ADGM FSRA DeFi Risk Management Guidance: Comments Due 30 November

On 6 October 2026, the Financial Services Regulatory Authority (FSRA) of Abu Dhabi Global Market (ADGM) published Consultation Paper No. 5 of 2026 with proposed DeFi Risk Management Guidance attached. Comments close on 30 November 2026. The FSRA DeFi risk management guidance, as proposed, sets out how Authorised Persons and Recognised Bodies should identify, assess, monitor and manage the risks that arise from their engagement with DeFi protocols and venues, across ten control areas that run from governance and due diligence to incident escalation and client asset safeguards.

The paper lands on top of an established position. Paragraph 124 of the FSRA’s Virtual Asset Guidance, most recently revised on 10 June 2025, says Authorised Persons should avoid transacting through infrastructure or services where the counterparty is unknown or anonymous, and it names certain peer-to-peer and decentralised exchanges (DEXs) as the example. Guidance on managing DeFi engagement has to be read against that paragraph, and so does any comment letter.

Each of the ten areas already has a counterpart in the General Rulebook (GEN), the Conduct of Business Rulebook (COBS), the Anti-Money Laundering and Sanctions Rulebook (AML) or the Virtual Asset Guidance. Those counterparts are where a gap analysis starts, and they show where the consultation text adds something new.

Related reading: FATF DeFi Report: When Control Brings a DeFi Arrangement Within the FATF Standards

Consultation Paper No. 5 of 2026 and the dates around it

The window is short, and the paper has four years of FSRA thinking behind it.

• 13 April 2022: Discussion Paper No. 1 of 2022, Policy Considerations for Decentralised Finance, published. Its comment deadline was 30 June 2022, and the paper described itself as a starting point for dialogue and not guidance for financial institutions.
• 10 June 2025: most recent revision of the FSRA’s Guidance on Regulation of Virtual Asset Activities in ADGM (version VER07.100625), the document that holds the unknown-counterparty paragraphs.
• 6 October 2026: Consultation Paper No. 5 of 2026 published, with the proposed DeFi Risk Management Guidance as its attachment.
• 30 November 2026: comment period closes. Comments go in writing to fsra.consultation@adgm.com.
• Finalisation date: not specified in the FSRA’s 6 October 2026 announcement. The confirmed date is the consultation closing date of 30 November 2026. Firms should monitor subsequent FSRA publications for final guidance and any application or transitional arrangements.

Until the FSRA publishes final guidance, the current Virtual Asset Guidance remains the operative text. That document describes its own status at paragraph 5: it is not an exhaustive statement of FSRA policy, the FSRA is not bound by it, and the FSRA may impose additional requirements or waive and modify Rules where appropriate. The announcement calls the new document Guidance as well. The binding hooks for an ADGM firm stay in the Rules: GEN, COBS and AML.

One scheduling detail is easy to miss. The FSRA’s public consultations page lists two FSRA papers open at once. Consultation Paper No. 6 of 2026, on proposed revisions to the Fees and General Rulebooks, closes on 6 November 2026, 24 days before the DeFi paper.

Who the FSRA DeFi risk management guidance reaches

The announcement addresses Authorised Persons and Recognised Bodies. That group is wider than the firms holding a Virtual Asset permission. Paragraph 17 of the Virtual Asset Guidance lists seven Regulated Activities for which a firm needs FSRA approval to use Virtual Assets, among them dealing, managing assets, providing custody and operating a Multilateral Trading Facility. Paragraph 21 then says a firm carrying on other Regulated Activities is generally not required to comply with COBS Chapter 17, although the FSRA can impose parts of that chapter as conditions on the firm’s Financial Services Permission.

Read together, the announcement’s addressee list reaches beyond the population COBS 17 covers. The detailed application provisions and any qualifications for different regulated activities must be checked in Consultation Paper No. 5 of 2026 and its attached proposed guidance before concluding which requirements apply to each category of firm. On the announcement’s wording alone, sitting outside COBS 17 does not take a firm out of the paper’s audience.

