FCA DeFi Guidance GC26/7: A Mapping Checklist
Quick answer. GC26/7, the FCA's draft DeFi guidance, says a firm's SYSC 15A map should include key DeFi dependencies, such as smart contracts, oracles and bridges. Firms should identify the upgrade controls and admin keys that could affect their services.
Video transcript
GC twenty-six slash seven, the FCA's draft DeFi guidance, asks firms to map the code they do not control behind every client service.
It creates no new rules. It explains how existing resilience rules apply to DeFi, and all cryptoasset firms must comply with SYSC 15A from October 2027.
Paragraph 3.27 says your mapping may cover the settlement infrastructure, cloud providers, external protocols and smart contracts, oracles and bridges, client-facing interfaces, and internal functions like key management.
Paragraph 3.28 goes further. For each contract, record who can upgrade it, the timelock and any role that bypasses it, who can pause it, and how you would learn of a change.
In the FCA's Case Study 6, Drift administrators were induced to pre-sign transactions that transferred control, and a zero timelock let changes take effect immediately. Assess governance before you integrate.
Paragraph 3.31 adds scenario tests. Try a contract exploit, a malicious upgrade, a stale oracle price, a bridge verifier compromise, a chain halt and losing your RPC provider.
Then keep watching. Paragraph 3.40 expects monitoring of dependencies you do not control: upgrades, role grants, timelock changes, oracle sources and bridge settings.
Comments close November 18, 2026, with final guidance planned for Q1 2027. Read the full checklist, or book a system review with Guardian to map the DeFi dependencies behind your services.
The FCA's DeFi guidance is out in draft. GC26/7, published on October 21, 2026, explains how existing resilience and financial crime rules apply to FCA firms using DeFi.
It is non-Handbook guidance and creates no new requirements. In the FCA's usage, “must” describes an existing requirement and “should” describes how firms may meet it.
The FCA notes that all cryptoasset firms must comply with SYSC 15A from October 2027. Our UK crypto deadlines post has the dates.
This checklist turns paragraphs 3.19 to 3.42 into fields you can fill in. Our PERG 18 post covers CP26/36, the FCA's draft perimeter guidance.
This article explains the technical and security side of the FCA's GC26/7 DeFi guidance consultation. It is not legal advice; confirm how it applies to you with counsel.
What to map (3.25 to 3.28)
SYSC 15A.4.1R requires firms to map the people, processes, technology, facilities and information behind each important business service.
For firms using DeFi, GC26/7 says this should include key dependencies and supporting controls (3.26). Mapping may include (3.27):
- the underlying DLT and settlement infrastructure;
- cloud and technology providers;
- external protocols, smart contracts and middleware, such as oracles and bridges;
- client-facing interfaces;
- internal functions, including incident response, key management, governance, oversight and client communications.
Firms should also identify governance arrangements and change-control mechanisms, such as protocol upgrades, emergency controls and admin keys, that could affect their services (3.28).
The FCA warns that firms “may rely on open-source code that they do not control”. So map each protocol, contract address, upstream dependency and single point of failure.
Admin keys, oracles and bridges
Paragraph 3.28 is where DeFi mapping differs most from a conventional third-party register. A vendor contract tells you who can change a service; for a protocol, the code does.
Record these fields for each contract you depend on.
| Field | What to record |
|---|---|
| Upgradeability | Proxy pattern, proxy admin and current implementation, or immutable |
| Upgrade authority | Holder type (EOA, multisig, timelock, governance executor), threshold and signers |
| Timelock | Delay, functions covered and any role that can act without it |
| Emergency controls | Who can pause, unpause, freeze or withdraw, and whether that is disclosed |
| Parameter control | Who sets collateral factors, caps, fees and oracle sources |
| Governance | How proposals pass and who executes them |
| Change detection | How you learn of a change, and whether you can act inside the timelock delay |
The FCA's Case Study 6 shows why. Attackers spent months building relationships with members of the Drift protocol's administrator group.
They induced them to pre-sign transactions that transferred administrative control. A zero-timelock configuration let the changes take effect immediately.
The FCA's lesson is to assess a protocol's governance before integrating it, including “the concentration of administrative control, transaction approval arrangements, timelocks and controls over critical changes”.
Oracles and bridges
GC26/7 lists oracle failures (“inaccurate, delayed or manipulated external data”) and complex dependencies on bridges among DeFi's core risks.
For each oracle, record its sources, update triggers, staleness checks, fallbacks and who can change the feed.
For each bridge, record its verification model and threshold, who can change them, its pause controls and how wrapped assets would be redeemed if it stopped.
Scenario tests (3.31)
SYSC 15A.5.1R requires a testing plan and scenario tests of whether a firm can stay within impact tolerances in severe but plausible disruption.
For firms using DeFi, GC26/7 says this may include failures of DLT infrastructure, cloud or technology providers, smart contracts, third-party services, data feeds, bridges and client-facing interfaces (3.31).
