Kotsilieris2024).

Globally, regulators are catching up with rapid innovations. The European Union, in particular, has rolled out a slate of regulations that, taken together, create one of the most comprehensive legal regimes for digital assets.

Markets in Crypto-Assets Regulation (MiCA) is the EU’s landmark regulation for crypto-assets and associated services. MiCA establishes licensing requirements for crypto-asset service providers (CASPs) such as exchanges, custodians, and wallet providers, imposing obligations around capital, governance, disclosures, and consumer protection. It also regulates issuers of crypto-assets, including stablecoins (termed ‘asset-referenced tokens’ and ‘e-money tokens’ in the regulation) (Benson et al., Reference Mittelstadt2024). MiCA’s aim is to create a harmonised single market framework for crypto, balancing innovation with financial stability and investor protection. Importantly, MiCA largely avoids direct regulation of DeFi protocols that have no identifiable issuer or intermediary – a conscious choice acknowledging the difficulty of regulating pure decentralisation.

However, MiCA mandates the European Commission to produce, in a few years, a report on the emergence of DeFi and potentially propose adjustments. So, while DeFi currently sits in a ‘grey zone’, the trend is that if DeFi platforms have some governance body or provide certain services, they may eventually be brought into regulatory scope. Even now, if an entity actively facilitates a supposedly decentralised system (for instance, running a DeFi platform’s front-end or controlling its development), regulators might deem it a CASP subject to MiCA. Under MiCA, users gain rights such as clear information on crypto-assets and recourse mechanisms against service providers for fraud or operational failures (InnReg, Reference Nikolakopoulos2025). This should deter some malicious behaviour by professionalising the industry. From a dual-use perspective, MiCA also integrates with AML laws – CASPs will be ‘obliged entities’ under AML rules, meaning they must do KYC and report suspicious activities.

Global Coordination versus Jurisdictional Arbitrage: Regulatory efforts face the challenge of DeFi and crypto activities being geographically diffuse. If regulations are too onerous in one region, projects or users may migrate to more permissive jurisdictions (a phenomenon known as regulatory arbitrage). The EU’s approach, while comprehensive, will only directly cover activities in the EU or by EU-based entities. Nevertheless, its market size often forces global players to comply (as happened with GDPR). International bodies such as the Financial Action Task Force (FATF) are working to harmonise standards, for example, FATF’s guidance includes applying AML rules to ‘virtual asset service providers’ and calls out DeFi (noting that creators, owners or operators of DeFi protocols may fall under regulation even if the marketing suggests the project is decentralised) (Europol, 2025).

This international pressure helps close gaps – for instance, by 2025, many countries will have implemented travel rule requirements for crypto (originator/beneficiary information with transfers), making it harder to find an AML blind spot (Rayner, Reference Ogbeide, Thomson, Gonul, Pollock, Bhowmick and Bello2024). Still, true DeFi with no intermediaries remains a regulatory challenge: you cannot KYC a smart contract or sanction an algorithm easily. Some proposals suggest regulators could target the user interface layer (e.g., websites through which users access DeFi) or rely on voluntary compliance mechanisms such as decentralised identity solutions. There is also discussion of creating whitelisting schemes: for example, liquidity pools that only accept funds from verified addresses, thus splitting the DeFi ecosystem into ‘clean’ and ‘grey’ pools (Ocampo, Branzoli and Cusmano, 2023). These are contentious but illustrate creative regulatory thinking.

An ethical evaluation requires attention to the dangers arising from excessive regulatory practices. The prohibition of privacy coins and mixers as a result of AML regulation has the potential to diminish both technical advances in privacy-enhancing technology and legitimate privacy rights. Unwarranted regulatory actions aimed at AI finance operations will strengthen established financial institutions while limiting the potential growth of new fintech startups. Forcing full identification on all crypto transactions would create a problem because it could build a surveillance financial system which diminishes users’ cryptocurrency freedoms. To meet their ethical duty, regulators must implement regulations that reach their targets by minimising undesirable consequences. The EU tends to incorporate proportionality and stakeholder input in its laws.

