Decentralized finance (DeFi) is entering regulators’ crosshairs, but they don’t seem to be intent on taking it out – yet anyway. Instead a pair of reports from U.S. and French authorities seem more focused on understanding what sort of risks DeFi might pose to both users and the broader financial world, and whether there are ways to mitigate these risks while still allowing their operation.

Decentralized finance (DeFi) is suddenly a major topic of concern among financial regulators, with both the U.S. and France publishing reports analyzing the potential risks these projects might pose to their respective governments and providing recommendations for how regulators and developers can mitigate these concerns.

DeFi has been a growing part of the crypto sector for a while now, but recent exchange collapses, bank failures and lender bankruptcies are shining a wider spotlight on decentralized (or purportedly decentralized) projects. Regulators are now looking at how they may oversee these entities and services.

The U.S. Treasury Department and French central bank both published reports assessing how well DeFi entities meet anti-money laundering regulations and how these entities and tools may be used in illicit finance.

The U.S. risk assessment pointed to some of the major hacks and issues in DeFi over the past few months, such as North Korea’s use of DeFi to launder funds and other related concerns about how DeFi projects may not meet know-your-customer/anti-money laundering (KYC/AML) rules or just be really easy to steal from.

To be clear, these reports weren’t exactly positive for crypto. The U.S. report, for example, noted that many DeFi projects are open source in the hopes that the broader community may spot vulnerabilities, but this same open sourcing may allow attackers to find an exploit.

“This vulnerability can be compounded if the smart contracts are not written carefully or if they lack a mechanism for quick deactivation or alterations if a critical exploit is identified,” the U.S. report said. “As such, it is critical that the DeFi service identify and address vulnerabilities and potential exploits in open-source code.”

But the report seems fairly neutral toward DeFi itself – the recommendations ranged from “strengthening existing supervisory and enforcement actions” to meet legal requirements to better engaging with private-sector projects.

The French report similarly suggested that the government could create a set of “minimum standards” that would define how it assessed risks and decentralization, or otherwise try and move financial transactions to specifically private blockchains. The report even suggested going so far as to create a certification for developers to meet.

The U.S. Treasury Department also posed a number of questions for public feedback, including how it should determine if any given DeFi project is actually a financial institution subject to Bank Secrecy Act regulations.

The U.S. report even hinted at the suggestion of providing further guidance for projects which could provide clarity.

“The assessment finds that non-compliance by covered DeFi services with AML/CFT obligations may be partially attributable to a lack of understanding of how AML/CFT regulations apply to DeFi services,” the report said, referring to combating the financing of terrorism (CFT). “Are there additional recommendations for ways to clarify and remind DeFi services that fall under the BSA definition of a financial institution of their existing AML/CFT regulatory obligations?”

The reports, while often quite critical of DeFi, both seem to operate from the base understanding that these projects will continue operating, and aren’t calling for banning this segment of the crypto sector.