ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) 15.2: Participate securely in decentralised infrastructure: an approved governance framework, due diligence and ongoing oversight, criminal-use safeguards, monitoring and tracing, regulatory-safe data, AML and sanctions screening, segregated and patched components, governed voting, exit readiness, continuity, programmable contract and digital wallet security

What does 15.2 require?

A governing framework approved by senior management and the Governing Body ensures all participation follows defined principles and development policies and covers participation and monitoring of solutions built or connected to. Before connecting assets the institution performs due diligence on governance (consensus, finality, fees, forking, governance tokens, smart contract control), technical specifications, components such as tokens, nodes, oracles and cross-chain interoperability, and track record, and keeps ongoing oversight; its own solutions bar anonymous participation and other facilitation of crime; tools monitor network status and trace its published activities; data written to the network breaches no regulatory obligation with sensitive data encrypted or hashed; digital asset transfers are traced and screened against anti-money laundering and sanctions requirements with findings addressed; components operated outside core business run on resources separate from the business IT environment, securely configured and promptly updated; competent personnel decide on network votes through an internal function or forum with management approval; the network is monitored so that when participation becomes untenable for technical, legal or regulatory reasons remaining assets are extracted or liquidated safely and resources securely disconnected; continuity procedures recognise that failure of individual components may not disrupt the network; and participation is included in cyber event monitoring. Programmable contracts published for transaction automation follow secure development with robust pre-publication testing, and third-party contracts and the contracts they call receive due diligence on code integrity, security and alignment to intended outcomes, repeated after updates. Self-administered digital wallets follow policies on how keys and wallets are generated, accessed, used, revoked, recovered and destroyed under key lifecycle management, seed phrases are stored securely with secure backups, third-party wallet services receive due diligence and oversight with clarity on responsibilities and transaction control, controls such as velocity limits and MFA for wallet transfers counter automated wallet attacks, and cold wallets sit on secure hardware assigned to personnel, backed up and inventoried.