7.7 State-of-the-Art Developments and Current Initiatives

The year 2025 marks a period when technology developers and regulators work together to harness DeFi, AI, and IoT benefits through new approaches that overcome developing challenges (FTSG, 2025). This section highlights some state-of-the-art developments on these fronts, including technical innovations, industry best practices, and nascent regulatory or collaborative initiatives.

Advancements in Blockchain and DeFi Technology: On the technical side, a major focus has been improving the scalability and interoperability of blockchain networks, which enhances performance and security (by reducing congestion-related exploits). The Ethereum network maintains most DeFi activity as it implements Proof of Stake transition and develops Layer-2 scaling solutions through Optimistic and ZK-Rollups that enable thousands of off-chain transactions with proof-based recording on the blockchain. These Layer-2 networks significantly increase throughput and lower transaction fees, making micro-transactions (vital for IoT use cases) economically viable and reducing the risk of blockchain overload during usage spikes (Camargo, 2023). Importantly, improved scalability also prevents specific spam attacks and reduces front-running issues in DeFi by shortening the time transactions spend in mempools (i.e., memory pools).

In parallel, cross-chain interoperability protocols (e.g., Polkadot, Cosmos, or bridge networks) are advancing to allow assets and data to flow between different blockchains. The future demands different specialised ledgers to perform unique tasks while interacting, such as an IoT-optimised ledger connected to a finance-optimised ledger. Still, bridges themselves have been targets of major hacks, so the state-of-the-art response is developing more secure bridging tech, such as ‘trust-minimised bridges’ using cryptographic proofs or decentralised validation (for example, Chainlink’s forthcoming Cross-Chain Interoperability Protocol (CCIP) aims to securely relay data and tokens across chains using its decentralised Oracle network) (Camargo, 2023). These efforts, while technical, directly influence dual-use outcomes: a robust, interconnected infrastructure leaves less room for criminals to exploit isolated weak links or cause systemic outages.

Integration of Privacy-Enhancing Technologies (PETs): A noteworthy trend is the integration of PETs in blockchain and AI systems to merge transparency with privacy. Zero-knowledge proofs (ZKPs) have matured substantially and are now used to build privacy-preserving DeFi and identity solutions. For instance, protocols such as zkSync and Aztec enable transactions where the amounts and parties can be shielded but still cryptographically verified for correctness on Ethereum (Ismayilov and Özturan, Reference Ismayilov and Özturan2025). There are prototypes of AML-compliant confidential transactions using ZKPs: a user could prove that their transaction does not involve blacklisted addresses or that they have undergone KYC without revealing their entire identity or transaction history on the public ledger. This is state-of-the-art because it potentially offers the ‘best of both worlds’ – anonymity for legitimate users and traceability for bad actors (since a bad actor would be unable to produce proof of clean funds).

On the AI side, explainable AI (XAI) techniques are being actively researched for financial algorithms. Complex machine learning models (such as deep neural networks) are often ‘black boxes’, which is problematic in finance when a decision needs justification. New AI tools produce explanations together with indicators pointing out which variables affected model decisions – for example, through LIME (Local Interpretable Model-agnostic Explanations) or SHAP (SHapley Additive exPlanations) values. Financial institutions use these explainable AI systems to fulfil regulatory requirements and establish positive user relationships. An explainable AI loan approval system would notify applicants why they were rejected (for example, because of low income and high existing debt). This transparent approach replaces confusing denial with clear justification.

In trading, XAI helps risk managers understand AI-driven strategies so they can veto ones that might, say, concentrate too much risk. Many financial institutions have created their own AI ethics committees and model risk management procedures for AI in compliance with European Banking Authority standards (European Banking Authority, 2024). This is state-of-the-art in organisational practice, ensuring a human check on AI which, if widely implemented in DeFi teams and crypto projects, could prevent some dual-use outcomes (for instance, an AI feature that was found to be easily weaponisable might be modified or scrapped).

