FCA crypto rules: an app that picks your trade route is no mere “technical service”

Britain’s Financial Conduct Authority (FCA) has set out how narrowly it reads the new “technical services” exclusion in its crypto rules, and the answer matters for crypto apps with a blockchain, dove gli utenti scambiano token direttamente dal proprio wallet senza affidare la custodia dei fondi a una società.">swap button. In Consultation Paper CP26/36, opened on 21 October 2026, the regulator says a crypto app or front end that selects or adjusts trade routes on price, liquidity or cost, or that promises users best execution, is unlikely to be “merely” providing a technical service. Such a service may be arranging deals in cryptoassets, an activity that will need FCA authorisation once the UK regime starts on 25 October 2027.

Comments are open until 18 November 2026. The paper names no company and no wallet, and the text is draft guidance on how to read a law written by the Treasury, not a new rule or an enforcement action. Firms that want the new permissions have until 28 February 2027 to apply in the authorisation window that opened on 30 September.

The draft also closes off an easy defence. Automation does not change the answer: the exclusion can be lost “even though instructions are submitted through an automated interface and some or all of A’s functions are performed automatically”, the FCA writes in draft PERG 18.8.26, where A is the firm offering the service.

The FCA crypto rules exclusion covers plain access, not choices

The exclusion sits in article 9Z2A of the Regulated Activities Order, added by a second statutory instrument, the FSMA 2000 (Cryptoassets) (Miscellaneous Amendments) Regulations 2026. The government laid it the day before the FCA published its earlier perimeter guidance, PS26/18, in September (CP26/36, paragraph 1.3). The same instrument also carves out temporary settlement arrangements, some stablecoin holding arrangements, and proprietary trading, and market making on a qualifying cryptoasset trading platform.

Under draft PERG 18.8.25, the technical services carve-out applies only when four conditions are all met. The provider is neither an authorised firm nor a payment service provider. It merely provides a technical service. That service lets the user reach the services of a third party or a decentralised protocol. And the third party is itself authorised or exempt for that activity, or the destination is a decentralised protocol.

Then comes what the exclusion is not:

“It does not provide a general exclusion for services described as technological, technical, automated, software-based or connected with decentralised finance.” (FCA, CP26/36, draft PERG 18.8.25)

The carve-out covers arranging deals only. It does not extend to dealing or other regulated activities (paragraph 6.3). It gives no relief from the financial promotions regime, where the exclusion “has not been replicated” according to the government’s explanatory memorandum, as cited in draft PERG 18.8.34. Nor does it lift money laundering registration under regulation 14A (18.8.35). An app that stays outside the arranging perimeter can still need its marketing approved by an authorised firm.

Seven signs that an app is exercising discretion

The heart of the paper is draft PERG 18.8.30, on discretion, which the FCA defines as “qualitative judgement capable of materially affecting a transaction”. It lists seven indicators. A provider may be exercising discretion if it:

• chooses between counterparties, venues, service providers, protocols, liquidity sources or transaction routes;
• decides whether, when or in what order an instruction is sent or executed;
• changes an instruction or sets material terms of the trade;
• selects or adjusts routing by reference to an assessment of price, liquidity, speed, transaction costs, counterparty risk or likely outcome;
• recommends, ranks, filters or presents options in a way that reflects a judgement of their merits;
• decides that a trade should not go ahead;
• represents that it will obtain best execution, a best available outcome or another optimised result for the user.

The last indicator reaches past the code into the marketing. A best-execution claim counts, the FCA explains, “because it can indicate that A undertakes to assess available alternatives and exercise judgement” in choosing between them. How much it weighs depends on what the firm promised and how its service works in practice.

On the other side, the draft gives five signs of a non-discretionary service: the user picks the provider or protocol and sets the parameters; the instruction goes through unaltered; any routing follows “predetermined objective rules”; the same input ordinarily gives the same output; and the firm does not undertake to assess the merits of the options (18.8.30(2)).

Discretion is not the whole test

A firm that removes every judgement call is not automatically safe. Draft PERG 18.8.30 says the absence of discretion “does not necessarily establish” that a service is non-substantive, and that a person can take part substantively in trades through non-discretionary functions.

