DeFi protocol frontend in United Kingdom
Operates a web frontend or aggregator that interacts with permissionless smart contracts on behalf of users. May or may not screen users / restrict regions.
DeFi frontend is conditionally permitted in United Kingdom with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- FCA registration under MLR 2017 as a cryptoasset business if the frontend involves exchange or custody functions (gb.licensing.anti-money-laundering-aml-counter-terrorist-financing, gb.licensing.scope-cryptoasset-businesses-operating-in)
- Transaction screening against UK sanctions lists (OFSI) and asset freezing obligations for designated persons (gb.aml.ofsi-enforcement-uk-vasps-must)
- Prohibition on servicing sanctioned jurisdictions or designated persons globally where a UK nexus exists (gb.aml.no-services-to-sanctioned-jurisdictions)
- Financial promotions compliance: risk warnings mandatory, no misleading promotions, incentive restrictions for crypto classified as restricted mass-market investments (gb.licensing.financial-promotions-enforces-rules-regarding, gb.licensing.legislation-financial-promotions-order-crypto-amendment)
- AML/CTF framework integration with sanctions screening as required under FSMA for registered VASPs (gb.aml.fca-oversight-registered-vasps-under)
Key Restrictions
- If the frontend takes fees or facilitates exchange/custody, it is likely a regulated cryptoasset activity requiring FCA registration under the MLR 2017 (gb.licensing.vasp)
- Retail crypto derivatives are banned since 2021 — if the frontend facilitates derivatives, it cannot serve UK retail users (gb.licensing.exchange)
- Financial promotions rules apply — crypto classified as restricted mass-market investments; risk warnings required, no misleading promotions (gb.licensing.legislation-financial-promotions-order-crypto-amendment)
- Future FSMA-based regime (2025-2026) will cover trading platforms, intermediation — likely capturing frontend operators more explicitly (gb.licensing.legislation-financial-services-and-markets-act-2000-amended-2023, gb.licensing.regulator-hm-treasury)
- Geofencing / IP-blocking UK users may be necessary if the operator is not FCA-registered and cannot comply with financial promotions rules
Key Risks
- High regulatory ambiguity — FCA perimeter guidance on 'decentralized' vs 'centralized' activity is not fully settled; frontends interacting with permissionless contracts may be deemed regulated activity if they exercise control or take fees (gb.licensing.guidance-provides-guidance-on-how)
- ~85% FCA registration rejection/withdrawal rate — very low success rate for crypto registrations; operating without registration exposes to enforcement action with unlimited fines (gb.licensing.vasp, gb.aml.civilcriminal-fines-unlimited-fines-asset)
- Unregistered firms missing 2027-2028 compliance deadlines face fines, suspensions, or permanent closures (gb.aml.fca-actions-fines-suspensions-or)
- Fee-taking (frontend fees, commissions, or MEV-related revenue) strengthens the argument that the frontend is conducting regulated activity, increasing enforcement risk (gb.licensing.cryptoasset-exchange-providers-firms-that)
- Sanctions compliance risk is acute — UK OFSI enforcement against crypto firms is active; failure to block sanctioned parties can result in criminal liability up to 7-10 years imprisonment (gb.aml.civilcriminal-fines-unlimited-fines-asset)
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
FCA — MLR registration and AML/CTF supervision of cryptoasset businesses (since 10 January 2020), supervision of cryptoasset financial promotions (since 8 October 2023), and authorisation, conduct and prudential regulation under SI 2026/102 from 25 October 2027. Of 393 MLR applications determined since January 2020, 68 were registered, 46 rejected, 265 withdrawn and 14 refused (as at 1 October 2026).
Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (SI 2017/692), as amended by SI 2019/1511 with effect from 10 January 2020 — AML/CTF registration and supervision of cryptoasset exchange providers and custodian wallet providers (regs 14A, 56, 58A); travel rule in Part 7A from 1 September 2023 (SI 2022/860).
Financial Services and Markets Act 2000, as amended by FSMA 2023 s.69 (in force 29 August 2023) — s.22 extended so regulated activities may relate to cryptoassets and s.417 given a cryptoasset definition; the regulated activities themselves are created by SI 2026/102 from 25 October 2027, and the crypto financial-promotions regime came from SI 2023/612 (7 October 2023).
Financial Services and Markets Act 2000 (Financial Promotion) (Amendment) Order 2023 (SI 2023/612, made 7 June 2023, in force for all purposes 7 October 2023) — adds "qualifying cryptoasset" as a controlled investment and creates the art 73ZA exemption for MLR-registered firms' own promotions; the FCA classifies qualifying cryptoassets as restricted mass market investments in COBS 4.12A and has applied the regime since 8 October 2023.
FCA MLR registration is required for cryptoasset exchange providers and custodian wallet providers. Since January 2020 the FCA has received 427 applications and determined 393: 68 registered (17%), 46 rejected (12%), 265 withdrawn (67%) and 14 refused (4%) as at 1 October 2026. The FSMA-based regime under SI 2026/102 (trading platforms, dealing, arranging, safeguarding, staking, qualifying stablecoin issuance) starts 25 October 2027.
EXCHANGE: MLR registration plus the financial-promotions rules in COBS 4.12A (prescribed risk warnings, fair clear and not misleading, incentive ban). The retail ban on cryptoasset derivatives (CFDs, futures, options) has applied since 6 January 2021 (PS20/10) and remains; retail access to crypto exchange-traded notes traded on an FCA-approved UK exchange reopened on 8 October 2025.
