FCA consults on when a DeFi front-end needs authorisation

On 21 October 2026 the FCA opened two linked consultations that answer the question we left hanging at the start of this month: when does a website or app that sits in front of a decentralised protocol need FCA authorisation? Both close on 18 November 2026.

CP26/36: Cryptoasset perimeter guidance proposes changes to the Perimeter Guidance Manual (PERG 18, plus consequential edits to PERG 8 on financial promotions). It explains the new exclusions in the second statutory instrument, and adds guidance on how decentralisation affects the perimeter.
GC26/7: Decentralised finance guidance is non-Handbook guidance for firms that already use DeFi to provide financial services. It covers operational resilience and financial crime.

This piece is a summary of draft guidance, not legal advice. Every quote below is taken from the FCA's own consultation pages and papers.

Why this was needed

The FCA published its perimeter guidance, PS26/18, in September. The day before, the Government laid a second statutory instrument, the FSMA 2000 (Cryptoassets) (Miscellaneous Amendments) Regulations 2026, which the FCA calls the Cryptoassets Amendment Regulations. That instrument added several exclusions, so PS26/18 was out of date on arrival. CP26/36 lists the new exclusions as:

temporary settlement arrangements
temporary UK qualifying stablecoin holding arrangements for payment transactions
arrangements involving backing assets held for a UK qualifying stablecoin
proprietary trading where a person is not providing a service to anyone else, or acts as a market maker on a qualified cryptoasset trading platform
technical services that "merely allow access to services provided by a third person or to a decentralised protocol"

The last one is the exclusion that matters for DeFi front-ends.

"Decentralised" is not an answer on its own

CP26/36's starting point is that the perimeter is technology neutral. In the FCA's words, the use of "software, smart contracts, distributed ledger technology, distributed governance mechanisms or other technological arrangements does not determine whether there is a person carrying on a regulated activity".

The draft PERG text then lists three groups of features the FCA may look at when deciding whether someone is carrying on an activity:

Governance and decision-making: formal or legal control, discretion over decisions, liability for the service.
Operational and technical structure: control over design and maintenance, discretion over operations.
Economic and commercial structure: financial control, financial benefit, control over spending.

None of these is decisive and they are "not a separate perimeter test". The FCA also proposes to apply the "by way of business" test to each participant separately where functions are spread across several people, and says overseas elements do not by themselves take an activity outside the UK.

The technical services exclusion, in detail

This is the core of the consultation for anyone building or using a DeFi front-end. The exclusion only covers the arranging activity. In its own words it is "not a general exclusion for services described as technological, technical, software-based or connected with decentralised finance", and it does not extend to other activities such as dealing. It is also unavailable to anyone already authorised under FSMA or to a payment services provider.

The draft guidance says a provider is more likely to be "merely providing a technical service" where the points in the left-hand column apply, and less likely where its service is part of how transactions are "selected, shaped, directed, negotiated, routed or brought about":

Points towards the exclusion	Points away from it
The service responds to instructions the user starts	The service selects, shapes or directs the transaction
Instructions are passed on without judgement about their content or destination	The provider routes orders by reference to the trade
The user chooses the protocol or service provider	The provider picks or recommends the protocol
No ranking of counterparties, protocols, liquidity sources or routes	Ranking or recommending liquidity sources or execution routes
No negotiating or setting of material terms	Negotiating or setting material terms
No substantive part in whether, where or how a trade happens	Substantive participation in bringing the trade about

Two lines from the draft are worth quoting in full. The first is that a person "does not obtain the benefit of the exclusion simply by placing an interface between users and arrangements described as decentralised". The second is that this "may remain the case even though instructions are submitted through an automated interface", so automating the routing does not turn it into a technical service.

On the other hand, a service does not stop being technical "because it is designed specifically for cryptoasset transactions, operates commercially, charges a fee or provides a convenient means of access". Added features do not automatically rule a provider out either. The test is whether the service is still "non-substantive and non-discretionary technical functionality".

For a reader of our Uniswap guide, the dividing line is easy to picture. A swap screen that sends your trade to the pool you chose looks like the left-hand column. A screen that searches several pools and picks a route for you, the job an aggregator does and part of why slippage settings exist, starts to look like the right-hand column. Where any particular service lands is a question of fact that the FCA has not answered, and this site does not try to.

What GC26/7 adds

GC26/7 is aimed at firms already in scope of SYSC 15A (operational resilience), SYSC 6 (compliance and financial crime) or the Money Laundering Regulations that use DeFi to provide financial services. The FCA says it "seeks to clarify existing rules rather than establish new policy", so it creates no new requirements and carries no cost benefit analysis. It asks six questions, covering whether the FCA has described the operational resilience and financial crime risks correctly and what other steps or measures could reduce financial crime in DeFi.

Timing, and a small inconsistency

Responses due: 18 November 2026 for both. CP26/36 responses go to cp26-36@fca.org.uk and GC26/7 responses to GC26-7@fca.org.uk, or through the online forms.
Final guidance: the FCA gives three different answers. The CP26/36 web page says January 2027, the CP26/36 paper (paragraph 1.14) says "spring 2027", and GC26/7 says Q1 2027. Read that as early 2027.
Application window: still open, from 30 September 2026 to 28 February 2027.
Regime start: 25 October 2027.

The FCA also offers some forbearance. A firm that can show the uncertainty over the technical services exclusion "materially impacted" its ability to apply, and submits an otherwise complete application inside the window, will be given extra time on the incomplete parts.

What this does not settle

It is still a draft. Nothing here is final until the guidance is published in 2027, and the wording on "merely providing" is exactly the kind of text consultation responses push on.
There is no list of who is in or out. The FCA gives indicators, not a verdict on any front-end, wallet or aggregator. Anyone relying on the exclusion still has to apply the test to their own service.
The exclusion covers arranging only. A front-end that does anything amounting to dealing, custody or operating a trading platform is not helped by it.
Financial promotions are a separate question. CP26/36 amends PERG 8 too, so a provider that falls inside the exclusion may still face the promotion rules.

For ordinary users, nothing changes today. The way a swap works on-chain is the same as before, and so are the risks covered in our guides to yield farming, choosing a wallet and common scams. What the consultations change is how the services in front of those protocols will be regulated from October 2027.

Sources

FCA, CP26/36: Cryptoasset perimeter guidance (web page) and consultation paper PDF, 21 October 2026, especially chapter 2, chapter 6 and draft PERG 18.8.25 to 18.8.35
FCA, GC26/7: Decentralised finance guidance (web page) and guidance consultation PDF, 21 October 2026
FCA, PS26/18: Cryptoasset perimeter guidance, September 2026