Roman Storm’s Conviction Exposes the Limits of CLARITY Act Section 604

Senator Lummis has made Section 604 of the CLARITY Act the centerpiece of her case for developer protection, citing the August 6, 2025 conviction of Tornado Cash co-founder Roman Storm as the clearest evidence that open-source developers face genuine criminal exposure under current law.

The provision would codify a federal safe harbor exempting non-custodial software builders from classification as money transmitters, a direct statutory response to the prosecution theory that put Storm in front of a jury.

The bill cleared the House 294-134 in July 2025 and the Senate Banking Committee 15-9 in May 2026, but has not received a Senate floor vote.

What the provision actually covers is more specific than the industry framing implies, and what it leaves intact is more significant than its supporters tend to acknowledge.

CLARITY Act Section 604: What the Legislative Record Actually Shows

The Digital Asset Market Clarity Act passed the House with a 294-134 bipartisan margin in July 2025, a vote count that reflected genuine cross-party support for bringing regulatory structure to crypto markets.

The Senate Banking Committee followed in May 2026 with a 15-9 vote advancing the bill to the full chamber. Senate floor action has remained procedurally uncertain, with no scheduled vote and active inter-committee friction still unresolved.

Senator Lummis has pointed explicitly to the Roman Storm case as the bill’s animating example. Storm, a co-founder of Tornado Cash, an open-source privacy protocol built on Ethereum, was convicted of conspiracy to operate an unlicensed money transmitting business.

The jury deadlocked on the two more serious charges: conspiracy to commit money laundering and conspiracy to violate sanctions. The conviction carries a maximum five-year sentence.

More than 60 CEOs and founders, including executives from Coinbase, Uniswap, Kraken, a16z crypto, and Paradigm, signed a letter to Senate leadership in June calling Section 604 a non-negotiable condition of their support for the broader bill.

Software developers should not need an army of lawyers to know if their code is legal. The Clarity Act ends that absurdity.

— Senator Cynthia Lummis (@SenLummis) June 21, 2026

“Software developers should not need an army of lawyers to know if their code is legal. The Clarity Act ends that absurdity,” Lummis said. That framing captures the legislative intent. Whether the provision delivers on it depends on the specific legal architecture of Section 604 itself.

Section 604 Decoded: The Non-Custodial Developer Exemption

Section 604 is drawn directly from the Blockchain Regulatory Certainty Act (BRCA), legislation first introduced in 2018 and folded into the CLARITY framework after years of reintroduction.

Its operative text specifies that a non-controlling developer or provider shall not be treated as a money transmitting business under 31 U.S.C. § 5330, nor as engaged in money transmitting under 18 U.S.C. § 1960, solely because they publish distributed ledger software, provide self-custody tools, or run infrastructure nodes.

Regulatory ambiguity doesn't just hurt builders. It helps criminals. The Clarity Act closes the gaps bad actors exploit.

— Senator Cynthia Lummis (@SenLummis) June 18, 2026

The provision codifies what FinCEN’s 2019 guidance already stated administratively: that non-custodial developers who never control user funds are not money transmitters.

The threshold is the “non-controlling” test. A developer qualifies only if they lack the legal right to control user transactions, lack unilateral ability to initiate transactions on demand, and cannot effectuate transfers without another party’s approval.

Non-custodial protocols, by design, meet all three conditions, the smart contract executes autonomously, and the developer has no key that moves funds. Tornado Cash fits that architecture precisely.

Under Section 604, the act of writing and deploying that code would not, standing alone, make Storm a money transmitter under federal law.

Section 604 is also paired with Section 601, which limits SEC registration obligations for non-custodial software builders, and a commodities-law carve-out under Section 207, together creating a three-part framework that treats open-source developers as technical publishers rather than financial intermediaries.

That architecture matters for the broader DeFi regulation landscape, not just privacy tools.