FCA DeFi Guidance Consultation Outlines Existing Rules for Operational Resilience and AML

The UK Financial Conduct Authority published Guidance Consultation GC26/7 on 21 October 2026 to explain how existing rules apply when firms provide services through decentralised finance protocols. The document addresses operational resilience under SYSC 15A, compliance and financial crime controls under SYSC 6, and obligations under the Money Laundering Regulations. It does not introduce new requirements.

FCA DeFi Guidance Details on Resilience and Compliance

GC26/7 defines DeFi as financial services such as trading or lending delivered through distributed ledger technology, smart contracts and high levels of automation, often without a traditional intermediary. The guidance stresses that labels or technology features alone do not determine regulatory status. Firms must assess whether an identifiable controlling entity exists and apply the same standards that govern centralised activities.

The consultation also covers internal audit functions, risk management frameworks and customer due diligence procedures when firms interact with decentralised protocols. Cumulative losses from DeFi and bridge exploits have exceeded US$12 billion since 2016, according to data cited in the document. Between January and August 2026, decentralised exchanges accounted for 14 to 19 percent of global crypto spot trading volume.

Alongside GC26/7, the FCA released CP26/36 on cryptoasset perimeter guidance. That paper clarifies legislative exclusions for temporary settlement activities, certain stablecoin holdings for payments, and technical services that merely provide access to third-party or decentralised protocols.

UK Crypto Regulation Timeline and Industry Context

The new UK cryptoasset regime, which creates additional regulated activities, takes effect on 25 October 2027. Authorisation applications opened on 30 September 2026 and must be submitted by 28 February 2027. GC26/7 is intended to help firms prepare for these obligations by mapping current Handbook rules onto decentralised business models.

Approximately 8 percent of UK crypto users acquired assets through decentralised exchanges in 2025. The FCA states that responsibility for compliance remains with the firm regardless of claims about decentralised governance or smart-contract execution. Case-by-case analysis will continue to focus on substance rather than form.

The UK Cryptoasset Business Council welcomed the consultation and called for clear, proportionate perimeter rules that support responsible innovation. Feedback on GC26/7 must be submitted by 18 November 2026. The FCA plans to publish final non-Handbook guidance in the first quarter of 2027.

Next Steps for Firms Assessing DeFi Activities

Regulated firms and those seeking authorisation should map their specific DeFi-related services against SYSC 15A operational resilience requirements and MLR customer due diligence obligations. They must also review the perimeter clarifications set out in CP26/36 to determine whether any activities fall outside the new regulated activities.

Early assessment allows firms to adjust governance, audit and financial crime controls before the 2027 authorisation deadline. The FCA has indicated it will continue to evaluate activities on a case-by-case basis where an identifiable entity exercises control.