DeFi: what is decentralized finance

You connect a digital wallet to a website, deposit crypto-assets into a program and, minutes later, receive another token on loan or in exchange. There was no sign-up, no account manager and no credit check. That is the typical scenario of so-called decentralized finance, or DeFi.

This article explains what the term means, how the most common services work, who actually controls these systems and which risks show up most often. The regulatory information was checked on October 8, 2026.

What is called DeFi

There is no official definition. IOSCO, the international organization that brings together capital markets regulators, notes that there is no generally accepted definition of DeFi, not even among industry participants (IOSCO, 2023).

Broadly, DeFi refers to financial products and services that use blockchain and smart contracts, programs recorded on the blockchain that execute rules automatically when certain conditions are met. How these programs work is explained in What are smart contracts and how do they work.

The official website of Ethereum, the network where many of these services were born, describes DeFi as an open financial system that anyone with an internet connection can use, and states that most products do not take custody of your funds (ethereum.org). That is the view of those promoting the technology. Regulators, as you will see below, raise important caveats.

To review the basics, see What is Ethereum and how does it work.

The most common services

IOSCO groups the most used DeFi protocols into three types: exchanges, lending and aggregators. A protocol, here, is the set of smart contracts that delivers a service.

Decentralized exchanges

A decentralized exchange (DEX) lets you swap one crypto-asset for another. The most widespread model does not use an order book. Instead, it uses an automated market maker (AMM): a contract that holds reserves of two tokens, called a liquidity pool.

On Uniswap, one protocol of this kind, the price comes from a formula: the product of the two reserves must stay constant or increase with each trade. Traders interact directly with the pool, not with another person’s order. A trade that is large relative to the pool’s size moves the price more (Uniswap, documentation).

Those who deposit both tokens into the pool are called liquidity providers and receive part of the fees. According to IOSCO, these systems rely heavily on arbitrageurs, usually bots, who buy and sell until the pool price moves close to the market price (IOSCO, 2023).

The comparison between this model and traditional exchanges is in Centralized vs. decentralized exchanges.

Collateralized lending

In lending protocols, people holding crypto-assets, often stablecoins, deposit them into a pool and start earning variable interest. Other people borrow from that same pool.

Since there is no credit check, protection comes from collateral. IOSCO describes that loans usually require overcollateralization: you post collateral worth more than you borrow. If the value of the collateral falls below a certain threshold, it can be liquidated, with a penalty, to repay the debt (IOSCO, 2023). The Ethereum website sums up the same logic: the lender automatically receives the collateral if the loan is not repaid (ethereum.org).

In practice, this means a sharp price drop can make you lose your collateral automatically, without warning and without negotiation.

Aggregators and stablecoins

Aggregators are services that scan several protocols for the best price or the highest yield and route your transaction. Each layer may charge an additional fee.

Stablecoins work as the currency of this ecosystem. The Bank for International Settlements (BIS) identifies protocols and stablecoins as the two pillars of DeFi (BIS, 2021). How they hold (or fail to hold) their value is covered in What are stablecoins and how do they keep their value.

How decentralized DeFi really is

This is the point regulators stress most. IOSCO lists two perceptions it considers mistaken: that DeFi products are very different from traditional ones, and that they operate fully automatically, without people. According to the report, the code is created, deployed, operated and maintained by humans, and the smart contract is often just one part of a service that also depends on websites, apps and conventional infrastructure (IOSCO, 2023).

Protocol parameters, such as fees and collateral limits, can generally be changed by developers, the project team or a vote by the holders of a governance token, often organized in a DAO (decentralized autonomous organization).

The BIS calls this the “decentralisation illusion.” The argument is that no code anticipates every situation, so someone has to decide. And governance tokens tend to concentrate in a few hands, frequently those of the developers themselves and early investors (BIS, 2021).

For you, the practical consequence is simple: trusting a DeFi protocol means trusting the code and also the people who can change it.

The risks you take on

The Financial Stability Board (FSB), which coordinates G20 regulators, concluded that DeFi does not differ substantially from traditional finance in the functions it performs, and that it inherits and can amplify the same vulnerabilities: leverage, liquidity mismatch, operational problems and interconnectedness among participants (FSB, 2023). From the user’s point of view, these are the main risks.

• Code flaws and exploits. ethereum.org itself acknowledges that these products, like any software, can have bugs and be exploited. IOSCO cites vulnerabilities in contracts, governance mechanisms, oracles (the services that bring external data to the blockchain) and bridges between blockchains.
• Collateral liquidation. In loans, rapid price drops can trigger the automatic sale of your collateral.
• Leverage and cascade effects. The BIS observes that chains of forced sales push prices down and that DeFi has no shock absorbers, such as a central bank or deposit insurance (BIS, 2021).
• Stablecoin dependence. If a stablecoin loses its peg, the protocols that use it feel the impact. IOSCO records that the collapse of TerraUSD in 2022 caused outflows in the billions from applications linked to it.
• Opacity. The code is public, but it is in machine format, does not always match the published description and can be changed by whoever controls the protocol, according to IOSCO.
• No one to turn to. There is no guarantee fund, and often no identifiable company responsible for the service.

There is also the risk of fraud: fake websites that imitate protocols and ask you to “approve” your wallet. Learn how to spot them in Crypto wallet phishing: how to protect yourself and Crypto scams: how to spot and report them. And, as with any crypto-asset, the value of what you deposit can fall to zero.

How DeFi appears in regulation

The international approach is to treat the activity by its substance. In December 2023, IOSCO published nine recommendations for DeFi, based on the principle “same activity, same risk, same regulation.” The report states that applicable rules apply regardless of claims of decentralization and recommends that regulators identify the people responsible for each arrangement (IOSCO, 2023).

In Brazil, Law 14,478/2022 regulates the virtual asset service provider: the legal entity that performs, on behalf of others, services such as exchange, transfer and custody of crypto-assets, and that can only operate with prior authorization (Lei 14.478/2022). The law does not expressly address DeFi protocols.

BCB Resolution 520, issued by the Banco Central do Brasil (Brazil’s central bank) and in force since February 2, 2026, mentions the segment once: it requires providers to take measures to reduce cyber incidents, “in particular in operations involving operators in the decentralized finance segment” (art. 48, III). The same rule requires that, if the client opts for self-custody, the provider explain the risks and the necessary security measures (art. 57, § 2) (Resolução BCB 520).

In the editorial team’s assessment, this means that when you use a DeFi protocol directly, you generally fall outside the protection the rules give to clients of authorized exchanges, such as the separation between your assets and the company’s. When the CVM (Brazil’s securities regulator) steps in, and the role of each body, is covered in Crypto regulation in Brazil: who oversees what.

Key takeaways

• DeFi is a label for financial services executed by smart contracts; swaps and collateralized loans are the most common.
• “Decentralized” rarely means “ownerless”: there are people who write, maintain and can change the code.
• DeFi users take on code, liquidation, stablecoin and market risks, generally with no nearby regulator, no guarantee fund and a real chance of total loss.