FCA consults on DeFi and the cryptoasset perimeter

What does this mean?

DeFi is subject to the ordinary perimeter analysis

The FCA proposes that arrangements involving decentralisation, automation, software and smart contracts should be assessed using the same perimeter approach as other arrangements. The analysis remains fact-specific and considers whether there is a person carrying on a regulated activity, whether it is carried on by way of business in the UK, and whether an exclusion or exemption applies. Terms such as DeFi, decentralised autonomous organisation and “true DeFi” are not statutory concepts and do not determine whether authorisation is required.

Software, protocols, algorithms and smart contracts are not themselves persons capable of being authorised or exempt. However, functions performed through them may form part of an activity carried on by a person. Relevant considerations may include who determines or materially influences the design, inputs, criteria or parameters, and who operates, maintains, updates or exercises control over the arrangements. More than one person involved in an arrangement may need to be authorised or exempt.

The technical services exclusion is limited

The proposed exclusion applies where a person that is neither authorised nor a payment service provider merely provides a technical service allowing another person to access services provided by an authorised or exempt person, or to access a decentralised protocol. It is not a general exclusion for technological, automated, software-based or DeFi services.

The FCA proposes that a person is more likely to be merely providing a technical service where the customer initiates the instruction, selects the provider or protocol, and determines the transaction parameters, while the provider processes the instruction without alteration or qualitative judgement. The exclusion is less likely to apply where the provider selects, recommends or ranks protocols, counterparties, liquidity sources or execution routes, determines transaction terms, modifies instructions or represents that it will obtain an optimised result. The exclusion does not extend to other regulated activities, the financial promotions regime or the Money Laundering Regulations.

Other exclusions depend on the activity and asset

The proposed perimeter guidance covers exclusions for temporary settlement arrangements, UK qualifying stablecoins and their backing assets, recognised central securities depositaries, proprietary trading and market making on a qualifying cryptoasset trading platform. The stablecoin exclusions do not apply to all qualifying stablecoins. Several apply only to UK qualifying stablecoins, meaning stablecoins issued within the scope of the regulated issuing activity by a person with the relevant Part 4A permission.

Existing resilience and financial crime requirements continue to apply

GC26/7: Decentralised Finance does not create new regulatory requirements. Firms within scope of SYSC 15A must identify important business services, set impact tolerances, map supporting resources and carry out scenario testing. For DeFi activities, mapping should include relevant protocols, smart contracts, distributed ledger infrastructure, bridges, oracles, external providers, governance arrangements and change-control mechanisms. Firms remain responsible for managing third-party dependencies and for the quality and accuracy of third-party testing.

Firms must also consider DeFi-specific risks under SYSC 6 and the Money Laundering Regulations, where applicable. The proposed guidance covers business-wide risk assessments, systems and controls, customer due diligence, enhanced due diligence, ongoing monitoring, suspicious activity reporting and the Travel Rule. Relevant risks include complex cross-chain flows, non-custodial wallets, privacy-enhancing technologies, sanctioned persons or services, and exposure to illicit wallet addresses, smart contracts or protocols.

What do firms need to do?

Firms should resist treating decentralisation as a classification exercise. The more important task is to establish who performs each economically and operationally significant function. Product architecture, governance rights, protocol-selection criteria, upgrade mechanisms and control over system parameters may all affect whether a participant is carrying on a regulated activity. Legal analysis should therefore be grounded in how the arrangement operates, not how it is described.

The proposed technical services exclusion deserves particular scrutiny. The distinction between providing access and arranging a transaction may turn on features that appear operational rather than legal. Selecting or ranking protocols, determining transaction routes, modifying instructions or promising an optimised outcome could move a service beyond neutral technical functionality. Firms should examine both customer-facing features and judgements embedded within algorithms.

Reliance on an exclusion should also be precise. An exclusion may apply to one activity without resolving the position under another regulated activity, the financial promotions regime or the Money Laundering Regulations.

For firms within scope of SYSC 15A, resilience mapping should follow the delivery of each important business service across relevant smart contracts, bridges, oracles, interfaces and governance mechanisms. Other firms interacting with DeFi should consider the operational and technological risks under the regulatory requirements applicable to their activities.

Next steps

Both consultations close on 18 November 2026. The FCA plans to publish final DeFi guidance in Q1 2027 and final perimeter guidance in spring 2027, ahead of the new cryptoasset regime commencing on 25 October 2027.