Case Study – RWA Tokenisation Boom: Tokenisation of real-world assets became a leading DeFi development during the latter part of 2024 and 2025. Projects enable blockchain integration of Treasury bills, trade receivables, real estate, and traditional assets that become blockchain-based tokens. Various startups alongside Goldman Sachs and Santander created public blockchain-based tokenised bond offerings while also launching DeFi-based short-term government bond versions that deliver interest. TradFi and DeFi systems blend together to form CeDeFi (centralised-decentralised finance).

The current advanced platforms within this domain establish multi-signature and escrow systems and create legal token wrappers for token rights registration, along with specific compliance tools that create blockchain-based regulated platforms (Zimperium.com, Reference Pillai2025). The dual-use perspective views this trend favourably because it adds legitimacy through oversight to DeFi but introduces potential risks when tokenised asset system breaches harm real-world financial markets. The continuous rise of RWAs entering DeFi platforms to exceed $10 billion within early 2025 (Tangem, Reference Ostmann and Dorobantu2025) represents the advancing state-of-the-art, which shows the decreasing distinction between DeFi and conventional finance systems.

Law Enforcement and Regtech Tools: On the regulatory side, we see governments and compliance firms deploying advanced blockchain analytics and AI tools as a state-of-the-art answer to financial crime. Companies such as Chainalysis, Elliptic, and TRM Labs have developed sophisticated software that uses machine learning to cluster blockchain addresses, identifying likely exchange wallets, mixers, darknet markets, and mapping funds flows. These tools proved highly successful by monitoring ransomware payments through numerous transactions to detect exchange hits and reveal smart contract scam authors through linked patterns.

Law enforcement agencies in the EU and US now routinely use such analytics; in one case, the FBI and Europol traced and seized billions in crypto from the Silk Road case years after the crimes, showing that ‘crime does not pay’ if the blockchain trail remains. To keep up with criminals’ use of AI, agencies are also experimenting with their own AI, for instance, Interpol’s collaboration on an AI system to comb social media and the dark web for early warning of crypto scam campaigns. ‘Follow the Money 2.0’ represents the state-of-the-art method that employs AI to track digital funds through an automatic process spanning multiple blockchain networks and reaching data outside blockchains (Choi and Kim, Reference Nagaraj, Anand, Priyadharshini, Aparna, Gundebommu, Sadasivuni and Malladi2025).

Regulators also launch innovation hubs and regulatory sandboxes focusing on fintech/DeFi and AI. The European Commission, through its Digital Finance Strategy, supports pan-European regulatory sandboxes for Distributed Ledger Technology (DLT), where companies can test innovative solutions under supervision (PwC, 2025). One such pilot allows selected firms to trial use cases such as trading tokenised bonds or using AI for AML on a blockchain, with regulators observing and providing feedback without immediate threat of enforcement. These sandboxes are state-of-the-art regulatory tools to learn and refine approaches in collaboration with industry. The knowledge gained feeds into guidelines and future regulation, ensuring laws keep pace with tech. The European Blockchain Sandbox (2023–2026) results will help shape regulatory changes to MiCA or the creation of separate rules for DeFi.

Cybersecurity and Resilience Efforts: The increasing number of hacks has led to enhanced efforts for better security measures in smart contract creation. Auditing firms (including CertiK and ConsenSys Diligence and Trail of Bits) employ manual expert assessment and automated analysis systems (some of which utilise AI technology) to examine code. Secure coding standards emerge as various auditing organisations distribute their best practices through a continuous consolidation process. There is movement towards ‘formally verified’ smart contracts – writing contracts in languages such as Coq or using verification tools (e.g., Certora, Ethereum’s Vyper with formal specs) that mathematically prove specific properties (e.g., ‘this contract will never allow an unauthorised withdrawal’). The application of formal verification remains rare because of its complexity, although advanced security specialists have used it to check critical contracts, especially portions of Ethereum 2.0 consensus code. High-value DeFi protocols are expected to implement routine extensive checks in the future to create better protection against hacking attempts (Xiang et al., Reference Xiang, Lin, Nie, Zheng, Xu, Ding and Liu2024).

