DeFi guidance: the FCA consults on resilience in GC26/7
GC26/7 explains how SYSC 15A, SYSC 6 and the Money Laundering Regulations apply to firms using DeFi. Comments close on 18 November 2026.
What changed
On 21 October 2026 the FCA published GC26/7, a consultation on non-Handbook guidance for firms that provide financial services using decentralised finance (DeFi). It explains how existing requirements apply when firms use or interact with DeFi: operational resilience under SYSC 15A, financial crime systems and controls under SYSC 6, and the Money Laundering Regulations. The FCA says the guidance does not create new regulatory requirements. Firms may interact with DeFi by receiving cryptoassets transferred by clients, by partnering with firms that use DeFi, or by engaging directly with DeFi protocols.
On operational resilience, the FCA says firms should identify the service delivered to the client as the important business service, not the underlying technology or protocol. Mapping should cover dependencies such as the underlying ledger and settlement infrastructure, external protocols, smart contracts, oracles and bridges, and internal functions including key management. The FCA also says that where a firm cannot adequately identify and manage the risks of a proposed activity, it should consider whether the activity is appropriate for its business and clients. All cryptoasset firms must comply with SYSC 15A from October 2027, when new cryptoasset activities come into the perimeter on 25 October 2027. The guidance should be read with CP26/36 and PS26/18 on the cryptoasset perimeter. Comments are due by 18 November 2026, and the FCA plans to publish final guidance in January 2027.
The rules it touches: SYSC 15A.2.1R, SYSC 15A.4.1R, SYSC 6.3.1R.
What to do
- Now: record every way your firm touches DeFi, including client transfers, partners that use DeFi and direct use of protocols, in your business-wide risk assessment.
- By 18 November 2026: send comments on GC26/7 through the FCA's online response form if your firm uses or plans to use DeFi.
- January 2027: test your important business services, mapping and financial crime controls against the final guidance when the FCA publishes it.
- Before 25 October 2027: cryptoasset firms coming into scope should have their SYSC 15A mapping of protocols and smart contracts in place.
Our view
In our view the most useful line in GC26/7 is that the important business service is what the client receives, not the protocol behind it. That framing moves the work from technology teams to the people who own client outcomes. The FCA's advice that firms should question an activity they cannot adequately risk-manage is also a fair test to put to any DeFi proposal before it reaches the board.
How this was produced: drafted automatically from the source and our FCA Handbook mirror; every Handbook reference was checked against the provision text before publication.