UK FCA Opens DeFi Guidance Consultation GC26/7, Feedback Due November 18

October 22, 2026 MM Crypto Team

The FCA DeFi Guidance Consultation: What GC26/7 Actually Does

The UK Financial Conduct Authority fired the starting gun on formal DeFi guidance on October 21, launching a consultation on non-handbook guidance for decentralized finance under the reference GC26/7. The consultation closes on November 18, 2026 — giving industry participants less than a month to respond — with the final guidance planned for the first quarter of 2027. One source places the target as early as January 2027, which would make this one of the fastest-moving pieces of crypto policy in the FCA’s recent history.

The single most important thing to understand about GC26/7 is what it is not. The guidance does not create new regulatory requirements. It is explicitly non-handbook guidance — interpretive material clarifying how existing rules apply, not a new rulebook. It explains how three existing frameworks map onto firms that use or access DeFi: SYSC 15A, the FCA’s operational resilience regime; SYSC 6, covering compliance and financial crime controls; and the UK’s Money Laundering Regulations. The FCA is telling regulated firms: the rules you already follow do not stop applying just because the activity happens on-chain.

That message is sharpened by the FCA’s central warning, which cuts through years of industry wordplay. Any firm conducting regulated activities in the UK — regardless of whether it describes itself as “decentralized” — must be authorized or exempt. The label on the tin does not determine regulatory status; the activity does. For a sector that has spent years arguing decentralization places it beyond the perimeter, this is the regulator planting a flag.

A second consultation, CP26/36, opened alongside GC26/7, covering exclusions from the UK cryptoasset regime — the boundary lines determining which activities fall inside and outside the new framework. Together, the two papers form the opening act of the UK’s endgame: the full crypto regime takes effect on October 25, 2027, exactly one year from now. Guidance landing in Q1 2027 gives firms roughly six to nine months to align their DeFi operations before go-live.

Why Now: The Data Behind the FCA’s Move

Regulators rarely move on vibes alone, and the consultation arrives armed with statistics explaining the urgency. Between January and August 2026, decentralized exchanges accounted for roughly 14 to 19 percent of global crypto spot trading volume. Nearly a fifth of the world’s crypto spot trading now happens on venues with no central operator — for a conduct regulator, a market of that size at the edge of the rulebook is a supervisory gap, not a curiosity.

The UK-specific numbers tell a complementary story. In 2025, about 8% of UK crypto users accessed crypto via DEXs — a meaningful minority interacting directly with smart contracts, often without fully understanding the custody or recourse implications. Then there is the security record: DeFi and cross-chain bridge hacks have caused cumulative losses exceeding $12 billion since 2016. The 2026 chapter alone has been brutal, with tracked crypto hacks reaching $2.345 billion across 305 incidents through October 21 — including the $295 million Drift Protocol exploit whose proceeds were being funneled through Tornado Cash in the very week the FCA opened its consultation. Regulators write guidance in the shadow of the losses that motivate it.

Taken together, the data makes the FCA’s logic legible. DeFi is a material slice of global trading, a channel used by millions of UK consumers, and a recurring source of nine-figure losses. The question was never whether guidance would come, but what shape it would take — and GC26/7’s answer is clarification, not revolution.

Operational Resilience and Financial Crime: The Two Pillars

The guidance’s focus on SYSC 15A (operational resilience) and SYSC 6 (compliance and financial crime) reveals how the FCA thinks about DeFi risk. These are the same two pillars it applies to banks, brokers, and payment firms. The message is technology neutrality: a lending protocol and a lending bank face the same expectations around keeping services running and keeping criminals out.

Operational resilience in a DeFi context raises genuinely novel questions. When a firm integrates with a lending protocol or routes orders through a DEX aggregator, who is responsible when the underlying smart contract is exploited? SYSC 15A requires firms to identify important business services, set impact tolerances for disruption, and map the third parties those services depend on. Applied to DeFi, a regulated firm cannot point at a protocol’s decentralization as an excuse; it must understand its dependencies and plan for their failure.

The financial-crime pillar is thornier. SYSC 6 and the Money Laundering Regulations demand customer due diligence, transaction monitoring, and suspicious-activity reporting — but DeFi’s permissionless composability means liquidity arrives from anonymous sources, and funds can come from mixers or sanctioned addresses without the protocol performing checks. A regulated firm must therefore build its own perimeter: blockchain analytics, wallet screening, exposure limits to high-risk protocols, and escalation paths when tainted funds surface. The era of a regulated entity casually plugging into any yield farm with the best APY is, if GC26/7’s direction holds, coming to an end.

