UK FCA Opens DeFi Consultations Ahead of 2027 Rules

FCA launches two DeFi consultations

The UK Financial Conduct Authority (FCA) has launched two formal consultations to clarify how decentralized finance (DeFi) activities will be treated under Britain’s new cryptoasset regime, which is scheduled to take effect in October 2027. The consultations aim to explain how existing financial services rules — including operational resilience, anti-money laundering (AML) and financial crime requirements — apply to firms using decentralized protocols, and to define which activities could fall outside the perimeter of FCA authorization.

The consultations opened on October 21, with industry responses invited until November 18. Final guidance is expected in January 2027, and the full framework will become effective on October 25, 2027.

Consultation 1: DeFi compliance requirements (GC26/7)

Scope and intent

GC26/7 targets firms that either use decentralized protocols directly or provide clients with access to them. While DeFi systems often rely on smart contracts, automated execution and distributed ledgers, the FCA reiterates that regulated firms remain accountable for meeting their existing compliance obligations when they interact with these technologies.

The guidance focuses on how provisions in the FCA Handbook apply to decentralized models, particularly operational resilience under SYSC 15A and management and controls under SYSC 6, alongside responsibilities arising from the UK’s Money Laundering Regulations. The regulator emphasizes that decentralization does not remove legal or compliance duties from regulated entities.

Risk areas and suggested mitigations

The consultation highlights several material risks presented by open, interoperable DeFi systems: operational failures, governance weaknesses, and heightened vulnerability to money laundering and other financial crime. The FCA sets out example measures firms could adopt to manage those risks — for example, enhanced transaction monitoring, resilient incident response plans tailored for decentralized infrastructure, robust vendor and smart contract assurance, and governance arrangements for interacting with permissionless protocols.

Crucially, the FCA stops short of creating a bespoke rulebook exclusively for DeFi. Instead, it aims to demonstrate how existing rules apply where businesses choose to deploy or connect to decentralized finance protocols.

Consultation 2: Perimeter and exemptions (CP26/36)

Which crypto activities might be excluded?

CP26/36 examines the boundaries of the new cryptoasset regime and sets out proposed exclusions introduced by the draft Cryptoassets (Miscellaneous Amendments) Regulations 2026. The draft exclusions would exempt certain activities that feature digital assets but do not necessarily require FCA authorization. Examples include:

• Temporary settlement arrangements and temporary holding of qualifying UK stablecoins involved in payment transactions.
• Specific arrangements related to the assets that back qualifying stablecoins.
• Proprietary trading where a firm trades on its own account without offering services to third parties.
• Qualifying market-making on regulated cryptoasset trading venues.
• Technical service providers whose role is limited to enabling access to another firm’s services or to decentralized protocols.

The regulator makes clear that the use of smart contracts, distributed ledger technology or decentralized governance does not in itself determine whether an activity falls inside or outside the regulatory perimeter. Instead, the functional nature of the service, and who is performing it, will determine whether FCA authorization is required.

Guidance on perimeter assessment

The FCA’s perimeter guidance, first published in September, is referenced in CP26/36 as the initial framework firms should use to assess whether their activities require permission. The new consultation builds on that guidance to clarify borderline cases and describe how the proposed exclusions would work in practice.

Application timeline, flexibility and transitional arrangements

Existing UK cryptoasset businesses have been able to apply for FCA authorization since September 30, 2026. The formal application window closes on February 28, 2027. Firms that submit a complete application within that window may continue offering eligible crypto services while their applications are processed, even if the regulator has not decided by the time the new rules take effect.

The FCA acknowledges that the timing of legislative amendments has created uncertainty for some firms, especially those relying on the technical services exclusion. To address this, the regulator has proposed limited flexibility: firms can receive extra time to satisfy certain application requirements provided they submit an otherwise complete application within the prescribed window and can show that legal uncertainty materially affected their ability to prepare supporting materials.

Firms that miss the application window will face more restrictive transitional arrangements, typically restricting eligible activity to servicing existing contracts while awaiting authorization. The FCA also makes clear that existing registration under the Money Laundering Regulations will not automatically transfer into the new authorization regime.

Industry reaction and international context

Industry groups have largely welcomed the opportunity to engage with the FCA’s proposals, while urging the regulator to ensure that DeFi rules are proportionate and technology-neutral. The UK Cryptoasset Business Council has called for clear regulatory boundaries and proportionate compliance expectations, warning that overly restrictive requirements risk driving firms offshore.

A related policy debate is unfolding in France, where regulators have recently proposed placing greater responsibility on crypto platforms that facilitate customer access to DeFi services. That proposal would oblige platforms to assess and monitor the risks associated with decentralized protocols they surface to customers — a theme that echoes questions raised in the FCA consultations about who bears operational and security responsibilities in decentralized ecosystems.

What this means for firms and users

For crypto businesses operating in the UK, the consultations signal that decentralization will not exempt firms from mainstream regulatory standards on operational resilience, AML and client protections. Firms planning to use or integrate decentralized protocols should review SYSC 15A and SYSC 6 obligations, enhance smart-contract due diligence, and consider how to implement transaction monitoring and governance controls appropriate to DeFi models.

For users and institutional participants, the consultations aim to bring greater clarity about which DeFi services will be subject to FCA oversight and which may be provided under defined exemptions — a step intended to balance innovation in decentralized finance with consumer protection and market integrity.

The consultation period runs until November 18, with final guidance expected in January 2027. Market participants should respond to the consultations and use the interim months to prepare authorization paperwork if they intend to operate in the UK under the new cryptoasset framework by October 2027.