Decentralised finance, centralised responsibility: the FCA’s proposed approach to operational resilience and DeFi

On 21 October 2026, the FCA published GC26/7, a consultation on proposed guidance for firms providing financial services using decentralised finance (DeFi). The guidance focuses on how firms should approach the operational resilience and financial crime risks associated with DeFi. The consultation closes on 18 November 2026, with final guidance planned for January 2027.

The FCA is not proposing a new operational resilience regime for DeFi. Rather, its starting point is that firms using DeFi must continue to achieve the same regulatory outcomes expected in traditional financial services. The proposed guidance therefore explains how existing requirements, including those in SYSC 15A, may apply where regulated firms interact with, facilitate access to, or provide financial services using DeFi.

That is significant. The architecture underpinning a service may be decentralised, automated and distributed across multiple participants, but this does not displace the regulatory responsibilities of the firm providing the regulated financial service.

Why does DeFi create a particular operational resilience challenge?

DeFi is characterised by highly automated, open and interoperable technology and, in some cases, the absence of a traditional intermediary. The FCA recognises the potential benefits of innovation and efficiency, but also notes that these features can increase operational resilience and financial crime risks for firms and their clients.

For operational resilience purposes, the important point is therefore not simply whether a particular protocol or technology falls within a conventional outsourcing model. Firms need to understand how their use of DeFi supports the financial services they deliver and how disruption could affect their ability to continue providing those services.

The consultation translates the existing operational resilience framework into that environment. In practical terms, firms will need to consider the following.

1. Start with the important business service, not the technology

The regulatory focus remains the service delivered to the client. DeFi protocols and the technologies supporting them should be considered as dependencies underpinning that service rather than as the starting point for the analysis.

That distinction matters. A technically decentralised arrangement does not necessarily result in decentralised regulatory responsibility.

2. Map the full chain of dependencies

For firms using DeFi, operational mapping may need to extend beyond conventional systems and third-party providers. Firms should understand the technological and other dependencies on which their services rely, including the different components of the DeFi ecosystem on which delivery of the service depends.

The practical challenge will be ensuring that mapping goes sufficiently far down the chain to identify vulnerabilities that could disrupt an important business service.

3. Impact tolerances need to reflect the characteristics of DeFi

Existing operational resilience requirements are outcomes-focused. Applying them to DeFi means firms need to consider what disruption actually looks like in this environment and assess whether their impact tolerances remain appropriate.

This is particularly important where the consequences of disruption may arise from technology or infrastructure over which the regulated firm does not exercise direct control.

4. Testing may require a different approach

Firms must test their ability to remain within impact tolerances in severe but plausible scenarios. Applying that requirement to DeFi means scenario testing should reflect the particular dependencies and failure points associated with the relevant arrangements.

The distributed nature of the ecosystem may also make effective testing more dependent upon engagement with third parties.

5. Customer communications remain part of operational resilience

Firms should consider in advance how they would communicate with clients during disruption. DeFi does not change the underlying regulatory concern: customers need appropriate information about disruption affecting the services they receive and firms need credible arrangements for managing that communication.

6. Third-party risk extends beyond formal outsourcing

Perhaps the broader point for firms is that the operational resilience analysis is not confined to arrangements that meet the traditional definition of outsourcing.

A firm may depend materially on third parties or decentralised infrastructure without having a conventional bilateral outsourcing relationship with the relevant provider or participant. The FCA's approach reinforces the importance of looking at dependency and operational impact, rather than contractual labels alone.

What does this mean for firms?

For firms already subject to SYSC 15A, GC26/7 does not require a wholesale rethink of their operational resilience programmes. It does, however, provide a useful prompt to ask whether existing frameworks adequately capture the distinctive dependencies created by the use of DeFi.

In particular, firms using or considering DeFi should consider:

• whether DeFi forms part of the delivery chain for any existing important business service;
• whether existing mapping captures the relevant technological and third-party dependencies;
• whether impact tolerances and severe-but-plausible testing properly reflect potential DeFi disruption;
• how dependencies outside conventional outsourcing relationships are identified and managed; and
• whether incident response and customer communication arrangements work in circumstances where the firm may have limited ability to control or remediate the underlying cause of disruption.

The guidance will also be relevant to crypto firms preparing for the UK's wider cryptoasset regulatory regime. The FCA states that the new regime will expand from 25 October 2027, and has separately confirmed that established standards, including operational resilience requirements, will apply to UK crypto firms.

A broader regulatory message

Perhaps the most interesting aspect of the consultation is what it says about the FCA's approach to new technology more generally.

The FCA is not seeking to construct a parallel operational resilience regime around DeFi. Instead, it is applying an existing, outcomes-based regulatory framework to a technological model in which responsibility, infrastructure and control may be much more dispersed.

For regulated firms, that reinforces a familiar but increasingly important principle: a lack of direct control over an underlying technology or third party does not remove the need to understand the dependency, manage the associated risk and remain accountable for the service delivered to customers.

GC26/7 should therefore be relevant not only to firms already materially engaged with DeFi, but also to firms considering how decentralised technologies might form part of their future service and operating models.

The FCA is seeking responses to GC26/7 by 18 November 2026 and intends to publish final guidance in January 2027.