Recognised Bodies are recognised investment exchanges and recognised clearing houses, each operating under a Recognition Order from the FSRA. AML Section 10.3 applies to Authorised Persons and Recognised Bodies undertaking VA/FRT transfers, subject to the exclusions and role-specific requirements in Rule 10.3.1. In particular, Rule 10.3.4 applies only where the entity is the originating institution. The application of those obligations to particular DeFi interactions requires an assessment of the transfer and the entity’s role.

The announcement describes an entity-level document. It says the guidance focuses on regulated entities’ governance and control of their DeFi engagements. It says nothing about recognising or approving protocols, or about licensing the people who control them. Those ideas come from the 2022 Discussion Paper, which sketched an illustrative framework of recognised and approved DeFi protocols, conditions or caps on retail exposure, and an approved DeFi controller, and stated at paragraph 47 that the FSRA was not bound to implement it. The Virtual Asset Guidance takes the same entity-first line on technology: at paragraph 52 the FSRA describes its approach as technology-neutral and says it does not seek to regulate Virtual Asset technologies directly.

The announcement does not define engagement, and that word sets the perimeter. The 2022 paper drew a scoping line that is still useful. Holders of DeFi governance tokens are not obliged to use the protocol, so the FSRA would likely treat those tokens consistently with its Virtual Asset regime, while a firm that used a DeFi protocol to provide financial services would be engaging in a DeFi activity (Discussion Paper, paragraph 54). Whether Consultation Paper No. 5 keeps that line is one of the first definitions to check.

Paragraph 124 and the unknown-counterparty position

Paragraph 124 of the Virtual Asset Guidance sits under the heading “Transactions with unknown counterparties”. It says Authorised Persons should avoid a transactional interaction with any infrastructure or services where a counterparty is unknown or anonymous, giving certain peer-to-peer or decentralised exchanges as the example, “at any stage of the process within and outside of the Authorised Persons’ core operations”. The stated purpose is to keep firms compliant with FSRA Rules and away from risks from tainted sources or destinations of funds.

The scope phrase matters. On its wording, “within and outside” core operations can reach treasury, liquidity management and back-office flows as well as client business.

Paragraph 125 goes further. It says firms should also avoid including liquidity, pricing and settlement data from such entities in their day-to-day operations. On its wording, that reaches a valuation process that takes a mid-price from a decentralised exchange pool, a best-execution check that benchmarks against on-chain liquidity, and a settlement workflow that reads a decentralised venue’s state. None of those involve placing a trade, and each would be caught where the venue supplying the data is one on which the counterparty is unknown or anonymous, which is the condition paragraph 124 sets.

Two other passages frame the same risk. In the list of expected risk disclosures at paragraph 99, item (k) covers any links to Virtual Asset activity outside ADGM that may be unregulated or subject to limited regulation. A footnote to paragraph 107 adds that the FSRA expects suitable controls, including client protection controls and disclosure mechanisms, when intermediary-type Authorised Persons trade into unregulated or lightly regulated markets globally.

The 2022 Discussion Paper took the same stance on identity. At paragraph 41 it said risks from anonymous DeFi activity “are not and will not be tolerated in ADGM” and that the FSRA would only allow DeFi activities where all DeFi participants had been identified and had undergone the necessary AML/CFT due diligence. That was a non-binding policy position, and it predates the current guidance.

Consultation Paper No. 5 addresses how firms manage engagement with DeFi protocols and venues, which presupposes that some engagement takes place. The announcement does not say whether paragraphs 124 and 125 will be amended, carved back for venues that meet stated conditions, or left in place beside the new guidance. That relationship is the question most likely to change an ADGM firm’s operating model, and the announcement leaves it open.

Ten control areas and the ADGM rules already behind them

The announcement lists the areas in one sentence: risk management, governance, due diligence, monitoring, financial crime controls, incident escalation, recordkeeping, auditability, competence and client asset safeguards. The table maps each to the existing requirement it will sit beside. The mapping is an analytical reading, built from the Virtual Asset Guidance, the AML Rulebook and the COBS staking Rules; the consultation text may draw different connections, and it may add expectations with no current counterpart.

