The UK Financial Conduct Authority on 21 October 2026 published two consultation papers — CP26/36 and GC26/7 — that together constitute the regulator's first formal attempt to draw a regulatory perimeter around decentralized finance. The documents arrive 12 months before the Financial Services an...
"Getting ready for regulation starts with understanding how the regime applies to your business. This guidance gives firms the clarity they've asked for." — David Geale, Executive Director, Financial Conduct Authority
The UK Financial Conduct Authority on 21 October 2026 published two consultation papers — CP26/36 and GC26/7 — that together constitute the regulator's first formal attempt to draw a regulatory perimeter around decentralized finance. The documents arrive 12 months before the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 take full effect on 25 October 2027, creating a regime that will require firms conducting six defined cryptoasset activities to hold FCA authorization.
The guidance introduces a "technical services exclusion" that could exempt DeFi front-end operators from authorization requirements — provided they function as passive access points rather than intermediaries. The FCA simultaneously rejected "true DeFi" as a statutory concept, stating that decentralization exists on a spectrum and that the substance of financial activity, not its technological wrapper, determines regulatory status. Both consultations close 18 November 2026, with final guidance expected in January 2027.
For an industry where the FCA has approved only 47 of 359 crypto-related applications since January 2020 — a 13% approval rate — the papers signal that the authorization gateway, open since 30 September 2026, will be no easier to pass through for DeFi-adjacent firms.
CP26/36: Cryptoasset Perimeter Guidance addresses how recent legislative changes affect the UK's regulatory perimeter for cryptoassets. The paper proposes amendments to the Perimeter Guidance Manual (PERG) within the FCA Handbook, explaining how new exclusions interact with regulated cryptoasset activities. It is a map of what falls inside the regulatory boundary and what does not.
GC26/7: Decentralised Finance Guidance is a separate, non-Handbook document that does not create new rules. Instead, it clarifies how existing FCA obligations — particularly around operational resilience (SYSC 15A), compliance and internal audit functions (SYSC 6), and anti-money laundering controls under the Money Laundering Regulations — apply to authorized firms that interact with decentralized protocols. The FCA described it as "a clarification of existing requirements rather than new policy."
The two papers are complementary. CP26/36 tells firms whether they need authorization. GC26/7 tells authorized firms how to manage DeFi-related risks once inside the perimeter.
Beginning 25 October 2027, six cryptoasset activities will require FCA authorization:
Existing registrations under the Money Laundering Regulations will not automatically convert to authorization under the new framework. Firms must submit fresh applications. The FCA has set the authorization gateway application period from 30 September 2026 to 28 February 2027. Firms failing to apply within this window risk losing the benefit of statutory transitional arrangements.
The regime's reach extends beyond native crypto firms. Payment service providers, electronic money issuers, traditional financial institutions, and overseas companies serving UK customers all fall within scope. Firms offering multiple product types may need multiple permissions.
The most consequential element for DeFi-adjacent businesses is a new exclusion from the "arranging deals" activity. Under this carve-out, a person is excluded from regulated activity where they "merely provide a technical service that allows another person to access services provided by a third person (who is carrying on a regulated activity and is authorised or exempt) or a decentralised protocol."
This is the FCA's attempt to distinguish infrastructure providers from regulated intermediaries. In practical terms, it could exempt operators of DeFi front-end interfaces — the websites and applications through which users interact with on-chain protocols — from requiring FCA authorization.
The exclusion carries strict conditions. The provider must genuinely offer only technical access. If it exercises control over transactions, manages client relationships, or adds intermediary functions beyond passive routing, it likely falls outside the safe harbor. The guidance does not explicitly address automated market makers, yield-farming aggregators, or cross-chain bridge interfaces.
For firms uncertain about their status, the FCA noted the availability of forbearance provisions. These allow firms impacted by ambiguity in the technical services exclusion to continue operating while seeking clarity, though the details of such forbearance remain to be formalized.
