- The FCA has published draft guidance on when the website that fronts a DeFi needs UK authorisation, alongside a second paper on how already-regulated firms should handle DeFi exposure.
- Both consultations are open until 18 November. A consultation is a proposal, and none of this binds anyone yet.
- France has separately proposed making exchanges liable for some customer losses on DeFi protocols they give access to, so the thinking isn’t confined to London.
Regulators have spent years circling the same problem: how do you supervise software that nobody owns and nobody can switch off? The Financial Conduct Authority‘s draft answer is to leave the code alone and look instead at the websites people use to reach it.
If the firm running a DeFi website needs a UK licence, some will apply and plenty won’t bother. When authorisation looks expensive next to the traffic a site gets from one country, the standard commercial response is to block visitors from that country rather than pay for the permission. The protocol keeps running either way. What changes is whether there’s a convenient front door for you to walk through, and whether anyone answers for it when something goes wrong.
The difference between the code and the website
A DeFi protocol is a set of : programs deployed onto a such as Ethereum, which execute when someone sends them a transaction and carry on doing so whether or not the people who wrote them are still involved. There is no company behind the contracts in the way there’s a company behind a bank account.
A front-end is the website. Someone registers the domain, pays for the hosting, designs the screens that turn a smart contract into a few buttons, and in many cases takes a cut of what passes through. That someone lives in a country, has a bank account, and can be written to.
That gap is what the consultation is built on. Code has been extremely difficult for regulators to reach. A website is an ordinary business with an ordinary address, and the question being asked is at what point running one amounts to carrying on a regulated activity in the UK.
What’s actually on the table
There are two papers. One deals with the interfaces and when the people operating them would need authorisation. The other sets out how firms already regulated by the FCA are expected to manage the risks of touching DeFi at all. Both close to comment on 18 November, according to the reporting.
The timing follows on from the FCA opening applications for crypto firms under its new regime, which we covered when the gateway opened. Authorisation is the machinery being built first; this is an early attempt to mark out who has to queue up for it.
We worked from secondary coverage here. The FCA’s consultation documents weren’t in front of us at the time of writing, which is why nothing is quoted from them directly and why this sticks to the shape of the proposals rather than their detail.
Worth being clear about what a consultation is. It’s a document asking for comment, and what emerges at the other end is routinely narrower, broader or later than what went in. Anyone telling you DeFi has been regulated in Britain this week has read a headline and stopped there.
Britain isn’t the only one thinking this way
In France, authorities have proposed that crypto exchanges run checks on the DeFi protocols they offer customers access to, and carry liability for certain losses, under suggested changes to the EU’s crypto rules. The mechanism is different from the FCA’s. The instinct is the same one: find the party that can be held to account, and attach the obligation there.
Not everyone in the industry is relaxed about it. The Cardano Foundation has been among the voices pushing back on stretching MiCA, the EU’s crypto framework, over decentralised protocols, on the grounds that the thing being regulated doesn’t have an operator to regulate.
There’s a practical limit to all of it that regulators on both sides of the Channel will be aware of. A blocked front-end is not a blocked protocol. The contracts stay where they are, reachable from any wallet you control, and the effect of pushing a website out of a market is mostly to make the route to the same contracts less convenient and less supervised.
What to watch
What the FCA publishes after 18 November, and in particular whether the final version separates front-ends that charge fees or route orders from plain open-source interfaces that do neither. That line is where the cost of compliance lands.
Also worth watching whether any UK-facing DeFi sites geo-block before they have to. Firms frequently move ahead of a rule rather than wait for it, and if that starts happening over the next few months it will be the first visible consequence of a document that is, for now, only a proposal. More of our regulation coverage sits in Policy.