Two rows carry a trap. The due diligence row looks covered for any firm with a mature Accepted Virtual Asset process, but paragraph 31 makes Accepted Virtual Asset status specific to the asset and to the firm that assessed it. The file documents a token, including the bridge and wrapping risks of the chain it sits on. On the text of paragraph 33, the assessment looks at the asset, its issuance model and its DLT ecosystem, not at each lending pool or decentralised exchange where the firm might deploy it. Whether a venue needs its own assessment is a point the consultation text would have to settle.

The client asset row assumes the firm can see what it holds. COBS 17.8.3 establishes custody-related requirements for client Virtual Assets. Where a client position is represented by smart-contract state or receipt tokens, firms should assess how the applicable reconciliation requirements can be satisfied and documented. The FSRA’s existing guidance does not, by itself, prescribe a reconciliation methodology for every DeFi custody structure.

Financial crime controls when the counterparty is a smart contract

The AML Rulebook’s travel rule section is the most mechanical part of the existing framework, and its definitions are built around originators, beneficiaries and the institutions between them. In AML Rulebook version VER11.210526 (May 2026), Rule 10.3.2 defines a VA/FRT transfer to include any transfer of Virtual Assets or Fiat-Referenced Tokens to or from an unhosted wallet. An unhosted wallet includes a non-custodial wallet or wallet address operated, held, maintained or controlled by an originator or beneficiary, without services from a third party beyond the technology that lets them administer their own assets or keys.

A deposit into a lending pool or an automated market maker sends assets to a contract address. On the face of those definitions, that address is neither obviously an unhosted wallet controlled by an originator or beneficiary nor a beneficiary institution receiving the transfer in the course of business. The text is silent on contract addresses. That is an interpretation, and it is a point the consultation could resolve.

The classification decides the workflow. If a contract deposit were treated as a transfer to a beneficiary institution, Rule 10.3.4(1)(b) would require due diligence on that institution and satisfaction that it is appropriately regulated, and Rule 10.3.4(6) says the firm must not effect a transfer where it cannot comply with Rule 10.3.4. If it were treated as an unhosted wallet transfer, Rule 10.3.6 requires Enhanced CDD on the customer first, and relevant transfer information before an outbound transfer proceeds. Rule 10.3.4 applies only where the firm is the originating institution. Neither provision is a complete alternative compliance pathway on its own, because the remaining requirements of Section 10.3 still have to be considered.

Own-account activity does not escape cleanly either. Rule 10.3.1(1)(b) takes transfers out of Section 10.3 only where both originator and beneficiary are Financial Institutions acting on their own behalf. A firm deploying house assets into a protocol will often have no identifiable Financial Institution on the other side, so the exemption does not obviously apply; how a contract address is classified is the open point.

Some obligations apply whichever path a firm takes. Rule 10.3.3 contains requirements concerning the tracking of Virtual Asset transaction history and identification of sources and destinations. For transfers involving pools, wrapped tokens or bridges, firms should assess how their transaction-monitoring arrangements meet the applicable requirements. The Rule should not be read as prescribing a specific tracing method for every DeFi structure. The AML/CFT section of the Virtual Asset Guidance (Principle 4) expects firms to define the indicators of illicit use, naming mixer and tumbler services, and to have a process for when those indicators trigger. Our notes on FATF travel rule implementation and the FATF’s targeted report on stablecoins and unhosted wallets cover the international standard these rules implement.

Whether the proposed guidance tells firms which travel rule path applies to protocol interactions is not visible from the announcement.

Client asset safeguards once assets leave the custody stack

The Virtual Asset Guidance sorts custody into three arrangements at paragraph 148. Type 1 is in-house custody, where the firm holds the private keys as agent and controls the assets. Type 2 is outsourced custody, where the firm stays wholly responsible but a third-party custodian holds the assets. Type 3 is self-custody, where clients hold their own keys and the firm never has partial or full control. Paragraph 149 says Types 1 and 2 would generally be regarded as Providing Custody, which needs a Financial Services Permission. Paragraph 150 calls Type 3 potentially a material risk and requires full, upfront disclosure to clients that they are responsible for safeguarding.

