GC26/7 says DeFi use does not rewrite SYSC 15A rules

Guidance consultation GC26/7 does not write a new rulebook for decentralised finance (DeFi). It explains how the Senior Management Arrangements, Systems and Controls sourcebook (SYSC) 15A, SYSC 6 and the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the Money Laundering Regulations, or MLRs) already apply when an in-scope Financial Conduct Authority (FCA) firm uses DeFi, and it asks for comments by November 18, 2026.

The consultation opened on October 21, 2026. Paragraph 1.11 of the draft guidance says the text creates no new requirements. The publication page plans final guidance for January 2027, and paragraph 1.12 of the consultation says the first quarter of 2027. Draft paragraph 1.4 says decentralised-exchange trading was about 14% to 19% of global cryptoasset spot volume from January to August 2026. This piece sets out those duties, compares the United Kingdom with the United States and Singapore, and ties the text to an existing gateway penalty. It does not restate the perimeter tests in CP26/36.

Key facts

• Opened October 21, 2026. Closes November 18, 2026, by form or gc26-7@fca.org.uk (paragraphs 1.11 and 1.13).
• Final guidance: January 2027 on the publication page; the first quarter of 2027 in consultation paragraph 1.12.
• Draft paragraph 1.11: no new requirements. Section 138I of FSMA: a cost benefit analysis for rules, not for guidance (paragraph 1.10).
• Draft paragraph 1.12: "must" is an existing requirement. "Should" is guidance.
• Draft paragraph 1.4: 14% to 19% of global cryptoasset spot volume, January to August 2026. Around 8% of UK users in 2025, on FCA research cited in the paper.
• Draft paragraph 1.7: more than US$12 billion reportedly lost to DeFi and bridge hacks since 2016. Not an FCA-audited total.
• Cryptoassets Regulations 2026 from October 25, 2027. SYSC 15A for cryptoasset firms from October 2027, with or without DeFi (draft paragraph 3.2).

Methodology and sources

The primary text is the FCA’s GC26/7 PDF, 24 pages, dated October 21, 2026, read with the publication page of the same day. CP26/36 and PS26/18 are covered in CP26/36’s exclusion tests and in PS26/18 and the Article 9Z2A front-end question. FG26/6 was published on June 30, 2026. Pins are SYSC 15A, SYSC 6, section 138I of FSMA and MLR regulations 18, 18A, 27, 33, 64 and 64G. Commodity Futures Trading Commission (CFTC) Release No. 8774-23 is dated September 7, 2023. Monetary Authority of Singapore (MAS) Notice FSM-N30 took effect on June 30, 2025. Enforcement is the Final Notice to CB Payments Ltd of July 23, 2024. Case-study losses are not re-audited. Scope is the United Kingdom, the United States and Singapore.

Related:CP26/36 sets the tests for new cryptoasset exclusions

What GC26/7 actually says

Draft paragraph 1.1 defines DeFi as trading, lending and borrowing on distributed ledger technology (DLT), often without a traditional intermediary. Paragraph 1.4 calls engagement "currently relatively limited". Paragraph 1.6 lists smart-contract flaws, hard-to-reverse transactions, compromised keys, oracle failures, fraud, sanctions exposure, and failures across protocols and bridges.

GC26/7’s draft non-Handbook guidance explains duties firms already have. It is not a new DeFi code. Paragraph 1.11 of the draft states that the guidance does not create new regulatory requirements. It explains how existing FCA requirements on operational resilience and financial crime may apply when firms use or interact with DeFi, and it offers examples that are not exhaustive and may not be appropriate in every case. In draft paragraph 1.12, "must" describes an existing legal or regulatory requirement and "should" indicates how firms may meet or consider it. The publication page names SYSC 15A, SYSC 6 and the Money Laundering Regulations. Section 138I of FSMA requires a cost benefit analysis for new rules, but not for guidance, and consultation paragraph 1.10 says the FCA does not expect materially different costs or benefits. Comments run from October 21, 2026 until November 18, 2026.

