ADGM Proposes DeFi Risk Guidance for Regulated Firms

Key facts

What is the FSRA proposing?

The FSRA proposes supervisory guidance, issued under section 15(2) of the Financial Services and Markets Regulations 2015 (FSMR), on how regulated firms should manage the risks of engaging with decentralised finance (DeFi) (Guidance para 1.1.5).

It would not regulate DeFi protocols, create a new permission, or approve any protocol (para 1.1.3). The consultation paper adds that it does not decide whether a given protocol, token or exposure falls inside the FSRA perimeter (CP Introduction, para 5). Existing requirements continue to apply (CP Background, para 5).

The draft has three parts: risk management arrangements (Section 2), infrastructure risks such as custody, smart contracts, oracles and bridges (Section 3), and exposure risks such as Fiat-Referenced Tokens, synthetic exposures, receipt tokens and wrapped assets (Section 4).

What would firms be expected to do?

Paragraph references are to Attachment 1 unless marked CP. The draft uses “should”, so these are supervisory expectations.

• Permission comes first.

  A firm would first test whether the activity is within its permissions. If it is not, due diligence and controls cannot make it permissible (paras 2.4.1 and 2.4.2).

• Board ownership.

  The Governing Body would approve the DeFi strategy and risk appetite (para 2.3.1). Existing governance would be extended; no separate structure is needed (para 2.3.3).

• Controls before exposure.

  A firm should not rely mainly on exiting after a stress event. Position sizing, concentration limits and provider selection come first (para 2.2.3).

• DeFi-specific stress tests.

  Scenarios would include Fiat-Referenced Token depegs, oracle failure, bridge failure, governance attack and cascading liquidation (para 2.5.5).

• Dependencies, monitoring and records.

  Firms would know their third-party and concentration exposures, monitor continuously and keep records good enough to reconstruct an event (para 2.2.2).

• Incident readiness.

  Escalation should work outside normal business hours (para 2.10.3). A material Cyber Incident may trigger notification under GEN 3.5.18 (para 2.10.7).

• Client assets unchanged.

  DeFi does not alter the Client Asset rules. Client Assets must stay in a Client Account kept by a Third-Party Agent (footnote 1 to para 2.4.3).

Who is affected?

The Guidance applies to an Authorised Person that engages with DeFi venues, protocols or providers in connection with a Regulated Activity, or whose Regulated Activity is materially affected by that engagement. It also applies to a Recognised Investment Exchange or Recognised Clearing House whose recognised functions depend on, or are materially affected by, such engagement (para 1.2.1).

It does not impose obligations on DeFi venues, protocols or providers (para 1.2.4). Where a client product relies on DeFi, the draft expects clear client disclosures of the exposure and its material risks (para 2.3.2(g)). A CFO should also note that the draft asks firms to speak to the FSRA before starting an engagement that is novel to them or has unclear regulatory implications, and in any event before using Client Assets in it (para 2.4.3).

What should CFOs do next?

The draft is not binding, but it signals what the FSRA expects of firms. The five moves below are practical advice, not requirements of the paper:

1. List every DeFi touchpoint.Include indirect ones, such as a custodian or tokenised product that depends on a protocol.
2. Test each against permissions.Ask Compliance to confirm in writing that the activity sits within your Financial Services Permission (para 2.4.1).
3. Run a gap check.Compare governance, limits, monitoring, records and incident plans with Section 2 of the draft.
4. Cost the proposal.Estimate people, tooling and analytics spend, and consider answering Question 7 on implementation challenges.
5. Decide whether to respond.Comments supported by reasoning and evidence will be given more weight, and the FSRA may publish them (CP paras 7 and 8).

Deadlines and status

After that the FSRA will consider changes and then publish the Guidance in final form (CP para 9). The papers state no effective date, no transition period and no penalty provision, so nothing here is yet a rule.

Frequently asked questions

Sources (official, verified 12 October 2026)

1. Consultation Paper No. 5 of 2026, DeFi Risk Management Guidance, 6 October 2026 (PDF, 9 pages) https://en.adgm.thomsonreuters.com/sites/default/files/net_file_store/Consultation_Paper_No._5_of_2026_-_DeFi_Risk_Management_Guidance.pdf
2. Attachment 1: proposed DeFi Risk Management Guidance (PDF, 40 pages) https://en.adgm.thomsonreuters.com/sites/default/files/net_file_store/Attachment_1_-_Proposed_DeFi_Risk_Management_Guidance.pdf
3. ADGM announcement, 6 October 2026: “ADGM FSRA Invites Industry Feedback on Proposed DeFi Risk Management Guidance” https://www.adgm.com/media/announcements/adgm-fsra-invites-industry-feedback-on-proposed-defi-risk-management-guidance
4. ADGM Rulebook, Public Consultation Papers (open papers list) https://en.adgm.thomsonreuters.com/rulebook/public-consultation-papers

• DeFi
• Decentralised finance
• ADGM
• FSRA
• Consultation paper
• Digital assets
• Risk management
• Financial Services and Markets Regulations 2015

← Back to all articles