For custodians, paragraph 146 applies the COBS Chapter 15 safe custody rules, read with COBS 17.8, and COBS Chapter 16. Paragraph 147 sets the cadence: statements to Retail Clients at least monthly and reconciliations of client Virtual Asset holdings at least weekly. Paragraphs 153 to 155 prohibit any arrangement in which a sole party or signatory can completely authorise the movement of client assets, require controls against collusion among signatories, and require a maintained list of everyone past and present who could view, initiate, approve or complete a transfer.

None of the three types describes client assets sitting in a protocol. Where client Virtual Assets are deployed into a pool that issues receipt tokens, the firm ends up holding the receipt token or a claim recorded in contract state, while the original asset sits in a pool that no signatory controls. Two questions follow: does the safe custody analysis attach to the original asset, the receipt token or both, and can a weekly reconciliation be performed against on-chain state with the same assurance as against a firm-controlled wallet? A footnote to paragraph 148 leaves room for this: the FSRA recognises that other custody models may exist or emerge, and it encourages firms unsure of their obligations to contact it as early as possible.

Staking client Virtual Assets already has its own Rules. The FSRA announced the finalisation of its Virtual Asset staking framework on 29 April 2026. The detailed permission conditions, disclosures and Staking Service Provider obligations should be assessed against the applicable consolidated COBS rules, including section 17.10 (read here in COBS VER24.160926, September 2026). Under Rule 17.10.2, a firm may stake client Virtual Assets only where it has advised the FSRA of its intention and provided any further information the FSRA reasonably requests, the assets are Accepted Virtual Assets, and the Rewards consist only of Accepted Virtual Assets or Accepted Fiat-Referenced Tokens. Rule 17.10.3 adds a permission test: staking on the client’s instructions needs a Financial Services Permission for Managing Assets or Providing Custody, and staking at the firm’s discretion needs Managing Assets.

Before staking, Rule 17.10.4 requires the firm to give the client the key terms, including any period during which the assets may not be withdrawn and how to request withdrawal, and to disclose the risks, among them slashing and any inability or delay in withdrawing. Rule 17.10.7 requires the firm, before staking through a Staking Service Provider, to carry out due diligence on the provider and to enter into a written agreement that obliges the provider to inform the firm without delay of any incident or breach adversely affecting the staked assets, including protocol-level risks, upgrade schedules and governance votes that could affect withdrawals. Guidance to that Rule says the FSRA would expect the due diligence to examine the provider’s past performance on runtime, downtime, slashing and withdrawal queues or delays.

Section 17.10 is narrower than a DeFi inventory. Rule 17.10.1 applies it to an Authorised Person staking Virtual Assets belonging to its Clients, and the announcement describes the framework in the same client terms, so a firm staking its own assets sits outside the section’s stated application. The announcement adds that the final framework was extended to staking models other than proof of stake that have materially similar characteristics, so whether a particular protocol deployment falls within the Staking definition is a check to run line by line.

Section 17.10’s Rules cover conditions, key terms, risk disclosures, ongoing client information and Staking Service Provider terms, including a provider agreement that acknowledges the staked assets are not the provider’s property (Rule 17.10.7); none of them sets a custody type or a reconciliation method. Section 17.10 contains no disapplication of COBS Chapter 15, which applies, subject to the Fund Manager exclusion in Rule 15.1.2, to an Authorised Person holding or controlling Safe Custody Assets (Rule 15.1.1), or of the custodian Rules in COBS 17.8. Where a firm holds, controls or Provides Custody for staked client assets, the custody-type and weekly reconciliation questions set out above therefore remain open.

The 2022 Discussion Paper added a point about staking that still matters for client communications. The FSRA said staking would not be treated like deposits under its framework because Virtual Assets are not Money, and that no systemic depositor protections exist for staking. On insurance, paragraph 129 of the current guidance does not require cover, though the FSRA recommends that Virtual Asset brokers, dealers and custodians take out asset protection policies covering at least hot wallets.

