Section 308* of the CLARITY Act is short but very impactful. It sits inside the bill's DeFi provisions and sets risk management standards for any digital asset intermediary that routes orders or trades through a DeFi protocol. Read it once and it sounds like a disclosure requirement. Read it twice and it's an ask for a control most compliance programs don't have in place yet.
The four duties
Before an intermediary touches a DeFi trading protocol, Section 308 asks for four things:
- Analyze the risk. Assess money laundering and sanctions-evasion risk, including whether the activity relates to a primary money laundering concern, along with fraud, market manipulation, and operational and cybersecurity risk on the protocol itself. The cyber duty at 308(b)(1) puts the smart contract and operational risk of the protocol in scope, not just the behavior of your customers.
- Disclose those risks to customers.
- Detect the activity in real time. The statute calls for a "robust, risk-based capability to detect market manipulation, fraud, cyber intrusions, money laundering, and sanctions evasion," naming "the use of ... distributed-ledger analytics tools" as an example. It's the first time a US statute has named onchain analytics as a compliance tool.
- Act. Run a risk-based procedure to execute, reject, or suspend incoming and outgoing transactions based on suspected illicit risk.
All four sit under one clause: compliance is verified by examination. An examiner doesn't grade the policy document, they test whether the capability works. So the question institutions should be asking is "can we show an execute, reject, or suspend decision happening on a live transaction, with the reasoning behind it?"
Where the gap actually sits
Detection can be sourced from several vendors. What's harder is moving from detection to a per-transaction decision fast enough to land before the transaction settles. Post-hoc tracing tells you a wallet is sanctioned or a counterparty is compromised, but it doesn't hold the withdrawal or reject the transfer while it's still pending. Section 308 lives in that pending window, the seconds between a transaction being submitted and being final.
That points to a specific architecture, where three things are wired together:
- a detection layer that sees risk onchain as blocks finalize,
- a decision layer that returns an accept-or-deny on an individual transaction and enforces it at the point of signing or broadcast,
- an evidence trail that reconstructs, after the fact, why each decision was made.
Where Hypernative fits
Hypernative approaches Section 308 as one connected system rather than a stack of point tools. Detection, the transaction-level decision, the operational and cyber response, and the evidence trail an examiner will ask for all run on a single platform, wired together from the start rather than stitched across vendors after the fact.
Hyperntive's Transaction Guard simulates a transaction before execution and returns an accept-or-deny, which can be automated against custom policies and plugs into Fireblocks, Safe, and MPC or HSM custody. That's the fourth duty in operational form.
Our Onchain Monitoring and Automated Response covers the operational and cyber limb, with actions like emergency pause, role revocation, or a frontend disable when a protocol is under attack.
Screening & Intelligence covers the sanctions and money-laundering limb: address and transaction screening across 75+ chains, streamed into your own infrastructure and re-run continuously.
Section 308 is written in outcome terms, not tool terms. It doesn't tell you what to buy, but it describes something an examiner should be able to watch happen live, on a real transaction, in real time. Build backward from that, and the requirements get a lot more concrete.
Reach out for a demo of Hypernative's solutions, tune into Hypernative's blog and our social channels to keep up with the latest on cybersecurity in Web3.
Proactive security for onchain finance.
Website | X (Twitter) | LinkedIn
*Section numbers follow the House-passed bill. The July 22, 2026, Senate substitute renumbered them (e.g., Section 308 is now §10308); the numbering may change again if the bill moves further this fall.
