UK FCA says ‘true DeFi’ is not a statutory concept

The UK Financial Conduct Authority has published draft guidance stating that calling an app or arrangement decentralised does not, by itself, place it outside regulation. In consultation paper CP26/36, opened on 21 October 2026, the regulator says that “true DeFi” is not a statutory concept, and that authorisation depends on what a person does in substance rather than on the label used to describe the service.

What happened

The FCA opened CP26/36, Cryptoasset perimeter guidance, on the same day as a related consultation, GC26/7, on how existing operational-resilience and financial-crime rules apply when firms use decentralised finance. Comments on both close on 18 November 2026. CP26/36 updates the FCA’s Perimeter Guidance Manual after legislative amendments that add exclusions, including for certain technical services that merely allow access to a third party’s services or to a decentralised protocol.

In the draft text, the FCA poses the question of what “true DeFi” is and whether it will ever require authorisation or an exemption. According to the paper, the phrase is sometimes used for arrangements said to operate through software, smart contracts or distributed ledger technology without intermediaries or central operators. The draft states that “true DeFi” is not a statutory concept in the Financial Services and Markets Act, the Regulated Activities Order or the Cryptoassets Regulations. The FCA says it has not set a comprehensive, deterministic test for the term. Decentralisation, it adds, exists on a spectrum and does not create a separate perimeter framework. Whether a person needs authorisation does not depend on whether an arrangement is described as decentralised, decentralised finance or “true DeFi”.

The consultation paper says the perimeter is technology neutral. Use of software, smart contracts, distributed ledger technology or distributed governance does not determine whether there is a person carrying on a regulated activity for which authorisation is needed. According to the draft, an arrangement described as decentralised, or as a DeFi arrangement, does not on its own mean that no relevant person is involved. Perimeter analysis always turns on the facts, including whether a person is carrying on a regulated activity, by way of business, in the UK, and whether an exclusion or exemption applies. Sector terms such as “decentralised”, “DeFi” and “DAO” may describe technology or organisation, but they are not generally statutory concepts.

The paper also says a new exclusion for certain technical service providers is not a general exclusion for services described as technological, technical, software-based or connected with decentralised finance. CoinMarketCap reported the same core point: smart contracts or distributed governance will not, by themselves, keep firms outside the licensing regime.

Why it matters

From 25 October 2027, the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 bring new cryptoasset activities into the UK regulatory perimeter. A person carrying on a regulated cryptoasset activity by way of business in the UK will need FCA authorisation unless exempt. The application window opened on 30 September 2026 and closes on 28 February 2027 for firms that want to rely on the savings provisions described in the consultation paper.

The draft is relevant to teams that market interfaces, aggregators or apps as decentralised. Automation describes how a function is performed; it does not, by itself, decide whether that function is part of a regulated activity carried on by a person. According to the paper, a person may still be carrying on an activity through software or automated arrangements where those arrangements implement choices, criteria or parameters that the person previously set. Where functions are split among several participants, the “by way of business” test is applied separately to each relevant person. Overseas elements alone do not mean an activity falls outside the UK.

That approach is consistent with earlier FCA policy that requirements apply where an identifiable person is carrying on a regulated activity, while activity with no such person may fall outside the perimeter. The new draft does not replace that test with a label. Linklaters noted that the FCA may look at who designed material functions, who can change parameters, who maintains the arrangements, and who takes responsibility or a commercial benefit.

What's next

Both consultations remain open until 18 November 2026. The consultation paper says the FCA will publish final perimeter guidance in spring 2027, taking responses into account. The FCA’s GC26/7 page says it plans to publish final guidance on DeFi operational resilience and financial crime in January 2027. That guidance is intended to explain existing rules rather than create a separate DeFi rulebook. Firms preparing authorisation applications are expected to consider how the drafts apply to services that use or connect users to DeFi before the regime starts on 25 October 2027.

Sources

• FCA, CP26/36: Cryptoasset Perimeter Guidance (PDF)
• FCA, CP26/36 consultation page
• FCA, GC26/7: Decentralised finance guidance
• CoinMarketCap, UK FCA Says Smart Contracts Alone Won't Keep DeFi Firms Outside Crypto Rules
• Linklaters, UK FCA proposes updates to crypto perimeter guidance