Protocol due diligence and the outsourcing analogy

The Accepted Virtual Asset criteria already contain much of what protocol due diligence needs. The security criterion in paragraph 33 expects that smart contracts behind a Virtual Asset have had an independent security review by a non-conflicted person with adequate scope and coverage. It also points to bug bounty programmes, past security incidents, the development team’s track record, the level of active developer maintenance and the speed and quality of response to exploited vulnerabilities. The DLT infrastructure criterion asks firms to assess cross-chain bridges and interoperability protocols for vulnerabilities and single points of failure, and it flags wrapped tokens, bridge-based tokens and liquid staking assets as sources of further risk.

Paragraph 35 adds a disclosure detail: the website list of Accepted Virtual Assets that each firm maintains should show the network each asset operates on and, where applicable, its smart contract addresses. Paragraph 34 requires the assessment notification to reach the FSRA no later than five Business Days before the firm uses the asset.

The criteria reach venues through exchange connectivity, which asks whether exchanges support the asset, in which jurisdictions, and whether those exchanges are suitably regulated (paragraph 31(d)), and through the DLT infrastructure guidance in paragraph 33, which asks firms to consider the asset’s role in lending markets; none of them calls for an assessment of each protocol into which a firm deploys the asset. The 2022 Discussion Paper offered an analogy for that gap. At paragraph 38 it said a firm using a protocol that relies on other protocols might not need a permission for each one, because the activity is effectively outsourced to them, and that the firm would need to consider whether those protocols are robust and secure enough for it to meet its own obligations. Under the current guidance, outsourcing leaves the firm with full regulatory responsibility, including for a third party’s failure (paragraph 87, citing GEN 3.3.31), and paragraph 88 requires the firm to satisfy itself that a provider maintains adequate testing and security processes.

The outsourcing toolkit assumes a counterparty that can be assessed, contracted and held to service levels; paragraph 90, for example, expects cloud service agreements to be reviewed annually. A permissionless protocol offers code, governance arrangements and administration keys in place of a contract. The 2022 paper identified control over administration keys as one of the factors in deciding who a DeFi controller is. Whether Consultation Paper No. 5 adopts the outsourcing analogy, and what it expects in place of a service agreement, is among the first things to read in its text.

The EU comparison: ESMA’s proposed gateway service

The same question is moving in the EU, through a different legal route. In its 30 September 2026 response to the European Commission’s consultation on the review of the Markets in Crypto-Assets Regulation (MiCA), reference ESMA75-113276571-1721, ESMA said it had observed business models in which authorised crypto-asset service providers help clients access DeFi products or protocols, including decentralised exchanges, lending and borrowing protocols, staking and re-staking, liquidity provision and yield strategies, or provide an interface to unregulated smart contracts. ESMA proposed a new regulated “gatekeeper” service for that access, adding that the Regulation could clarify that a provider in that role should be subject to appropriate obligations, including disclosure of DeFi protocol risks, transparency on protocol selection and routing, conflicts of interest, due diligence on the protocols made available, and operational and cybersecurity safeguards, and said the new obligations should remain proportionate to the level of control the provider exercises over the protocol.

Two differences matter for a group with entities in both places. ESMA’s route would add a new service at Level 1, and it is a proposal to the Commission with no legal effect today. The ADGM route, on the announcement’s description, is guidance on how regulated entities govern and control their DeFi engagements, with a comment deadline already set. The overlap in substance is real but partial: due diligence appears on both lists, while ESMA’s risk disclosure, routing transparency, conflicts of interest and operational safeguards are not among the ten areas the ADGM announcement names. A group policy can share the analysis while keeping the legal mapping separate for each regulator. Our article on ESMA’s MiCA review response sets out the rest of ESMA’s proposals.

What a consultation response can usefully raise

The announcement asks for written comments to fsra.consultation@adgm.com by 30 November 2026. For the 2022 Discussion Paper, the FSRA asked respondents to put the paper number in the email subject line and to identify the organisation they represented, and it said it did not intend to publish comments. The instructions in Consultation Paper No. 5 itself govern this round; the announcement does not repeat them.