Draft PERG 18.8.31 lists what the FCA calls substantive intermediation. It includes deciding which providers users can reach, structuring the steps a user must go through, receiving, combining, modifying or routing orders, bringing together parties or liquidity, and holding the service out as arranging, executing or optimising trades. Pay matters too: remuneration “calculated by reference to whether, or on what terms, transactions take place” is on the list. It is qualified at once. A fee linked to trades “will not determine the issue” without looking at what it pays for, and limiting access for security or legal compliance reasons is not necessarily intermediation.

Extra features are not fatal in themselves (18.8.26). The question the FCA keeps returning to is whether the service is still “non-substantive and non-discretionary technical functionality”.

An algorithm is neither a shield nor a trap

Crypto front ends often argue that code, not people, chooses the route. The regulator addresses that head on:

“The fact that software uses an algorithm does not necessarily make the service non-discretionary.” (FCA, CP26/36, draft PERG 18.8.30)

Its reasoning is that predetermined software can carry out judgements the firm made earlier, and an algorithm can pick among options using criteria the firm set or tuned. The test, it says, is whether the firm, looking at the design and operation of the service as a whole, exercises or has taken responsibility for judgement that materially affects the trade.

That cuts both ways. Routing by “predetermined objective rules” is listed as a sign of a non-discretionary service, so a fixed rule is not condemned. But a router whose rules rank venues by price and gas is, on the face of indicator (d), making exactly the kind of assessment the FCA describes. The draft gives no worked example that settles where one ends and the other begins.

DeFi front ends: a protocol label is not enough

The second branch of the exclusion covers access to a decentralised protocol, a term the law does not define. Draft PERG 18.8.32 lists what does not, by itself, make something a decentralised protocol: running on smart contracts, public source code, automatic execution, token-holder governance, being called “DeFi” or “permissionless”, or having no named operator. The FCA says the term is “unlikely to describe what is, in substance, a service controlled and operated by an identifiable person”.

It points to three things it may weigh: how far people are engaged in the ongoing maintenance and adaptation of the arrangement, whether they earn money from a service tied to its use, and whether they hold it out as a protocol for trading. And even where the destination really is a decentralised protocol, the interface in front of it must still only provide access:

“A person does not obtain the benefit of the exclusion simply by placing an interface between users and arrangements described as decentralised.” (FCA, CP26/36, draft PERG 18.8.32)

Readers new to these terms can start with our explainer on what a decentralised exchange is. On 21 October, the day CP26/36 opened, the FCA also opened a separate and narrower consultation, GC26/7 on decentralised finance, aimed at firms it already regulates that use DeFi; it covers operational resilience and financial crime, and also closes on 18 November.

How the UK got here: from no carve-out to a narrow one

The first draft of the perimeter guidance, CP26/13 of 15 April 2026, said there was no technical services exclusion from arranging for trading, only one for staking. That position is restated in PS26/18 at paragraph 4.29. Comments on CP26/13 closed on 3 June.

The industry pushed back hard. According to PS26/18 (paragraphs 4.32 and 4.33), of 62 responses on intermediary activities, 63% were unsupportive of the guidance on arranging deals, 59% said it took too broad a view of the activity, 43% asked for clarity on technical service providers, and 49% said the arranging perimeter “should not apply to technical service providers without discretion or control over transactions”. On staking, 28% raised non-custodial staking interfaces and argued that wallet connectivity and similar access tools should stay out of scope where users keep full control (paragraph 4.39).

Law firm Latham & Watkins wrote in an April note on the earlier draft that the FCA’s approach could reach non-custodial wallet providers, web3 interfaces and trading software, and that finding prices and venues for users would likely count as arranging. That was a reading of a draft now superseded.

The Treasury answered in September with the amending regulations and the new exclusion. CP26/36 is the FCA’s reading of it, and most of the new text, draft PERG 18.8.25 to 18.8.35, turns on what the word “merely” in article 9Z2A allows (18.8.26).

What it could mean for swap buttons in MetaMask, Phantom and Revolut

No firm is named, and the paper says nothing specific about self-custody wallets. In CP26/36 the word “wallet” appears only as an example of a loose label (draft PERG 18.1.12) and in passing in the stablecoin and settlement passages. What follows is Coindaro’s own reading of how the draft factors line up with features these products describe publicly. It is not an FCA statement, and nothing here suggests any of these firms is breaching any rule; the UK regime does not start until October 2027.

