FCA proposes DeFi guidance on operational resilience and financial crime before the 2027 perimeter expands

The Financial Conduct Authority is consulting on non-Handbook guidance for regulated firms providing financial services through decentralised-finance arrangements. The paper focuses on operational resilience, financial crime and compliance with the Money Laundering Regulations.[1]

DeFi can combine smart contracts, public blockchains, external data feeds, bridges, wallets and governance processes. A service may be highly automated while still relying on identifiable firms for access, interface design, custody, promotion or risk management.[1]

Controls for automated services

The guidance is directed at FCA-regulated firms using DeFi that fall within the relevant operational-resilience, financial-crime and Money Laundering Regulations requirements. It provides illustrative controls for those firms rather than declaring every DeFi interaction regulated.[1]

Operational incidents may arise from code, third-party infrastructure, governance actions or dependencies outside the firm’s direct control. The FCA’s wider incident-reporting framework also means that a decentralised component does not make a material outage invisible to the regulator.[2]

The document should be read with the FCA’s crypto perimeter consultation. It is a proposal, not final guidance, and it does not determine that every DeFi interaction is regulated. Firms need to analyse the activity, legal entity and role rather than relying on the label attached to the technology.[1][3]

Report an error or submit an update