Where third parties test for you, you remain responsible for the quality of the testing (3.32). Every test or real disruption needs a lessons-learned exercise (3.33).
| Component | Scenario | What to measure |
|---|---|---|
| Smart contract | Exploit or emergency pause in a protocol you route client assets to | Time to detect, stop new flows and inform clients |
| Governance | A malicious upgrade is queued, or an admin key changes hands | Whether you detect it and act inside the timelock delay |
| Oracle | Stale or manipulated price | Which controls and client positions rely on that price |
| Bridge | Verifier compromise or halt | Exposure to wrapped assets and the redemption path |
| DLT | Chain halt or congestion | Staying within tolerance; the FCA cites a six-hour Sui network halt in January 2026 |
| Infrastructure | Loss of your RPC node provider | Failover time; the FCA's example firm cut reliance on a single provider |
FG26/6, the FCA's resilience guidance for crypto firms, adds oracle manipulation, malicious node activity and compounded disruptions. It also says firms should conduct pentesting.
Run tabletops for decisions and communications, and technical tests, such as replaying a failure on a fork, for code.
Monitor what you do not control
Paragraph 3.40 says firms in scope of SYSC 15A must monitor critical dependencies and understand any limits on their ability to control or recover from third-party disruption.
They must also assess concentration risk and alternatives, and keep clients and regulators informed during incidents. SYSC 15A applies whether or not these arrangements are outsourcing (3.41).
FG26/6 says permissionless DLTs should not be treated as outsourcing under SYSC 8.1.1R. Where there is no contract, firms must strengthen internal controls and monitoring.
Monitoring means watching your admin power register: upgrades, role grants, threshold and timelock changes, oracle sources and bridge settings.
Firms must review their mapping and testing after a significant change to their business, operating model or markets (3.42). A major upgrade to a protocol you use is a good prompt.
The checklist
- Name each important business service as the client sees it, such as trading, lending or staking, not as a protocol (3.20).
- Set impact tolerances for lost access, failed or reversed transactions, inaccurate pricing and further disruption or hacking (3.22).
- List every protocol, chain and contract address each service touches.
- Confirm deployed code matches an audited version, and note what the audit did not cover.
- Record proxy admins, upgrade authority, thresholds, signers, timelock delays and bypass roles.
- Record who can pause, freeze or change parameters, and whether those powers are disclosed.
- Capture each oracle's sources, update triggers, fallbacks and who can change them.
- Capture each bridge's verification model, configuration owner and redemption path.
- List RPC, cloud, indexer and aggregator providers, and remove single points of failure.
- Map your own signing, key management and approval interfaces.
- Test contract, governance, oracle, bridge, chain and provider failures; record lessons learned.
- Monitor upgrade, role, threshold, timelock, oracle and bridge changes on every dependency.
- Review the map after any significant change, including upgrades to protocols you use.
How to respond by November 18
The consultation runs from October 21 to November 18, 2026. Respond in one of two ways:
- the FCA's online response form;
- email to gc26-7@fca.org.uk, saying whether you want your response treated as confidential and whether you are content to be named.
Firms that have mapped real dependencies are well placed to say where 3.27 and 3.28 need more precision, such as on oracles, bridges and emergency roles.
The FCA plans final guidance in Q1 2027; its web page says January 2027.
What Guardian does
Guardian's system review starts with an hour with a Guardian engineer. It covers the contracts that are live, the services that can reach them and who holds the keys that can change either.
For firms allocating to or integrating protocols, Guardian's underwriting work assesses control, custody and dependencies as inherited exposure. It then monitors upgrades, control changes and dependency drift.
Guardian's operational resilience assessment exercises scenarios such as key compromise, an oracle failure and a chain halt.
Frequently Asked Questions
Does GC26/7 create new rules for firms using DeFi?
No. It is draft non-Handbook guidance on how existing requirements in SYSC 15A, SYSC 6 and the Money Laundering Regulations apply when firms use DeFi.
Which firms does GC26/7 apply to?
FCA-regulated firms that interact with, facilitate access to or provide financial services using DeFi, and are subject to SYSC 15A, SYSC 6 or the Money Laundering Regulations. It will also be relevant to firms seeking authorization.
How do I respond to GC26/7?
Send comments by November 18, 2026 using the FCA's online response form or by email to gc26-7@fca.org.uk. If you email, say whether you want your response treated as confidential and whether you are content to be named.
Sources
- FCA: GC26/7 Decentralised finance guidance (DeFi) (October 21, 2026)
- FCA: GC26/7 guidance consultation, Decentralised Finance (DeFi) (PDF, October 21, 2026)
- FCA: FG26/6 Guidance on Cryptoasset Operational Resilience (PDF, June 30, 2026)
- FCA: CP26/36 Cryptoasset perimeter guidance (October 21, 2026)
- FCA: Overview of our cryptoassets regime policy statements (June 30, 2026)
Map the DeFi dependencies behind your services
Guardian maps the contracts, admin keys, oracles and bridges your services rely on, and watches them for changes, so your SYSC 15A mapping stays current.