FCA consults on how regulated firms should manage DeFi risks

The approach to perimeter analysis remains the same regardless of how a business model is described, whether centralised, decentralised or DeFi. Persons carrying on a regulated activity by way of business in the UK will need to be authorised or exempt, even if they describe themselves as DeFi. Even where a firm meets the conditions of an exclusion from a regulated activity, it must still consider whether its activities are within the scope of the financial promotions regime or the Money Laundering Regulations.

Firms remain responsible for complying with applicable legal and regulatory requirements when they use or interact with DeFi, and should assess whether they can adequately identify, understand, manage and mitigate the risks arising from a proposed activity. Where they cannot do so adequately, they should consider whether the activity is appropriate for their business and clients.  Firms are responsible and accountable for all the regulatory responsibilities that apply to outsourcing and third-party service arrangements and cannot delegate any part of this responsibility to a third party.

Various FCA-regulated firms, including all cryptoasset firms from October 2027, must comply with the requirements in SYSC 15A, and these requirements apply irrespective of whether the firm uses or interacts with DeFi.  SYSC 15A requires in-scope firms to identify important business services, map resources, set impact tolerances, and plan and test severe but plausible disruption scenarios.

Under SYSC 15A.2.1, firms must identify important business services i.e. those where disruption could cause intolerable harm to their clients or threaten UK market integrity or financial stability.  Firms should identify the service delivered to the client, rather than treating the underlying technology or protocol as the important business service. Depending on the firm's activities, relevant services could include enabling clients to trade, transfer, lend, borrow or stake cryptoassets.

Under SYSC 15A.2.5, firms must set an impact tolerance for each important business service, defining the maximum level of disruption they can tolerate before harm occurs.  When setting those impact tolerances, firms should consider DeFi-specific factors, including:

• clients being unable to access, transfer or transact with assets;
• failed, delayed or reversed transactions;
• inaccurate pricing or data failures; and
• assets becoming inaccessible or exposed to further risk of operational disruptions or hacking.

Under SYSC 15A.4.1, firms must map the people, processes, technology, facilities and information that support their important business services, sufficiently to allow the firm to identify vulnerabilities and remedy these as appropriate.  The mapping exercise should include the underlying DLT and settlement infrastructure, cloud and technology providers, external protocols, smart contracts and middleware such as oracles and bridges, client-facing interfaces, and internal functions including incident response, key management, governance, oversight and client communications.  Firms should also identify governance arrangements, for example for protocol upgrades and emergency controls, and change control mechanisms that could affect the delivery of important business services.

Firms using DeFi might rely on protocols, infrastructure and service providers that they do not control, yet firms in scope of SYSC 15A remain responsible for understanding and managing the risks these dependencies create for their important business services.  Firms in scope of SYSC 15A must:

• map key dependencies and their role in service delivery;
• understand any limits on their ability to control or recover from disruptions impacting third-party services;
• monitor the performance and resilience of critical dependencies;
• test the impact of severe but plausible failures;
• assess concentration risk and the availability of alternatives; and
• maintain clear communications with clients and regulators during incidents.

SYSC 15A.5.1 requires firms to develop a testing plan and carry out scenario testing to assess whether they can remain within their impact tolerances during severe but plausible disruption.  For firms using DeFi, this may include testing the impact of failures affecting DLT infrastructure, cloud or technology providers, smart contracts, third-party services, data feeds, bridges and client-facing interfaces.  Where firms rely on third parties for the delivery of important business services, they should work with those third parties to ensure the validity of scenario testing, but the firm is ultimately responsible for the quality and accuracy of any testing carried out, whether by itself or by a third party.

Following testing or an operational disruption, and in line with SYSC 15A.5.8, firms must conduct a lessons-learned exercise to identify weaknesses, make improvements and support ongoing resilience.  Firms must also review their compliance with operational resilience requirements following a significant change to their business, operating model or the markets in which they operate, and must keep their identification of important business services, impact tolerances, mapping and scenario testing under review to ensure they remain appropriate.

