DeFi and UK Regulation: What the FCA’s New Guidance Means for Crypto Businesses

A practical guide to FCA consultation GC26/7, operational resilience and financial crime risks

A customer opens a crypto wallet, connects to a decentralised protocol and stakes their tokens.

For the customer, the experience is simple. They click a few buttons, approve a transaction and expect to earn a return.

Behind the screen, however, several systems may be working together: the wallet interface, a blockchain network, smart contracts, a staking protocol, validator operators and perhaps a bridge connecting different blockchains.

Now suppose something goes wrong.

A vulnerability in the protocol is exploited. The blockchain experiences an outage. A compromised administrative key allows an attacker to change the protocol. Or the customer’s assets become inaccessible.

Who is responsible?

For a regulated firm that has designed, promoted or facilitated the service, the answer cannot simply be: “The protocol is decentralised.”

This is one of the central messages emerging from the UK Financial Conduct Authority’s consultation, GC26/7: Decentralised Finance (DeFi), published on 21 October 2026.

The consultation examines how firms using or interacting with DeFi should approach two major areas of regulatory concern: operational resilience and financial crime.

For crypto exchanges, wallet providers, staking businesses, financial institutions and other firms building services around DeFi, the paper provides an important insight into the FCA’s expectations.

What is the FCA’s DeFi consultation?

GC26/7 proposes non-Handbook guidance on how existing regulatory requirements may apply when firms provide financial services using DeFi.

The guidance is particularly relevant to firms subject to:

• SYSC 15A, the FCA’s operational resilience requirements;
• SYSC 6, including financial crime systems and controls requirements; and
• The UK Money Laundering Regulations, where applicable.

The consultation may also be useful to businesses seeking FCA authorisation, firms that interact with decentralised protocols and professional advisers assessing DeFi business models.

The FCA is not proposing a separate, standalone “DeFi licence” through GC26/7. Nor does the consultation itself create new regulatory requirements. Instead, it explains how existing obligations may apply and offers examples of practices firms could consider.

That distinction matters. The FCA uses “must” when describing an existing legal or regulatory requirement and “should” when setting out guidance. The examples are illustrative, and their suitability depends on the firm’s activities and risk profile.

The consultation closes on 18 November 2026. The FCA’s publication page states that final guidance is planned for January 2027, although the final text may change following feedback.

Why is the FCA paying attention to DeFi?

DeFi allows financial activities to be performed using distributed ledger technology, smart contracts and interconnected applications.

Depending on the arrangement, users can trade cryptoassets, lend or borrow assets, supply liquidity or participate in staking without relying on the same type of intermediary found in traditional finance.

These arrangements can offer meaningful advantages.

Transactions may be automated. Services may operate around the clock. Protocols can connect with one another, allowing businesses to create products from existing components rather than building every part from scratch.

But the features that make DeFi attractive can also make risks harder to manage.

A transaction may be difficult to reverse. A protocol may depend on infrastructure operated by multiple parties. A coding error may affect thousands of users before anyone can respond. And if the people responsible for a protocol are anonymous or difficult to identify, customers may have limited practical recourse.

For firms offering regulated financial services, these are business risks as well as technology risks.

The question is not whether DeFi can be innovative. The question is whether a firm understands the risks well enough to use it responsibly.

“We use DeFi” is not a licensing analysis

A founder launches a platform that allows users to access decentralised trading if you need a UK crypto Licence.

When asked whether the business requires FCA authorisation, the founder replies:

“We don’t operate an exchange. The smart contracts do everything.”

That answer may describe part of the technology. It does not complete the legal analysis.

The FCA explains that using software, smart contracts, distributed governance or other decentralised arrangements does not, by itself, determine whether a person is carrying on a regulated activity.

The relevant assessment depends on the facts, including:

• What activity is being carried on.
• Who carries it on and in what capacity.
• Whether it is conducted by way of business.
• Whether the relevant UK territorial conditions are met.
• Whether an exclusion applies.
• Whether the person needs to be authorised or can rely on an exemption.

The degree of decentralisation can be relevant. However, firms should assess the actual roles, arrangements and controls involved rather than relying on the label “DeFi”.

A genuinely decentralised arrangement may raise different perimeter questions from a platform where an identifiable business controls the interface, determines product features or otherwise carries on a relevant activity. The conclusion requires a case-by-case assessment.

