GC26/7: Decentralised finance guidance (DeFi)

For compliance teams, the message is that the regulator expects DeFi-enabled activity to be governed by the same standards as traditional models, even where the technology and governance structures are novel. The guidance is intentionally illustrative rather than prescriptive, so firms should treat it as a benchmark for assessing whether existing resilience testing, third-party and smart contract dependencies, governance accountability and AML/KYC frameworks hold up under decentralised operating models. Importantly, the paper is published alongside perimeter guidance (CP26/36), signalling a joined-up push to clarify where DeFi activity falls inside the regulatory boundary.

Compliance and legal functions should coordinate responses across both consultations, map current and planned DeFi exposures, and assess whether governance and control documentation evidences adequate oversight of distributed arrangements. Firms should also review wider cryptoasset regime publications and existing operational resilience materials for consistency. Responses to the consultation represent an opportunity to shape final expectations, particularly around how proportionality should apply to varying DeFi models.

Those who engage early will be better positioned to influence outcomes and avoid retrospective remediation.