FCA Consults on UK Cryptoasset Perimeter Guidance and DeFi Operational Resilience and Financial Crime Guidance

The Financial Conduct Authority (“FCA”) has published a consultation paper (“CP26/36”) on draft perimeter guidance for regulated cryptoasset activities, accompanied by a guidance consultation (“GC26/7”) on decentralised finance (“DeFi”).

Background

From 25 October 2027, the Financial Services and Markets Act 2000 (“FSMA”) (Cryptoassets) Regulations 2026 will introduce new regulated cryptoasset activities into the UK’s regulatory perimeter. This means that any person carrying on such activities by way of business in the UK will need FCA authorisation unless they can benefit from an exemption or exclusion. 

In September 2026, the FCA published perimeter guidance in PS26/18 on the scope of the new regime. However, the day before PS26/18 was published, HM Treasury laid the FSMA 2000 (Cryptoassets) (Miscellaneous Amendments) Regulations 2026, which introduce a number of exclusions from authorisation. CP26/36 therefore proposes amendments to PERG 18 and PERG 8 to explain how such exclusions apply and also gives new guidance on how decentralisation affects perimeter analysis. Separately, GC26/7 sets out non-Handbook guidance on how existing operational resilience and financial crime requirements apply to firms providing financial services using DeFi. The FCA states that it is to be read alongside CP26/36 and PS26/18.

Key Proposals

CP26/36

CP26/36 proposes guidance on the following areas:

• decentralisation: the perimeter is technology neutral, so the use of smart contracts, distributed ledger technology or distributed governance does not of itself determine whether a person carries on a regulated activity, and the analysis turns on substance rather than labels such as “DeFi” or “DAO”; the “by way of business” test applies separately to each participant; and overseas elements do not by themselves take an activity outside the UK, with UK-based persons involved in governance or development potentially enough to establish a territorial link; 
• safeguarding exclusions: the guidance covers the revised article 9Q exclusion for temporary settlement arrangements, together with new exclusions for backing assets of UK qualifying stablecoins (articles 9QB and 43A), for UK qualifying stablecoins held temporarily in connection with payment transactions (article 9QA), and for arrangements operated by recognised and third-country central securities depositories; issuers relying on the backing asset exclusions must still comply with CASS 16; 
• qualifying stablecoins: the guidance explains the new “UK qualifying stablecoin” sub-type on which several exclusions depend, sets out indicators distinguishing qualifying stablecoins from electronic money, and addresses the article 9Z10A exclusions from dealing and arranging for payment-related transfers and certain collateral arrangements, along with corresponding Financial Promotion Order changes; the transfer exclusion is unavailable where the transfer is subject to a right of return, as in qualifying cryptoasset lending or borrowing; 
• proprietary trading and market making: dealing as principal is excluded where it is not for the purpose of providing a service to another person, or where the firm acts as a market maker on a qualifying cryptoasset trading platform. In the former case, indicators of a service include having retail counterparties, fees/commissions being charged to counterparties, and the firm holding itself out as a liquidity provider; and 
• technical service providers: the new article 9Z2A exclusion from arranging is available only to persons that are neither authorised persons nor payment service providers and that “merely” provide technical access, for example by acting on the user’s instructions without selecting, recommending or ranking counterparties, protocols or execution routes; the exclusion does not extend to dealing, the financial promotion regime or regulation 14A of the Money Laundering Regulations (“MLRs”).  

GC26/7

GC26/7 applies to firms subject to SYSC 15A, SYSC 6 and the MLRs, and does not create new requirements. On operational resilience, it explains how firms should identify important business services, set impact tolerances, map dependencies such as smart contracts, carry out scenario testing and manage third-party arrangements. SYSC 15A will apply to all cryptoasset firms from October 2027. On financial crime, it identifies DeFi-specific risks such as flash loans, mixers, cross-chain layering and social engineering. 

Next Steps

Both consultations close on 18 November 2026. The FCA expects to publish final guidance under GC26/7 in Q1 2027 and under CP26/36 in spring 2027. The authorisation application window opened on 30 September 2026 and closes on 28 February 2027, and the new regime takes effect on 25 October 2027. 

CP26/36 and GC26/7 are available here and here.

Our previous coverage of PS26/18 is available here.