The FCA directs firms to read GC26/7 alongside PS26/18 and CP26/36, which address the cryptoasset regulatory perimeter and the effect of decentralisation. It also notes that an exclusion from a regulated activity does not automatically resolve questions under the financial promotions regime or the Money Laundering Regulations.

This assessment is especially relevant as the UK prepares for its broader cryptoasset regime. According to the FCA, new cryptoasset activities are due to enter its regulatory perimeter on 25 October 2027. Existing obligations can already apply, depending on the business and activity.

The first major concern: operational resilience

Imagine a crypto company offering customers a staking product for overseas crypto companies in UK FCA Authorisation.

The company does not operate the blockchain or control the staking protocol. It selects an external protocol, connects it to its platform and allows customers to stake through its interface.

For several months, everything worked smoothly.

Then a validator fails, the protocol experiences a security incident, and customers cannot access or withdraw their assets when expected.

The company may not have caused the incident. But customers experience the disruption through the service the company offered them.

This is where operational resilience becomes important: a firm needs to understand how disruption could affect its services and how it would respond and recover.

The FCA identifies several DeFi-related risks, including:

• Smart contract risk: coding errors or vulnerabilities can be exploited.
• Oracle risk: inaccurate, delayed or manipulated data can trigger unintended outcomes.
• Bridge risk: failures in infrastructure connecting blockchains can affect transferred assets.
• Network risk: congestion, outages or validation problems can delay or prevent transactions.
• Governance risk: weak controls over upgrades, administrative keys or emergency actions can expose a protocol to compromise.
• Third-party risk: failures at infrastructure providers can disrupt connected services.
• Incident-response risk: a firm may have limited ability to pause a smart contract, reverse a transaction or coordinate recovery.

These risks do not necessarily mean a firm should avoid DeFi. They do mean that a firm should know what it is relying on before making that dependency part of a customer-facing service.

Identify the customer service—not just the technology

Under SYSC 15A.2.1R, firms within scope must identify their important business services: services whose disruption could cause intolerable harm to clients or threaten UK market integrity or financial stability.

The FCA’s draft guidance makes a useful distinction: the important business service is generally the service delivered to the customer, rather than the underlying protocol itself.

For example, a staking provider may identify its customer staking service as an important business service. The decentralised protocol, blockchain and validator operators then become dependencies supporting that service.

This distinction helps management focus on the customer impact.

If the protocol fails:

• Can customers still access their assets?
• Can the firm process withdrawal requests?
• Could customers suffer slashing losses?
• How many customers may be affected?
• How long could the disruption continue before the harm becomes intolerable?

Under SYSC 15A.2.5R, an in-scope firm must set an impact tolerance for each important business service. The FCA’s examples encourage firms using DeFi to consider factors such as inaccessible assets, transaction delays and inaccurate data when setting those tolerances.

The point is to define the disruption the firm must be prepared to manage and understand whether it can continue to deliver the service within the applicable tolerance.

Map the dependencies behind the product

For UK Crypto staking FCA Authorisation a crypto product can look simple to the customer while relying on a complicated chain of infrastructure.

A token swap offered through a wallet, for example, might depend on a user interface, a blockchain network, an RPC node provider, an oracle, a DEX aggregator and one or more liquidity protocols.

Under SYSC 15A.4.1R, in-scope firms must map the people, processes, technology, facilities and information supporting important business services.

For DeFi-related services, the FCA suggests that this mapping may include:

• Blockchain and settlement infrastructure.
• Smart contracts and external protocols.
• Bridges, oracles and middleware.
• Cloud and technology providers.
• Customer-facing interfaces.
• Key management and internal governance.
• Incident response and customer communications.
• Protocol upgrade arrangements and administrative controls.

A useful question for any business is: If one component failed tomorrow, would we know which customers and services were affected?

If the answer is unclear, the firm may struggle to respond quickly when an incident occurs.

Mapping should also reveal areas where the firm has limited control. A business may rely on a protocol without being able to require its developers or governance participants to make an urgent change. That limitation needs to be understood and reflected in the firm’s risk decisions.

Test what happens when things go wrong

Most businesses can explain how their product works under normal conditions.

The harder question is: What happens during a serious disruption?

Under SYSC 15A.5.1R, firms in scope must develop a testing plan and carry out scenario testing to assess whether they can remain within impact tolerances during severe but plausible disruption.

