At a glance
- The UK Financial Conduct Authority (FCA), the country’s financial regulator, opened a consultation on Wednesday on draft guidance for firms using decentralised finance, known as GC26/7. It covers operational resilience and financial crime, and it closes on 18 Nov.
- In a second paper, CP26/36, the FCA proposed guidance on new exclusions from its crypto regime, including one for technical services whose only role is to connect users to a decentralised protocol. It also promised some leeway for firms that this exclusion left unsure whether they needed a licence.
Decentralised finance, or DeFi, means financial services such as trading, lending and borrowing run through software on public blockchains rather than through a company in the middle. For the basics, see how DeFi lending works.
What the DeFi guidance says
GC26/7 is non-Handbook guidance: it sits outside the FCA’s formal rulebook. It is aimed at regulated firms that interact with DeFi, give clients access to it or provide services using it, and that are subject to the FCA’s operational-resilience rules (SYSC 15A), its compliance and financial-crime rules (SYSC 6) and the Money Laundering Regulations.
The FCA says it adds no obligations. The proposal “seeks to clarify existing rules rather than establish new policy”, the consultation document says, and the draft guidance “does not create new regulatory requirements”.
The document sets out the scale. Decentralised exchanges handled roughly 14% to 19% of worldwide crypto spot volume from January to August 2026, it says, and FCA research found that about 8% of UK crypto users bought through decentralised exchanges in 2025.
It also sets out the risk. “More than US$12bn has reportedly been lost through DeFi and bridge hacks since 2016,” the FCA writes.
Its central point is about labels. “The use of software, smart contracts, DLT or other decentralised arrangements does not, by itself, determine whether an activity is regulated,” the draft says. Calling a business DeFi does not change the analysis.
What the exclusions paper covers
The perimeter is the line between activities that need FCA permission and those that do not. CP26/36 deals with exclusions added by a second statutory instrument, which the government laid the day before the FCA published its main perimeter guidance, PS26/18, in September.
The new exclusions include, the FCA says:
- short-term arrangements for settling trades;
- short-term holdings of UK qualifying stablecoins while a payment goes through;
- arrangements for the assets that back a UK qualifying stablecoin;
- trading on one’s own account, either with no client involved or as a market maker on a qualifying crypto trading platform (QCATP);
- technical services whose only role is to give users access to someone else’s service or to a decentralised protocol.
The FCA said the timing of the new law “will have created uncertainty for a small number of firms around the need to be authorised”. Where a firm can show that uncertainty about the technical services exclusion materially hurt its ability to file a complete application, the FCA will give it extra time to finish the parts covering the arranging permission, provided the rest of the application arrives within the window.
The UK Cryptoasset Business Council, an industry group, said “DeFi sits among the most innovative parts” of financial services and that “the FCA needs to get this right”, Cointelegraph reported.
The EU took a different route with its own rulebook; see what MiCA is. For other UK action this month, see the UK sanctions on Cryptomus’s owner.
What happens next
Both consultations close on 18 Nov. The FCA plans final DeFi guidance in the first quarter of 2027 and final perimeter guidance in January 2027.
The application window for firms already doing UK crypto business opened on 30 Sep and closes on 28 Feb 2027. The regime itself starts on 25 Oct 2027.
This article is for information only and is not investment advice.