In terms of collaboration and knowledge-sharing, communities of practice have emerged. The DAO community works together to investigate security exploits because researchers worldwide use Twitter and forums to analyse hacks and identify solutions within short periods following attacks. Such crowdsourced financial response marks a new approach in the field of finance. Ethical hackers now participate in bug bounty programmes operated by DeFi protocols since they receive compensation for detecting vulnerabilities before they become exploitable weaknesses. The payment of bounties totalling millions of dollars has proven to be more affordable than allowing actual security breaches to occur. The approach turns the global talent base that could participate in criminal activities into defenders of security through financial incentives, thus reducing dual-use risk (Arshad et al., Reference Arshad, Talha, Saleem, Shah, Zaman and Muhammad2024).

Finally, it is notable that academic research is active at this intersection of disciplines. Conferences and journals now regularly feature papers on topics such as AI for blockchain consensus optimisation, machine learning to predict DeFi liquidations, game-theoretic modelling of miner behaviour, and secure multi-party computation for privacy in finance. The state-of-the-art knowledge is thus rapidly evolving, and many cutting-edge ideas (such as using homomorphic encryption to compute on encrypted financial data or multi-agent AI simulations to test economic scenarios in crypto markets) are on the horizon of practical deployment.

7.8 Future Outlook and Conclusion

The rapid convergence of blockchain, AI, and IoT in finance stands at an inflexion point. The coming years will likely define whether the optimistic vision of decentralised, intelligent financial systems empowering individuals can be realised or whether the pessimistic scenario of widespread abuse and regulatory restrictions will dominate. In reality, both paths will co-exist in a dynamic tension, and the outcome will be shaped by technological evolution, regulatory adaptation, and the collective actions of stakeholders.

Technological Trajectory: We can expect significant technical maturation in this space. Blockchain technology is likely to become more scalable (with Ethereum 2.0 upgrades and alternative high-throughput networks), more interoperable (through standardised protocols or even eventual consolidation of chains), and more user-friendly (abstracting away complex cryptographic processes behind intuitive interfaces). This will make the benefits of DeFi and associated tech accessible to a broader population – possibly integrating with mainstream banking apps or using corporations and governments for routine processes. Central Bank Digital Currencies (CBDCs) might also come into play: if major jurisdictions issue CBDCs, these could interface with DeFi protocols, blurring the line between traditional and decentralised finance even more.

AI is poised to become more potent with advances in deep learning and the availability of ever-larger datasets (including rich financial and IoT data). We may see autonomous economic agents become a reality – AI bots transacting, contracting, and collaborating with other bots and humans in financial markets. It raises the prospect of wholly machine-driven finance in some niches (for example, IoT devices negotiating for energy prices with each other, settling in cryptocurrency, and AI optimising their trading strategies).

Such a hyper-connected, AI-automated financial ecosystem would be efficient but highly complex and potentially fragile. It will demand new forms of risk management. Real-time oversight might shift towards AI as well – regulators might deploy their own AI ‘agents’ that roam the blockchain finance ecosystem, flagging rule violations or systemic risks instantaneously. Indeed, ‘embedded supervision’ is a concept the Bank for International Settlements has floated: using the transparent data from DLT to let compliance be automated (PwC, 2025). We might see regulatory nodes directly plugged into major blockchains, running analytics continuously. Regulation technology (RegTech) and SupTech (supervisory tech) will lean on AI to cope with the scale.

Regulatory Adaptation: Regulators are likely to refine and expand frameworks iteratively. The EU’s MiCA and AI Act are first-generation rules – they will be reviewed and updated as the market and technologies evolves. By around 2026–2027, we expect discussions on ‘MiCA 2.0’ or dedicated DeFi regulations. Suppose DeFi platforms remain significantly non-compliant with AML norms – in that case, regulators may attempt more assertive measures: for example, a regime of licensed DeFi where major liquidity pools or protocols could voluntarily become certified under specific standards (much as exchanges are licensed) – offering users a safer option and marginalising rogue protocols. Alternatively, regulators might leverage chokepoints, requiring internet service providers or app stores to block known illicit decentralised applications, and so on. However, such measures raise censorship concerns and are easily bypassed by savvy users.

