Key takeaways
- The FCA published two linked consultations on 21 October 2026: GC26/7 on DeFi guidance and CP26/36 on the cryptoasset perimeter, both reported to close on 18 November 2026.
- Reported guidance says using software or smart contracts does not by itself decide whether an activity is regulated.
- We could not confirm how the papers treat technology providers as a category, so read them directly.
- The wider regime starts on 25 October 2027, and applications are accepted until 28 February 2027.
On 21 October 2026, the FCA published two linked consultations on how UK financial regulation applies to decentralised finance and to the wider cryptoasset perimeter. The FCA decentralised protocols consultation matters to Indian protocol developers because UK rules can reach a service that has no UK office if it serves UK consumers, as earlier guides in this series explain.
Both papers close for responses on 18 November 2026, so the time to act is short. This guide sets out what the FCA decentralised protocols consultation covers on what we could confirm, what remains unverified, which Indian developers should pay attention, how to respond and what to do in the meantime. It summarises secondary reports: UK regulatory points must be confirmed with UK advisers, because Halverton & Co. is an Indian law firm.
What the FCA published
The FCA published two connected consultations on 21 October 2026. The DeFi paper is guidance consultation GC26/7, which is non-Handbook guidance on how existing operational resilience and financial crime requirements apply to firms that use decentralised finance. The second paper, CP26/36, is a consultation on the cryptoasset perimeter. Both are open until 18 November 2026, according to the coverage we reviewed.
Reports say the FCA plans final DeFi guidance in the first quarter of 2027 and final perimeter guidance in spring 2027. These dates sit alongside the dates already set for the wider regime: the authorisation gateway opened on 30 September 2026, applications are accepted until 28 February 2027 and the full cryptoasset regime is due to start on 25 October 2027.
Sources differ slightly on the exact publication date of the DeFi paper, and we did not open the consultation papers themselves. The summary here is therefore a map to what to read, not a substitute for reading it. Anyone who plans to respond to the FCA decentralised protocols consultation should work from the FCA’s own pages.
What the DeFi guidance says about technology use
A central point reported in the coverage is technology neutrality. The perimeter guidance says that the use of software, smart contracts or distributed ledger technology does not by itself decide whether a person is carrying on a regulated activity. In other words, saying that a protocol is decentralised or run by code is not a defence. The FCA looks at who actually performs the activity, who controls it and who benefits.
The guidance focuses on firms that use DeFi, and applies existing expectations on operational resilience and financial crime to them. For a regulated firm that routes customer business through a protocol, that means doing due diligence on the protocol, understanding its risks and controlling its own exposure. For a protocol team, it means that your regulated customers may start asking for assurance about your governance, security, upgrade controls and incident response.
Reports also say that relying on a stablecoin or other exclusion does not settle the position under the financial promotions regime, and that the exclusions do not extend to other regulated activities or to the Money Laundering Regulations. We could not confirm how the consultation treats technology providers as a category, which the FCA decentralised protocols consultation is expected to cover in part, so that point should be checked in the papers.
For a protocol team, a useful exercise is to list every point of control. Who can upgrade the contracts, pause them or change fee parameters? Who holds the admin keys, and are they a multisig, a foundation or a company? Who hosts the front end and the RPC endpoints, and who collects fees? Who markets the protocol and to whom? These answers show how a regulator reading the FCA decentralised protocols consultation is likely to see your project, and they are the facts the FCA says it will look at.
Who among Indian developers should pay attention
Indian teams that build and maintain a protocol with a front end used by UK consumers should read the papers closely. So should teams that run a hosted interface, operate a validator or sequencer, manage an admin key or upgrade multisig, collect fees or promote the protocol to UK audiences. The more control and benefit a team has, the harder it is to argue that it is only publishing software.
| Role | Likely level of attention | Why |
|---|---|---|
| Team that runs a hosted front end for UK users | High | Controls the interface and may collect fees |
| Operator of a validator, sequencer or admin key | High | Control over upgrades or transactions |
| Team that markets the protocol or token to UK audiences | High | Financial promotions rules can apply |
| Open-source developer who only publishes code | Lower, but substance decides | No service, fees or UK marketing, though labels do not decide the outcome |
Pure open-source developers who publish code without running a service, collecting fees or marketing to the UK are in a different position, but the FCA’s focus on substance means that role labels do not decide the outcome. A foundation or DAO structure does not remove the question either. The UK has not extended its overseas persons exclusion to crypto, so an Indian developer with UK users can be within scope without a UK entity.
Financial promotions deserve a separate look. The regime has applied to cryptoassets since 8 October 2023, and promoting a protocol or token to UK consumers can be an offence unless the promotion is approved by an authorised person or meets an exemption. Developer-led marketing, airdrop campaigns and community posts aimed at the UK are common risk points.
