UK FCA consults on guidance for decentralised finance

According to the Financial Conduct Authority, firms are increasingly using decentralised finance (DeFi) to provide financial services. The FCA is consulting on new guidance to help firms comply with its rules when using DeFi. The consultation (GC26/7) closes on 18 November 2026.

Defining DeFi

The FCA explains that DeFi is a general term for financial services that are facilitated by distributed ledger technology, typically automate transactions and processes through open and interoperable technology, and in some cases operate without a traditional intermediary. The FCA notes that DeFi is used in the cryptoasset ecosystem, tokenised financial markets and agentic payments.

Firms remain responsible for complying with applicable legal and regulatory requirements when they use or interact with DeFi. The FCA’s draft guidance focuses on how firms can manage operational resilience and financial crime risks.

Operational resilience

The FCA observes that DeFi can change the nature, scale and speed of operational risks through reliance on smart contracts, automated execution, decentralised governance and interconnected protocols. Firms should consider whether their use of DeFi introduces additional risks, including security risk, dependence on third parties and challenges in responding to operational incidents.

Where firms use DeFi to provide financial services, they should consider how they can maintain operational resilience throughout the lifecycle of a product or service by, for example:

• Applying appropriate controls, safeguards and contingency mechanisms

• Testing how systems perform under a range of severe but plausible scenarios before deployment

• Identifying vulnerabilities and addressing them in a timely manner

• Monitoring services on an ongoing basis, including dependencies on third parties and critical infrastructure

• Responding to incidents effectively and considering how risks may spread across interconnected services and markets

The FCA notes that the appropriate approach will depend on each firm’s business model, activities and risk profile.

Financial crime

Firms should keep their assessment of financial crime risks up to date and, where applicable, apply SYSC 6, the Financial Crime Guide and the Money Laundering Regulations (MLRs) when providing services using DeFi. The FCA expects firms to consider how criminals could exploit vulnerabilities in DeFi for illicit purposes. For example:

• Business-wide risk assessments should factor in the complexity of multi-protocol transaction flows and difficulties in identifying participants and tracing funds

• Systems and controls should be reassessed for DeFi-specific exposures such as illicit-activity links to wallets, smart contracts or protocols, and reliance on third-party infrastructure or higher-risk jurisdictions

• When conducting customer due diligence, firms should consider exposure to illicit or sanctioned wallets, privacy-enhancing tech, and transaction structures spanning multiple protocols or chains

• Ongoing monitoring should be risk-sensitive and consider risks such as newly deployed tokens or smart contracts, indicators of fraud such as potential rug pulls, layering patterns and sanctions exposure

• Firms should assess whether their use of DeFi affects their ability to obtain, verify, transmit and retain the information required under the travel rule in the MLRs and have procedures for non-custodial wallet transfers and missing or incomplete originator or beneficiary information

Next steps

New cryptoasset activities will be regulated in the UK from 25 October 2027. Firms have been able to submit applications for authorisation since 30 September 2026. Applicants who plan to use DeFi in connection with these future regulated cryptoasset activities should factor the guidance into their preparations for the new regime and documentation they share with the FCA. The guidance will also be of interest to firms that are already FCA-authorised and that engage with DeFi.

The FCA has separately consulted on revised perimeter guidance on the new cryptoasset regime, including in relation to decentralisation. Read our blogpost: UK FCA proposes updates to crypto perimeter guidance. The consultation period for both papers runs to 18 November 2026 and the FCA plans to finalise its DeFi guidance in Q1 2027.