GC26/7: Decentralised finance guidance (DeFi)
AI Analysis
The FCA has opened consultation GC26/7 on non-Handbook guidance for FCA-regulated firms using decentralised finance, focusing on operational resilience, financial crime controls and the Money Laundering Regulations. The consultation does not itself create new binding rules, but it signals that existing expectations will apply to DeFi arrangements and that firms should assess heightened risks before the new cryptoasset perimeter takes effect on 25 October 2027.
Key dates
- 2026-10-21
- FCA published GC26/7 and opened the guidance consultation.
- 2026-11-18 Deadline
- Deadline for consultation responses to GC26/7.
- 2027-01-01
- FCA plans to publish final DeFi guidance during January 2027; no specific publication day has been stated.
- 2027-10-25
- The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 are due to bring new cryptoasset activities into the FCA regulatory perimeter.
Suggested considerations
- Compliance teams may wish to map each DeFi use case, protocol, smart-contract dependency, service provider and customer-facing activity against the firm's existing SYSC 15A, SYSC 6 and Money Laundering Regulations obligations.
- Firms should consider documenting governance and accountability for DeFi arrangements, including who controls or can materially influence protocol changes, access permissions, treasury assets, upgrades, emergency controls and customer outcomes.
- Operational resilience teams may wish to assess important business services, impact tolerances, vulnerabilities, third-party and smart-contract dependencies, oracle and bridge risks, key-management arrangements, cyberattack scenarios and credible disruption testing.
- Financial-crime teams should consider whether existing customer due diligence, transaction monitoring, sanctions screening, blockchain analytics, wallet-risk assessment, suspicious activity escalation and record-keeping controls remain effective for pseudonymous, automated or cross-chain activity.
- Firms may wish to review outsourcing and third-party risk assessments for protocol developers, validators, custodians, wallet providers, analytics providers, cloud infrastructure and other critical DeFi dependencies.
- Legal and regulatory teams should assess whether current and planned activities fall within the existing perimeter or the new cryptoasset activities introduced by the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, including whether there is an identifiable controlling entity.
- Affected stakeholders may wish to submit responses to the FCA by 18 November 2026 and identify any areas where the illustrative guidance is unclear, disproportionate or difficult to apply to genuinely decentralised arrangements.
- Firms may wish to track the FCA's planned final guidance in January 2027 and update risk assessments, policies, control testing and implementation plans before the new cryptoasset regime commences.
What changed
The FCA is proposing guidance describing the operational resilience and financial crime risks associated with DeFi and providing illustrative measures firms may consider. The guidance is relevant to firms within SYSC 15A, SYSC 6 and the Money Laundering Regulations, including firms using distributed-ledger technology, automated protocols, open and interoperable systems or arrangements with limited traditional intermediation. It is intended to clarify application of existing requirements rather than establish a separate DeFi regime or new Handbook obligations. The consultation should be read alongside CP26/36 on cryptoasset perimeter guidance and the FCA's wider cryptoasset, operational resilience and Financial Crime Guide publications. Independent market commentary views GC26/7 as part of
Compliance impact
The immediate legal impact is limited because GC26/7 is proposed non-Handbook guidance and does not itself impose new binding requirements. Its practical significance is nevertheless material: the FCA is signalling supervisory expectations for governance, resilience and financial-crime controls in DeFi, and weaknesses may contribute to consumer harm, market-integrity concerns, operational disrupti
Who is affected
Related regulations
References
AI-generated analysis. May contain errors or omissions — verify with the original FCA source before acting. Full disclaimer.
What the FCA said
We’re consulting on non-Handbook guidance to help firms providing financial services using decentralised finance (DeFi) comply with our rules on operational resilience and financial crime, and with the Money Laundering Regulations (MLRs). ... Read GC26/7 (PDF) ... Why we are consultingOur guidance covers observations…
Extract from FCA . Read the full notice at the source for the authoritative text.