The UK Just Opened Its DeFi Rulebook. Builders Have Until October 2026.

I've been waiting on this one. The UK's Financial Conduct Authority has opened consultations on DeFi guidance and the next chunk of its crypto rulebook, and it did it just weeks after it started taking applications from firms that want to operate legally under the new regime.

This week in 60 seconds: the door is open, the clock is running, and the deadline sitting over all of it's October 2026.

That's not much runway for anyone still pretending this is a two-year problem.

What the FCA actually did

Two tracks, one consultation. First, guidance on decentralized finance. The agency wants to spell out where DeFi sits relative to its regulatory perimeter and, more usefully, where it doesn't. Second, the operational rules for cryptoasset firms that plan to be authorized.

Here's the bit people skim past. The sequencing. Applications opened before the guidance landed.

That order looks backward until you think about it from the regulator's side. The FCA wants to see who shows up before it finishes writing the questions. It's cheaper to learn from a few hundred applications than to publish a rulebook and discover everyone read it differently.

So who's actually in scope? The FCA has been clear for years that pure, genuinely decentralized protocols sit largely outside the perimeter. What drags you in is the connective tissue around them. Front-ends. Aggregators. Wallets that route orders. Anyone who takes a fee for putting a user in front of a trade. So is a DeFi interface a protocol or a broker? That's the whole ballgame, and it's the question this guidance has to answer.

The context numbers matter here. The FCA's own consumer research has put UK crypto ownership around 12% of adults, roughly 7 million people. That's not a niche anymore. It's a retail market with retail problems, and the regulator knows it's already on the hook for it.

Worth remembering what's already live, because a lot of the hard rules aren't new. The financial promotions regime kicked in on 8 October 2023. Firms can't market crypto to UK consumers without a cooling-off period, risk warnings, and a category check. Consumer Duty applies too, and the FCA has used it as a crowbar more than once. The incoming stuff is the licensing layer that makes all of that enforceable at the entity level rather than at the advertisement level.

And the derivatives ban from January 2021 is still standing, by the way. Five years on, UK retail still can't touch regulated crypto derivatives. That decision pushed a lot of volume offshore, and it's the clearest example of the UK's pattern: tight consumer rules, slow institutional rules.

The wider board

Pull the camera back and the UK is playing catch-up in a race it used to lead.

Europe's MiCA went live for stablecoins in mid-2024 and for cryptoasset service providers at the end of that year. Firms got a passport across 27 countries. Dubai built a dedicated regulator and filled it with UK-trained compliance people. Singapore and Hong Kong took the institutional and tokenization business while London was still publishing discussion papers.

The damage is measurable in where firms put their European hubs. Dublin, Luxembourg, Paris. Not London. Not yet.

But here's the thing about being late. You get to see what worked. MiCA's biggest headache has been the stablecoin provisions, where strict e-money classification made life awkward for issuers. The FCA can design around that. It's also got the Digital Securities Sandbox running with the Bank of England, which is a real testing ground for tokenized assets, not a talking shop.

And the DeFi market itself has spent years swinging between roughly $60 billion and $200 billion in locked value depending on the month and your definition. If the UK writes guidance that treats that activity as permanently offshore, it forfeits the tax base and the talent. If it writes something workable, it gets first crack at the next cohort of builders who want a regulated home in a major currency.

Who wins? Licensed venues, custodians, and payment rails, because authorization becomes a moat and moats are good for margins. Anyone with real compliance staff gets a hiring premium for about 18 months. Who loses? Offshore-only platforms that have been serving UK users without a licence, and small DeFi teams whose entire product is a nice interface on top of someone else's liquidity.

My honest take

Two things I actually believe.

First, the DeFi guidance is intermediary guidance wearing a costume. The FCA has no appetite to chase smart contracts. What it wants is a clear answer to "who is the firm here" for every hop in the chain. That's not a philosophical position. It's an enforcement strategy. Builders who assume "the code is the protocol" will get surprised.

Second, October 2026 is the only date that matters. Applications are open now. Firms that queue early get feedback cycles, conditional conversations, and time to fix what's broken. Firms that apply in September 2026 get a rejection letter with a deadline attached. The FCA has been explicit that it won't extend the runway for stragglers. Regulators rarely do.

If you're building, the boring move is the right one. Read the consultation. Respond to it, because the comment window is the only point where you get input without paying legal fees. Then map your product against the intermediary test before someone else does it for you.

If you're a user, expect two things. Better fiat on-ramps and clearer disclosures in the UK specifically, because licensed firms will compete on trust. And consolidation, because half the apps you use today can't afford a licence and won't get one.

The one thing to remember from this week: the UK stopped talking about crypto rules and started collecting names. Everything else is downstream of that.

That's the week. See you Monday.