Additional exclusions apply to: temporary settlement arrangements; temporary UK qualifying stablecoin holding for payment transactions; backing assets held in relation to a qualifying stablecoin; proprietary trading where the firm is not providing a service to another person; market-making on a QCATP; and transfers or exchanges of UK qualifying stablecoins under title transfer collateral or repurchase arrangements (unless the counterparty is a consumer).
The FCA's conceptual framework for DeFi rests on two principles. First, "the use of software, smart contracts, distributed ledger technology, decentralized governance mechanisms, or other technological arrangements does not, in itself, determine whether regulated activities are present." Automation describes how functions are executed, not whether those functions constitute regulated activity.
Second, "true DeFi" is not a statutory concept under the Regulated Activities Order or the Cryptoassets Regulations. The degree of decentralization exists on a spectrum. At one end, genuinely decentralized activity with no identifiable controlling entity may fall outside FCA jurisdiction. At the other, a protocol with centralized admin keys, a token-holder governance structure controlled by a small group, or an identifiable team managing upgrades may well trigger authorization requirements.
The FCA applies a case-by-case method. The "by-way-of-business" test focuses on "persons whose business model involves providing, performing, operating or otherwise being engaged in the relevant activity as an activity of their business." This narrows the perimeter to professional service providers and distinguishes them from occasional or passive participants.
Notably, the guidance leaves several areas unresolved. Decentralized autonomous organizations, fully permissionless protocols, and multi-jurisdictional service models are not comprehensively addressed. The FCA indicated further consultation in Q4 2026 on draft regulation impacts for these edge cases.
GC26/7 targets a specific behavioral shift: firms that currently treat smart contract integrations as product features must now treat them as "critical infrastructure with documented controls," according to analysis from Crypto Briefing.
The guidance applies existing FCA requirements in three areas:
Operational Resilience (SYSC 15A): Firms interacting with DeFi protocols must identify important business services that rely on decentralized infrastructure, map dependencies on smart contracts and external protocols, and set impact tolerances for disruption scenarios. The implication is that a protocol exploit, oracle failure, or governance attack on an upstream DeFi dependency constitutes an operational resilience event that firms must plan for.
Compliance and Internal Audit (SYSC 6): Firms must maintain compliance functions capable of monitoring obligations arising from DeFi interactions. Internal audit processes must cover on-chain activities with the same rigor applied to traditional financial operations.
Financial Crime Prevention (MLRs): Tighter onboarding and transaction monitoring requirements apply to DeFi access points. Firms must address money laundering, terrorist financing, and sanctions risks arising from interactions with pseudonymous or permissionless protocols.
The guidance is primarily aimed at FCA-authorized firms using DeFi as part of regulated activities, firms seeking authorization, and those carrying on future regulated cryptoasset activities. The FCA emphasized these are illustrative examples rather than prescriptive rules, giving firms flexibility in implementation while establishing clear expectations.
The FCA's regulatory push arrives as UK crypto ownership contracts. According to FCA data from December 2025, 8% of UK adults — approximately 4.2 million people — hold cryptocurrency, down from 12% in 2024. Awareness remains at 91%.
Mean holdings per owner stand at approximately £1,842. Bitcoin accounts for 57% of holdings among UK crypto owners, followed by Ethereum at 43% and Solana at 20%.
The economic stakes extend beyond retail. The UK received approximately $217 billion in crypto value over 12 months through June 2024, ranking 12th on the Chainalysis Global Crypto Adoption Index. Crypto-related investment fraud losses reached £649 million in 2024, with crypto scams representing 66% of all investment fraud reports — a 13% year-over-year increase.
On enforcement, the FCA has issued 1,702 consumer alerts about illegal crypto promotions and removed over 900 scam websites. Of 359 crypto-related applications received since January 2020, 47 were approved — a 13% approval rate that reflects the regulator's filtering intensity.
Approximately 73 crypto trading companies are actively operating in the UK, with more than 60 holding current FCA registration under the AML regime. All must now navigate the transition to full FSMA authorization.
