ADGM’s proposed DeFi risk management guidance addresses how regulated firms engage with decentralised finance. It does not introduce a new DeFi licence or approve individual protocols. Businesses considering DeFi should begin with their existing permissions, then assess how they will control the activity and manage the resulting risks.
The Financial Services Regulatory Authority (FSRA) published Consultation Paper No. 5 of 2026 on 6 October 2026. The consultation remains open, with responses due by 30 November 2026. The accompanying guidance is a proposal, not final guidance. FSRA announcement
For decision-makers, two practical examples deserve particular attention: a smart contract retaining permission to move assets after a transaction has ended, and a token issuer restricting the transfers needed to exit a position.
Who would the proposed guidance apply to?
The proposal addresses Authorised Persons and Recognised Bodies engaging with DeFi in connection with their regulated activities or recognised functions. Its focus is the regulated entity’s management of that engagement. It does not itself authorise DeFi protocols or providers to operate in or from ADGM.
The three main themes are effective DeFi risk management, infrastructure risks and exposure risks. Together, they connect the firm’s internal decision-making with the way a protocol operates and the assets used within it. These are complementary parts of the assessment, rather than alternative approaches.
Do existing permissions cover the proposed activity?
The first assessment concerns what the firm proposes to do through DeFi and whether that activity falls within its permissions. A technically secure protocol cannot resolve an authorisation problem.
Paragraphs 1.1.3 and 2.4.1–2.4.3 of the proposed Guidance separate this threshold assessment from due diligence and risk controls. They also envisage early engagement with the FSRA where a proposed engagement is novel or its regulatory implications are unclear. Proposed Guidance
A useful starting document is a short description of the intended service and transaction flow. It should let legal, compliance and technical teams discuss the same activity. A broad label such as “DeFi strategy” offers too little detail for that discussion.
How should firms manage DeFi risks over time?
The proposal combines governing body oversight, due diligence before engagement and ongoing monitoring. Firms would need clear responsibilities and controls that remain suitable as their activities and risks change.
For implementation, a firm can connect each material finding to a named decision-maker and an action. Identifying a risk in a report is only useful if someone knows when to reassess it, who can authorise a response and how that response would be carried out.
This is also a practical way to test communication between teams. Legal analysis may identify a constraint that technology teams need to implement; monitoring may reveal a change that requires renewed legal assessment. The process should accommodate both directions.
Who can move assets after a transaction ends?
The infrastructure theme includes custody, control and asset access. A smart contract permission may allow a protocol to move assets from a firm’s wallet beyond the immediate operation. Completing the transaction does not necessarily remove that permission.
The proposed Guidance addresses delegated permissions in paragraphs 3.2.2(c) and 3.2.3(a). Paragraph 3.2.3(c) qualifies revocation by reference to the firm’s ability to do so. An exit procedure should therefore avoid assuming that every permission can always be withdrawn. Proposed Guidance
As a practical review exercise, the firm can compare the permissions it intended to grant with those that remain active. The result should be understandable to the people responsible for the assets, rather than existing only as a technical record that nobody reviews.
What could prevent an exit from a DeFi position?
Under the exposure theme, the proposal identifies issuer freezing or blacklisting as a risk for fiat-referenced tokens. Such action may restrict transfers, redemption or exit from a DeFi position.
Consider a firm whose planned exit requires transferring a token to another address or redeeming it with its issuer. If that token or address becomes subject to an issuer restriction, the assumed exit route may no longer work. This illustrates the risk; it is not an account of a particular market incident.
Paragraph 4.2.2(d) addresses this example. Paragraphs 2.2.2(h) and 2.2.3 also explain why exit planning should not be the only protection: an exit that works in normal conditions may be unavailable under stress. Proposed Guidance
What should firms document before engaging with DeFi?
The following checklist translates the four issues above into practical preparation. It is not a substitute for assessing the applicable regulatory requirements.
The activity and its permissions
Describe the proposed activity and record the basis for treating it as permitted. Identify unresolved questions before selecting controls or committing assets.
Responsibility throughout the engagement
Record who approves the engagement, who monitors it and who can decide on a response. Give each person an intelligible account of the assumptions behind the decision.
Control over assets
Map the wallet and smart contract permissions involved. Record how the team will review continuing access and establish what revocation is technically possible.
The actual exit route
Describe the steps needed to unwind the position. Identify any dependence on a token transfer, issuer redemption or permission that another party can restrict.
Key takeaway
The proposal links permission checks with continuing oversight and practical control over assets.
- For a business considering DeFi, the preparation should explain both how the activity will operate and what could prevent the firm from stopping it.
- The consultation is an opportunity to assess those questions before the guidance is finalised.
Frequently asked questions
Is the ADGM DeFi guidance already final?
No. As at 10 October 2026, it is proposed guidance accompanying Consultation Paper No. 5 of 2026. The consultation closes on 30 November 2026.
Does the proposal create a DeFi licence?
No. It does not introduce a new licence or approve protocols. Firms must consider their existing permissions before undertaking a proposed activity.
Does finishing a transaction remove smart contract permissions?
Not necessarily. Permissions may remain active afterwards, so the firm needs to understand continuing access and how it can be reviewed or revoked.
Can a token issuer affect a DeFi exit?
Yes. The proposal identifies freezing or blacklisting as possible constraints on transfers, redemption and exit. The effect depends on the token and the position.
What are the three main themes of the consultation?
They are effective DeFi risk management, DeFi infrastructure risks and DeFi exposure risks. The firm’s assessment should connect its governance arrangements with the relevant operational and asset risks.
Official sources
ADGM Financial Services Regulatory Authority (FSRA)
Consultation documents
- FSRA Consultation Paper No. 5 of 2026 — DeFi Risk Management Guidance.
- Attachment 1 — Proposed DeFi Risk Management Guidance.
Discuss your proposed DeFi activity with BLegal
BLegal advises on ADGM financial services and digital assets, including regulatory perimeter assessment, governance and compliance policies. We help businesses connect the proposed activity with the legal and operational questions that need to be resolved.
If your business is considering DeFi engagement, contact us to discuss the relevant permissions, asset control arrangements and potential exit constraints.
Last reviewed: 10 October 2026
Disclaimer. This article is provided for general information only and does not constitute legal or regulatory advice. The applicable framework depends on the specific token, activities, entity structure and jurisdictions involved. Regulatory requirements and interpretations may change. Businesses should obtain advice based on their particular circumstances before making structuring, licensing or commercial decisions.