ADGM seeks feedback on how regulated firms engage with decentralised finance

The consultation on the proposed DeFi risk management guidance (9-page / 198KB PDF) closes on 30 November. The guidance focuses on how regulated firms engage with decentralised finance (DeFi) rather than on regulating DeFi protocols themselves. In particular, the FSRA said it is not creating a new framework for DeFi, introducing new regulated activities or asset categories, or changing the scope of its existing regulations.

Marie Chowdhry, a fintech expert at Pinsent Masons in the UAE, said: "The FSRA has resisted building a decentralised finance rulebook, and that is the right call at this stage.”

"DeFi protocols themselves are hard to regulate directly, because there is often no identifiable operator behind them. The ADGM has instead set out what it expects of firms engaging with decentralised finance within the rules that already applies ” she said.

Under the draft guidance, responsibility is placed on firms' boards and senior management. They must approve their firm’s decentralised finance strategy and risk appetite. Senior management is also expected tounderstand and accept the risks of interacting with DeFi venues or protocols that operate without a directly applicable regulatory framework. The FSRA also expects firms to engage with the regulator before undertaking novel activities or where the regulatory position is unclear, and in any event before any client assets are used or deployed in connection with DeFi arrangement.

Abhay Raj of Pinsent Masons said: "A DeFi engagement that involves an activity outside a firm’s financial services permission cannot proceed. Risk controls address how an activity is conducted, but they do not determine whether firm may conduct it.”

"The guidance is particularly relevant to authorised persons and recognised bodies in the ADGM, including virtual asset firms, custodians, exchanges and clearing houses, and at their compliance, risk and technology teams,” he said.

"While the guidance does not expand what firms are permitted to do, it raises expectations around governance, risk management and regulatory compliance. In particular, firms must be able to demonstrate that an activity is permissible before taking any exposure, and that appropriate controls are in place from the outset, rather than relying on the ability to react after a stress event."