The European Central Bank published a working paper assessing decentralised finance (DeFi) governance arrangements to inform how DeFi could be regulated and supervised. Analysing four major protocols, it finds that governance power is heavily concentrated and that key actors behind token holdings and voting are frequently difficult to identify using public data, limiting the practicality of commonly cited regulatory “anchor points” such as governance token holders, developers or centralised exchanges. Using a hand-collected dataset for Aave, MakerDAO, Ampleforth and Uniswap across November 2022 and May 2023, the paper reports that the top 100 holders account for over 80% of governance token holdings for each protocol, with concentration broadly stable over time. For some protocols, around half or more of holdings are linked to the protocols themselves or to centralised and decentralised exchanges, but available data cannot pin down whether protocol-linked holdings sit with founders, developers or treasuries, and cannot distinguish exchange proprietary holdings from customer holdings. On voting, top voters are mostly delegates and around one third of top voters could not be identified; delegation also concentrates influence, with the top voters controlling 96% of delegated voting power in Ampleforth, 66% in MakerDAO and 52% in Uniswap. The proposal sample is dominated by “risk parameter” (28%) and “asset listing” (23%) decisions, indicating that concentrated governance can shape key risk settings and protocol scope.