Same Function, Punitive Tax—Part II
How Illinois Turned a Tax Bill into a DeFi Felony Trap
[Originally published on X, June 19, 2026.]
My last article took Illinois’ Digital Asset Tax Act on its own terms: a gross-value tax that makes moving a dollar of value cost real money when it rides a public blockchain rail and nothing when it rides a bank’s. That critique still holds. But it was incomplete.
Read against the digital-asset statute Illinois passed ten months earlier, DACPA, the Digital Asset Tax Act looks less like a sloppy revenue measure and more like a targeted workaround. Not just a tax, but a licensing, surveillance, reporting, and criminal-enforcement regime aimed at the decentralized, noncustodial, open-source activity ordinary financial-regulatory concepts have struggled to reach.
Part I was mostly about effect: Illinois taxes digital-asset activity while leaving functionally equivalent banking, brokerage, payment, custody, and settlement activity untouched. Part II is about purpose. The statutory choices show that Illinois knew how to spare DeFi, software development, validators, nodes, and peer-to-peer activity because it had just done so in DACPA—and then chose not to do so here.
The significance of that choice is shocking—even to me. It turns the Tax Act from merely discriminatory into something more revealing: a backdoor anti-DeFi regime built through a must-pass budget bill, reaching the very noncustodial architecture that exists to avoid the trusted-intermediary failures lawmakers claim to be preventing.
The irony is that this is almost exactly where Sam Bankman-Fried wanted regulators looking before FTX collapsed: away from centralized custody and toward DeFi front ends. Illinois has now taken that logic and gone further.
The carve-outs they deleted tell the story.
Start where the drafters started. The Tax Act does not define “digital asset” at all. It borrows the definition wholesale from Section 1-5 of the Digital Assets and Consumer Protection Act—DACPA—the consumer-protection law Governor Pritzker signed in August 2025. So far, unremarkable; reusing a definition is good drafting hygiene.
But DACPA does something the Tax Act conspicuously does not. After defining “digital asset business activity” as exchanging, transferring, or storing a digital asset, DACPA immediately carves five things out of that scope. It does not reach peer-to-peer exchanges or transfers. It does not reach decentralized exchanges that facilitate peer-to-peer activity through self-executing code. It does not reach the development, publication, or maintenance of software “in and of itself.” It does not reach the issuance of an NFT in and of itself. And it does not reach validating a transaction, running a node, or otherwise helping operate or secure a blockchain.
In other words, the legislature that wrote DACPA understood—and said in statutory text—that DeFi, software development, and network participation are different from running a custodial exchange. They drew the line on purpose. They knew where it was.
The Tax Act takes DACPA’s definition of the asset and discards every one of those carve-outs. It re-defines “digital asset business activity” in its own Section 3-15 as any single occurrence of exchanging, transferring, or storing a digital asset—and stops there. No peer-to-peer exclusion. No decentralized-exchange exclusion. No software exclusion. No node exclusion. The five doors DACPA deliberately closed to regulators, the Tax Act blew wide open.
You do not strip five precise, recently enacted carve-outs by accident. Someone had DACPA open in one window and the Tax Act in the other and decided the tax should reach exactly what the former law spared.
Frankenstein’s broker: reviving the definition Congress killed.
Having widened the scope, the drafters needed a defendant. They chose “digital asset broker,” defined by reference to Section 6045(c)(1)(D) of the Internal Revenue Code—the federal definition that reaches anyone who regularly provides any service effectuating transfers of digital assets—a standard wholly distinct from those for traditional brokers where the status attaches to a “person” who “executes/enters into/effects” transactions “on behalf of/for the account of” other persons.
“Effectuating” thus carries the weight here, and the word was load-bearing by design. The verbs that usually switch on intermediary regulation—execute a trade, effect a transfer—describe someone standing in the flow of funds with custody/control or agency. “Effectuate” describes anything that helps the transfer happen, which is a net wide enough to drape over a front-end that never touches the assets at all.
Washington has already run this experiment and abandoned it. The same conception was the heart of Treasury’s DeFi-broker rule, and that rule did not quietly fade; Congress affirmatively struck it down in 2025 and slammed the door on bringing it back in any recognizable form. The federal government held this exact language up to the light, decided it could not honestly be applied to decentralized software, and threw it out.
Illinois imported the dead definition by reference anyway. Granted, a state is free to define its own terms. But of all the available formulations—including the narrower, custody-focused triggers in Illinois’ own DACPA—they reached past the workable options for the one Washington had just discarded as too broad. When you select the rejected tool, you are telling on yourself about what you mean to catch.
