FCA DeFi Consultation GC26/7: What It Means If You Use DeFi Apps in the UK

The FCA's new DeFi papers don't ban DeFi apps or change what you can do with your own wallet today. GC26/7 is draft guidance telling FCA-regulated firms how existing operational resilience and anti-money-laundering rules apply when they use DeFi, and CP26/36 explains where the cryptoasset perimeter stops. Both opened on 21 October 2026 and close on 18 November 2026.

Most coverage so far is written for compliance teams. But if you swap tokens on a decentralised exchange, or your exchange app offers a "DeFi yield" button, these papers tell you a fair amount about how your experience will change once the new regime starts on 25 October 2027.

What are GC26/7 and CP26/36?

They're two linked FCA consultations published on 21 October 2026. GC26/7 is non-Handbook guidance on how operational resilience (SYSC 15A), financial crime (SYSC 6) and Money Laundering Regulations duties apply to firms using DeFi. CP26/36 updates the FCA's perimeter guidance, setting out which crypto activities need authorisation and which fall under exclusions.

The FCA says GC26/7 "does not create new regulatory requirements"; it explains how existing rules apply when a regulated firm routes customers to a protocol, trades on a DEX or joins lending and staking pools. CP26/36 is the trickier one. It proposes exclusions for things like temporary settlement arrangements, proprietary trading where nobody else is being served, and technical services that only give access to someone else's service or a decentralised protocol.

Paper	Type	Who it's aimed at	Closes	Final version
GC26/7	Draft non-Handbook guidance	FCA-regulated firms using or giving access to DeFi	18 November 2026	Planned Q1 2027 (FCA web page says January 2027)
CP26/36	Consultation on perimeter guidance (PERG)	Anyone working out whether they need FCA authorisation	18 November 2026	FCA aims for January 2027
New regime	Legislation and FCA rules	All UK cryptoasset firms	n/a	In force 25 October 2027

Photo: Yirba, CC0, via Wikimedia Commons

Does the FCA's DeFi guidance affect ordinary users?

Not directly. Nothing in either paper stops you holding a self-custody wallet or using a DEX. The guidance is aimed at regulated firms, but it lists consumers among the groups that may be interested, and it shapes how firms that give you DeFi access must screen transactions, test smart-contract dependencies and plan for outages.

Here's where you'll feel it. The FCA expects firms to understand the risks of the protocols they plug customers into, from smart contract bugs and oracle failures to bridges and outside service providers. Where a firm can't adequately understand and manage those risks, the guidance says it should consider whether the activity is appropriate for its business and clients. In plain English: some exchanges may quietly drop DeFi features they can't vouch for.

The FCA says around 8% of UK crypto users acquired crypto through decentralised exchanges in 2025, and that DEX trading made up roughly 14% to 19% of global spot volume between January and August 2026. It also cites industry data that more than US$12bn has reportedly been lost through DeFi and bridge hacks since 2016. (One of its case studies is the April 2026 KelpDAO bridge attack, which we covered in our KelpDAO exploit explainer.)

Where does the cryptoasset perimeter stop?

The perimeter is the line between activities that need FCA authorisation and those that don't. CP26/36 says calling yourself "DeFi" doesn't move that line. If someone carries on a regulated activity by way of business in the UK and no exclusion applies, they need authorisation, however the code or governance is arranged.

The FCA puts it bluntly in GC26/7: using software, smart contracts, DLT or distributed governance "does not, by itself, determine" whether an activity is regulated. According to Linklaters' summary of CP26/36, the FCA may look at who designed the arrangement's material functions, who sets its parameters, who runs or updates it and who benefits commercially. Spreading decisions across lots of people doesn't automatically remove the need for authorisation.

The technical services exclusion matters most for app users. It covers services that only give access to a third party's service or to a decentralised protocol. Linklaters notes it isn't a general carve-out for anything automated or software-based; the test separates plain technical access from real intermediation. So a front-end that just passes your instruction to a protocol may sit outside the perimeter, while one that picks your route, takes a cut and markets itself as a service is likelier to be inside. That's a reading of draft guidance, not a ruling, and the final wording could shift.

Will DeFi still be safe or protected in the UK?

No more than it is now. The FCA's own paper says DeFi transactions are hard to reverse and there may be no central authority able to recover assets or compensate people. Guidance for firms doesn't change that for a direct wallet-to-protocol swap you make yourself.

Reach DeFi through an authorised firm from October 2027 and that firm answers for its own conduct and controls. Connect your own wallet to a protocol and you're largely on your own, as today. The paper's list of social engineering risks is worth reading for that alone, from phishing approvals to compromised front-ends. The FCA's Bybit case study describes attackers tampering with a wallet interface so a transaction appeared legitimate to the staff approving it.

Honestly, I think this is the right balance. The FCA isn't pretending it can police a smart contract. It's putting the burden on the firms that sit between you and the protocol, which is the one place a regulator can actually reach.

How do you respond to the FCA's DeFi consultations?

Anyone can respond, including individual users. Send views on GC26/7 through the online form on the FCA's consultation page or by email to GC26-7@fca.org.uk before 18 November 2026. CP26/36 has its own response route on its page. Say whether you want your response kept confidential.

GC26/7 asks six questions. The ones a user can answer from experience are Q1 and Q3, which ask whether the FCA has described the operational resilience and financial crime risks correctly, and Q5, which asks about other DeFi risks it should consider. You don't need to write like a lawyer. A short, specific account works: an outage that froze your funds, a phishing approval you nearly signed. Concrete examples help a regulator more than general opinions.

Frequently asked questions

Is DeFi being banned in the UK? No. GC26/7 is guidance for regulated firms and creates no new requirements. CP26/36 clarifies which activities need authorisation. Neither stops individuals using self-custody wallets or decentralised exchanges, though some regulated apps may limit DeFi features they can't manage safely.

When does the FCA DeFi consultation close? Both GC26/7 and CP26/36 close on 18 November 2026. The FCA plans to publish final guidance in early 2027; the GC26/7 web page says January and the paper itself says Q1 2027. The wider crypto regime starts on 25 October 2027.

Can I respond to an FCA consultation as an individual? Yes. The FCA lists consumers among the groups the GC26/7 consultation may interest. You can use the online form or email GC26-7@fca.org.uk, and you can ask for your response to be treated as confidential or say you're happy to be named.

Does a DeFi app need FCA authorisation? It depends what it does. Under CP26/36, a pure technical service giving access to a protocol may fall under an exclusion, but anyone carrying on a regulated activity by way of business in the UK still needs authorisation, even if they describe themselves as DeFi.

Will I get compensation if a DeFi protocol is hacked? Usually not. The FCA itself notes there may be no central authority able to recover assets or compensate consumers. Using DeFi through an authorised firm after October 2027 puts that firm under FCA rules, but a direct swap from your own wallet carries the risk yourself.

What to do now

Nothing changes in your wallet this week. If you use DeFi through an exchange, ask it how it plans to apply the new guidance, and expect some features to change before October 2027. If you have a real experience to share, the response window is short, so send it before 18 November. For background, see our beginner's guide to DeFi, how decentralised exchanges work and how HMRC taxes DeFi lending and liquidity pools.