FCA Consults on Cryptoasset Perimeter and DeFi Rules in Four-Week Sprint

The UK Financial Conduct Authority published two consultations on 21 October 2026 — CP26/36 on its cryptoasset perimeter guidance and GC26/7 on how DeFi-facing firms must meet operational resilience and financial crime rules — with both running on an accelerated four-week timetable that closes on 18 November 2026.

CP26/36 amends Chapter 18 of the Perimeter Guidance Manual (PERG 18). It also bridges a gap that practitioners had flagged since the draft Financial Services and Markets Act 2000 (Cryptoassets) (Miscellaneous Amendments) Regulations 2026 failed to align with the FCA's finalised perimeter guidance in policy statement PS26/18. The new draft guidance brings regulatory guidance into line with the statutory exclusions.

Buried in the perimeter paper is material its title does not advertise: draft guidance on DeFi, including the concept of 'True DeFi', who counts as a person for perimeter purposes, and how DeFi affects the 'by way of business' and 'in the UK' tests.

What does the technical services exclusion change?

Draft guidance at PERG 18.8.25 to 18.8.35 addresses the new technical services exclusion (Article 9Z2A RAO), which removes persons 'merely providing a technical service' from Article 9Y arranging. A provider is more likely to qualify when:

• the service responds to instructions initiated by the customer;
• the service is non-discretionary;
• the customer selects the provider and the decentralised protocol;
• the provider does not select, recommend or rank counterparties;
• the provider does not negotiate material terms; and
• the provider does not substantively participate in deciding whether, when or how a transaction takes place.

Discretion or substantive engagement pushes a provider outside the exclusion. The FCA stresses that the relevant question is the function of a service, not the technology behind it — a service with no technology at all can still be 'technical'. The word 'allows' in 'allowing another person to access' a protocol is read as 'facilitates', not 'permits'. Determinations will be case-by-case.

How does the FCA treat stablecoins and proprietary trading?

The legislation is deliberately clear that a product cannot be both e-money and a qualifying stablecoin. Features pointing toward qualifying stablecoin status (PERG 18.4.5B) include:

• the token is minted before it is issued;
• it is issued via distributed ledger technology;
• admission to trading is intended;
• backing assets exist to maintain confidence in value stability; or
• it is issued for purposes other than making payment transactions.

The FCA also clarified that the dealing and arranging exclusion for transfers of UK qualifying stablecoins covers transactions forming part of qualifying cryptoasset lending or borrowing arrangements.

On proprietary trading, the Article 9UA exclusion (PERG 18.8.18A) covers persons trading qualifying cryptoassets with their own funds, including borrowed funds, provided they do not hold themselves out as offering a financial service. Indicators that a service is being provided — which defeat the exclusion — include retail counterparties, fees or commission charged to the counterparty, ongoing transactional arrangements, or holding oneself out as a liquidity provider or execution service. Market making on a qualifying cryptoasset trading platform (QCATP) is also excluded from dealing as principal, and a market maker responding to requests for quotes on a QCATP may rely on that exclusion.

Where does DeFi sit inside the perimeter?

The FCA states plainly that 'True DeFi' is not a statutory concept under FSMA (PERG 18.1.20). Calling an arrangement decentralised, automated or smart-contract-governed does not, by itself, place it outside the perimeter. The operative question is whether one or more persons carry on regulated activities through the arrangements — assessed by who designs, deploys, operates, maintains or updates them, and who assumes responsibility or derives commercial benefit.

Decentralisation does not defeat either the 'by way of business' test (PERG 18.2.3), which is applied to each participant's distinct role separately, or the 'in the UK' test (PERG 18.3.1A), which considers UK connections of the persons involved in governance, operation, maintenance or development.

GC26/7, the companion paper, proposes non-Handbook guidance applying SYSC 15A operational resilience, SYSC 6 financial crime rules and the Money Laundering Regulations to authorised firms using, interacting with, or offering access to DeFi protocols. The principle: the FCA expects the same regulatory outcomes as in traditional finance, illustrated with DeFi-specific examples and case studies.

The FCA has not moved the application timetable. The transitional gateway closes on 28 February 2027 and the regime commences on 25 October 2027 — meaning many firms will file before this guidance is finalised, and should build the updated perimeter into their application packs now.