FCA consults on DeFi operational resilience and perimeter exclusions

Britain's Financial Conduct Authority on Oct. 21, 2026 opened two consultations that together set how decentralised finance interfaces and related intermediaries will be treated under the incoming UK crypto regime. Guidance Consultation GC26/7 asks for feedback on non-Handbook guidance for firms that provide financial services using DeFi, while Consultation Paper CP26/36 proposes perimeter guidance on new statutory exclusions from the regulated cryptoasset activities. Both windows close on Nov. 18, 2026, and the FCA aims to publish final guidance in January 2027, according to the regulator's GC26/7 page and CP26/36 page.

GC26/7 targets FCA-regulated firms that interact with, grant access to, or provide financial services using DeFi and that fall in scope of the operational-resilience rules in SYSC 15A, the compliance and financial-crime rules in SYSC 6, and the Money Laundering Regulations. The draft guidance does not create new requirements. It explains how those existing duties apply when firms use or interact with DeFi, and offers illustrative measures for systems and controls. Crypto Briefing reported the same day that the paper is non-Handbook guidance rather than a fresh rulebook.

The FCA describes DeFi as financial services enabled by distributed ledger technology with high automation, open and interoperable software, and in some cases no traditional intermediary. The regulator said such features can raise operational-resilience and financial-crime risks for firms and their clients, which is why the guidance focuses on those two areas plus the money-laundering regime. Firms that cannot adequately identify, understand and manage the risks of a proposed DeFi activity should consider whether the activity is appropriate for their business and clients, the GC26/7 text states.

A separate question is when a DeFi interface itself needs UK authorisation. The FCA's answer stays case by case. Decentralisation may affect whether a person needs authorisation or an exemption, but the approach to perimeter analysis does not change because a business model is labelled centralised, decentralised or DeFi, CP26/36 says. Anyone carrying on a regulated activity by way of business in the UK, with no exclusion available, still needs authorisation, even if they describe themselves as DeFi. The use of software, smart contracts, distributed ledger technology or distributed governance does not by itself determine whether a regulated activity is being carried on.

CP26/36 exists because Parliament amended the regime after the FCA published its main perimeter policy statement, PS26/18, in September. The day before that statement, the government laid a second statutory instrument, the Cryptoassets (Miscellaneous Amendments) Regulations 2026, which introduced further exclusions. Those cover temporary settlement arrangements, temporary UK qualifying stablecoin holding arrangements for payment transactions, arrangements involving backing assets for a UK qualifying stablecoin, proprietary trading where no service is provided to another person or where the person acts as a market maker on a qualifying cryptoasset trading platform, and technical services that merely allow access to services provided by a third person or to a decentralised protocol. The FCA is consulting on how those amendments apply in the Perimeter Guidance Manual so the handbook reflects the current legislative position.

The technical-services exclusion is the live issue for front-end operators. The draft guidance treats software development itself as outside the regulated activities, while the people who provide access to that software for others are the ones who typically need authorisation when a regulated activity is being carried on. Arranging remains drawn widely: the ability to influence or exercise discretion over a transaction is not a necessary part of arranging deals, nor is control of the cryptoassets. A front-end that never holds user funds is not out of scope for that reason alone, as DeFi Notebook summarised from the September perimeter material that the new consultation builds on.

The FCA also addressed timing uncertainty created by the late statutory instrument. Where a firm can show that uncertainty over the technical-services provider exclusion materially affected its ability to file a complete application during the authorisation window, the regulator will exercise some forbearance. Provided the firm submits an otherwise complete application inside the window, it will get additional time to fix incomplete aspects relating to the arranging permission. The authorisation window for firms with existing UK cryptoasset business opened Sept. 30, 2026 and closes Feb. 28, 2027. The full cryptoasset regime starts Oct. 25, 2027.

On the DeFi resilience side, the FCA's broader crypto work already produced finalised guidance FG26/6 on cryptoasset operational resilience, which GC26/7 sits alongside. Firms responding by Nov. 18 can use the online response form or email, and must say whether they want their response treated as confidential and whether they are content to be named. The regulator said it will consider feedback and update the proposed guidance as appropriate before the January 2027 target.