Twenty-eight days. That is the full interval between publication of FCA Consultation Paper CP26/36 on 21 October and the close of feedback on 18 November. For a document that will decide whether a non-custodial frontend deployed in the UK is regulated software or unlicensed intermediation, four weeks is not a consultation period. It is a filter. Firms with standing compliance departments will file. The independent developers who actually ship the interfaces in question, the ones running three-person teams and a GitHub org, mostly will not. The exemption list in CP26/36 is short, and only one line of it touches on-chain software. The rest is scaffolding. Everything worth arguing about sits inside a single clause about technical access, and the people best positioned to argue it have the least time to do so.
CP26/36 is not a rulebook. It is a consultation on where the UK's expanded crypto regime should and should not apply โ specifically, how the FCA intends to interpret exemptions introduced by recent legislative change from HM Treasury. The agency is executing a mandate, not inventing one. Four categories appear on the exemption list: temporary settlement arrangements, qualifying stablecoin holdings in payment processing, certain proprietary trading activity, and technical services that solely provide access to other providers or to decentralised protocols.
The framing matters more than the list. This is activity-based regulation โ a perimeter question โ not asset classification. The Howey test asks what a token is. The FCA is asking what a person does. Those are orthogonal axes, and conflating them has produced most of the bad DeFi regulatory analysis I have read since 2021.
The clock is the tell. Consultation in October 2024. Final guidance scheduled for January 2027. The regime applies from 25 October 2027. The chain is fast; the settlement is slow. Three years between question and answer is a long time in a sector that redeploys its architecture every eighteen months, and it means the document in front of us is a forecast of intent, not a description of it. It also means anyone citing CP26/36 as a current compliance position is citing a draft.
Start with the clause. "Technical services that only provide access to other providers or decentralised protocols" maps, in engineering terms, to a non-custodial frontend: no private key custody, no asset custody, no settlement authority, just a UI layer that constructs and broadcasts calls. The FCA did not say all DeFi frontends are exempt. It said applicability "depends on the actual activities and factual circumstances." That sentence is the entire regulatory philosophy โ principled leniency at the level of text, discretionary severity at the level of enforcement.
So the operative question for any team is not "is my protocol decentralised." It is "does my interface do anything." I built a version of this checklist during a 2024 due diligence engagement for a European fund, evaluating a modular protocol's data availability sampling. Forty hours in, the finding was not in the mechanism the team documented โ it was in the sequencer they had filed under infrastructure. Same structure here. The risk in a frontend is never in the rendering code. It is in the fee flow and the routing logic.
- Does the interface capture a fee, and where does it flow?
- Does it route across venues, or pass one call to one contract?
- Does it curate a token list, or read an on-chain registry?
- Does it host a fiat on-ramp?
- Does it perform KYC, or hand off to a third party?
Each affirmative answer converts "technical access" into "arranging transactions," the phrase that carries the licence burden. Token-list curation is the sharpest of them. A static list is a discretionary editorial act, and editorial acts are what intermediaries do. The exemption, read literally, rewards passivity.
The second exemption deserves equal scrutiny and is receiving none. "Temporary settlement arrangements" concedes, in regulatory language, that on-chain finality and traditional settlement cycles do not align. That is a stablecoin payment concession written in four words, and it is the only place the paper acknowledges that settlement latency is a design constraint rather than a bug. It is also unspecified.
The burden asymmetry is the practical content of the paper.
| Actor | Probable classification | Licence burden | |---|---|---| | Exchange / custodian | Intermediary | High | | Order aggregator | Intermediary | High | | Non-custodial frontend | Technical access | Possible exemption | | Wallet with embedded swap | Ambiguous | Case-by-case | | Stablecoin issuer | Conditional | Undefined |
That last row is the one nobody is pricing. The paper exempts qualifying stablecoin holdings in payment processing without defining qualifying. Reserve composition, audit cadence, redemption latency โ all deferred to a document that does not yet exist. Proofs verify truth, but context verifies intent, and the intent here is to leave the stablecoin question open until the market settles into a shape worth regulating.
The prevailing read is that DeFi frontends have been handed a safe harbour. Two corrections.
First, a consultation paper has no legal force. No firm can claim an exemption on its basis, and the FCA has reserved the right to move. Anyone restructuring against a consultation document is building on an unpoured foundation.
Second, the exemption is not a reward for decentralisation. It is a reward for interface passivity. What is carved out is not the protocol โ it is the absence of behaviour. That inverts the narrative entirely: teams that want to stay inside the exemption will have to strip functionality. No frontend fee switch. No curated lists. No fiat rails. Complexity hides risk; simplicity reveals it โ and the regulator has quietly decided that simplicity is also the test for legality. The incentive is to ship a worse product and call it compliance.
Meanwhile the three-year gap is an arbitrage corridor. Unbundle custody from interface now, argue factual circumstances at authorisation later. The FCA has pre-empted this in language and not in mechanism.
Watch the response count on 18 November. If submissions skew toward incumbents, "depends on factual circumstances" becomes an enforcement instrument rather than a description. My forecast: the exemption survives in the text and narrows in application, and the first action targets an aggregator โ the cleanest case of arranging. The structural vulnerability is vocabulary. "Arranging" is drafted in economic terms; the code is written in functional terms. Those two languages do not compile together, and the compiler will be a case officer in Leeds.