The Digital Asset Market Clarity Act, which cleared the Senate Banking Committee on May 14, will set the rules of the road for an industry that has grown faster than the laws meant to govern it.

Almost everyone agrees that crypto regulation is overdue. But as the bill moves toward a vote on the Senate floor, it contains five gaps that threaten to undermine the very structure and stability the legislation otherwise hopes to deliver.

The Decentralized Finance or “DeFi” gap

A platform or intermediary that moves, exchanges, conceals, or otherwise facilitates the transfer of value should not be able to avoid oversight simply by calling itself “decentralized.” North Korean hackers have repeatedly exploited mixers and other virtual asset laundering infrastructure to move stolen crypto and help fund the regime’s weapons programs. Treasury has found that Tornado Cash was used to launder more than $455 million stolen by the Lazarus Group, and U.N. experts have reported that North Korea later laundered another $147.5 million through the same platform. These are exactly the blind spots Congress needs to close: when a digital asset platform or intermediary performs financial functions, it should be subject to appropriate anti-money laundering and sanctions safeguards.

The so-called “Tornado Cash” loophole gap

Some crypto tools are designed to keep operating automatically, even when it becomes clear they are being used to launder money. When anti-money laundering rules attach to a person but evaporate the moment software performs the same task, the result is not a safeguard — it is a workaround written into the law. The urgency is not hypothetical. This past May, FinCEN warned U.S. banks that Iran’s Islamic Revolutionary Guard Corps had built a multi-jurisdictional shadow banking network — combining digital asset infrastructure with front companies and exchange houses — to launder oil proceeds and finance weapons procurement and terrorism. Congress should give the Treasury Department’s Office of Foreign Assets Control (OFAC) the explicit authority it needs to act against anonymizing tools used to evade sanctions.

The stablecoin gap

The GENIUS Act, passed earlier this year, established the core framework for stablecoin issuers, but allowed illicit actors to circumvent that framework via DeFi protocols, offshore platforms, mixers, or other services that move stablecoins without meaningful controls. Sanctioned Russian entities have already used stablecoins, including through platforms that impose no identity verification requirements, to move funds and sustain financial networks. The Clarity Act should require stablecoin issuers to implement reasonable ecosystem-wide monitoring to identify and report suspicious activity. Without that broader visibility, stablecoins risk becoming the preferred rail for sanctions evasion, fraud, ransomware, trafficking, and corruption-related money laundering.

The jurisdictional gap

A platform that serves American customers or routes activity through the U.S. financial system should not be able to shed its anti-money laundering and sanctions obligations simply by registering its headquarters abroad. The Justice Department recently charged a Venezuelan national with allegedly laundering approximately $1 billion through a network that used bank accounts, cryptocurrency exchange accounts, private wallets, shell companies, and transactions into and out of the United States. Cross-border flows like that are precisely what slip through the cracks when platforms get to pick the jurisdiction with the lightest scrutiny. If a platform or intermediary facilitates illicit finance, it should be cut off from the legitimate financial system.

The ethics and conflict of interest gap

Four days before the 2025 inauguration, a member of President Trump’s immediate family reportedly signed a deal to sell a 49% stake in their crypto venture, World Liberty Financial, to an Abu Dhabi-backed entity for half a billion dollars. According to The Wall Street Journal, the Trump Administration later approved giving the UAE access to 500,000 of the world’s most advanced AI chips, overcoming longstanding national security objections. The Clarity Act is now advancing under an administration whose family has direct financial stakes in the very same digital asset ventures that the bill would govern. No impartial crypto framework can be built on that foundation. The Clarity Act must bar public officials and their immediate family members from owning, promoting, sponsoring, endorsing, or soliciting investment in digital asset ventures while the official is in office.

These five gaps are not abstract concerns. Each one maps onto an activity that is already happening: sanctioned states moving money, foreign officials laundering bribes, hostile actors funding weapons programs, and a sitting president’s family selling stakes in the industry the legislation is meant to regulate. Congress has the opportunity to write rules that protect the integrity of the U.S. financial system. It also has the opportunity to write rules that quietly accommodate those who would exploit it. The version of the Clarity Act now moving toward the Senate floor does not yet distinguish clearly enough between the two.

The choice before the Senate is not whether to regulate crypto. It is whether the rules Congress writes will be strong enough to do what regulation is supposed to do: protect consumers, defend U.S. national security, and ensure that public office cannot be used for personal or family profit. Five gaps stand between this bill and that standard. They can and must be closed.