The UK’s Financial Conduct Authority (FCA) has clarified that describing a cryptocurrency project as decentralized does not automatically exempt its operators from financial regulation, as the country prepares to expand oversight of digital asset businesses.
The regulator published two consultations on October 21, 2026, addressing the boundaries of cryptocurrency regulation and the operational risks associated with decentralized finance (DeFi).
The documents, CP26/36 and GC26/7, explain how the FCA intends to distinguish genuinely decentralized technical infrastructure from businesses performing regulated financial activities.
The approach focuses on what an organization actually does, whether identifiable parties exercise control and whether statutory exclusions apply. The consultations remain open until November 18, with final DeFi guidance expected in January 2027.
The proposals come ahead of Britain’s expanded cryptocurrency regulatory regime, scheduled to take effect on October 25, 2027.
FCA to Assess DeFi Control and Activities Case by Case
Under the new framework, cryptocurrency businesses conducting regulated activities in the UK will generally require FCA authorization unless a relevant exclusion or exemption applies. These activities include operating trading platforms, dealing in cryptoassets, arranging transactions, custody, qualifying stablecoin issuance and certain staking services.
The FCA recognizes that DeFi protocols can operate through automated smart contracts without conventional intermediaries. However, the presence of blockchain technology or decentralized governance mechanisms does not necessarily establish that no regulated business exists.
Where an identifiable entity controls or operates a financial service, regulatory obligations may still apply. The FCA plans to evaluate DeFi arrangements individually rather than applying a single definition to every protocol. Relevant considerations may include operational control, governance arrangements and the responsibilities performed by developers or service providers.
At the same time, the regulator acknowledges that some technical services should remain outside the authorization requirement. Its October consultation addresses exclusions for providers that merely facilitate access to services offered by third parties or decentralized protocols. Such exclusions are intended to distinguish technical infrastructure from businesses directly providing regulated financial services.
The distinction could affect decentralized exchanges, lending applications, staking platforms and companies operating interfaces connected to blockchain protocols. However, the guidance does not mean every developer, tokenholder or participant in a decentralized autonomous organization automatically requires authorization.
New Rules Emphasize Operational Resilience and Financial Crime
Alongside its regulatory perimeter consultation, the FCA published proposed guidance on managing risks associated with DeFi. The document addresses operational resilience, financial crime and compliance with existing anti-money laundering requirements.
The regulator identified risks arising from smart contract vulnerabilities, reliance on external infrastructure and the difficulty of identifying responsible parties in decentralized systems. It also highlighted challenges involving transaction monitoring and financial crime controls.
The guidance is directed primarily at FCA-regulated firms using DeFi services that already fall within relevant operational resilience, compliance or money laundering requirements. Consequently, the consultation should not be interpreted as immediately imposing identical obligations on every decentralized protocol.
Britain’s broader regulatory framework was established through the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, enacted in February. The FCA opened its authorization application window on September 30, 2026, with existing firms seeking transitional protection required to apply by February 28, 2027.
The expanded regime becomes operational on October 25, 2027. For DeFi businesses, the proposed approach creates both regulatory obligations and potential exemptions depending on their actual activities. Projects with identifiable operators may face authorization, governance and compliance requirements, while genuinely decentralized infrastructure could qualify for exclusions.
The FCA’s final guidance will be important in determining how those distinctions are applied in practice. For the cryptocurrency industry, the central message is that regulatory status depends on substance rather than terminology, making claims of decentralization insufficient on their own to establish an exemption.