How to respond and what to prepare
Responding to the FCA decentralised protocols consultation is open to anyone. A useful submission is specific: describe how a real protocol works, who holds which keys and powers, where control is truly distributed and what a workable rule would look like. Give examples, and say what would be impractical. Regulators rely on this kind of technical evidence, and a short, evidence-based response is better than a long general one. The deadline is 18 November 2026.
In parallel, prepare an internal map of your protocol: components, roles, admin powers, fees, off-chain services and the entities that run them. Record the legal entity behind each component and where it is located. That map is the starting point for any perimeter analysis and for any later FCA application.
Decide on the UK question for each product. Options include restricting UK access with real controls, adopting a structure in which an authorised UK partner serves UK consumers, or preparing an application inside the window that closes on 28 February 2027. Document the decision and the reasons. Where the legal analysis is unclear, take UK advice before launching a UK-facing campaign.
Indian developers sometimes assume that a foundation in another jurisdiction, or a DAO wrapper, closes the question. It rarely does by itself, because the FCA looks through labels to who performs and benefits from the activity. If you do rely on a structure, be ready to explain who really makes decisions, where they are, and how the structure works in practice. Contributing to the FCA decentralised protocols consultation with a clear technical description may also help the FCA understand where responsibility can sensibly sit.
Indian-law checks, remedies and quick answers
Indian law adds its own layer. India has no dedicated DeFi statute, but gains from virtual digital assets are taxed at a flat 30% with a 1% TDS on transfers, and entities that facilitate transactions may need FIU-IND registration as virtual digital asset service providers. FEMA applies to any UK subsidiary or overseas investment, and Indian-resident founders have disclosure duties for foreign assets. If you are reviewing the FCA decentralised protocols consultation, keep these in view because UK and Indian analyses often point in different directions. If the FCA or a UK partner raises a concern, respond promptly and in writing, preserve records and take advice. If you decide to restrict the UK, give existing users notice and a way to withdraw. Keep marketing and community channels consistent with the decision, since posts aimed at UK audiences can undo an access restriction. Revisit the position after the final guidance is published in 2027.
Related reading: FCA crypto authorisation: what Indian firms must do, how the UK crypto regime reaches Indian Web3 startups, UK crypto promotions and Indian influencers, UK staking regulation for Indian providers, UK stablecoin rules for Indian payment startups, FIU-IND registration for crypto businesses and crypto tax in India vs the UK; also smart contract liability for Indian developers; also the CLARITY Act status after the Senate vote.
Quick answers
What is the FCA decentralised protocols consultation?
It is the FCA’s October 2026 consultation on DeFi guidance (GC26/7) and the cryptoasset perimeter (CP26/36), both open until 18 November 2026. It deals with how existing UK rules apply to decentralised activity and related technology.
Does decentralisation mean an Indian protocol is outside UK regulation?
No. The reported guidance says that using software or smart contracts does not by itself decide whether an activity is regulated. The FCA looks at who performs, controls and benefits from the activity.
Can anyone respond to the FCA consultation?
Yes. Developers, firms and individuals can respond, and specific technical evidence is most useful. The reported deadline is 18 November 2026.
Who can respond to the FCA consultation?
Developers, firms and individuals can respond. Specific technical evidence about how a real protocol works is the most useful, and the reported closing date is 18 November 2026.
Does the guidance apply only to regulated firms?
Reports describe GC26/7 as guidance on how existing operational resilience and financial crime requirements apply to firms that use DeFi. Protocol teams are affected indirectly, because regulated customers will ask for assurance.
Final word
Halverton & Co. is an Indian law firm advising UK companies, founders, investors and law firms on Indian law, including FIU-IND registration, FEMA structuring, crypto tax and Indian-law compliance for Web3 protocol teams with overseas users. We practise in Jharkhand, Maharashtra and before the Supreme Court of India, and work alongside your UK solicitors, who advise on English law. Halverton & Co.: Where tech needs law! If you have a question about Indian law, write to us at office@halvertonandco.com, or get in touch.
This article reflects developments reported up to late October 2026. It is for general information only, is not legal advice, and does not create a solicitor-client relationship. Halverton & Co. is an Indian law firm, is not authorised or regulated by the Solicitors Regulation Authority, and does not advise on English law; UK-law points should be confirmed with UK advisers.
Sources
Related practice area
Crypto, Web3 & Digital Assets
Advice for virtual digital asset businesses on registration, reporting and structure.
View the practice areaComments
No account needed. Comments are reviewed before they appear, so yours will show here once approved. Please do not share confidential details or describe your own legal matter: replies are general discussion, not legal advice, and do not create an advocate-client relationship. For your own situation, write to office@halvertonandco.com.
