The UK Financial Conduct Authority on October 21, 2026, published two consultation documents that collectively represent the first formal regulatory guidance addressing decentralized finance: GC26/7 (non-Handbook guidance on DeFi operational resilience and financial crime) and CP26/36 (perimeter ...
"Once our rules come into effect in October 2027, I expect we'll see the market move from a period of uncertainty to one of greater clarity, with firms operating within a clear regulatory framework and consumers and investors having a better understanding of the protections in place." — Matthew Long, Director of Payments & Digital Assets, FCA
The UK Financial Conduct Authority on October 21, 2026, published two consultation documents that collectively represent the first formal regulatory guidance addressing decentralized finance: GC26/7 (non-Handbook guidance on DeFi operational resilience and financial crime) and CP26/36 (perimeter guidance clarifying exclusions from regulated cryptoasset activities). The publications follow PS26/18, issued September 16, 2026, which defined eight regulated cryptoasset activities under the Financial Services and Markets Act (FSMA) framework. The consultation window closes November 18, 2026, with final guidance expected in January 2027 and the full regime taking effect October 25, 2027.
The FCA's approach targets intermediaries — firms sitting between end users and decentralized protocols — rather than attempting to regulate protocol-level code directly. CP26/36 introduces a "technical services" exclusion for DeFi front-ends that merely provide access to a third party's services or a decentralized protocol. The regulator explicitly states that "use of software, smart contracts, distributed ledger technology, decentralized governance mechanisms...does not, in itself, determine whether regulated activities are present." Genuinely decentralized protocols may fall outside FCA jurisdiction entirely, though the FCA offers no legal definition of "true DeFi" and will assess decentralization on a spectrum, case by case.
The guidance lands in a UK crypto market generating $365.3 million in revenue in 2025, projected to reach $913.8 million by 2033 at a 12.5% CAGR. Approximately 73 active crypto trading firms operate in the UK as of 2026. Only 51 firms hold FCA registration under the existing anti-money laundering regime — a 14% approval rate from hundreds of applications — signaling the regulator's willingness to maintain a high bar for market entry. The authorization application window for the new regime runs from September 30, 2026, to February 28, 2027.
The FCA's October 21 publications operate as companion documents within the broader cryptoasset regulatory architecture established by PS26/18. The timeline is as follows:
| Milestone | Date | |---|---| | PS26/18 published (8 regulated activities defined) | September 16, 2026 | | Authorization application window opens | September 30, 2026 | | GC26/7 and CP26/36 published | October 21, 2026 | | Consultation closes | November 18, 2026 | | Final guidance expected | January 2027 | | Authorization application window closes | February 28, 2027 | | Full regime takes effect | October 25, 2027 |
GC26/7 is non-Handbook guidance, meaning it carries interpretive weight but does not impose binding rules. CP26/36 is a consultation paper seeking industry feedback on proposed exclusions from the regulated activities perimeter. The FCA has framed both documents as providing "illustrative examples" rather than prescriptive rules, explicitly noting that the guidance is "not exhaustive and may not be appropriate in every case."
The structure reflects the FCA's outcomes-based regulatory philosophy: rather than enumerating specific prohibited or permitted activities within DeFi, the regulator is establishing principles that authorized firms must apply to their own DeFi interactions and leaving the determination of regulatory status to a case-by-case analysis of each arrangement's factual characteristics.
GC26/7 is directed at FCA-authorized firms that use or interact with decentralized finance protocols. It addresses three regulatory domains:
Operational Resilience (SYSC 15A). Firms must treat smart contract integrations as critical infrastructure. This requires documented controls covering the identification, monitoring, and management of risks arising from reliance on DeFi protocols. The guidance implies that firms cannot outsource operational risk management simply because the underlying technology is decentralized; the regulated firm retains responsibility for the resilience of its service delivery chain regardless of the technological architecture.
Compliance Functions (SYSC 6). The guidance reinforces existing requirements for compliance oversight, applied to the DeFi context. Authorized firms interacting with DeFi protocols must ensure their compliance functions are equipped to assess and monitor the specific risks introduced by smart contracts, on-chain governance mechanisms, and the absence of centralized counterparties.
Anti-Money Laundering (MLRs). Financial crime obligations under the Money Laundering Regulations apply to DeFi interactions by authorized firms. The FCA's position is that the pseudonymous or permissionless nature of DeFi protocols does not relieve firms of their AML/KYC obligations. Firms must implement controls appropriate to the risks presented by the specific DeFi protocols and transactions they engage with.
The FCA's key framing statement in GC26/7 — that "use of software, smart contracts, distributed ledger technology, decentralized governance mechanisms...does not, in itself, determine whether regulated activities are present" — establishes that the regulatory analysis turns on the economic substance and function of an activity, not its technological form. This is consistent with the FCA's longstanding "same risk, same regulatory outcome" approach.
CP26/36 proposes five categories of exclusion from the regulated cryptoasset activities defined in PS26/18:
The technical services exclusion is the provision most directly relevant to DeFi. It targets the regulatory status of front-end interfaces, aggregators, and similar intermediary layers. Under this exclusion, a firm that provides nothing more than a technical access point to a decentralized protocol — without exercising discretion over user funds, order routing, or execution — would fall outside the regulated activities perimeter.
The FCA's approach targets intermediaries rather than protocol-level code. The regulator acknowledges that genuinely decentralized protocols may fall entirely outside FCA jurisdiction. However, the FCA provides no legal definition of "true DeFi" and states that decentralization will be assessed on a spectrum, case by case, using an "identifiable controlling entity" test. Where an identifiable person or group exercises material control over a protocol's operations, governance, or user funds, the activity is more likely to fall within the regulatory perimeter.
