What is a DAO and how does its governance work

Imagine a group of thousands of people, spread around the world, who share a common treasury and decide how to spend it by vote. There is no hired board and no bank account: the rules live in programs recorded on a blockchain, and money only goes out when the vote approves it. That is the idea behind a DAO, short for decentralized autonomous organization.

This article explains how a DAO works on the inside, which voting models exist, where the promise of decentralization runs into limits and what regulators have already said on the subject. The information was checked on October 8, 2026.

What a DAO is

The official Ethereum website defines a DAO as a collectively owned organization working toward a shared mission. The rules live in smart contracts, not in the hands of a leader: no executive can spend the group’s money on their own (ethereum.org, DAO).

Smart contracts are programs recorded on the blockchain that execute rules automatically when certain conditions are met. To review how they work and what their limits are, see What are smart contracts and how do they work.

Three elements appear in almost every DAO:

• Treasury: a shared pool of funds, controlled by the contract, which only releases resources according to the rules.
• Proposals: formal requests to do something, such as paying a supplier or changing a system parameter.
• Voting: the mechanism that decides whether a proposal passes. According to ethereum.org, once the result is tallied, execution can be carried out by the code itself, with no intermediary.

DAOs often govern decentralized finance protocols, but also investment clubs, open-source projects and community initiatives. How financial protocols work is covered in DeFi: what is decentralized finance.

Who can vote: three participation models

ethereum.org describes three main ways of defining who takes part and how much each vote weighs (ethereum.org, DAO).

Token-based. Voting power comes from holding a governance token, a digital asset that grants the right to vote. It can usually be bought and sold freely, and it is sometimes distributed as a reward for using the protocol. This is the most common model in large protocols. The direct consequence is that more tokens mean more votes.

Share-based. Entry is more restricted: the applicant submits a membership proposal, usually offering funds or work. Shares grant votes and a stake in the treasury, and those who leave can take their proportional part. This model suits smaller, closer-knit groups.

Reputation-based. Votes come from participation in the group and cannot be bought or transferred. Reputation measures contribution, not money.

There are further variations. Many DAOs allow delegation: you transfer your voting power to a representative without handing over your tokens. Others keep the money in a multisignature (multisig) wallet, which requires the signatures of several identified people to move funds. In that case the community decides, but a small group executes, and that group has to be trusted.

How a proposal becomes a decision

To understand the mechanics, it helps to look at an industry standard. OpenZeppelin, a company that publishes widely used smart contract libraries, documents a governance contract called Governor. The typical cycle has four stages (OpenZeppelin, on-chain governance):

1. Creation. Someone registers the proposal: a set of actions to execute and a description. There may be a proposal threshold, meaning a minimum number of votes the person must hold in order to propose.
2. Delay and balance snapshot. There is an interval before voting opens. Each participant’s voting power is measured from a “snapshot” of balances taken at that moment, not from the current balance. This stops someone from voting, transferring the tokens to another wallet and voting again.
3. Voting. During a set period, participants vote for, against or abstain. The proposal passes if it reaches quorum (minimum participation, measured as a percentage of tokens) and has more votes for than against.
4. Queue and execution. Many DAOs use a timelock, a mandatory delay between approval and execution. The documentation explains that it gives those who disagree time to exit the system before the decision takes effect.

In the documentation’s examples, the delay is one day, voting lasts one week and quorum is 4% of tokens. These are illustrative parameters: each DAO chooses its own, and the choice greatly changes the outcome. A low quorum makes it easy to pass decisions with little participation; a high quorum can paralyze the group.

Decentralization in theory and in practice

The name suggests the absence of central command. Regulators and researchers see something else.

A study by the Bank for International Settlements (BIS), which brings together central banks, states that all DeFi platforms have some element of centralization and that it usually revolves around governance token holders, often the developers themselves. These holders act much like shareholders of a company. The paper concludes that “full decentralisation in DeFi is an illusion” and that governance structures are the natural entry point for regulation (BIS, 2021).

The same study notes that the initial token distribution usually gives a large share to project insiders, which concentrates decision-making power and can facilitate collusion.

In the editorial team’s assessment, there are three practical points to look at in any DAO:

• Who holds the votes. If a few addresses hold most of the tokens, they decide on their own, even if thousands of people take part.
• Who can change the code. Upgradeable contracts depend on whoever has permission to upgrade them.
• Who holds the treasury. In a multisig, the risk lies with the signers and the security of their keys.

The DAO case and the SEC’s view

The most studied example is The DAO, launched on Ethereum in 2016. The code flaw that allowed funds to be drained and the network fork that followed are recounted in What are smart contracts and how do they work. Here the focus is governance.

In July 2017, the SEC, the U.S. Securities and Exchange Commission, published an investigative report on the case. According to the document, The DAO raised ETH worth about US$ 150 million between April and May 2016, and an attacker diverted roughly one third of those funds (SEC, Release No. 81207).

The report reached three conclusions that still help explain DAOs today:

• The tokens were securities. Under U.S. law, in the circumstances analyzed, The DAO tokens were considered securities and their offering required registration or an exemption.
• Voting did not give real control. Proposals only went to a vote after being approved by “curators,” a group chosen by the founding company. Holders were numerous, dispersed and identified only by addresses, which made it hard to organize. The SEC compared this vote to that of an ordinary shareholder.
• Automation does not put it outside the law. The document states that the use of smart contracts does not remove the activity from the reach of securities laws.

The report also records that, at the time of the attack, holders could not react on their own: they depended on the founding company and other participants.

The SEC’s conclusion applies to the facts of that case and to U.S. law. It does not automatically classify every governance token. The general rules in Brazil are in Crypto regulation in Brazil: who oversees what.

Does a DAO have legal personality?

Generally, no. A DAO is a set of contracts and people, and the lack of a legal form leaves doubts about who is liable for debts, taxes and contracts with third parties.

Some places have created their own rules. The U.S. state of Wyoming passed a law in 2021 that allows a DAO to be registered as a limited liability company. Under the original text, in force since July 1, 2021, the name must contain “DAO,” “LAO” or “DAO LLC,” and the formation documents must warn that members’ rights may differ materially from those in an ordinary company, including reduced or eliminated fiduciary duties. The law also distinguishes a member-managed DAO from an algorithmically managed one (Wyoming, Enrolled Act No. 73). Later amendments to this law were not verified by the editorial team.

Rules like this are the exception. If you take part in a DAO with no legal form, there is no guarantee that your liability will be limited to what you put in.

Risks of taking part in a DAO

Holding a governance token is not the same as owning a share protected by corporate law. The main risks:

• Total loss. The token can lose all its value, and the DAO’s treasury can be emptied by a code error or a majority decision.
• Governance attack. Anyone who gathers enough tokens, even briefly, can pass proposals that benefit themselves. The timelock and the balance “snapshot” reduce this risk but do not eliminate it.
• Low participation. With few voters, a small group decides for everyone.
• Technical failure. Flawed contracts, compromised multisig keys and scams that imitate voting sites. See Crypto scams: how to spot and report them.
• Legal uncertainty. Without a corporate form, it is unclear who is liable to third parties, and regulators may treat the tokens as securities.

Key takeaways

• A DAO is a shared treasury and a set of rules in smart contracts, with decisions made by votes recorded on the blockchain.
• The voting model defines who is in charge: in token voting, weight follows the number of tokens held, and concentration is common.
• “Decentralized” does not mean nobody is responsible or that it is beyond the law: The DAO case showed a technical flaw, concentrated control and the application of securities rules.