The UK's approach to DeFi regulation diverges from the EU's Markets in Crypto-Assets Regulation (MiCA), which has been fully applicable since December 2024. MiCA explicitly excludes decentralized finance protocols operating in a "fully decentralized" manner, though it provides no precise threshold for that label. As of October 2026, ESMA's MiCA page lists no dedicated guidance on fully decentralized services, leaving interpretation to national competent authorities across 27 member states.
The FCA, by contrast, rejects binary categorization. Its spectrum-based approach and case-by-case methodology aim to capture DeFi intermediaries that would slip through MiCA's full-decentralization carve-out. The trade-off is regulatory uncertainty for firms operating in gray areas.
Structural differences compound the divergence. MiCA provides passporting rights — a license in one EU member state covers the entire European Economic Area. The FCA framework offers no passporting; authorization is valid only within the United Kingdom. Capital requirements under MiCA are specified in the regulation itself, while UK requirements will be set by FCA rules drawing on MIFIDPRU and PSRs 2017 principles.
For firms operating across both jurisdictions, compliance obligations are overlapping but distinct. Overseas operators serving UK customers face a clear choice: seek FCA authorization, restructure service delivery to exclude UK access, or limit their UK-facing operations.
Recent MiCA enforcement underscores the divergence. On 8 October 2026, ESMA instructed regulators that licensed crypto firms must wind down services in non-MiCA-compliant stablecoins within three months. On 14 October, the EBA classified USDC as the first significant e-money token. The UK regime, still 12 months from activation, has no equivalent enforcement posture yet.
| Date | Milestone | |------|-----------| | 30 September 2026 | FCA authorization gateway opens | | 21 October 2026 | CP26/36 and GC26/7 published | | 18 November 2026 | Consultation period closes | | January 2027 | Final guidance published (GC26/7) | | 28 February 2027 | Authorization application deadline (transitional benefit) | | Spring 2027 | Final perimeter guidance published (CP26/36) | | 25 October 2027 | New cryptoasset regime takes full effect |
The FCA published its first formal DeFi guidance on 21 October 2026 through two consultation papers (CP26/36 and GC26/7), covering both the regulatory perimeter and operational expectations for authorized firms interacting with decentralized protocols.
A new "technical services exclusion" could exempt passive DeFi front-end operators from the arranging deals activity, but only if they do not exercise control over transactions or manage client relationships. The boundary conditions remain untested.
"True DeFi" has no statutory meaning in UK law. The FCA treats decentralization as a spectrum, applying a case-by-case analysis that contrasts with MiCA's binary "fully decentralized" exclusion.
Six cryptoasset activities will require FCA authorization from 25 October 2027: stablecoin issuance, safeguarding, platform operation, dealing, arranging, and staking. Existing AML registrations do not convert.
The FCA's 13% historical approval rate across 359 applications signals a high authorization bar. Firms have until 28 February 2027 to apply under transitional provisions.
Smart contract integrations must now be treated as critical infrastructure with documented controls under existing operational resilience requirements, not as passive product features.
The UK and EU approaches to DeFi regulation are diverging: the UK applies a spectrum-based, case-by-case method; the EU carved out "fully decentralized" services but provided no enforcement guidance.
The FCA's twin consultation papers represent a regulatory framework that prioritizes economic substance over technological form. The message to the crypto industry is that decentralization is not a compliance strategy — the nature of the financial activity determines regulatory status, regardless of whether it runs on smart contracts or spreadsheets.
The technical services exclusion offers a narrow safe harbor for genuine infrastructure providers, but its boundaries remain imprecise. Firms operating DeFi aggregators, cross-chain bridges, or protocol interfaces with any intermediary function face authorization requirements that carry a historically low approval rate.
With the authorization gateway open and a February 2027 deadline approaching, firms face a compressed timeline to assess their regulatory position, prepare applications, and build compliance infrastructure. The consultation window closes 18 November 2026. The economic value at stake — for an industry handling $217 billion in UK-connected crypto flows — is substantial. Whether the FCA's spectrum-based approach proves more effective than MiCA's binary exclusion at capturing DeFi risk without suppressing legitimate activity will become clearer as applications are processed and enforcement patterns emerge.