Under SYSC 15A.8.1, firms must maintain communication strategies that enable them to respond quickly and effectively to operational disruption.  Under SYSC 15A.8.3, firms must provide clear, timely and relevant communications to ensure that clients are informed in the event of disruption. Where relevant, firms may explain the nature of the disruption, likely impacts, potential limitations on remediation and any actions clients can take to reduce harm.

In line with Regulations 18 and 18A of the MLRs and FCG 2.2.4, firms must undertake a business-wide assessment of their exposure to money laundering, terrorist financing and proliferation financing risks.  In the context of DeFi, firms should consider whether the use of multiple protocols, smart contracts and services within a single transaction increases the complexity of transaction flows and makes it more difficult to identify participants and trace the source and destination of funds, and should take these risks into account when assessing their systems and controls.

As set out in SYSC 6.3.1 and SYSC 6.3.3, firms must establish and maintain proportionate policies and procedures to counter the risk that they might be used to further financial crime.  When assessing whether their systems and controls remain proportionate, firms should consider whether the products, services or protocols they use create additional opportunities for money laundering or sanctions evasion; whether the channels through which customers access services make it more difficult to identify or manage financial crime risks; whether complex transaction flows across multiple protocols or blockchain networks make monitoring and investigation more challenging; whether their systems can identify exposure to illicit activity linked to wallet addresses, smart contracts or protocols; and whether exposure to third-party infrastructure or higher-risk jurisdictions creates additional financial crime risks.

Under Regulation 27 of the MLRs, firms subject to the MLRs must apply customer due diligence measures, and under Regulation 33, must apply enhanced due diligence where there is a higher risk of money laundering or terrorist financing, including where transactions are unusually complex or display unusual patterns.  When assessing whether a business relationship or transaction involving DeFi presents a high risk, firms should consider:

• exposure to wallets, protocols or services associated with illicit activity or sanctions risk;
• the use of privacy-enhancing technologies;
• transaction structures involving multiple protocols, services or blockchain networks that make fund flows more difficult to understand; and
• other indicators that may suggest attempts to obscure the origin, ownership or destination of funds.

As set out in FCG 3.2.5, firms should conduct ongoing monitoring on a risk-sensitive basis; where firms provide financial services using DeFi, they should consider whether the nature of the protocols, transaction flows and blockchain activity involved requires additional monitoring to identify financial crime risks.  Relevant factors for enhanced monitoring include interactions with newly deployed cryptoassets, tokenised assets or smart contracts; indicators of fraud including activity associated with potential rug pulls or account compromise; transaction patterns that may indicate layering, obfuscation or other attempts to conceal the source or destination of funds; and direct or indirect exposure to sanctioned persons, wallets, protocols or services.

Firms in scope of the MLRs must comply with the Travel Rule requirements in Regulation 64 of the MLRs where those requirements apply to a cryptoasset transfer.  Firms should assess whether their use of DeFi affects their ability to obtain, verify, transmit and retain the information required under the Travel Rule, noting that this may be more difficult where transfers involve non-custodial wallets, multiple intermediaries or environments with differing levels of customer identification and record keeping. Nonetheless, firms must mitigate the relevant risks, and under Regulation 64G of the MLRs, firms involved in a non-custodial wallet transfer may request information from their customers whether they are an originator or beneficiary.

In April 2026, hackers linked to North Korea stole US$285m from the Drift protocol through a months-long social engineering campaign that induced members of Drift's administrator group to pre-sign malicious transactions, transferring administrative control to the attackers; the protocol had adopted a zero-timelock configuration, allowing the malicious changes to take effect immediately without any mandatory delay.  The FCA highlights that relevant considerations before integrating a protocol into a firm's services include the concentration of administrative control, transaction approval arrangements, timelocks and controls over critical changes.

Industry data indicates that more than US$12bn has reportedly been lost through DeFi and bridge hacks since 2016.  In April 2026, hackers exploited a security weakness in the LayerZero bridge used by KelpDAO to steal over US$290m in cryptoassets, the attackers fed false data to internal nodes and simultaneously launched a DDoS attack, meaning the on-chain transaction appeared valid and KelpDAO's security tools could not detect the attack. The stolen cryptoassets were then used as collateral to borrow US$190m on the Aave protocol, causing depositors to withdraw over US$10bn, with the total value locked in DeFi dropping by US$13bn within two days.