Chapter 2 says the perimeter test "remains the same regardless of how a business model is described", including as DeFi. A regulated activity carried on by way of business in the United Kingdom, with no exclusion, still needs authorisation or an exemption. Software does not decide that question. An exclusion leaves financial promotions and the MLRs. The draft points that analysis to PS26/18 and CP26/36.

Draft paragraph 3.2 says in-scope firms, including all cryptoasset firms from October 2027, must comply with SYSC 15A whether or not they use DeFi. It also points to the Principles for Businesses, SYSC 3, 4, 7 and 8, and SUP 15 and SUP 16. Firms cannot delegate third-party responsibility. SYSC 15A.2.1R requires important business services to be identified, meaning the service the client receives, not the protocol. SYSC 15A.2.5R requires an impact tolerance, taking in failed transfers, bad prices and assets left exposed. SYSC 15A.4.1R requires a map that, for DeFi, includes the ledger, cloud providers, protocols, smart contracts, oracles, bridges, interfaces, key management and admin keys. SYSC 15A.5.1R requires severe-but-plausible testing. SYSC 15A.5.5G leaves the firm responsible for the quality of a test a third party runs. SYSC 15A.8.1R and 15A.8.3R require timely client communications. After a material change, the map, tolerances and tests must be reviewed.

The draft’s two firms are fictional. Firm A arranges staking and treats protocol selection as the important business service, including time assets cannot be returned after slashing. Firm B routes orders to a UK venue and then cuts reliance on a single node provider.

Chapter 4 covers fraud, scams, money laundering, terrorist financing, sanctions evasion and market abuse. It cites the 2025 National Risk Assessment and the Financial Action Task Force (FATF). Regulations 18 and 18A require a business-wide assessment. Regulation 27 is customer due diligence, regulation 33 enhanced due diligence, and regulation 64 the Travel Rule. Paragraphs 4.27 and 4.28 say a non-custodial wallet does not switch that duty off, and regulation 64G lets the firm ask its customer for information. See the Travel Rule piece on virtual-asset service providers and the Annex 1 registration analysis.

"Somewhere along the way, DeFi operators got the idea that unlawful transactions become lawful when facilitated by smart contracts. They do not."

— Ian McGinley, director of enforcement, Commodity Futures Trading Commission (CFTC Release No. 8774-23, September 7, 2023)

McGinley was applying United States derivatives law, not SYSC 15A. The line still matches draft paragraphs 1.9 and 2.2: technology does not retire a duty the firm already has. GC26/7 addresses firms inside FCA duties. The CFTC orders addressed protocol operators.

How the UK, the US and Singapore compare

Sources: GC26/7 PDF, FCA publication page, CB Payments Ltd Final Notice, CFTC Release No. 8774-23, MAS Notice FSM-N30. Last updated: October 23, 2026.

The split is the addressee. GC26/7 speaks to firms already inside, or heading into, FCA duties, and it leaves non-authorised arrangements to CP26/36. The CFTC orders treated protocol operators as the persons who had offered illegal derivatives and, for Opyn and Deridex, as unregistered intermediaries with a customer-identification duty. MAS Notice FSM-N30, effective June 30, 2025, binds a digital token service provider licensed under section 138 of Singapore’s Financial Services and Markets Act 2022 to availability clocks: unscheduled downtime for each critical system capped at four hours in any 12 months, a recovery time objective of not more than four hours, and notice to the Monetary Authority of Singapore not later than one hour after discovery of a relevant incident. It does not, on its face, discuss composability. A firm serving UK clients through a Singapore licensee cannot treat one text as cancelling another. The separate EU anti-money-laundering statute book is set out in the note on the EU rulebook against the US and the UK.

Draft paragraph 3.2 puts cryptoasset firms under SYSC 15A from October 2027 whether or not they use DeFi. The publication page dates the Cryptoassets Regulations 2026 at October 25, 2027. Release No. 8774-23 settled at US$250,000, US$200,000 and US$100,000. GC26/7 adds a map of the protocol, bridge, oracle and admin key against a service that already has an impact tolerance.

