News Desk · Crypto regulation

FCA consults on financial crime and Money Laundering Regulations guidance for DeFi firms

The UK Financial Conduct Authority has published draft guidance (GC26/7) for regulated firms that provide financial services using decentralised finance (DeFi). It covers financial crime controls, the Money Laundering Regulations and operational resilience, and comments are due by 18 November 2026.

Crypto regulationUK21 Oct 20262 min read

On 21 October 2026 the UK Financial Conduct Authority (FCA) published guidance consultation GC26/7. It consults on non-Handbook guidance to help firms that provide financial services using decentralised finance (DeFi) comply with FCA rules on operational resilience and financial crime, and with the Money Laundering Regulations (MLRs). DeFi refers to financial services delivered using distributed ledger technology, the shared record-keeping technology behind crypto assets.

According to the FCA, the guidance is aimed at FCA regulated firms providing financial services using DeFi that are in scope of SYSC 15A (operational resilience), in scope of SYSC 6 (compliance, internal audit and financial crime), or subject to the MLRs. The FCA says the guidance does not create new regulatory requirements and is meant to clarify existing rules. It gives illustrative examples of measures firms may wish to consider, along with observations on the current DeFi risk landscape.

The draft guidance lists relevant risks including fraud, scams, money laundering, terrorist financing and sanctions evasion. It refers firms to existing duties such as a business-wide assessment of their exposure to money laundering, customer due diligence under Regulation 27 of the MLRs, enhanced due diligence where the risk of money laundering or terrorist financing is higher, ongoing monitoring on a risk-sensitive basis, reporting knowledge or suspicion, and the Travel Rule in Regulation 64 of the MLRs. It also says firms' systems should be able to identify exposure to illicit activity linked to wallet addresses, smart contracts or protocols.

The consultation runs until 18 November 2026. The FCA says it will consider the feedback and update the proposed guidance as appropriate before publishing final guidance.

Why it matters to AML professionals

Crypto and DeFi activity is moving into regulated firms, and AML professionals are expected to apply the same core controls there as anywhere else. Teams that screen wallets, review crypto transfers or onboard crypto-related customers can use the draft to test whether their risk assessments, monitoring and blockchain screening cover DeFi exposure.

Red flags in this case

Funds that pass through mixers, bridges or newly deployed smart contracts shortly before reaching a customer's account
Customer wallets with direct or close indirect exposure to addresses flagged for scams, hacks or sanctions
Rapid movement of value across several DeFi protocols or blockchains with no clear business reason
Incoming crypto transfers that arrive without the originator information the Travel Rule requires

If this landed in your queue

Run the wallet addresses involved through blockchain analytics and record any exposure to illicit or sanctioned addresses
Check that the customer's stated source of funds matches the on-chain history of the assets
Confirm whether required Travel Rule information was received and follow your procedure if it is missing
Escalate for enhanced due diligence or a suspicious activity report where the exposure or pattern cannot be explained

Key terms

Decentralised finance (DeFi): Financial services delivered using distributed ledger technology, often through smart contracts rather than a traditional intermediary.
Travel Rule: The requirement for crypto asset firms to send and receive information about the sender and recipient with a crypto transfer.
Non-Handbook guidance: FCA guidance that explains how existing rules apply, without adding new rules to the FCA Handbook.

Interview angle

How would you apply customer due diligence and transaction monitoring to a customer who uses DeFi protocols?

Explain that the same risk-based duties apply: understand the customer and source of funds, use blockchain analytics to screen wallets and counterparties, monitor for exposure to illicit addresses and unusual cross-protocol movement, apply the Travel Rule, and escalate for EDD or reporting when risk is higher.

Sources

Go deeper on AMLift

Get the next story in your feedFollow AMLift on LinkedIn for new enforcement breakdowns, the weekly AML challenge and new tools.

Follow on LinkedIn

Every fact in AMLift News Desk stories comes from an official source: a regulator, court, government gazette or the company's own filing.