Based on the existing framework, five points look worth testing against the consultation text, and worth raising where the text leaves them open:

• How the new guidance relates to paragraphs 124 and 125 of the Virtual Asset Guidance, including the restriction on using liquidity, pricing and settlement data from unknown-counterparty venues.
• What counts as engagement: direct deployment only, or also indirect exposure such as routing through aggregators and holding wrapped, bridged or liquid staking assets.
• Which AML Rule 10.3 path applies when a transfer goes to a contract address.
• How client asset rules, including the paragraph 148 custody types and the weekly reconciliation, apply when client Virtual Assets sit in a protocol.
• Proportionality for Recognised Bodies and for Authorised Persons outside COBS 17.

Responses that cite the paragraph or Rule behind each point give the FSRA something it can act on, and they double as the firm’s own gap record.

Frequently Asked Questions

Does 30 November 2026 start an implementation clock?

The date closes the comment window only. The guidance is proposed, and the announcement gives no finalisation or application date. Any transition period would appear in the final guidance or its feedback statement.

An execution aggregator routed a client order through a decentralised exchange without our instruction. Does paragraph 124 still apply?

On the current wording, yes, where the counterparty on that exchange is unknown or anonymous, which is the condition paragraph 124 sets. That paragraph covers interaction at any stage of the process, and paragraph 125 says any interaction with such entities, whether deliberate or not, should be notified to the FSRA as soon as practicable. Routing configuration and post-trade checks are the controls that would surface the event.

Does the USD 1,000 threshold in the travel rule exempt small transfers into DeFi?

The relief is narrower than it looks. Rule 10.3.4(2) removes the duty to verify relevant transfer information where the originator’s daily aggregated transfers are below USD 1,000 and none is suspicious. The duty to collect the information under Rule 10.3.4(1)(a) remains, and the Enhanced CDD requirement for unhosted wallet transfers in Rule 10.3.6 carries no value threshold in the text checked.

We hold a liquid staking token as an Accepted Virtual Asset but never deploy assets into protocols ourselves. Are we engaging with DeFi?

The announcement does not define engagement, so the consultation text decides. Under the current framework the protocol risk behind that token already belongs in the Accepted Virtual Asset assessment, where paragraph 33 flags liquid staking assets as a possible single point of failure, and in the continuous monitoring paragraph 36 requires.

Can an ADGM entity rely on an EU affiliate’s due diligence on a protocol?

Group work can feed the file, but responsibility stays local. Accepted Virtual Asset status is specific to the firm that made the assessment (paragraph 31), and outsourcing leaves the ADGM firm fully responsible (paragraph 87). ESMA’s gateway service is still a proposal, so its due diligence obligations do not yet bind the EU affiliate either.

Is a protocol built around privacy features usable at all?

The prohibition attaches to assets. Section 5A(4) of the Financial Services and Markets Regulations 2015, cited in the Virtual Asset Guidance, prohibits Regulated Activities involving the issue, sale, purchase, transfer or custody of privacy tokens or any digital asset employing similar technology, and paragraph 33 says Virtual Assets that enforce non-traceability by default should not be offered to clients. Interaction with mixing services is treated through the AML indicator process, which expects firms to define what happens when a mixer or tumbler indicator triggers.

Will our comment letter be published?

The announcement is silent. For the 2022 Discussion Paper the FSRA said it did not intend to publish comments and would seek consent if that changed. The instructions in Consultation Paper No. 5 are the place to confirm the position before a letter includes commercially sensitive detail.

Related Articles

• FATF DeFi Report: When Control Brings a DeFi Arrangement Within the FATF Standards: the FATF’s July 2026 report on DeFi and the control test, with the actions it implies for AML and compliance teams.
• ESMA MiCA Review Response: What CASPs and Token Issuers Should Map: ESMA’s proposals for the MiCA review, including the DeFi gateway service.
• FATF Travel Rule Implementation: The Enforcement Gap: the FATF’s seventh update on how jurisdictions implement and enforce the travel rule for VASPs.
• FATF Stablecoins and Unhosted Wallets: AML/CFT: the financial-crime expectations that attach to stablecoin transfers and peer-to-peer activity through unhosted wallets.
• FinCEN CVC Mixing Withdrawal: Mixer and Wallet Proposals Dropped: FinCEN’s 6 October 2026 withdrawal of its mixer and unhosted wallet proposals, for groups comparing regimes.