It is worth stressing what the guidance does not do: it imposes no new obligations. A firm already compliant with SYSC 15A, SYSC 6, and the Money Laundering Regulations is, in the FCA’s view, already meeting the standard. For well-run firms, that should be reassuring. For firms that treated DeFi as a compliance-free zone, it is a polite but firm correction.

A Global Pattern: 2026 Is the Year DeFi Gets Its Rulebook

The FCA’s consultation did not land in a vacuum. It arrived the same week the US Office of the Comptroller of the Currency finalized its GENIUS Act stablecoin rules, and the Cardano Foundation publicly urged the European Union not to extend its MiCA framework to DeFi. Three data points, three jurisdictions, one pattern: 2026 is the year decentralized finance gets its rulebook, whether the industry welcomes it or not. Treat those as context, not hard facts — but the pattern is unmistakable.

The contrast between approaches is instructive. The US has moved toward comprehensive stablecoin legislation with detailed reserve and disclosure requirements. The EU, having built MiCA as the world’s most ambitious crypto framework, now debates whether its perimeter should expand to DeFi — a step critics call premature and technically unworkable. The UK takes the middle path: no new statute for DeFi yet, but detailed guidance clarifying that existing rules already reach it.

For the industry, the practical implication is convergence. Whatever the jurisdictional differences, the direction is uniform: permissionless does not mean unregulated, and firms intermediating between DeFi and customers will face conduct, resilience, and financial-crime expectations that look increasingly similar across London, Washington, and Brussels. There is also a competitive dimension: Britain has positioned itself as a crypto hub, and heavy-handed rules could push innovation offshore. The FCA’s choice of non-handbook guidance over new rules may reflect precisely that calculus.

Who Should Respond — and What Happens Next

The primary audience is FCA-regulated firms that use or access DeFi — banks exploring tokenized deposits, brokers offering crypto exposure, payment firms settling on-chain. But the net is wider: industry groups, advisers, consumer organizations, and academics are all invited to respond via online form or email, with the option to request confidentiality. The quality of the final guidance will depend on whether the FCA hears from the engineers who build these protocols, not just the compliance officers who oversee them.

The timeline is tight. Feedback is due November 18 — under a month — which favors organized industry bodies over individual builders. The final guidance is slated for Q1 2027, possibly January, giving firms roughly nine months before the full regime takes effect on October 25, 2027. Firms that wait for the final version before starting gap analysis will find that runway uncomfortably short.

The sensible playbook has three steps. First, inventory every DeFi touchpoint — protocol integrations, DEX routing, staking, lending, bridge usage — and map each against SYSC 15A and SYSC 6. Second, stress-test the financial-crime controls around those touchpoints: can the firm show it knows where its on-chain flows come from and where they go? Third, engage with the consultation itself — the firms that help shape the guidance will understand it best when it lands.

The longer-term question is whether guidance will be enough. If major incidents continue — and with $2.35 billion in 2026 hack losses, they will — political pressure for harder rules will build. GC26/7 may be remembered as the moment the UK chose the measured path, or as the first step toward a perimeter covering DeFi directly. For now, the message is clear and, by regulatory standards, almost gentle: the rules you know already apply. Read them again — this time with your on-chain operations in mind.

FAQ

What is consultation GC26/7?

The FCA’s consultation paper on non-handbook guidance for decentralized finance, opened October 21, 2026. It clarifies how existing rules on operational resilience (SYSC 15A), compliance and financial crime (SYSC 6), and the Money Laundering Regulations apply to regulated firms using DeFi. It creates no new requirements.

When does the consultation close, and when is final guidance due?

Feedback is due November 18, 2026. The final version is planned for Q1 2027, with one source indicating January 2027. The UK’s full cryptoasset regime takes effect October 25, 2027.

Does the guidance apply to fully decentralized protocols?

It targets FCA-regulated firms, but the FCA stresses that any firm conducting regulated activities in the UK must be authorized or exempt — regardless of whether it calls itself “decentralized.” The activity, not the label, determines status.

The FCA has chosen clarification over confrontation — for now. GC26/7 tells Britain’s regulated firms that DeFi is not a loophole, sets a Q1 2027 deadline for final guidance, and gives the industry one month to make its case. In a week when America finalized stablecoin rules and Europe debated DeFi’s place in MiCA, the message from London fits a global pattern: the permissionless era is ending, and the rulebook era has begun.

Source: KuCoin

MM Crypto Analysis Web