FCA Consults on UK Cryptoasset Perimeter Guidance and DeFi Operational Resilience and Financial Crime Guidance - The National Law Review

The Financial Conduct Authority has published a consultation paper on draft perimeter guidance for regulated cryptoasset activities, accompanied by a guidance consultation on decentralised finance.

The FCA is consulting on CP26/36 and GC26/7, with responses due by 18 November 2026.

The new rules will be enforced from 25 October 2027, when the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 come into force.

New perimeter guidance

The consultation proposes amendments to PERG 18 and PERG 8 to explain how exclusions from authorisation will apply under the new regime.

The guidance is technology neutral, stating that the use of smart contracts or distributed ledger technology does not of itself determine whether a person carries on a regulated activity.

The analysis turns on substance rather than labels such as 'DeFi' or 'DAO', with the 'by way of business' test applying separately to each participant.

Overseas elements do not by themselves take an activity outside the UK, with UK-based persons involved in governance or development potentially enough to establish a territorial link.

The guidance also covers revised exclusions for temporary settlement arrangements and for backing assets of UK qualifying stablecoins.

Issuers relying on the backing asset exclusions must still comply with CASS 16.

The guidance explains the new 'UK qualifying stablecoin' sub-type, sets out indicators distinguishing qualifying stablecoins from electronic money, and addresses exclusions from dealing and arranging for payment-related transfers.

The transfer exclusion is unavailable where the transfer is subject to a right of return, as in qualifying cryptoasset lending or borrowing.

Dealing as principal is excluded where it is not for the purpose of providing a service to another person, or where the firm acts as a market maker on a qualifying cryptoasset trading platform.

A new article 9Z2A exclusion from arranging is available only to persons that are neither authorised persons nor payment service providers and that 'merely' provide technical access.

The exclusion does not extend to dealing, the financial promotion regime or regulation 14A of the Money Laundering Regulations.

DeFi operational resilience and financial crime

The guidance consultation GC26/7 sets out non-Handbook guidance on how existing operational resilience and financial crime requirements apply to firms providing financial services using DeFi.

It applies to firms subject to SYSC 15A, SYSC 6 and the Money Laundering Regulations, and does not create new requirements.

On operational resilience, it explains how firms should identify important business services, set impact tolerances, map dependencies such as smart contracts, carry out scenario testing and manage third-party arrangements.

SYSC 15A will apply to all cryptoasset firms from October 2027.

On financial crime, it identifies DeFi-specific risks such as flash loans, mixers, cross-chain layering and social engineering.

Next steps

The FCA expects to publish final guidance under GC26/7 in Q1 2027 and under CP26/36 in spring 2027.

The authorisation application window opened on 30 September 2026 and closes on 28 February 2027.

The new regime takes effect on 25 October 2027.