Enforcement context: the gateway firm still owns the failure

The named FCA action is not a protocol case. The Final Notice of July 23, 2024 to CB Payments Ltd, reference 900635, imposed £3,503,546 under regulation 51(1)(a) of the Electronic Money Regulations 2011, against an undiscounted £5,003,646. The press release of July 25, 2024 said this Coinbase Group firm was a gateway and was not then registered for UK cryptoasset activities. This article does not update that 2024 status.

In October 2020 the firm agreed not to take on new high-risk customers. It nonetheless onboarded or served 13,416 of them. About 31% deposited about US$24.9 million, later used for cryptoasset transactions through other group entities totalling about US$226 million. Breaches went undiscovered for almost two years because the control was not designed across every onboarding path.

"The money laundering risks associated with crypto are obvious and firms must take them seriously. Firms like CBPL that enable crypto trading need to have strong financial crime controls."

— Therese Chambers, joint executive director of enforcement and market oversight, Financial Conduct Authority (FCA press release, July 25, 2024)

The six case studies are illustrations, not fines. In April 2026 the paper says Lazarus Group stole over US$290 million through a LayerZero bridge used by KelpDAO, borrowed US$190 million on Aave, and saw withdrawals over US$10 billion as total value locked fell by US$13 billion in two days. It also describes a February 2025 Bybit theft of US$1.5 billion via the Safe Wallet screen, an April 2026 Drift theft of US$285 million, an estimated US$19.3 million $SQUID drain, a Polygon flaw that could have replayed one withdrawal 224 times against US$850 million, and a six-hour Sui halt in January 2026 with over US$1 billion inactive.

What this means for firms, venues and compliance teams

For a broker, arranger or electronic money institution, draft paragraphs 3.19 and 3.20 put the important business service on the client path, not the protocol. CB Payments Ltd ran the account path, and the penalty landed there. The draft tells that firm to set a tolerance, map nodes and bridges, and test a stoppage.

For an exchange or a future cryptoasset firm, draft paragraph 3.2 applies SYSC 15A from October 2027. The publication page dates the Cryptoassets Regulations 2026 at October 25, 2027. The timetable is in the account of the FCA’s October 2027 cryptoasset gateway. GC26/7 creates no DeFi permission. A Crypto-Asset Service Provider (CASP) is outside the draft unless it is also an FCA firm. Draft paragraph 1.8 says a firm that cannot mitigate the risks should reconsider the activity.

For a fund manager or custodian, Firm A is the staking example: protocol selection and validators the firm does not appoint. Slashing, a halt and a failure to return assets go against the tolerance. Draft paragraphs 4.15 and 4.20 say source-of-funds work should pick up mixers and sanctioned persons.

For compliance teams, “must” is the existing rule and “should” is guidance that may not fit. Map the service, set the tolerance, test it, tell clients, and review it after a material change. Keep the regulation 18 assessment current where regulations 27, 33 and 64 apply. Comments close on November 18, 2026. Question 6 is the route to a later rule, which would need a cost benefit analysis under section 138I.

"Yet, today’s actions do not promote responsible innovation—they shut it down, banishing innovation from U.S. shores."

— Summer K. Mersinger, commissioner, Commodity Futures Trading Commission (dissenting statement, September 7, 2023)

Mersinger dissented from the Opyn, ZeroEx and Deridex orders and argued for notice-and-comment rules before protocol operators were treated as registrants. “Should” lists in GC26/7 can harden, in supervision, into rules the draft says it is not writing. Nikhil Rathi, the FCA’s chief executive, listed decentralised finance in his Mansion House speech on October 22, 2026 and did not name GC26/7. He said: “In the face of all today’s challenges, the temptation is to say: 'write more rules, but do it damned well faster'.” That is not a promise that question 6 stays guidance.

What is next: final guidance and the 2027 dates

Comments close on November 18, 2026. Responses go by form or to gc26-7@fca.org.uk, and email respondents must say if the reply is confidential. Questions 1 and 3 test the risk descriptions. Questions 2, 4 and 5 test the guidance. Question 6 asks whether other measures should reduce financial-crime risk in DeFi.

