The instinct you bring from banking, that lending needs a credit desk, market-making needs a trading floor, and yield needs someone's balance sheet, is exactly the instinct DeFi (decentralised finance) was built to make redundant. DeFi is a set of financial functions, lending, exchange, asset issuance, reimplemented as smart-contract protocols on public blockchains and run without a firm in the middle. Nobody underwrites the borrower, nobody faces the client, and nobody picks up the phone when something breaks. The honest way to read the category is not "unregulated finance" but "finance where the counterparty has been replaced by code", which relocates the risk rather than removing it.
Finance as protocol, not firm
A DeFi protocol is a bundle of open-source smart contracts deployed to a public chain. Anyone with a wallet can interact with them, the contracts themselves hold the pooled assets, fees accrue according to rules written into the code, and rule changes happen by governance vote rather than management committee. There is no legal entity between the user and the pool, which is precisely the feature and precisely the problem. Where a bank's lending business is a balance sheet plus an underwriting function plus a legal person you can sue, a lending protocol is a pile of collateral governed by maths.
Part 3 covered the exchange function, and one recap sentence is enough: an AMM (automated market maker) replaces the order book with a pooled pot of two assets and a pricing formula, with the liquidity providers who stocked the pool earning the trading fees. That same move, replace the intermediary's function with a pool plus a formula, is the design pattern for everything else in DeFi.
Lending without a credit desk
Aave, the largest lending protocol, is the worked example. A depositor supplies a stablecoin such as USDC to a shared pool and earns a floating rate that moves with utilisation. A borrower posts collateral, say ETH, worth comfortably more than the loan, and can draw down only up to a set LTV (loan-to-value) ratio. If the collateral's value falls enough to breach the liquidation threshold, any third party can repay a slice of the debt and seize the corresponding collateral at a discount, and bots compete to do so within seconds.
Notice what is missing: any assessment of the borrower. There is no credit underwriting because the collateral is the underwriting. The protocol never learns who the borrower is because it does not need to; the loan is default-remote by construction rather than by covenant. The costs of that construction are real: no unsecured credit, no term structure, no relationship pricing, and poor capital efficiency, since every dollar borrowed is more than a dollar locked. In exchange you get a lending book that has survived repeated 50 per cent collateral drawdowns without a workout desk, because the workout is automatic and permissionless.
Staking, and crypto's idea of a reference rate
Staking is the yield on securing a PoS (proof-of-stake) chain, covered in Part 1: validators lock ETH, propose and attest blocks, and earn protocol issuance plus a share of transaction fees. Liquid staking removes the lock-up problem. A protocol such as Lido takes ETH deposits, runs the validator infrastructure, and issues stETH, a transferable token representing the staked position plus its accruing rewards, so the holder keeps earning the staking yield while remaining free to sell the token or post it as collateral in Aave, which is why stETH became one of DeFi's most widely used collateral assets.
The ETH staking rate gets treated as crypto's reference rate, the nearest thing the ecosystem has to a risk-free benchmark, and the analogy deserves honest caveats. The rate is not risk-free (validator slashing, smart-contract risk in the liquid-staking layer, and stETH trading below ETH in stressed markets), and it is denominated in ETH rather than in any fiat currency, so it benchmarks ETH-denominated capital and is nothing like SOFR (the secured overnight financing rate) for a treasury desk.
TVL, read sceptically
TVL (total value locked) is the headline size metric, the market value of assets deposited in a protocol's contracts, aggregated by trackers such as DefiLlama. Read it the way you would read a metric invented by the people it flatters. TVL is price-driven, so a rally in ETH inflates every ETH-heavy protocol's TVL with no new deposits at all. It double counts recursive positions, since stETH minted by Lido and then deposited into Aave shows up in both protocols' figures. And it is inflated by mercenary capital that arrives for token incentives and leaves the week they end. TVL is a decent ranking device and a poor measure of durable economic activity; fees and revenue are the harder numbers.
The risk surface, and the institutional frontier
The risks a bank should price are not the familiar ones. In place of counterparty credit risk sit three technical exposures. Smart-contract risk: the code holding the pool has a bug and the pool is drained. Oracle risk: the price feed used to value collateral is stale or manipulated, triggering wrongful liquidations or letting an attacker borrow real assets against a fictional price. And bridge risk, historically the worst of the three: the March 2022 Ronin bridge exploit drained assets reported at over $600 million and the February 2022 Wormhole exploit minted roughly $320 million of unbacked wrapped ether, both from infrastructure that moves assets between chains.
The frontier worth watching is institutional DeFi, the same rails with a permission layer. In August 2025 Aave Labs launched Horizon, a market where qualified institutions borrow stablecoins against tokenised collateral, including tokenised MMF (money-market fund) shares, with Circle and Securitize among the launch ecosystem. Tokenised fund shares posted as live collateral on a DeFi rail is the concrete bridge between the two worlds. The desk-level takeaway travels well: DeFi is counterparty-free but not risk-free, and the risk sits in the code and the oracle rather than on anyone's balance sheet, so the diligence artefact is an audit report and an oracle-dependency map, not a credit memo.