This case-by-case approach creates interpretive uncertainty for firms operating in the space. The 28-day consultation window (closing November 18, 2026) provides a compressed timeline for industry feedback on these boundary questions.
The FCA's existing track record on crypto firm registration provides context for the authorization pipeline under the new regime. Approximately 60 firms currently hold FCA registration under the anti-money laundering regime. The FCA approved only 51 firms out of hundreds of applications — a 14% success rate. This attrition rate reflects the FCA's stringent assessment of governance, financial crime controls, and operational capabilities.
As of 2026, 73 active crypto trading companies operate in the UK. The authorization application window under the new regime opened September 30, 2026, and closes February 28, 2027, giving firms a five-month window to submit applications. Firms that fail to apply within this window or that do not receive authorization will be unable to conduct regulated cryptoasset activities in the UK once the full regime takes effect on October 25, 2027.
Given the historical 14% approval rate and the expanded scope of the new regime (eight regulated activities versus the prior AML-only registration), the authorization bottleneck is a material risk for market participants. Firms seeking authorization will need to demonstrate compliance across operational resilience, governance, financial crime, and consumer protection requirements simultaneously.
The FCA's guidance arrives during a period of significant volatility in DeFi markets:
| Metric | Value | |---|---| | Global DeFi TVL (September 2026) | ~$96.3B | | Global DeFi TVL (January 2026) | ~$127.3B | | Global DeFi TVL (July 2026 low) | ~$68.2B | | DeFi TVL decline, 2026 YTD (Jan to Sept) | -24.4% | | DeFi TVL decline, 2026 peak-to-trough | -46.4% | | DeFi TVL full-year 2026 decline | -39% | | DeFi lending TVL recovery (July to mid-Oct) | +55%, reaching ~$56B | | DeFi hacks in 2026 | 121 incidents | | Total funds stolen (2026) | $942M |
DeFi lending has been the strongest subsector in the recovery, with TVL climbing 55% from the July trough to approximately $56 billion by mid-October 2026. The security environment remains a persistent concern: 121 DeFi hacks occurred in 2026, with $942 million stolen. This loss figure provides empirical support for the FCA's emphasis on operational resilience in GC26/7. Firms integrating with DeFi protocols face smart contract risk, oracle manipulation risk, governance attack risk, and bridge exploit risk — categories that SYSC 15A is designed to address.
The UK and EU have adopted structurally different approaches to crypto regulation, though they converge on several substantive requirements:
| Dimension | UK (FSMA-integrated) | EU (MiCA) | |---|---|---| | Legislative structure | Phased, outcomes-based, integrated into FSMA | Standalone regulation | | DeFi treatment | Case-by-case; "identifiable controlling entity" test | Currently excludes DeFi lending/borrowing entirely | | Stablecoin issuer requirements | No requirement to be a bank or EMI | Issuers must be authorized as banks or EMIs | | Governance/risk management | Aligned with EU in substance | Aligned with UK in substance | | Financial crime controls | Aligned with EU in substance | Aligned with UK in substance |
The most significant divergence is on DeFi. MiCA currently excludes DeFi lending and borrowing from its scope entirely, creating a regulatory gap that the European Commission is expected to revisit. The UK's case-by-case approach, while creating more interpretive uncertainty, avoids this categorical exclusion and allows the FCA to bring DeFi activities within scope where an identifiable controlling entity exists.
On stablecoins, the UK takes a more permissive approach: it does not require stablecoin issuers to be authorized as banks or electronic money institutions, whereas MiCA imposes this requirement. This could position the UK as a more accessible jurisdiction for stablecoin issuance, though practical impact depends on authorization standards.
Matthew Long, Director of Payments and Digital Assets at the FCA, characterized the UK approach: "We've built a proportionate and competitive regime based on proven regulatory principles, adapted for the realities of crypto markets, giving firms a solid foundation to build and scale with confidence."
UK crypto market revenue reached $365.3 million in 2025. Industry projections estimate growth to $913.8 million by 2033, representing a 12.5% compound annual growth rate. The regulatory clarity provided by PS26/18, GC26/7, and CP26/36 will influence whether the UK captures a proportionate share of global crypto activity or sees firms relocate to lighter jurisdictions.
The 73 active crypto trading companies currently operating in the UK represent the addressable universe of firms likely to seek authorization under the new regime. Given the FCA's historical 14% approval rate for crypto registrations, the post-October 2027 market could see a substantial reduction in the number of authorized participants — concentrating market share among firms with the governance and compliance infrastructure to meet the FCA's standards.
The FCA's publication of GC26/7 and CP26/36 marks the first time a major financial regulator has issued formal DeFi-specific guidance that attempts to draw a perimeter around regulated activity without categorically excluding or including all decentralized finance. The approach is calibrated: intermediaries face clear obligations; genuinely decentralized protocols may fall outside scope; and the boundary between the two will be determined case by case using a functional, substance-over-form analysis.
The compressed 28-day consultation window and the February 28, 2027, authorization deadline create urgency for market participants. Firms operating in the UK crypto market — currently numbering 73 active trading companies — must assess whether their DeFi interactions bring them within the regulatory perimeter, and if so, whether they can meet the FCA's governance, operational resilience, and financial crime standards within the prescribed timeline. The FCA's historical 14% approval rate suggests the regulator will not lower the bar to accommodate volume.
The practical impact will depend on the final guidance issued in January 2027 and on how the FCA applies its case-by-case decentralization assessment in practice. For now, the direction is clear: the FCA will regulate the firms it can identify and reach, and it will use existing regulatory principles — operational resilience, compliance, anti-money laundering — to do so. The technology is new; the regulatory logic is not.