For a DeFi-facing business, scenarios might include:

1. A bridge used by the service is compromised.
2. A critical oracle produces inaccurate pricing data.
3. A blockchain network experiences an extended outage.
4. A wallet provider loses access to its main RPC node provider.
5. A protocol upgrade introduces a vulnerability.
6. A customer-facing interface is compromised.

The objective is to test the firm’s response in practice.

Who detects the problem? Who makes decisions? Can transactions be paused where necessary? What can customers be told, and when? What happens if the firm cannot directly control the affected protocol?

The FCA’s paper includes an example of a non-custodial wallet provider that tests its reliance on infrastructure and discovers a weakness: dependence on a single RPC node provider. The firm then improves its arrangements and retests.

The lesson is clear. A contingency plan becomes more credible when it has been tested against the dependencies the business actually uses.

Third-party responsibility does not disappear in DeFi

A common challenge in decentralised finance is that a business may rely on infrastructure it does not own or control.

A wallet provider may use a third-party interface. An exchange may route activity through an external protocol. A staking provider may depend on validators selected by another platform.

In each case, the firm must understand the risks created by those dependencies.

The FCA explains that relevant SYSC 15A requirements apply to third-party arrangements whether or not they qualify as outsourcing. Where an arrangement is outsourcing, relevant SYSC 8 requirements may also apply.

This can make protocol selection a significant compliance decision.

Before integrating a protocol, a firm should consider questions such as:

• How are upgrades approved?
• Who controls administrative keys?
• Are there emergency controls, and who can use them?
• What security reviews have been conducted?
• Are there known dependencies on bridges or data providers?
• What information would be available during an incident?
• Can the firm or its customers stop using the protocol if risks become unacceptable?

A firm may not be able to eliminate every dependency. It should, however, understand the consequences of relying on it and whether suitable controls or alternatives are available.

Financial crime: when on-chain activity becomes difficult to follow

Operational failure is only part of the picture.

DeFi can also create challenges for detecting and preventing financial crime.

Consider a customer who deposits cryptoassets into a regulated platform. The assets have moved through several wallets, a decentralised exchange, a bridge and a privacy-enhancing service before reaching the platform.

Some of those transactions may be legitimate. But the transaction path may make it harder for the firm to understand where the assets came from, who controlled them and whether the activity is consistent with the customer’s profile.

The FCA’s draft guidance highlights risks involving:

• Money laundering.
• Terrorist and proliferation financing.
• Fraud and scams.
• Sanctions evasion.
• Concealment of the origin, ownership or destination of funds.
• Complex activity across multiple protocols and blockchains.

The FCA does not say that providing services using DeFi automatically makes a firm non-compliant. Its concern is whether the firm has assessed the risks and put appropriate systems and controls in place.

A firm’s approach should therefore be tailored to its own products, customers, delivery channels and exposure to DeFi—not copied from a generic policy template.

Risk assessments need to reflect how the business actually operates

The FCA refers to Regulations 18 and 18A of the Money Laundering Regulations, which concern business-wide assessments of money laundering, terrorist financing and proliferation financing risks for firms subject to those provisions.

A risk assessment for a business using DeFi should consider more than whether the customer has passed onboarding checks.

For example:

• Which protocols can customers access through the firm?
• Can customers interact with newly deployed tokens or smart contracts?
• Are transactions routed across multiple blockchain networks?
• Does the firm rely on third-party interfaces?
• Can the firm identify exposure to illicit or sanctioned activity?
• Are certain customers, jurisdictions or transaction patterns higher risk?
• Can the firm obtain enough information to investigate unusual activity?

The answers may differ significantly between a custodial exchange, a wallet interface and a staking provider. That is why the risk assessment needs to follow the actual flow of assets and services.

A document that says “DeFi presents higher risk” without explaining where that risk arises and how the firm manages it is unlikely to be a useful management tool.

Customer due diligence and ongoing monitoring

The consultation discusses customer due diligence under Regulation 27 and enhanced due diligence under Regulation 33 of the Money Laundering Regulations, where applicable.

The FCA points to potential indicators of elevated risk, including exposure to illicit activity or sanctions risk, privacy-enhancing technologies, and complex transactions across multiple protocols or networks.

These indicators should inform a risk-based assessment. They do not mean that every transaction involving a non-custodial wallet or a decentralised exchange is automatically illicit.

