11.5 · Compliance Principles
Compliance is a necessity for the web's long-term survival; obfuscating sales and circumventing proofs, repeating the fines and criminal penalties already paid by Web2/Web3.
WCN regards compliance as a constraint on products and processes, rather than post-event public relations: node design, deal promotion, PoB, settlement and future on-chain bearer layers must all operate under defensible procedures; differences in jurisdictions cannot be covered up by a single “global community rule”.
Four Principles (Operational Implications)
Rule prefixBefore launching online functions, external language, fees and incentive structures, first define the domain and product; benchmark against the recurring "economic substance over labels" in SEC enforcement - calling utility or NFT does not change the fact that registration/exemption is required if it constitutes an investment contract.
clear boundariesNode seats, services and any tradable rights are described and delivered consistently; do not follow the gray area of unregistered securities issuance or misleading earnings promotion.
Leave traces firstDeal, review, consent and changes can be replayed; benchmarking FINRA recording rules and the internal control logic of listed companies - "failure to produce logs" in investigations and civil litigation is equivalent to failure of defense.
geographically sensitiveThe rules of the United States, the European Union, Singapore, the United Arab Emirates, etc. exist in parallel; the default is to deal with data, marketing and access as high as possible, until local legal counsel issues written boundaries.
Main jurisdictions: focus axis (non-legal opinions)
The following is a topic level summary, specific actions must be confirmed by a licensed consultant on a case-by-case basis; WCN Wiki does not constitute legal advice.
USA
- SEC
- CFTC/State Law: Some crypto derivatives and commodity attributes; Sanctions and Exports (OFAC) rigidity in address and counterparty screening.
- Bank Secrecy Act System: If the business involves the transmission of funds or specific custody arrangements, AML procedures and SAR culture must be consistent with the prohibited areas in 11.4.
European Union (MiCA, etc.)
- CASPs (Crypto Asset Service Providers) licensing, white paper and marketing constraints; layering of stablecoin and e-money token rules.
- MiFID II/Traditional Financial Interface: Additional permissions when crossing with security tokens or structured products.
- GDPR: Data processing legality, cross-border transfer, DPA; has nothing to do with "community governance" and is solely the responsibility of the controller.
Singapore (MAS)
- DPT (Digital Payment Token) service licensing and advertising restrictions; Stablecoin regulatory path and tighter reserve disclosure requirements.
- AML/CFT: Similar to the US, screening and suspicious reporting are non-negotiable.
Dubai (VARA etc.)
- VA activity licensing (brokerage, custody, advisory, etc.) and localized disclosures; coordination with other emirate and federal level rules.
- Marketing and retail access rules are often strict, and regional headquarters narrative does not mean automatic compliance.
Red line (versus on-chain/sale incidents)
Don’t make vague profit promisesAny language that implies fixed returns, capital guarantees or regulatory endorsements can trigger both securities laws and advertising laws in many countries; the same is true for Compound governance token marketing lessons: economic incentives need to be defensible and disclosed.
No cross-border salesIf node rights, NFT or points have the characteristics of investment expectations and management of the efforts of others, they must be processed according to securities logic; it is prohibited to use "DAO voting" to circumvent KYC and suitability.
Do not bypass certification and review"Results" without PoB or internal control support will not enter attribution and settlement to prevent internal fraud and external fraud.
Don’t ignore regional differencesGlobal distribution of the same deck is often wrong in practice; domain slicing or universal conservative versions must be used.
Compliance and Governance Interface
Compliance Impact Assessment (PIA/Compliance gate)
New functions, new areas, and new token forms must go through the list and leave traces.
Sync with 11.4
Any proposal that attempts to put compliance decisions on a ballot shall be procedurally rejected.
Supplier and customer due diligence
Escrow, KYC, cloud and payment providers must be able to audit contracts and subcontracting chains.
Incident reporting path
Data breaches, regulatory letters, and major security incidents are escalated to the responsible level and supervised (if required by law) within a preset time limit.
Compliance is not about "slowing down growth," but about avoiding the consequences of bans, criminal investigations, and bank disconnections. Beanstalk/The DAO-level incidents also show that technical accidents and compliance crises often overlap.
Only with compliance in advance, node seats, service fees, transaction fees and subsequent value-carrying layers can form financial, acquireable, and cooperative assets, rather than a one-time narrative.