The FCA's perimeter guidance on cryptoassets is PS19/22 Guidance on Cryptoassets (23 January 2019), setting out where tokens are specified investments, e-money, within the Payment Services Regulations or outside regulation, supplemented by PS26/18 Cryptoasset perimeter guidance (16 September 2026) on when the new regulated activities need FCA authorisation.
The FCA supervises and enforces the cryptoasset financial-promotions regime that applies since 8 October 2023 under FSMA 2000 s.21 and SI 2023/612, issuing 146 alerts about illegal promotions in the regime's first 24 hours; its rules are in COBS 4.12A and its guidance in FG23/3.
MLR registration is required for cryptoasset exchange and custodian wallet services provided by way of business in the UK, and registration must be obtained before any in-scope service starts; the presence of a crypto ATM in the UK is treated as business carried on in the UK.
A "cryptoasset exchange provider" under MLRs 2017 reg 14A is a firm or sole practitioner that by way of business exchanges or arranges the exchange of cryptoassets for money or money for cryptoassets, exchanges one cryptoasset for another, or operates a machine (crypto ATM) that exchanges cryptoassets for money — including where it is the creator or issuer of the cryptoassets involved.
A "custodian wallet provider" under MLRs 2017 reg 14A is a firm or sole practitioner that by way of business provides services to safeguard, or to safeguard and administer, cryptoassets on behalf of its customers, or private cryptographic keys on behalf of its customers in order to hold, store and transfer cryptoassets.
Anti-Money Laundering (AML) & Counter-Terrorist Financing (CTF) – The Money Laundering Regulations 2017 (MLRs):
Cryptoasset exchange providers and custodian wallet providers have been "relevant firms" under every UK sanctions regime since 30 August 2022 (SI 2022/818) and must freeze funds and economic resources of designated persons, not make funds available to them, and report to OFSI any designated-person holdings and suspected breaches; OFSI published "Sanctions compliance in the Cryptoassets sector: Threat Assessment" on 21 July 2025 setting out the sector-specific evasion risks it expects firms to control.
Cryptoasset exchange providers and custodian wallet providers registered with the FCA under the Money Laundering Regulations 2017 reg 14A have been "relevant firms" under every UK sanctions regime since 30 August 2022 (SI 2022/818) and must screen for designated persons and report to OFSI; the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 (SI 2026/102) bring safeguarding of qualifying cryptoassets and other cryptoasset activities into FSMA authorisation on 25 October 2027, with the FCA application window running 30 September 2026 to 28 February 2027 and no automatic conversion of MLR registrations.
UK financial sanctions prohibitions bind all persons within the UK and United Kingdom persons for conduct anywhere in the world (SAMLA 2018 s.21), so a UK cryptoasset firm must apply asset-freeze and OFSI reporting obligations to transactions it conducts abroad, including in markets where cryptoassets are otherwise unregulated; the obligations attach to designated persons on the UK Sanctions List rather than to whole jurisdictions.
UK sanctions offences created under SAMLA 2018 regulations carry a statutory maximum of 10 years imprisonment on indictment (SAMLA s.17(5)); OFSI may impose civil monetary penalties under the Policing and Crime Act 2017 s.146 of up to the greater of £1,000,000 and 50% of the estimated value of the funds or economic resources involved; carrying on unauthorised regulated activity (FSMA 2000 s.23) and contravening the Money Laundering Regulations 2017 (reg 86) each carry up to two years imprisonment and a fine on indictment.
FCA cryptoasset enforcement to date comprises three actions: CB Payments Ltd (Coinbase group) fined £3,503,546 on 25 July 2024 under the Electronic Money Regulations 2011 after onboarding 13,416 high-risk customers in breach of a voluntary requirement; Olumide Osunkoya sentenced to four years at Southwark Crown Court on 28 February 2025 for running an unregistered crypto ATM network worth over £2.5m, the first UK criminal conviction for unregistered cryptoasset activity; and legal proceedings begun against HTX (formerly Huobi) on 10 February 2026 for illegal financial promotions to UK consumers. Firms that do not apply for FSMA authorisation in the 30 September 2026 to 28 February 2027 window must run off UK cryptoasset business before the regime commences on 25 October 2027 or breach the FSMA s.19 general prohibition.
The FCA has been the anti-money laundering and counter-terrorist financing supervisor of UK cryptoasset businesses since 10 January 2020, and such businesses must register with the FCA under the Money Laundering Regulations 2017 before starting in-scope services; FSMA authorisation, supervision, rule-making and enforcement for regulated cryptoasset activities under SI 2026/102 begin on 25 October 2027, with applications accepted from 30 September 2026 to 28 February 2027.
HM Treasury sets UK cryptoasset policy and makes the implementing legislation: it published the draft cryptoasset regulated-activities statutory instrument with a policy note (near-final version 16 December 2025) and made the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 (SI 2026/102) on 4 February 2026, which come into force on 25 October 2027.
Evidence fact gb.regulatory.regulatory-approach-uk-adopts-a-phased not found (may have been renamed).
Evidence fact gb.regulatory.regulatory-timeline-phased-implementation not found (may have been renamed).
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a DeFi protocol frontend targeting UK users is likely a regulated cryptoasset activity requiring FCA registration (MLR 2017) and financial promotions compliance if it takes fees, facilitates exchange, or provides custodial elements; the ~85% rejection rate and unsettled perimeter guidance for decentralized protocols create significant operational risk.
Questions this verdict aims to answer
- Is operating the frontend a regulated activity even if the protocol is decentralized?
- What geofencing or KYC obligations apply?
- Does fee-taking change classification?