DeFi (Decentralised Finance) is the set of financial services, such as trading, lending, borrowing and derivatives, that run as smart contracts on public blockchains instead of through a company holding customer funds. Users connect a self-custodied wallet, and contract code moves assets under rules anyone can read on-chain. Lending pools set rates from the ratio of borrowed to supplied funds and liquidate under-collateralised loans automatically, while trading runs through automated market makers. Losses from contract bugs, manipulated price oracles or governance attacks fall on users, with no insolvency estate behind them. MiCA excludes fully decentralised services, but a business running a front end or holding upgrade keys may still need CASP authorisation.
How does DeFi work
A DeFi protocol is a group of contracts deployed to a chain such as Ethereum. A lending protocol holds deposited tokens in a pool, lets borrowers draw from it against over-collateralised deposits, and sets interest rates automatically from the ratio of borrowed to supplied funds. If a borrower's collateral value falls below the liquidation threshold, anyone can repay part of the loan and buy the collateral at a discount, which keeps the pool solvent without a credit team.
Trading works through automated market makers. On Uniswap v2, each pool holds two tokens and enforces the formula x × y = k, so the price moves with every trade, and a 0.30% fee on each swap is added to the pool's reserves for liquidity providers. The same token can then be deposited elsewhere as collateral, which is why DeFi services are described as composable: one protocol's output is another's input.
DeFi vs CeFi
In CeFi, a company such as a centralised exchange or a crypto lender takes custody of client assets, runs KYC and can freeze or reverse transfers. In DeFi, no single party holds the keys to user funds, transactions settle on the chain itself, and there is usually no customer onboarding. The trade-off is that losses from a contract bug, a manipulated price oracle or a governance attack fall on users, with no insolvency estate or compensation scheme behind them.
Many projects sit in between. A protocol with an admin key that can pause contracts, a company running the only front end, or a foundation collecting fees has an identifiable operator, and regulators look at those control points.
Is DeFi regulated under MiCA
Recital 22 of the Markets in Crypto-Assets Regulation (EU) 2023/1114 states that where crypto-asset services are provided in a fully decentralised manner without any intermediary, they fall outside MiCA's scope. The test is factual: a business that runs a front end, holds upgrade keys or earns fees from a pool may still be treated as a crypto-asset service provider and need authorisation.
The US takes a similar functional approach. FinCEN's May 2019 guidance on convertible virtual currencies (FIN-2019-G001, section 4.4) says that when a decentralised application accepts and transmits value, the money transmitter definition applies to the application, its owners or operators, or both.
A worked example of DeFi risk
Take an illustrative lending pool holding $50 million of deposits, where ETH collateral must stay worth at least 125% of each loan. If the oracle feeding the ETH price is manipulated to report a price 30% too high for a few blocks, an attacker can borrow against inflated collateral and leave the pool with bad debt. Depositors bear the loss pro rata, since no capital requirement or guarantee fund stands behind the protocol.
For a buyer of a licensed crypto business, DeFi exposure shows up in diligence as treasury assets deployed into protocols, yield products offered to clients, and any front ends or admin keys the target controls. Each of these can change whether the business needs a VASP registration or CASP licence, and how its balance sheet should be valued.