The UK Financial Conduct Authority opened two consultations on October 21 and 22, 2026, that move UK DeFi compliance rules from theory into concrete regulatory expectations for firms using decentralized finance. The first consultation, Guidance Consultation GC26/7, addresses how businesses must comply with existing anti-money laundering and financial crime rules, while the second, CP26/36, covers exemptions for certain cryptoassets under recent legislative changes.

The proposals matter because they clarify how the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 apply to DeFi structures, rather than creating new legislation. According to the FCA, the guidance "seeks to clarify existing rules rather than establish new policy."

What the UK DeFi compliance rules cover

The draft guidance focuses on operational resilience and financial crime risks for FCA-regulated firms that provide financial services using DeFi. It captures entities meeting the definition of cryptoasset exchange provider or custodian wallet provider under the MLRs, whatever their legal form, whether company, foundation or DAO, and also reaches firms not authorized by the FCA that interact with DeFi.

The FCA points firms toward three existing frameworks: SYSC 15A covering operational resilience, SYSC 6 addressing compliance and financial crime, plus the Money Laundering Regulations. Running a DEX web interface, offering fiat conversion services, or enabling peer-to-peer swaps via a protocol's front-end could all fall within scope under the draft interpretation, even where the underlying smart contracts are permissionless.

Any firm performing regulated activities in the UK needs authorization or an exemption, and labeling itself decentralized changes nothing. The FCA said a firm cannot simply hide behind a smart contract to escape its obligations.

Operational resilience and financial crime risks

The guidance requires regulated firms to examine how DeFi can disrupt their services, citing specific risk vectors including smart contract coding flaws or exploits, cross-chain bridge failures, oracle price data errors, and third-party dependencies that create single points of failure. A firm should understand how a disruption could affect customers and select suitable controls.

On the financial crime side, the draft covers anti-money laundering, customer due diligence and transaction monitoring. The FCA's effectiveness depends on how precisely it defines the perimeter, according to a ComplyCube assessment, and these consultations move from high-level warnings to specific obligations.

The rules do not require every user, wallet or protocol to complete KYC. Instead, the obligations fall on regulated firms that engage with DeFi, connect customers to it, or deliver financial services through it, while an ordinary person using a decentralized app sits in a different position from a regulated firm.

Deadlines and the authorization gateway

Applications under the FCA's new crypto regulatory regime opened on September 30, 2026, with a hard compliance deadline of February 28, 2027. Missing that date exposes firms to enforcement action and the loss of their UK-facing services.

The consequences of missing the February 28, 2027, deadline extend beyond regulatory fines. The watchdog has power to halt UK-facing services, and partner banks may freeze or terminate accounts, which could sever the fiat on/off-ramp pipeline and make the business unviable for UK users.

The second consultation addresses exemptions for certain cryptoassets, including stablecoins and reserve assets, under the Financial Services and Markets Act 2023. The exemption window would let qualifying stablecoin issuers and service providers keep operating ahead of full authorization, taking effect in October 2027.

Truly decentralized carve-out and industry reaction

The FCA is weighing a "truly decentralized" carve-out limited to protocols that have no identifiable governance or control mechanisms at all, a threshold many DAOs will find difficult to satisfy, according to a Freshfields analysis. The regulator will assess each case individually, and its rules apply where there is an identifiable controlling entity, meaning genuinely decentralised activity may sit outside the FCA's jurisdiction.

The UK Cryptoasset Business Council described DeFi as among the most innovative parts of financial services and said the UK should establish clear and proportionate regulatory boundaries. "The UK can still strike the right balance – clear perimeter rules, expectations that stay proportionate, and a framework that lets responsible innovation take root here instead of migrating elsewhere […] the FCA needs to get this right," the council said.

DeFi teams that have so far run their operations without formal KYB/KYC processes, transaction monitoring, or suspicious activity reporting must now build those capabilities or risk being shut out of the UK market. The guidance establishes that these entities must register, perform KYC/KYB checks, run transaction monitoring, and report suspicious activity.

Consultation timeline and next steps

The public can send feedback on GC26/7 until November 18, 2026, through the FCA website form or to GC26-7@fca.org.uk. The FCA plans to publish final guidance in January 2027 after reviewing responses, though some reports indicate Q1 2027.

A separate FCA paper on crypto-asset scope, CP26/36, was released the same day with its own timetable. For businesses, the UK DeFi compliance rules may prompt a review of four areas: risk controls, third-party dependencies, customer checks and transaction monitoring.

The consultations landed about three weeks after the FCA's authorization gateway for cryptoasset firms opened on September 30, 2026. The regulator is aiming its attention at intermediaries, the firms that sit between users and protocols, rather than the code itself.

Conclusion

The FCA's October 2026 consultations establish that DeFi firms operating in the UK must comply with existing AML, operational resilience and financial crime rules, with a registration deadline of February 28, 2027, and final guidance expected in January 2027. The regulator has made clear that calling a service decentralized does not remove authorization requirements, and firms that fail to register risk enforcement action and loss of UK banking access. Industry feedback is due by November 18, 2026.

Frequently Asked Questions

What is the FCA's February 28, 2027 deadline for DeFi firms?

The FCA opened applications for its new crypto regulatory regime on September 30, 2026, and requires businesses to achieve compliance by February 28, 2027. Firms that fail to register by that date risk enforcement action and removal of their UK-facing services.

Does the FCA DeFi guidance create new rules?

No. The FCA said the guidance "seeks to clarify existing rules rather than establish new policy." It interprets how the Money Laundering Regulations 2017, SYSC 15A and SYSC 6 apply to DeFi structures rather than creating new legislation.

Who must comply with the UK DeFi compliance rules?

The rules apply to FCA-regulated firms that interact with DeFi, help customers reach it, or offer financial services through it, including cryptoasset exchange providers and custodian wallet providers regardless of legal structure. Firms not authorized by the FCA but interacting with DeFi are also covered.

What is the truly decentralized carve-out in the FCA proposal?

The FCA is considering an exemption for protocols with zero identifiable governance or control mechanisms. According to a Freshfields analysis, this is a high bar that many DAOs will struggle to meet, and the regulator will take a case-by-case approach.

When will the FCA publish final DeFi guidance?

The consultation closes on November 18, 2026, and the FCA plans to publish final guidance in January 2027 after reviewing feedback. Some reports indicate the final guidance will arrive in Q1 2027.