Blockchain Code and Criminal Liability: What Sen. Lummis's CLARITY Act Warning Reveals
Writing blockchain code can make you criminally liable in the US. Here is how the CLARITY Act is trying to fix that, and what its own negotiation has moved.
In August 2025, a federal jury convicted Roman Storm of conspiracy to operate an unlicensed money-transmitting business. Storm was the co-founder of Tornado Cash, a blockchain protocol that ran autonomously after he built it, held no user funds, and processed transactions without any ongoing involvement from its creator.
The jury found that writing and deploying the code was sufficient for criminal liability. The federal statute applied to Storm was designed for businesses like Western Union, entities that take custody of money, transfer it on behalf of customers, and operate within a licensed network.
The law that was not written for code
The statute, 18 U.S.C. § 1960, makes it a federal crime to operate an unlicensed money-transmitting business. It was not written with blockchain developers in mind. The US Financial Crimes Enforcement Network had said as much in its 2019 guidance on virtual currencies, which explicitly stated that developing a decentralized application does not make someone a money transmitter, even if that application facilitates financial activity. In the Storm prosecution, the Department of Justice told the court it was not bound by that guidance and could apply its own interpretation.
The conviction left an entire category of developers in an unresolved position. Anyone writing non-custodial software, code that facilitates transactions without holding the funds involved, now operates under a legal precedent that the act of publishing could constitute the act of transmitting. The Storm jury accepted that argument. The question of whether building financial infrastructure is legally equivalent to operating it remains open in US federal law.
What the CLARITY Act was built to fix
The Blockchain Regulatory Certainty Act, a provision embedded within the larger CLARITY Act, was written specifically to address the gap the Storm conviction exposed. It would codify in federal statute that non-custodial developers are not money transmitters, converting FinCEN's overrideable guidance into durable law.
Senator Cynthia Lummis, who chairs the Senate Banking Subcommittee on Digital Assets and has been central to crypto market structure negotiations since at least 2022, spent years of hearings and rewrites securing the BRCA's inclusion in the bill. The 15-9 Senate Banking Committee vote on May 14 advanced the bill with the BRCA intact.
On May 22, Lummis posted publicly that the case for the bill comes down to one thing: American consumers and the broader industry deserve a real regulatory framework, not ongoing legal ambiguity. On May 27, she made the stakes explicit, saying publicly that if the CLARITY Act fails this Congress, American software developers will face prosecution again for publishing blockchain code.
What the same markup moved in the other direction
The May 14 markup also introduced a complication the DeFi sector has been raising publicly since. The Lummis amendment package that preserved the BRCA simultaneously removed a separate protection for non-controlling blockchain developers within the bill's DeFi section. Under the earlier text, developers who create blockchain software but exercise no control over how it runs after deployment were explicitly shielded in that context.
Under the version that cleared committee, according to CoinDesk, those same developers could be classified as securities intermediaries if regulators argue they retain some level of control over the protocol, including through governance arrangements.
The removal was part of a last-minute deal to bring two Democrats across for a bipartisan result, and Lummis's office, when contacted by CoinDesk days after the markup, did not address the DeFi provision. Bill Hughes, senior counsel at Consensys, told CoinDesk the change was nuanced and that outcomes would depend heavily on how agencies implement it through rulemaking. The BRCA closes the money-transmitter classification door. The negotiation that secured enough votes to keep it in the bill may have left a different door ajar.
The ground is still moving
The bill still has a floor vote, an ethics negotiation, and a merger of two committee texts ahead of it before it can reach the president's desk, and the DeFi provision concern may be addressed in that process. The fight currently blocking the floor vote, over whether government officials can profit from the industry they are regulating, has nothing to do with the developers Lummis named on May 27.
The legal ground under blockchain developers in the United States has shifted through prosecution, through the legislation designed to respond to it, and through the negotiation that moved the legislation forward. It is still moving.
Editor's note
Every piece published on The Bright Minded goes through careful verification, but mistakes can happen. If you spot an error, have additional information, or want to flag anything, write to rosalia@thebrightminded.com.
