CeFi Vs DeFi: Who Controls Your Money And The Rules?

You want to exchange one crypto token for another. One app asks you to deposit tokens into a company account. Another asks you to connect a wallet and approve a transaction. The buttons may look similar, but what happens behind them is different.

Centralised finance, or CeFi, puts an organisation between you and the financial service. Decentralised finance, or DeFi, uses programs on a blockchain to carry out financial transactions. Those programs are called smart contracts. They follow rules written in code.

The difference is about who holds the assets, who can change the rules and whose systems you depend on. A DeFi label alone doesn't answer all three.

What does centralised finance mean?

Banks and brokers are familiar financial intermediaries: organisations that provide services between customers and markets. In crypto discussions, CeFi usually means centralised crypto businesses, such as exchanges and lending platforms. Traditional banks and brokers are often grouped separately as traditional finance, or TradFi.

A crypto exchange can use a blockchain to receive deposits while keeping customer trades in its own database. Using blockchain technology doesn't make the company decentralised.

With a custodial service, the provider holds the assets for you. You use an account to instruct it, rather than directly controlling the keys that authorise transactions. Our crypto wallet explainer covers that distinction in more detail.

Custody and an earn product can have different terms. An earn product may transfer ownership of deposited assets to the business so it can use them elsewhere. The Financial Stability Institute's research on crypto intermediaries describes that distinction. The product's terms matter as much as the company name.

What changes when you use DeFi?

DeFi covers financial applications such as token exchanges and lending services. You interact with contracts through a wallet, often using a website as the interface. The interface is the part you see. The contract is the program that carries out the transaction.

Return to the token swap. On a centralised exchange, the company records your trade and account balance. On a decentralised exchange, a contract can exchange tokens using a shared pool of assets supplied by other users. That pool provides liquidity, meaning assets available to trade. The BIS comparison of exchange designs explains how these pools replace a company's internal order matching in this model.

Connecting a wallet does not mean every token stays in it. A lending application may require you to transfer tokens into a contract. Aave's documentation, for example, says supplied tokens are held in publicly accessible smart contracts. What you can withdraw depends on the contract's rules and the assets available.

This is why “non-custodial” needs context. You may authorise the transaction yourself without handing a company your wallet keys, while still exposing the deposited assets to a program's behaviour.

What does borrowing look like?

Imagine you want to borrow some tokens while keeping an asset you already own. In a secured loan, you pledge an asset as collateral: something that can be used to cover the debt if the borrowing conditions are breached.

Aave provides one DeFi example. Borrowers supply approved collateral worth more than they borrow. The amount available depends on that collateral, the protocol's limits and whether enough tokens are available to lend. This describes that lending model, rather than every kind of DeFi loan.

If collateral loses enough value, or the debt grows through interest, the position can become eligible for liquidation. Someone else can repay debt and receive part of the borrower's collateral, including a bonus. The process follows the protocol's rules rather than waiting for a loan officer's decision.

Code carries out those rules, but it doesn't make the loan safe. Aave lists collateral and price data risks among its risks. A rapid price fall or an incorrect price feed can affect the assets supporting the loan.

Who can change a DeFi application?

Software still has people behind its design and administration. Some applications give particular accounts permission to upgrade contracts or pause operations. Others use governance, a process for deciding changes, which may give voting power to token holders.

Ethereum's smart contract security documentation explains both approaches and their risks. A stolen administrator key can give an attacker powerful permissions. Poorly designed token voting can also allow harmful proposals to pass.

Control over an application is separate from control over the blockchain beneath it. A network can have many independent operators while an application on it has a small group with upgrade powers. “Decentralised” is a question about the actual arrangement, not a guarantee that nobody can intervene.

How do the risks compare?

With crypto CeFi, you depend on the provider's custody arrangements and ability to meet its obligations. If a business lends customer assets and cannot recover them, it may be unable to return what customers expect. The Financial Stability Institute's 2026 paper identifies these credit and liquidity risks. Liquidity here means having assets available when customers request them.

With DeFi, errors in contract code, powerful administrator permissions and unreliable external data can put assets at risk. An oracle supplies information from outside the blockchain, such as a market price. A contract can follow its code correctly and still act on a bad price.

Both arrangements also expose you to the assets themselves losing value. Moving a token from a company account into a contract does not remove that risk.

The useful comparison is specific: who can move these assets, who can change these rules, and what has to keep working for the transaction to succeed?