The UK’s Financial Conduct Authority has opened two consultations addressing how financial firms manage decentralised-finance risks and which crypto-related activities require permission under the country’s expanded regulatory regime.
The consultations, published on October 21, both accept comments until November 18. One concerns operational resilience and financial crime in DeFi; the other explains exclusions at the boundary of regulated crypto services.
The distinction matters for firms building an application or connecting customers to a protocol. They need to establish both whether their activity requires authorisation and what obligations apply when they carry it out.
Existing responsibilities follow firms into DeFi
The DeFi consultation, GC26/7, is directed principally at regulated firms within the relevant operational-resilience, compliance and money-laundering requirements. It explains how existing obligations can apply when a service uses decentralised technology.
The draft identifies vulnerabilities in smart contracts, compromised keys, faulty external data and dependencies between protocols as potential sources of disruption. It also highlights the difficulty customers can face obtaining redress when transactions cannot readily be reversed.
Those risks can interact. A service may execute its own code correctly while relying on a price feed or another protocol that fails. Understanding the customer-facing business therefore requires looking beyond the part of the system it directly operates.
The proposed guidance does not establish a separate new set of DeFi rules. It asks how firms identify and manage the risks created by their use of the technology within the responsibilities they already have.
A separate consultation defines the boundary
CP26/36 concerns guidance on exclusions introduced through legislative changes. Examples include some temporary settlement and stablecoin-payment arrangements, certain reserve-asset arrangements and technical services that merely enable access to another provider or a decentralised protocol.
That is a question about the service actually performed. Software that provides access and a business that carries out an activity for a customer can occupy different positions, even if the customer experiences both through a similar interface.
The FCA also describes limited flexibility for firms whose ability to complete an application has been materially affected by uncertainty over the technical-service exclusion. An otherwise complete application must still arrive within the application period; the additional time concerns incomplete elements relating to arranging permission.
Consultation and authorisation have different deadlines
Our report on the UK crypto authorisation gateway covered the application window running from September 30 to February 28, 2027. The new guidance consultations have the earlier November response deadline.
The FCA expects final guidance in early 2027. Its consultation pages identify January, while the DeFi paper uses the broader first-quarter timetable. The expanded crypto regime is due to begin on October 25, 2027.
The work parallels questions raised in France’s proposed safeguards for DeFi intermediaries, although the UK and EU processes involve different legal frameworks.
For now, firms have a chance to challenge the proposed interpretation and explain where particular activities remain unclear. The consultations do not themselves settle every borderline business model or grant permission to operate it.