A smart contract can operate without a bank, but a business that uses it may still be subject to financial regulation. The UK Financial Conduct Authority (FCA) has opened two consultations on how existing rules apply to firms using decentralized finance (DeFi) and which crypto-related activities may be excluded from its incoming authorization regime.
- GC26/7: Proposed guidance on existing obligations for firms using DeFi or giving customers access to it.
- CP26/36: Proposed boundaries and exclusions for the incoming cryptoasset regime.
- Framework start: Scheduled for October 25, 2027.
DeFi does not automatically mean “unregulated”
The FCA’s proposed approach focuses on what a business does and the service it provides. Using smart contracts, distributed ledgers or decentralized governance does not, by itself, take a firm outside regulation.
Consultation GC26/7 covers financial services firms that use decentralized protocols or give customers access to them. The FCA proposes guidance on how existing requirements may apply, including operational resilience rules under SYSC 15A, compliance and financial-crime controls under SYSC 6, and obligations under the UK’s Money Laundering Regulations (MLRs).
These obligations do not automatically apply to everyone or every project involved in DeFi. Their relevance depends on the firm, its activities and the rules in question. FCA authorization is also separate from MLR registration. Registration under the MLRs will not automatically count as authorization under the new regime.
The FCA says GC26/7 provides examples of risk-management measures, rather than creating a separate DeFi rulebook. Operational resilience requirements address a firm’s ability to manage disruptions and failures. Financial-crime controls cover steps to tackle risks such as money laundering. Software can automate parts of a service, but that does not necessarily remove the responsibilities of a regulated firm that operates the service or gives customers access to it.
Which activities could be excluded?
Consultation CP26/36 looks at the scope of the incoming cryptoasset regime: which activities may require FCA authorization and which may be outside it. Draft amendments propose exclusions for several activities involving digital assets.
The proposed categories include temporary settlement arrangements; temporary holding of qualifying UK stablecoins during payment transactions; certain arrangements involving assets that back those stablecoins; proprietary trading; qualifying market-making on regulated cryptoasset trading platforms; and technical services limited to enabling access to another company’s service or a decentralized protocol.
Proprietary trading means trading for a business’s own account, rather than providing a trading service to someone else. Market-making supports trading by supplying liquidity. The proposed exclusion is limited to qualifying activity on regulated cryptoasset trading platforms.
The technical-services exclusion does not give every software company a free pass. It covers services described as limited to enabling access to another company’s service or a protocol. A firm’s label, or the fact that its technology is decentralized, does not determine whether it qualifies.
The proposed exclusions come with conditions, and the FCA’s consultation summary does not spell out every boundary. Firms should treat the exclusions as proposals, not confirmed exemptions, until the rules are finalized.
Authorization timetable and transition arrangements
The FCA’s timetable sets October 25, 2027 as the planned start date for the new framework. Existing UK cryptoasset businesses may apply for authorization from September 30, 2026. The application window is scheduled to close on February 28, 2027.
Firms that apply within the window may continue providing eligible crypto services while the FCA reviews their applications, even if it has not made a decision by the framework’s start date. Applying does not guarantee approval. Existing MLR registration will not transfer automatically to the new authorization system.
Firms that miss the window face tighter transitional arrangements. In general, eligible businesses may continue servicing existing contracts while awaiting authorization, but they cannot use the transition to take on new business. Some firms affected by uncertainty about the technical-services exclusion may get extra time to complete certain application requirements. To qualify, they must submit an otherwise complete application within the designated window and show that the uncertainty materially affected their preparation.
The FCA opened both consultations on October 21 and says it will accept feedback until November 18, with final guidance expected in January 2027. The FCA’s stated consultation dates do not specify a year, so firms should confirm the response deadline with the regulator.
Clarity matters, but so does proportionality
Clear regulatory boundaries can help firms work out whether they need authorization, which controls to build and how long they have to prepare. The UK Cryptoasset Business Council has urged the FCA to set clear limits and proportionate requirements. It warns that overly restrictive rules could drive crypto businesses out of the UK.
That risk deserves attention, as do the problems the rules are meant to address. A software failure, compromised system or weak financial-crime controls can cause real harm to users, even when a service has no conventional intermediary. Decentralization can make responsibility harder to assign, but it does not make operational or financial risks disappear.
The consultations leave difficult questions about applying existing rules when a service relies on multiple firms, protocol participants and automated processes. The final guidance will need to give businesses workable direction without treating every decentralized service as if it had the same structure or risks.
Key questions and answers
-
Does using DeFi automatically remove a business from FCA regulation?
No. The FCA says regulation depends on the activity and service provided, not simply on whether a firm uses decentralized technology.
-
What do GC26/7 and CP26/36 cover?
GC26/7 proposes guidance on existing obligations for firms using DeFi or giving customers access to it. CP26/36 examines the boundaries of the incoming cryptoasset regime and possible exclusions.
-
Which activities may be excluded from authorization?
The proposals cover certain settlement and stablecoin-payment arrangements, proprietary trading, qualifying market-making and narrowly limited technical services. Eligibility depends on conditions that remain subject to consultation.
-
When is the consultation response deadline?
The FCA lists November 18 as the deadline, but its stated consultation dates do not specify a year. Firms should confirm the deadline directly with the FCA.
-
When does the new framework take effect?
The FCA’s timetable schedules the framework to take effect on October 25, 2027.
-
What is the authorization application deadline for existing cryptoasset businesses?
The application window is scheduled to close on February 28, 2027. Applying does not guarantee approval, and existing MLR registration will not transfer automatically.
-
What should firms do while the proposals are under consultation?
They should compare their activities with the proposed scope and timetable, and confirm deadlines and eligibility directly with the FCA. The guidance and exclusions are not final.
