On 21 October 2026, the Financial Conduct Authority ("FCA") launched Guidance Consultation GC26/7, proposing non-Handbook guidance (the "Draft Guidance") on how existing operational resilience and financial crime requirements apply to firms providing financial services using decentralised finance ("DeFi"). The Consultation runs until 18 November 2026, with final guidance expected in Q1 2027. Although the Draft Guidance introduces no new requirements, it warrants close attention. The FCA remains actively focused on this area, and firms which do not meet the standards set out in the Draft Guidance may be attractive targets for enforcement action.

Why it matters now (and may matter in future)

DeFi already represents 14-19 per cent of global cryptoasset spot trading volume, and around 8 per cent of UK cryptoasset users acquired assets via decentralised exchanges in 2025. The FCA expects this exposure to grow as the forthcoming UK cryptoasset regime beds in. The scale of criminal activity in the DeFi context is substantial – the FCA notes that, since 2016, more than USD 12 billion has reportedly been lost through DeFi and bridge hacks.

Levels of enforcement activity in some areas of the FCA's remit are lower than in previous years, but it remains committed to deploying assertive supervisory and enforcement tools where it identifies deficiencies in financial crime controls in the cryptoasset context.

Who does it apply to

The Draft Guidance targets FCA-regulated firms that interact with, facilitate access to, or provide services using DeFi and are subject to SYSC 6 (compliance, internal audit and financial crime), SYSC 15A (operational resilience) and/or the Money Laundering Regulations ("MLRs").

It is primarily intended for FCA-authorised firms that use or interact with DeFi as part of their regulated activities, including future regulated cryptoasset activities, and will also be relevant to firms seeking authorisation. It may also be useful to others engaging with DeFi, including firms involved in tokenised financial markets and agentic payments.

The Draft Guidance should be read alongside CP26/36 and PS26/18 on decentralisation, the cryptoasset perimeter and authorisation (see previous Clifford Chance Regulatory Update here). FCA non-Handbook guidance is not binding and need not be followed where a firm otherwise complies with the Principles and applicable rules, although it may inform enforcement decisions and the FCA will not take action for behaviour it considers consistent with guidance current at the time (ENFG 3.4.2G and 3.4.3G; and DEPP 6.2.1G(4)).

How firms tend to interact with DeFi

An important practical distinction is between the underlying DeFi protocol, the businesses developing or providing interfaces to it, and any regulated firm providing related services. In common self-custodial models, including access to automated market makers and lending protocols, users connect their own wallets and authorise transactions with smart contracts, rather than instructing a regulated intermediary to execute those transactions. The interface or wallet service may be provided outside a regulated entity, while a separate regulated provider supplies an on/off-ramp or another related service. In such a model, the regulated firm’s own systems need not connect directly to the protocol: its exposure may instead arise when customers transfer assets to or from self-custodial wallets.

The compliance implications therefore depend on the nature of the service and the relevant transaction flow, not simply on whether DeFi is involved. A firm integrating a protocol, routing transactions or providing a wallet-enabled service will need to assess the dependencies supporting that service. A firm whose customers independently access DeFi may instead need to focus on the risks arising at its own entry and exit points, including, as applicable, customer and source-of-funds assessments, wallet and transaction screening, ongoing monitoring and Travel Rule requirements. Self-custody does not remove applicable obligations, but neither should firms assume that they can amend, pause or reverse transactions on protocols they do not control.

The financial crime risk picture

The 2025 National Risk Assessment flags a sharp rise in crypto-related money laundering since 2020, and the Financial Action Task Force notes that criminals and sanctioned entities increasingly turn to DeFi when centralised cryptoasset services are restricted. The FCA uses the Draft Guidance to identify DeFi features that can be exploited and complicate transaction tracing, and categorises vulnerabilities by reference to:

• Technological infrastructure: flash loans enabling market manipulation, mempool transparency enabling sandwich attacks (exploiting transaction visibility before blockchain confirmation to profit at users' expense), and weak decentralised exchange ("DEX") listing controls enabling "rug pulls" (i.e. fraudulent schemes in which developers abruptly abandon a project and abscond with investors' funds).
• Intermediary and control gaps: fragmented anti money laundering ("AML")/counter terrorist financing ("CTF")/counter proliferation financing ("CPF") responsibility, limited customer due diligence ("CDD"), and automated execution reducing opportunities to catch suspicious activity.
• Anonymity and concealment: mixers, cross-chain bridges, privacy coins, and increasingly agentic AI accelerating fund flows.
• Social engineering: phishing and other social engineering attacks leading users to approve unauthorised transactions or grant access to cryptoassets, and governance-based protocols manipulated into approving malicious changes that weaken controls or facilitate theft.
• Geographic and jurisdictional risk: operating across multiple jurisdictions can make it more difficult to identify applicable regulatory obligations and assess the overall effectiveness of financial crime controls.