The publication page plans final guidance for January 2027. Consultation paragraph 1.12 says the first quarter of 2027. Both hold unless publication slips past March 2027, which the FCA has not said. Draft paragraph 3.4 flags a later consultation on distributed ledger technology. That paper is not GC26/7.

Cryptoasset activities enter the perimeter on October 25, 2027, and SYSC 15A applies to cryptoasset firms from October 2027. GC26/7 changes neither date. Section 138I of FSMA requires no cost benefit analysis for this guidance. It would if question 6 became rules.

TL;DR

GC26/7 opened on October 21, 2026 as non-Handbook guidance for FCA firms that use DeFi and are already in SYSC 15A, SYSC 6 or the Money Laundering Regulations. Draft paragraph 1.11 says it creates no new requirements. Comments close on November 18, 2026. The publication page plans final guidance for January 2027, and the PDF says the first quarter of 2027. Draft paragraph 1.4 says decentralised-exchange trading was about 14% to 19% of global cryptoasset spot volume from January to August 2026. The client service, not the protocol, is what must stay inside the impact tolerance. The sterling figure is the CB Payments Ltd penalty of £3,503,546 on July 23, 2024.

FAQ

What is GC26/7?

GC26/7 is an FCA guidance consultation first published on October 21, 2026. It explains how existing operational-resilience and financial-crime requirements may apply when an FCA firm uses decentralised finance. The publication page names firms in SYSC 15A, SYSC 6 or the Money Laundering Regulations, including future regulated cryptoasset activities. Paragraph 1.11 of the draft says the text creates no new requirements. It is not a new DeFi statute.

Does the draft create new rules?

No. Paragraph 1.11 of the draft says the guidance creates no new requirements, and the examples may not fit every firm. Draft paragraph 1.12 uses "must" for an existing requirement and "should" for guidance. Consultation paragraph 1.10 says section 138I of FSMA requires a cost benefit analysis for rules, not for guidance. Question 6 still asks whether other measures should be considered. A later rule would be a separate document.

Who is in scope?

The publication page addresses FCA firms that use DeFi and are in SYSC 15A, in SYSC 6, or subject to the Money Laundering Regulations. Draft paragraph 1.13 adds firms that will carry on future regulated cryptoasset activities. Chapter 2 says a decentralised label does not decide the perimeter. A regulated activity carried on by way of business in the United Kingdom still needs authorisation or an exemption. An exclusion does not remove the MLRs.

When do comments close, and when is final guidance due?

Comments close on November 18, 2026, on the publication page and in consultation paragraphs 1.11 and 1.13. Responses use the online form or gc26-7@fca.org.uk. The publication page plans final guidance for January 2027. Consultation paragraph 1.12 says the first quarter of 2027, and January falls inside that quarter. The paper names no day in January. FG26/6, published on June 30, 2026, is a different document.

How does the Travel Rule apply to a non-custodial wallet?

Draft paragraph 4.26 says firms subject to the Money Laundering Regulations must comply with regulation 64, the Travel Rule, where a cryptoasset transfer is in scope. Paragraph 4.27 says the firm should test whether DeFi use stops it collecting and sending the required information. The draft says non-custodial wallets can make that harder. The firm must still mitigate the risks. Regulation 64G lets the firm ask its customer for the information.

How is GC26/7 different from CP26/36?

CP26/36, opened the same day, asks when a cryptoasset activity is inside the perimeter, including where it is called decentralised. GC26/7 assumes the firm is, or will be, inside SYSC 15A, SYSC 6 or the Money Laundering Regulations, and it explains resilience and financial crime. Draft paragraph 1.16 says the two should be read with PS26/18. Both close on November 18, 2026. The exclusion tests are in CP26/36’s exclusion tests.

This article is informational analysis only and does not constitute legal, regulatory, tax, or investment advice. Regulatory frameworks change frequently and interpretation depends on facts and circumstances; primary documents and official regulator guidance always supersede summaries. Firms should consult qualified legal counsel and their relevant supervisory authority before taking any action based on the analysis above.