Global Cooperation: Given the global nature of the tech, international coordination should intensify. The G20 and bodies such as the International Organization of Securities Commissions (IOSCO) and FATF should push for baseline standards. FATF will likely update its guidance on virtual assets to clarify DeFi further – perhaps recommending that countries require DeFi project teams to register if they have control or to mandate that DeFi front-ends implement customer verification above specific volumes. We might also see bilateral agreements for sharing data on crypto transactions among law enforcement (somewhat akin to how SWIFT data is shared for bank transfers in anti-terrorism efforts).

On the other hand, divergence in approaches is also possible: some jurisdictions may intentionally position themselves as crypto-friendly with lighter rules to attract innovation (or illicit activity). There is a scenario where a kind of regulatory arbitrage arms race happens, with havens for unregulated DeFi persisting. However, the magnitude of risks (money laundering, investor harm) may pressurise even laissez-faire jurisdictions to come on board with basic norms, especially if lack of compliance starts to exclude from the international financial system (e.g., greylisting by FATF).

Ethical and Social Outlook: Ethically, the dialogue around AI and autonomy in finance will sharpen. There will be a public reaction if AI causes a financial crash or deliberately biased outcomes. This could spur stricter ethical codes and possibly the involvement of external auditors or certifiers for algorithms (an idea floated in policy circles is creating something such as a ‘Financial Algorithm Auditor’ role). The concept of algorithmic accountability will become not just a guideline but an enforceable requirement. At the same time, society will likely grow more adapted to AI and digital finance – new generations may trust an AI adviser more than a human banker, for example.

Privacy will remain a contested domain. By 2030, perhaps, privacy-enhancing tech will mature so that users can routinely enjoy confidential transactions on public networks (Auer et al., Reference Auer, Böhme, Clark and Demirag2025). Suppose law enforcement were also to develop methods for selectively piercing anonymity (through legal processes and advanced analytics), we might reach an equilibrium where everyday privacy is protected, but criminals still find it hard to hide – this is almost a holy grail outcome, reconciling dual use. Achieving it will require continuous innovation and dialogue between the cryptography community and regulators to embed ‘lawful access’ mechanisms without compromising overall security.

Conclusion: The dual use of emerging technologies in DeFi is not a temporary phase but a fundamental characteristic of our modern digital financial system. Just as the internet brought tremendous good while enabling new crimes, so will we manage the dual-use challenges of blockchain, AI, and IoT. The trajectory so far shows a pattern: groundbreaking innovation, exploitation by bad actors, and a cycle of adaptation with improved practices and regulatory oversight. Each cycle brings the technology to a more mature and stable state. We can be cautiously optimistic that the positive applications – financial inclusion, efficiency, resilience – will significantly outweigh the negatives with responsible innovation.

From a legal scholarship perspective, this domain will remain rich for analysis. The EU’s legal frameworks will serve as a living laboratory: MiCA and the AI Act might need amendments as new types of assets or algorithms emerge (for instance, how to regulate AI-driven DAOs or value that only exists in the metaverse). Courts may also have to interpret how existing laws apply (e.g., liability in fully automated transactions, GDPR rights apply on a blockchain, etc.). New case law and perhaps new principles (such as treating code as persons for certain liabilities or recognising DAOs as legal entities) could develop.

Finally, one might recall the proverb, ‘Technology is neither good nor evil; it is the use that makes it so’. DeFi, AI, and IoT convergence demonstrate this truth in the modern financial context. These tools can decentralise and democratise finance, create wealth, and improve risk management – but if unchecked, they can equally concentrate power in algorithms or facilitate large-scale crime. The challenge and responsibility for the current generation of technologists, regulators, and scholars is to handle this dual-use potential towards broadly beneficial outcomes. That means building effective systems with ethics and compliance in mind from the design phase, encouraging collaboration between innovators and authorities, and educating users about opportunities and dangers.