The Financial Services Regulatory Authority of Abu Dhabi Global Market on 6 October published Consultation Paper No. 5 of 2026, seeking comment on draft DeFi Risk Management Guidance for Authorised Persons and Recognised Bodies. The guidance takes a narrow route. It does not regulate DeFi protocols, create new regulated activities or decide the status of governance tokens. It sets out what the FSRA expects of firms it already licenses when they use smart contracts, liquidity pools, bridges and oracles in their regulated business. Comments are due by 30 November 2026.
The FSRA has chosen supervision over a DeFi regime
In 2022 the FSRA published a discussion paper on policy considerations for decentralised finance that sketched what a future framework might look like. The new paper says plainly that it does not implement that illustrative framework. Instead, the FSRA proposes to deal with DeFi “through supervisory guidance applicable to regulated firms”, and asks in its first question whether respondents agree with that approach.
The guidance also does not decide whether any protocol, token, receipt, claim or synthetic exposure falls inside the FSRA’s perimeter. Those questions stay case by case under the Financial Services and Markets Regulations 2015. For a firm, the practical message is that using DeFi changes nothing about its legal obligations. The draft says a firm “should not assume that the use of DeFi changes the underlying legal or regulatory characteristics of the asset or activity.”
Every material engagement needs an approval process
The draft guidance asks the governing body to approve a DeFi engagement strategy and risk appetite, including the venues, protocols and providers in scope. Each material engagement should then go through a defined approval process before it starts.
The first test is permission. An engagement outside a firm’s Financial Services Permission “must not proceed”, and the draft states that due diligence or controls cannot make it permissible. Only after that test does a firm assess risk appetite, operating capability and due diligence on the protocol. Where an engagement is novel or its regulatory implications are unclear, the firm should talk to the FSRA first, and in any event before using client assets. A footnote adds that DeFi does not change client asset rules: client assets must stay in a client account held by a third-party agent.
The draft also warns against treating the exit as the main control. Exit routes that work in normal markets “may be unavailable, uneconomical or unsafe under stress,” so firms should rely on position sizing, exposure and concentration limits, and provider selection.
Oracles, bridges and signing providers are dependencies to map
The draft lists the infrastructure behind a DeFi position: wallet and signing providers, analytics firms, oracles, bridges, indexers, node operators, routing services and front ends. Firms should keep records of each provider, what it does, where its services sit, the firm’s contractual rights and whether the provider can be replaced.
Concentration is treated as a market-wide question. A single oracle, bridge, sequencer or custodian may support several of a firm’s positions and those of other firms. The firm should consider how its overall position would be affected if that shared dependency failed.
Incident handling is set to DeFi speed. The draft notes that incidents “may unfold at the speed of block production” and may be visible on-chain before a firm detects them. Escalation should work outside office hours, and a protocol failure at a provider the firm relies on may trigger cyber incident notification duties under the FSRA’s General Rulebook.
DeFi incidents may unfold at the speed of block production, may propagate through dependency chains within minutes, and may be observable onchain before the Authorised Person has internally detected them.
FSRA, draft DeFi Risk Management Guidance, 6 October 2026
Privacy designs determine the financial crime risk
On financial crime, the draft distinguishes between privacy designs. Most public chains allow full tracing; some assets offer optional privacy; some newer designs let holders prove clean status while hiding identity; and some, including shielded transactions, are built to defeat tracing. Interaction with mixers or protocols that enforce non-traceability by default defeats transaction screening and, in the draft’s words, would “negate the prohibition on Privacy Tokens”. Firms should also not rely blindly on a venue’s own sanctions screening, whose design may not be visible to them.
Stablecoin exposures get their own section
For fiat-referenced tokens, the draft lists peg loss, redemption failure, issuer failure, issuer freezes and blacklisting, contagion and changes in a token’s regulatory standing. FSRA acceptance of a token does not remove the need to assess these risks. A wrapped or bridged version of an accepted token is not automatically accepted, and algorithmic stablecoins remain prohibited for any regulated activity in ADGM.
The consultation’s sixth question asks whether any categories of DeFi engagement should be treated as unsuitable for regulated firms, and on what objective criteria. The answers could turn parts of the guidance into firmer limits.
What to watch
- Responses on unsuitable engagements and any objective criteria the FSRA adopts.
- Final guidance after the consultation closes on 30 November 2026.
- Whether the FSRA returns to a protocol-level framework at a later stage.
Primary sources
- FSRA, Consultation Paper No. 5 of 2026: DeFi Risk Management Guidance (PDF), 6 October 2026
- FSRA, Attachment 1: Proposed DeFi Risk Management Guidance (PDF), 6 October 2026
- ADGM, Public consultations
Photo: MAVARIZ, CC BY-SA 4.0 via Wikimedia Commons
