GC26/7: UK Financial Conduct Authority consults on decentralised finance (DeFi) guidance

On 21 October 2026, the UK Financial Conduct Authority (FCA) launched GC26/7, a consultation on proposed non-Handbook guidance explaining how existing operational resilience and financial crime requirements may apply when firms interact with, facilitate access to or provide financial services using decentralised finance (DeFi). The consultation closes on 18 November 2026, with final guidance planned for January 2027.

The FCA is not proposing a new regulatory framework for DeFi. Its starting point is that firms using DeFi should meet the same regulatory outcomes as in traditional financial services, applying existing requirements under SYSC 15A (Operational resilience), SYSC 6 (Compliance, internal audit and financial crime) and the Money Laundering Regulations 2017 (MLRs).

The guidance also forms part of the FCA's wider work to implement the UK's new regulatory regime for cryptoassets (as discussed in our blog here) and is intended to assist both existing FCA-authorised firms and firms seeking authorisation for future regulated cryptoasset activities.

What is DeFi?

DeFi refers to financial services, such as trading, lending and borrowing, provided through distributed ledger technology rather than traditional intermediaries (see our earlier blogs here and here). The FCA also points to emerging applications in tokenised financial markets and agentic commerce (on which, more below). Instead of a central administrator, DeFi relies on protocols and smart contracts (self-executing code), supported by a chain of other infrastructure. That chain includes blockchain networks, cloud and technology providers, oracles (which feed outside data on-chain), bridges (which move assets between blockchains) and client-facing wallets and apps. DeFi may therefore involve limited or no involvement from traditional intermediaries in the form of natural or legal persons. 

What is the FCA consulting on?

The FCA is seeking views on whether it has correctly identified the operational resilience and financial crime risks associated with DeFi, whether its proposed guidance appropriately addresses those risks and whether further regulatory measures may be needed.

Operational resilience

For firms within scope of SYSC 15A, the underlying requirements remain the same. The proposed guidance focuses on how those requirements apply where important business services depend on decentralised infrastructure. Firms should consider:

1. the important business service, focusing on the service delivered to the client rather than the underlying technology;
2. its dependencies, including blockchain and settlement infrastructure, protocols, smart contracts, technology providers, oracles, bridges and client interfaces;
3. how those dependencies are governed, including protocol upgrades, emergency controls and administrative keys;
4. what happens if they fail, supported by appropriate scenario testing; and
5. what alternatives are available, including concentration risk and recovery options.

Financial crime

The FCA takes a similar approach to financial crime. Where applicable, firms remain subject to existing requirements on risk assessment, systems and controls, customer due diligence and ongoing monitoring, as well as the Travel Rule under the MLRs (on which see our blog here).

The FCA identifies several vulnerabilities of DeFi that may make compliance more challenging, including:

1. complex and potentially obfuscated transaction flows, including transactions across multiple protocols, blockchains, bridges and privacy-enhancing technologies;
2. limited or fragmented customer information, potentially creating gaps in customer identification, monitoring and compliance with the Travel Rule;
3. potential exposure to illicit or sanctioned activity arising from interactions with wallets, protocols and services over which firms may have limited or no direct control; and
4. automation, which may reduce opportunities to identify and prevent suspicious activity before a transaction is executed.

Under the proposed guidance, firms are therefore expected to reflect these vulnerabilities in their financial crime risk assessments and consider whether their systems and controls provide sufficient visibility over transactions, including the source and destination of funds and potential exposure to illicit activity.

What are the key takeaways?

Overall, the FCA's message is that using DeFi does not change a firm's responsibility for managing the risks associated with the services it provides. Four broader themes stand out:

1. Ecosystem risk. The FCA emphasises that risks can arise from interconnected protocols and service providers. In its KelpDAO case study, cryptoassets stolen through a vulnerability involving a cross-chain bridge used by one protocol were used to borrow US$190m on a separate lending protocol. Over US$10bn was subsequently withdrawn by depositors from that lending protocol, while total value across DeFi protocols fell by US$13bn in the following two days. Firms may therefore need to look beyond the systems they directly control and consider critical external dependencies as part of their resilience assessments.
    
2. Governance risk. The proposed guidance underlines that due diligence should extend beyond code security to a protocol’s governance and safeguards. In the FCA's Drift case study, attackers are said to have induced administrators to pre-sign malicious transactions transferring control of the protocol, with a ‘zero-timelock’ allowing the changes to take effect immediately. Governance arrangements can therefore themselves be a source of vulnerability.
    
3. Operational resilience and financial crime risks can converge. The FCA's Bybit case study illustrates how a vulnerability in a third-party wallet interface used in an approval process can facilitate theft, with decentralised exchanges and non-custodial wallets then used to obscure the proceeds. Firms may therefore need to consider operational resilience, cyber and financial crime risks together rather than in isolation.
    
4. AI may increase both risks and the tools available to manage them. The FCA's identification of autonomous AI agents executing payments as an emerging use case points to the growing interaction between AI and DeFi. AI may increase the sophistication, speed and scale of cyber-attacks on firms using DeFi, while also providing new tools to manage operational risks. Firms may therefore need to consider whether their systems and controls can keep pace.

What should firms do now?

Firms with an interest in DeFi have until 18 November 2026 to respond. Because the FCA is asking whether further regulatory measures are needed, firms that want to shape the final guidance should engage now. Firms applying under the new cryptoasset regime should also reflect GC26/7 in their applications before the authorisation window closes on 28 February 2027. More broadly, firms using or facilitating access to DeFi should:

• map any DeFi dependencies into their important business services and scenario testing;
• extend due diligence to cover protocol governance, including administrative keys, upgrade processes and timelocks;
• reassess their financial crime risk assessments and transaction-monitoring capability; and
• make sure responsibility for DeFi-related risks is clearly allocated at senior manager level, and that operational resilience, cyber, financial crime and sanctions teams work from a joined-up incident response plan.

If you would like to discuss any of the points raised in this blog post in further detail, please contact the authors or your usual Freshfields contact.