“Irrespective of whether licensed”: a reporting duty on the entire planet.
The reach does not stop at the state line, and the statute is candid about it. A “digital asset broker maintaining a place of business in this State” includes any broker with facilities or an agent here irrespective of whether that presence is permanent or temporary, and “irrespective of whether the digital asset broker or subsidiary is licensed to do business in this State.” A broker headquartered anywhere on earth is swept in once $100,000 in sales to Illinois customers crosses the line, with a quarterly look-back to keep score.
Pair that with the registration, return-filing, and recordkeeping mandates and the result is breathtaking in scope: as a matter of the statute’s plain terms, literally every business anywhere on earth that even touches a digital asset for an Illinois customer must register with the Department of Revenue and maintain inspectable records for the State of Illinois. Not pay tax—report. The licensing-and-surveillance apparatus attaches before, and independent of, any dollar of revenue collected.
Another giveaway that this is not really a revenue measure. A state that wanted money would tax and move on. A state that wanted control builds a registry, a recordkeeping duty, an inspection right, and a penalty for non-compliance—which is exactly what the back half of this Act does.
Taxing the gross—gas and protocol fees included.
The base makes the intent plainer still. “Purchase price” is defined to be calculated “without any deduction on account of the cost of materials used, labor or service costs, or any other expense whatsoever,” and to include “any and all charges that the customer pays related to or incidental to” the activity.
In a DeFi context, those incidental charges are not markup. They are network gas fees and protocol fees—costs paid to a blockchain and its smart contracts, not to any company sitting between the user and the chain. The Tax Act reaches them anyway. It taxes the user’s cost of using a public network as though it were a broker’s service charge. That is not how you write a tax aimed at financial middlemen; it is how you write one aimed at the public, digital rails themselves—more evidence the drafters were knowingly going after DeFi, not merely the custodial intermediaries they could have stopped at. And stopping at custodians would not have rescued the tax anyway; it would still carry every defect I laid out last time.
Relinquishing control to open-source code—taxed and logged.
Then there is the definition of “transfer.” Among its branches: relinquishing custody or control of a digital asset to another person. Read that against how DeFi actually works. When a user interacts with a decentralized protocol, what they do, mechanically, is relinquish control of an asset to a smart contract—autonomous, open-source code with no person behind it in any ordinary sense.
The definition is broad enough to treat that interaction—handing control to open-source smart contracts—as a taxable, reportable “transfer.” The statute thus reaches the most basic act in decentralized finance and labels it the very activity it taxes and polices. Again: the line DACPA was careful to draw around autonomous code, the Tax Act erases.
And then they made it a felony.
The last move is the one that should alarm anyone, crypto-skeptic or not. Section 3-55 makes it a Class 3 felony for a “digital asset broker” to fail to register, fail to file, fail to keep the required books and records, or otherwise violate the Act.
Now stack the definitions. “Digital asset broker” is anyone providing a service“effectuating” transfers, with no DeFi carve-out. “Transfer” is broad enough to include relinquishing control to a smart contract. And “person”—the word that decides who actually goes to prison—is drawn wide enough to close the loop: it covers not just individuals and companies but any “association” or “other entity,” which is the bucket a DAO falls into.
Because a protocol has no neck to put a collar on, the breadth of “person” is what lets the state reach past the faceless code and land the liability on a human being who participated in its development or participated in the DAO. The scope reaches noncustodial user-directed activity by design. Follow that chain to its end and you reach a genuinely startling place: a participant in a decentralized protocol can become a felon the moment this law takes effect and an Illinois resident uses that protocol—without ever having registered with a state they may not know exists, for failing to file returns on activity they do not control and cannot stop.
No doubt a court would strain to avoid that reading. But the fact that the text permits it—that the plain words criminalize participating in software—is not a bug a careful drafter would have left in. It is what you get when the definitions are tuned to reach DeFi and the penalty is bolted on without anyone asking who, exactly, ends up exposed.
A scalpel, not a shotgun.
Let me correct something. A tempting line is that the Act is so clumsy it would tax ordinary banks and brokers too, since they also move “value in digital form.” On a careful reading, it does not. The imported DACPA definition limits “digital asset” to a digital representation of value used as a medium of exchange, unit of account, or store of value—and DACPA’s applicability section expressly steps aside where federal securities or commodities law governs, and exempts insured depository institutions. So a bank’s wiring of dollars is not moving a “digital asset” subject to the Tax Act only because it was already carefully exempted by the Illinois legislature in DACPA.