MetaMask Swaps: route selection by design

Consensys describes MetaMask Swaps on a product page as pulling prices from several DEX aggregators, professional market makers and individual exchanges, and says Swaps “sources the best prices and determines which aggregator is the most gas efficient for every trade”. The same page gives a service fee of 0.875% built into each quote. It carries no date, and its most recent usage figures are as of March 2021, so that rate may no longer apply. Read against the draft, that design touches several indicators: selecting between liquidity sources (a), routing by price and cost (d), presenting options on their merits (e), the best-price claim (g), and transaction-linked pay under 18.8.31. Our MetaMask review covers the wallet itself.

MetaMask’s plain “connect to a dapp” function looks different. There, the user picks the protocol and signs what it presents, which matches the favourable factors in 18.8.26. We found no comment from Consensys on the consultation.

Phantom: in-wallet swaps on outside routers

Phantom also offers swaps inside the wallet; our Phantom review covers how the app works. Reports on which outside routers it uses and what fee it charges could not be confirmed on Phantom’s own pages, so we leave them aside. The same questions apply: who picks the route, on what criteria, and how the fee is set. Phantom has made no UK statement that we found. The same logic reaches aggregators that rank routes, a business model Uniswap itself moved closer to when its v4 hooks began routing swaps to outside venues; the FCA does not mention any of them.

Revolut: the exclusion is not on the table

Revolut sits in a different box. It is not a self-custody wallet but a regulated group: it became a fully licensed UK bank in March 2026, according to CoinDesk, which reported that its crypto and stock trading run through separate entities. Draft PERG 18.8.33 is blunt: an authorised person or payment service provider cannot use the technical services exclusion at all. For a firm like Revolut, the question is not whether its crypto routing is “technical” but which permissions it holds. We found no report on whether Revolut has applied in the FCA window, and the FCA does not publish applicants.

If a feature is caught, the draft leaves two paths: seek the arranging permission, with the money laundering and financial promotions duties that come with it, or change or switch off the feature for UK users. Latham & Watkins suggested in April, on the earlier draft, that an authorised firm might be limited to UK-authorised venues for execution; that is the law firm’s view, not an FCA rule.

Key dates: 18 November comments, 28 February applications

The final date for the guidance is unclear. The FCA’s consultation page points to January 2027, as does PANews, while the paper itself says at paragraph 1.14: “We will publish our final guidance in spring 2027”. Firms preparing applications before the 28 February deadline may therefore not have the final text in hand.

There is a softener. Its consultation page says firms whose applications were materially affected by uncertainty over the exclusion may get extra time on the arranging permission, provided they file an otherwise complete application inside the window. Firms registered under regulation 14A that apply in time can keep serving customers until their application is decided, and the FCA expects to decide applications filed by 28 February before the regime begins (paragraph 1.16).

What it changes for users in the UK and the EU

Until October 2027, crypto in the UK remains largely unregulated outside financial promotions and financial crime rules, as the FCA said in April. Nothing changes for UK users this year. The practical risk sits further out: a wallet or app that decides not to seek permission could restrict a swap feature for UK customers, or narrow the venues it routes to. None has announced anything of the kind.

Overseas teams are not automatically outside the test. The paper says overseas elements do not by themselves mean an activity is not carried on in the UK, leaving the question to the ordinary territorial analysis (paragraph 2.6).

For readers in France, Italy and the rest of the EU, the UK text has no direct effect. The EU already runs MiCA, and its open question is different: how to treat services that are “fully decentralised”, a point still unresolved in the current review. Our guide to the MiCA regulation sets out the EU rules. The UK has chosen a case-by-case test of who controls the route; the EU has not yet decided where its line falls.

What to watch before the final guidance

In the annex of questions, the regulator stresses that it “does not have the power to change the perimeter, only to interpret it”. Question 14 of the paper asks only whether firms agree with its reading of 18.8.25 to 18.8.35. Responses can still move the examples and the weight given to each indicator, but not the law. The FCA also says its manual is not the place for rulings on individual business models; firms can ask it directly or take legal advice.

Several points were still open when we checked at 04:50 UTC on 24 October. No wallet, aggregator or exchange has commented publicly on CP26/36 that we found. Nobody outside the FCA knows who has applied in the window. And the paper sets no penalties; those sit in the wider regime. The next fixed date is 18 November, when comments close, by the online form or by email to [email protected].