What is DeFi? Decentralized finance explained, with the risks regulators see

In traditional finance, a bank or broker sits in the middle of every transaction. DeFi, short for decentralized finance, tries to replace that middleman with software running on a blockchain. You connect your own wallet, and code executes the trade, the loan or the deposit.

This guide explains what DeFi is, using Ethereum’s documentation, and what can go wrong, using a 2023 report by the Financial Stability Board (FSB), the international body that monitors risks to the global financial system.

What DeFi is

ethereum.org describes DeFi as a collective term for financial products and services that are accessible to anyone who can use Ethereum: anyone with an internet connection. Most DeFi runs on Ethereum and similar blockchains, built from smart contracts.

The key difference from an exchange account: you keep control of your assets in your own wallet, and you interact with the smart contract directly. Nobody approves you, and nobody can freeze your account, but nobody can reverse your mistakes either.

What people use it for

According to ethereum.org, the main uses are:

• Trading: decentralized exchanges let you swap tokens from your wallet. See CEX vs DEX.
• Lending and borrowing: lend crypto to earn interest, or borrow by depositing collateral.
• Stablecoins: tokens designed to hold a steady value, often used as the “cash” of DeFi. See stablecoins explained.
• Savings and investing products: pooled strategies that try to earn a return.
• Payments: sending value worldwide, sometimes streamed continuously.

How a decentralized exchange works

Most decentralized exchanges don’t match buyers with sellers the way a stock exchange does. The US Treasury’s 2023 DeFi risk assessment describes the common model:

1. Liquidity providers deposit tokens into a liquidity pool, a smart contract the exchange draws on for trades.
2. In return, they usually get a liquidity provider (LP) token, which entitles them to their share of the pool, including the fees it earns.
3. Traders swap one token for another against the pool. The exchange rate is typically set by an algorithm, not by an order book.
4. Traders pay a fee, which is shared with the LP token holders.

That’s where some DeFi “yield” comes from: trading fees paid into pools. See CEX vs DEX.

How a DeFi loan works (simplified)

1. You deposit crypto, for example ETH, into a lending protocol as collateral.
2. You borrow a smaller value of another token, often a stablecoin. Loans are usually over-collateralized: you lock up more than you borrow.
3. If the value of your collateral falls too far, the protocol liquidates it automatically, selling some or all of it to repay the loan, usually with a penalty.

There are no credit checks because the collateral does the job. The trade-off is that a sharp price drop can liquidate you within minutes, at any hour.

Flash loans: borrowing for a single transaction

DeFi also allows something with no equivalent in banking. ethereum.org describes flash loans as an experimental form of lending that lets you borrow without collateral, on condition that the loan is taken out and repaid within the same transaction. If it can’t be repaid, the whole transaction reverts as if nothing had happened.

Its example is an arbitrage trade, all inside one transaction:

1. Borrow an amount of a token priced at $1.00 on exchange A.
2. Sell it on exchange B for $1.10.
3. Repay the loan to exchange A.
4. Keep the profit, minus transaction fees.

The same tool can be used for harm. The US Treasury describes flash loan attacks, in which an attacker uses the temporary surge of borrowed funds to manipulate prices across several DeFi services, or even to take over a protocol’s governance, change its code and drain its treasury, all in a very short time. See blockchain oracles explained.

DeFi vs a centralized exchange vs a bank

The FDIC is clear that deposit insurance doesn’t apply to crypto assets and doesn’t protect against the failure of non-bank crypto companies.

The risks, according to the Financial Stability Board

The FSB’s February 2023 report found that DeFi “inherits vulnerabilities” of traditional finance and may amplify them. It highlights:

• Operational fragilities: governance frameworks that are unclear, opaque, untested or easy to manipulate, with very different real degrees of decentralization; dependence on blockchains that can become congested; and oracles (price feeds) and cross-chain bridges that can expose users to disruptions and thefts.
• Coding errors in smart contracts, made worse by the fact that DeFi transactions are hard to reverse.
• Interconnections: protocols built on top of each other (“composability”), activity concentrated in a few protocols, and exposure to centralized platforms.
• Market integrity issues, including evading existing regulation.
• Unsustainable business models that rely on continuous inflows of new money to pay early users.

How decentralized is DeFi?

The name suggests no one is in charge, but reality varies. The US Treasury’s April 2023 illicit finance risk assessment found:

• There’s no generally accepted definition of DeFi.
• Whether a service is really decentralized is a matter of facts and circumstances, and DeFi services often have a controlling organization that provides a measure of centralized administration and governance.
• Many protocols are governed through governance tokens, whose holders can introduce and vote on proposals. Their powers vary widely: in some protocols they can vote to change the smart contracts, in others only on narrower matters such as fees.
• Criminals, including ransomware gangs, thieves, scammers and North Korean hackers, use DeFi services to move and launder stolen funds, often taking advantage of services that don’t follow anti-money-laundering rules.

For how token-holder governance works, see what is a DAO?

Everyday risks for users

Beyond the system-level risks, individual users mostly lose money through:

• Malicious approvals. ethereum.org warns not to allow unlimited spend limits, because an unlimited approval could let a smart contract drain your wallet. Revoke approvals you no longer need.
• Fake apps and airdrops. Copycat websites and “claim your airdrop” pages trick people into signing harmful transactions. See fake crypto apps and phishing and crypto airdrops explained.
• Liquidations on borrowing positions in fast markets.
• Scam tokens that can’t be sold once bought.

Taxes still apply

Using DeFi doesn’t remove tax obligations. Swapping one token for another is a disposal in the US, the UK and Canada, and interest or rewards are generally income. DeFi activity is also harder to track, because there’s no exchange statement. Keep your own records from the start. See our tax guides.

Before you try DeFi

1. Start with a small amount you can afford to lose.
2. Use a separate wallet for DeFi, not the one holding your long-term savings. See hot vs cold wallets.
3. Type addresses yourself or use bookmarks; don’t click links from messages or ads.
4. Read every transaction before signing, and avoid unlimited approvals.
5. Prefer protocols with a long track record, and remember that even audited code can fail.