A firm may need to seek additional information, review the source of funds, increase monitoring or assess whether the activity fits the customer’s expected behaviour. The appropriate response depends on the facts and applicable legal requirements.

Monitoring should also continue after onboarding. A customer’s risk profile can change, and a wallet or protocol that appeared acceptable at the start of a relationship may later become associated with suspicious activity.

Firms must also understand their applicable obligations concerning suspicious activity reports and the separate requirements relating to sanctions.

The Travel Rule and non-custodial wallets

The UK’s cryptoasset Travel Rule is another area where DeFi can present practical difficulties.

The FCA notes that firms within scope must comply with Regulation 64 of the Money Laundering Regulations, where its requirements apply to a cryptoasset transfer.

However, obtaining, verifying, transmitting or retaining the required information may become more complicated when transfers involve non-custodial wallets, multiple intermediaries or different levels of customer identification.

The consultation refers to Regulation 64G and explains that firms involved in a non-custodial wallet transfer may request information from their customers, whether those customers are the originator or beneficiary.

For an affected firm, the practical questions include:

• Does the Travel Rule apply to this particular transfer?
• What information is required, and who must provide it?
• How will missing or incomplete information be assessed?
• What additional risks arise from the transfer?
• What action should be taken under the applicable requirements and the firm’s procedures?

Firms should avoid assuming that every transfer involving a self-hosted wallet follows the same process. The applicable obligations depend on the transfer and the parties involved.

What the FCA’s case studies teach businesses

For UK Crypto Lending yield FCA regulation the consultation includes examples of incidents involving smart contracts, bridges, network outages, social engineering and fraud.

One case study discusses the Bybit/Safe Wallet incident, in which attackers compromised a transaction approval process. The example illustrates a point that is easy to overlook: a multi-signature arrangement may provide a layer of security, but its effectiveness can be undermined if the information presented to approvers is compromised.

Another example discusses the $SQUID token rug pull, illustrating how token design, limited oversight and deceptive conduct can expose investors to losses.

The broader lesson is that a firm’s assessment should extend beyond the name of a protocol or the existence of a security feature. It should consider how the relevant components and people work together in practice.

A protocol can be affected by code, interfaces, governance decisions and human behaviour. A weakness in any one of them may affect the service the firm provides to customers.

What should crypto businesses do now?

Businesses using or planning to use DeFi should begin by understanding where they sit in the transaction and what role they perform.

A practical starting point is to:

1. Map the business model. Identify the services offered, the assets involved, the customers targeted and each party’s role.
2. Conduct a regulatory perimeter assessment. Consider applicable regulated activities, exclusions, territorial scope, financial promotions and AML obligations.
3. Identify protocol dependencies. Document the protocols, smart contracts, infrastructure providers and governance arrangements supporting each service.
4. Assess operational resilience. Determine which rules apply and whether the business can detect, respond to and recover from relevant disruptions.
5. Review financial crime controls. Assess customer due diligence, blockchain monitoring, sanctions screening, suspicious activity escalation and Travel Rule procedures.
6. Test realistic scenarios. Consider whether the business can respond effectively to an exploit, outage, compromised interface or inaccessible assets.
7. Document decisions and revisit them. A protocol’s technology, governance, risks and dependencies can change after integration.

For firms preparing for the UK’s future cryptoasset regime, this work can also support authorisation planning. The FCA has indicated that firms should prepare ahead of the new regime and has opened an authorisation application window for eligible firms. Businesses should assess the applicable deadlines and transitional arrangements against their own circumstances.

How CRYPTOVERSE can help

At CRYPTOVERSE Legal Consultancy, we help crypto and digital asset businesses understand their regulatory position and prepare for the practical demands of operating in regulated markets.

Our support can include:

• DeFi regulatory perimeter assessments for exchanges, wallets, staking providers and other businesses.
• Business model and activity analysis to identify potential authorisation, registration and financial promotions issues.
• FCA authorisation readiness support, including reviews of proposed activities and documentation.
• DeFi protocol and third-party risk assessments from a regulatory perspective.
• AML and financial crime framework support, including risk assessments and policies.
• Operational resilience and governance documentation tailored to the proposed service.

Whether you are building a DeFi product or integrating an existing protocol into a broader crypto business, understanding the legal and operational implications early can help you make better decisions before launch.

Contact CRYPTOVERSE to discuss your DeFi business model and UK regulatory obligations.

FAQs