Key Takeaways

• Two FSRA deadlines fall close together: 6 November 2026 for the Fees and General Rulebooks paper, 30 November 2026 for the DeFi paper.
• Until final guidance appears, paragraphs 124 and 125 of the June 2025 Virtual Asset Guidance remain the operative text, including the line on liquidity, pricing and settlement data from venues where the counterparty is unknown or anonymous, such as certain DEXs.
• The announcement addresses Authorised Persons and Recognised Bodies, a wider population than the firms COBS 17 reaches, and the consultation text has to settle which paragraphs apply to each category.
• An Accepted Virtual Asset assessment is specific to the token and to the firm that made it (paragraph 31), so whether each protocol, exchange pool or bridge in use needs its own assessment is a question the consultation text has to answer.
• Where the firm is the originating institution, Rule 10.3.4(6) bars a transfer it cannot comply with, so the travel rule path for contract-address transfers is a decision to document before the next deployment.
• Client assets placed in a protocol raise a weekly reconciliation question under COBS 17.8.3, and the guidance invites firms unsure of a custody model to contact the FSRA early.
• Lines that stake client Virtual Assets map to COBS 17.10 for conditions, client disclosures and Staking Service Provider terms, but that section sets no custody-type or reconciliation rule, and staking house assets sits outside its stated application.

Sources and References

• ADGM FSRA, “ADGM FSRA Invites Industry Feedback on Proposed DeFi Risk Management Guidance” (6 October 2026): ADGM announcement
• ADGM FSRA, Consultation Paper No. 5 of 2026, DeFi Risk Management Guidance (ADGM rulebook site): Consultation Paper No. 5 of 2026
• ADGM, Public Consultations (listing for Consultation Papers No. 5 and No. 6 of 2026): ADGM public consultations
• ADGM FSRA, Guidance on Regulation of Virtual Asset Activities in ADGM (VER07.100625, updated 10 June 2025): Virtual Asset Guidance (PDF). GEN Rule 3.3, COBS Chapters 15 and 17 (other than COBS Rules 15.1.1 and 15.1.2 and the staking Rules in section 17.10, which were read in COBS VER24.160926, listed below) and section 5A(4) of the Financial Services and Markets Regulations 2015 are cited as set out in this Guidance.
• ADGM, Guidance and policy statements (listing with publication and update dates): ADGM guidance and policy statements
• ADGM FSRA, “ADGM FSRA Finalises Regulatory Framework for the Staking of Virtual Assets” (29 April 2026): ADGM staking announcement
• ADGM FSRA, FSRA Rules (Staking) (29 April 2026), with the staking Rules consolidated in section 17.10 of the Conduct of Business Rulebook (COBS VER24.160926), ADGM rulebook site: FSRA Rules (Staking)
• ADGM FSRA, Anti-Money Laundering and Sanctions Rules and Guidance (VER11.210526), Rules 4.4, 4.5, 10.3 and 10.4: AML Rulebook (PDF)
• ADGM FSRA, Discussion Paper No. 1 of 2022, Policy Considerations for Decentralised Finance (13 April 2022): Discussion Paper No. 1 of 2022 (PDF)
• ADGM FSRA, “FSRA issues discussion paper on Decentralised Finance (DeFi)” (13 April 2022): ADGM announcement
• ESMA, Response to the European Commission’s consultation on the review of the MiCA Regulation, ESMA75-113276571-1721 (30 September 2026): ESMA response (PDF)

Before 30 November 2026: inventory first, comment letter second

The useful preparation is an inventory sorted into three groups: direct deployments of house or client assets into protocols; indirect dependencies such as aggregator routing and DEX-sourced price, liquidity or settlement data; and assets on the Accepted Virtual Asset list whose risk comes from a protocol, such as wrapped, bridged or liquid staking tokens. Each line then gets an owner against the ten areas in the table above, and the places where a line conflicts with paragraphs 124 and 125 or with the AML Rule 10.3 workflow become the substance of the comment letter.

The inventory is the artifact to finish first. The comment letter goes to fsra.consultation@adgm.com, citing Consultation Paper No. 5 of 2026, by 30 November 2026.

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.