The FCA also flags sanctions evasion risk, noting DeFi can heighten exposure to money laundering, terrorist and proliferation financing, and other illicit finance where controls are absent or outdated, which could in turn lead to consumer harm, financial losses, market disruption and potential national security concerns.

Key AML requirements

The Draft Guidance sets out how firms should assess and manage DeFi risks in the context of the FCA's financial crime framework:

• Risk assessments: under Regulations 18 and 18A MLRs and FCG 2.2.4, firms must factor DeFi-specific complexity, including multi-protocol flows that obscure participants and fund tracing, into their business-wide risk assessment.
• CDD/enhanced due diligence ("EDD"): under Regulations 27 and 33 MLRs, exposure to wallets, protocols or services linked to illicit activity, privacy-enhancing technology, and complex multi-protocol structures are relevant higher-risk indicators to consider when assessing whether EDD and enhanced ongoing monitoring are required.
• Monitoring and suspicious activity reports ("SARs"): firms should enhance monitoring for newly deployed cryptoassets, rug-pull indicators, layering patterns and sanctions exposure, updating approaches as suspicious activity is identified, while complying with applicable reporting obligations.
• Travel Rule: under Regulations 64A-64H MLRs, firms must still comply for in-scope transfers; non-custodial wallet transfers, though harder to verify, must still be risk-mitigated, with Regulation 64G allowing firms involved in non-custodial wallet transfers to request originator/beneficiary information from customers. Where information requested under Regulation 64G is not received, the cryptoasset business must not make the cryptoasset available to the beneficiary. Firms should maintain procedures for dealing with missing or incomplete information, assessing the associated risks and determining the appropriate treatment of the transfer.

Compliance by design

The Draft Guidance highlights that automated execution can reduce opportunities to identify and stop suspicious activity, while limiting post-execution intervention. This may accelerate the adoption of "compliance by design": (i) at points within a firm’s control, including customer onboarding, wallet interfaces and transaction submission, recognising that individual firms would not be able to affect the underlying DeFi protocols; and (ii) potentially, in future protocols that incorporate compliance by design measures, such as AML, sanctions and CDD checks that must be satisfied before transactions can execute. However, such models may remain some way off given the absence of harmonised compliance frameworks. In any case, firms would remain accountable under SYSC 6 for the effectiveness of controls on which they rely, which must be appropriately tested, monitored and capable of being updated or overridden where necessary. Where users transact independently through self-custodial wallets, or the protocol cannot be amended or paused, firms should assess whether controls around their own services adequately manage the resulting risks and limitations.

The wider enforcement landscape

The FCA is not the only authority interested in the scenarios discussed in the Draft Guidance. Incidents involving suspected fraud, theft, money laundering or other criminality may also attract law enforcement agencies with powers extending beyond the FCA's supervisory toolkit. The risks identified in the Draft Guidance therefore have significance beyond FCA compliance, potentially triggering asset-tracing, freezing and recovery action by other authorities.

In particular, Part 5 of the Proceeds of Crime Act 2002 enables specified law enforcement bodies to obtain crypto wallet freezing orders and seek forfeiture of cryptoassets believed to be recoverable property or intended for use in unlawful conduct. In practice, these powers would ordinarily be exercised by the National Crime Agency, police, HM Revenue & Customs or the Serious Fraud Office, rather than the FCA, and may have significant practical implications for firms operating in DeFi markets.

Firms may need to review controls for identifying affected wallets and assets, preserving relevant records, implementing measures to prevent inadvertent dissipation, recognising that a firm may have no technical ability to freeze assets held in a customer’s independently controlled wallet, and responding appropriately to law enforcement requests. Given information-sharing between authorities, any asset-freezing or recovery action may also prompt scrutiny of whether a firm's financial crime controls were robust enough to identify and manage the risks highlighted in the Draft Guidance.

Next steps

The Consultation closes on 18 November 2026, with final guidance due in Q1 2027. Firms engaging with DeFi should meanwhile review their perimeter analysis, reassess financial crime and sanctions risks, map the relevant legal entities, services and transaction flows, distinguish direct protocol dependencies from customers’ independent DeFi activity, and assess whether controls at the firm’s actual points of involvement are adequate.