FCA Consults on DeFi and Crypto Perimeter Guidance

A year before the UK’s crypto regime takes effect, the Financial Conduct Authority is still drawing the line around it. The regulator opened two consultations on 21 October: one on how the newest legal exclusions change who needs permission, and one on how firms using decentralised finance (DeFi) should manage operational resilience and financial crime risks.

Both are proposals and both close on 18 November. They matter most to firms near the edge of the perimeter, such as those that offer technical access to decentralised protocols or hold stablecoins briefly for payments, which now need to know whether they need authorisation before the regime starts on 25 October 2027.

New exclusions follow a late change to the law

The first paper, CP26/36, sets out draft guidance on exclusions introduced by the draft Cryptoassets (Miscellaneous Amendments) Regulations 2026. According to the FCA, they include temporary settlement arrangements, temporary UK qualifying stablecoin holding arrangements for payment transactions, and arrangements involving backing assets held for a UK qualifying stablecoin.

The list also covers proprietary trading where a person is not providing a service to another person or acts as a market maker on a QCATP, and “technical services that merely allow access to services provided by a third party or to a decentralised protocol.” The FCA says the guidance aims to help firms understand whether they need its permission, “reducing the risk of them inadvertently breaching the perimeter when the regime comes into force on 25 October 2027.”

The timing was awkward. The FCA published perimeter guidance in PS26/18 in September, but the government laid a second statutory instrument with further exclusions the day before, the regulator says. It acknowledges this “will have created uncertainty for a small number of firms around the need to be authorised.”

Some applicants will get extra time

The FCA is offering limited relief. Where a firm can show that uncertainty over the technical services provider exclusion materially affected its ability to submit a complete application, “we will exercise some forbearance,” the regulator says. Provided the rest of the application is complete, such firms will get additional time on the parts relating to the arranging permission.

That window matters. The application period for firms with existing UK crypto business opened on 30 September 2026 and closes on 28 February 2027, and firms wanting to benefit from the savings provision must apply within it. The FCA urges affected firms to use its pre-application support service.

DeFi firms get guidance on resilience and money laundering

The second paper, GC26/7, is non-Handbook guidance for FCA-regulated firms that provide financial services using DeFi. It applies to firms in scope of the operational resilience rules (SYSC 15A), the compliance and financial crime rules (SYSC 6) and the Money Laundering Regulations.

The FCA defines DeFi as financial services facilitated by distributed ledger technology with high levels of automation, open and interoperable technology and, in some cases, no traditional intermediary. Those features “can expose firms and their clients to increased operational resilience and financial crime risks,” it says. The guidance describes the current risk landscape and gives illustrative examples of measures firms may wish to consider, and the FCA says it should be read alongside CP26/36.

For compliance teams, the practical point is that using a smart contract or protocol does not take a regulated firm outside its existing anti-money laundering and resilience duties. The examples in GC26/7 are likely to become the benchmark supervisors use when they ask how a firm controls risks it cannot fully see on-chain.

The FCA says it plans to publish final versions of both sets of guidance in January 2027. Before that, responses are due by 18 November, and the application window for existing crypto businesses shuts on 28 February.