FSRA draws the line: How ADGM expects firms to manage DeFi Risk

On 6 October 2026, the Financial Services Regulatory Authority (FSRA) of Abu Dhabi Global Market (ADGM) published Consultation Paper No. 5 of 2026, inviting industry feedback on proposed DeFi Risk Management Guidance (the Guidance).

The Guidance sets out the FSRA’s expectations for how Authorised Persons and Recognised Bodies should identify, assess, monitor and manage the risks arising from their engagement with decentralised finance (DeFi) protocols and venues. The consultation closes on 30 November 2026.

The context

The Guidance does not arrive in a vacuum. The FSRA first set out its thinking on DeFi in a 2022 discussion paper, and its existing Virtual Asset Guidance already cautions Authorised Persons against transacting through infrastructure where the counterparty is unknown or anonymous. In the meantime, the ADGM virtual asset market has moved well beyond custody and price exposure into areas such as staking, lending and tokenised assets, bringing regulated firms into closer contact with DeFi infrastructure. Internationally, the Financial Action Task Force’s July 2026 report on DeFi found that centralised elements frequently persist in arrangements that present as decentralised, and stressed that financial institutions interacting with DeFi remain subject to the relevant FATF Recommendations. The Guidance should be read against that backdrop.

What the Guidance does, and does not, do

Importantly, the Guidance operates within the existing regulatory framework. It does not create new DeFi regulated activities or asset categories, nor does it introduce a regime for approving or recognising protocols. Regulatory treatment continues to turn on the substance of the activity, instrument or arrangement concerned. The FSRA’s focus is instead on the regulated firm on the other side of the connection, and on whether that firm can demonstrate that its DeFi engagement is properly governed and controlled.

The starting point is permissibility. Before any material DeFi engagement proceeds, a firm is expected to confirm that the activity falls within its Financial Services Permission. Where it does not, the engagement should not proceed, and no amount of due diligence or risk mitigation will make it permissible. For novel or material DeFi engagements, the firm is expected to engage with the FSRA before commencing the activity. Only once that threshold is met do questions of risk appetite, internal capability and the suitability of the relevant protocol, venue or provider arise.

Beyond that threshold, the Guidance addresses three broad areas. The first is the firm’s own risk management arrangements, including Governing Body approval of the DeFi strategy and risk appetite, allocation of responsibility to identified individuals within Senior Management, approval and onboarding processes, continuous monitoring, recordkeeping, competence and incident escalation. The second is the infrastructure supporting the engagement, such as custody and key management, smart contracts, protocol governance, oracles and bridges, together with the financial crime constraints these raise. The third is the treatment of resulting exposures, including fiat-referenced tokens, tokenised claims and wrapped or bridged assets, where firms should not assume that the use of DeFi changes the underlying legal or regulatory character of the asset. Client asset protections are unaffected and continue to apply in full.

Why it matters

For firms already engaging with DeFi, the Guidance signals how the FSRA is likely to assess those engagements in supervision, and makes clear that accountability will rest with identified individuals rather than be diffused across committees. For firms considering DeFi engagement, it provides a useful framework against which to test a proposed business model before committing to it. In either case, the proposals touch governance, compliance, technology, operations and client asset arrangements, and merit review beyond a single function. Firms should also note that DeFi markets operate continuously, and the FSRA expects monitoring and incident response arrangements to reflect that, including the ability to detect and escalate issues outside normal business hours and at the speed of block production.

How we can help

DeFi may be decentralised, but accountability for engaging with it is not. Our Financial Regulatory team in the UAE advises firms across ADGM and the wider region on virtual asset and digital asset regulation. We can help you assess whether a proposed DeFi engagement sits within your existing permissions or requires a variation, review your governance, risk management, financial crime and client asset frameworks against the FSRA’s expectations, and structure new DeFi-related business so that it is built for regulatory scrutiny from the outset. As the FSRA sharpens its focus on this space, now is a good time to make sure your arrangements are ready.