That precision is the point. The “charitable” view—that this was a sloppy shotgun blast aimed at tax revenue that happened to hit crypto along with everything else—is wrong. This is a scalpel. The drafters knew enough to leave TradFi untouched and enough to strip the carve-outs that would have spared DeFi. The care they took to miss banks is the same care that proves they meant to hit decentralized finance. A genuinely sloppy bill would have been over-inclusive in both directions. This one is precisely under-inclusive where it protects incumbents and precisely over-inclusive where it reaches their competition.
The legal stakes, sharpened.
My previous article argued the tax was vulnerable on four fronts: the Internet Tax Freedom Act, the uniformity clause, the ban on resurrected personal-property taxes, and the dormant Commerce Clause. Those arguments ran on the tax’s effect: it discriminates against value moving on a digital rail whether or not anyone meant it to. Everything above adds the other half—purpose. And on these doctrines, purpose is worth more than effect. It does not replace the earlier arguments; it closes the exits the state was counting on.
And the fuller reading opens another front: the First Amendment. Once the law’s sweep extends to publishing and maintaining software and to running a node—the very things DACPA exempted and the Tax Act does not—it collides with a line of cases, from Bernstein to Junger, holding that source code is protected expression. The claim is narrow and as-applied: a registration mandate backed by a felony, attaching to a developer who did nothing but publish code, operates as a licensing regime over protected speech—the kind of prior restraint those courts struck down. I would not rest the whole challenge on it. But it is a real card the earlier, effect-only framing did not have, and it exists only because the drafters reached past the people who hold customer funds to people who merely write code.
The pattern, and the irony underneath it.
Step back, and the sequence tells the story. For years the anti-crypto regulatory posture was “same function, same regulation”: crypto/DeFi is just old finance in new clothes, so existing authority already covers it. The trouble is that the authority being invoked was built for a specific danger—handing your money to another person who has their own interests and the discretion to use your funds as their own.
Noncustodial DeFi is the opposite arrangement: self-directed activity, merely facilitated (aka effectuated) by software that, by design, never lets its operators touch the user’s assets. Federally and in Illinois, the attempt to force the first set of rules onto the second largely failed. Courts rejected the strained readings the Biden administration relied on. Separately, Congress repealed the DeFi-broker rule outright. Regulation by enforcement was pronounced over.
So the framing inverted. Now crypto is uniquely different—different enough to carry a gross-value tax, a bespoke registry, and a felony statute that traditional finance will never face. The classification flips with the objective. When the goal was to regulate, crypto was the same as everything else. When regulation failed, crypto became special enough to punish. A category that changes shape depending on what the state wants to do with it isn’t a category at all. It’s a pretext.
Strip away the tax-policy veneer and what remains is simpler and older: “crypto bad, so let’s make it expensive, surveilled, and criminal to operate.” When existing law would not stretch far enough to regulate crypto and DeFi to death, this is the response—a backdoor built through a must-pass budget bill, reaching the noncustodial, decentralized, open-source activity that the front-door law had been forced to spare.
Here is the part the drafters likely never considered. The decentralized systems they are working hardest to shut down exist precisely to remove the trusted intermediaries—the banks, the brokerages, the custodians—whose failures gave us the 2022 blowups DACPA was explicitly written to prevent.
Consider who first pitched this exact move. Weeks before FTX imploded, Sam Bankman-Fried published a regulatory “blueprint” proposing that DeFi front-ends, the websites and interfaces that let ordinary people reach a protocol, be made to register like traditional brokers—even as he ran a centralized, custodial exchange whose custody was the very thing that let him steal customer funds. He was careful to spare the base layer; the coders and validators, he conceded, were doing something like protected speech. His target was the interface.
Illinois has now enacted SBF’s wishlist and then exceeded it, reaching past the front-ends to the open-source code and the node operators SBF himself thought untouchable. The most notorious fraudster in the industry’s history wanted regulators pointed at decentralization and noncustodial alternatives rather than at the centralized custody that enabled his fraud—and Illinois obliged a man whose own collapse was the strongest argument against everything he was selling.
In targeting DeFi while leaving TradFi untouched, Illinois is not protecting consumers from the next FTX. It is protecting the incumbent rails from the one technology designed to make another FTX structurally near-impossible. They think they are stopping the danger. They are doing the bidding of its most likely source.