TL;DR: A separate FCA consultation examines how DeFi-facing firms can manage operational and financial-crime risks without treating every protocol identically.
The UK Financial Conduct Authority published a second crypto document on October 21 alongside its work on the regulatory perimeter. Guidance consultation GC26/7 focuses on operational resilience, financial crime and money-laundering obligations for firms providing financial services through decentralised finance.
Its approach reflects a familiar problem: a smart contract may operate automatically, but a business building services around it can still make decisions about access, safeguards, monitoring and customer relationships. Regulators want to know what responsibilities attach to those activities.
The FCA’s document offers examples of risk-management measures and asks for industry feedback. It is not a declaration that every DeFi software developer requires authorisation, nor a final list of new binding rules. The regulator explicitly recommends reading it alongside CP26/36, its consultation on the boundary of regulated crypto activity.
Both consultations close on November 18. As the UK moves toward its October 2027 crypto regime, firms will need to distinguish the technology they use from the services they actually provide. The distinction is important for consumer protection, but also for avoiding a compliance model that treats an open-source protocol like a traditional custodial intermediary.
Written by the News Desk and edited by Samuel Rae.
