FCA Crypto Perimeter Guidance: Draft PERG 18 Control Facts
Quick answer. Draft PERG 18, in the FCA's CP26/36, sets no separate decentralization test. The FCA weighs governance, operational and economic facts to judge how far anyone can “determine, influence, operate, maintain, update or exercise control over” the arrangement.
Video transcript
The FCA's draft perimeter guidance does not set up a separate decentralization test. It asks whether any person controls the arrangement.
Smart contracts are not persons. But the people who determine, influence, operate, maintain, update or control the arrangement may be carrying on the activity.
The draft weighs three groups of facts: governance and decision-making, operational and technical structure, and economic and commercial structure.
No single feature decides, and the absence of unilateral control does not settle it. In the FCA's words, what matters is the role the relevant person performs.
Each group maps to facts you can record: who executes governance actions, who holds upgrade keys and pause roles, and who receives fees and signs for the treasury.
Calling yourself a DAO settles nothing. Counsel needs each role's holder, threshold, signers, timelock delay and any bypass.
Check two gaps first: roles still sitting with a deployer key, and emergency roles that skip the timelock. The FCA's Drift case study shows why.
Comments on the consultation close on November 18, 2026. The application window closes in February 2027.
Read the full article for a control inventory to take to counsel, or talk to Guardian about mapping every privileged role. Your counsel owns the legal reading.
The FCA's crypto perimeter guidance is getting a decentralization chapter.
CP26/36, published on October 21, 2026, proposes new PERG 18 guidance on how decentralization, automation and smart contracts affect whether anyone needs authorization.
The draft offers no safe harbor and no checklist. This post maps the facts it weighs to contract-level evidence.
This article explains the technical and security side of the FCA's CP26/36 and draft PERG 18. It is not legal advice; confirm how it applies to you with counsel.
What CP26/36 proposes
CP26/36 also explains new exclusions in a second statutory instrument, the FSMA 2000 (Cryptoassets) (Miscellaneous Amendments) Regulations 2026.
That instrument was laid in draft in September 2026. It is still a draft, needing approval by each House of Parliament.
| Item | Detail |
|---|---|
| Status | Draft guidance; the FCA can interpret the perimeter, not change it |
| Comments close | November 18, 2026 |
| Final guidance | Spring 2027 per the paper; January 2027 per the FCA's web page |
| Application window | Opened September 30, 2026; closes February 28, 2027 |
| Regulation applies | October 25, 2027, under SI 2026/102 |
Our UK deadlines post covers the window and the savings provision.
Persons, DAOs and the UK
Only persons need authorization under section 19 of FSMA. The draft says software, protocols, smart contracts and automated systems “are not themselves persons capable of being authorised or exempt”.
But functions performed through them can still be attributed to a person:
- Automation is a means (18.1.11). A person may act through software that applies criteria or parameters they set.
- Decisions stay attributable (18.1.18). Automating a decision does not necessarily stop it being the person's decision.
- Code alone is not enough (18.1.18). Writing software or performing a technical function does not by itself mean carrying on the activity.
“True DeFi” is not a statutory concept (18.1.20). The FCA “has deliberately not sought to prescribe a comprehensive, deterministic test”, and decentralization “exists on a spectrum”.
Where no person carries on a regulated activity, no authorization question arises. Whether that is so is a question of fact.
The draft treats a DAO as a description, not a legal category. Spreading governance or operations across many persons does not necessarily stop them carrying on regulated activities.
The by way of business test applies person by person (18.2.3). In the FCA's words, “the question is not whether an arrangement is decentralised, but what role the relevant person performs within it”.
Overseas participants or infrastructure do not by themselves take an activity outside the UK (18.3.1A).
Involvement in governance, operation, maintenance or development by persons established in the UK “may be sufficient to establish a territorial link with the UK”.
The three fact groups
Draft PERG 18.1.17 lists three groups of features that may be relevant “as part of the overall factual matrix”.
- Governance and decision-making: formal or legal control, discretion over decisions, or liability.
- Operational and technical structure: control over design and maintenance, or discretion over operations.
- Economic and commercial structure: financial or economic control, financial benefit, or control over expenditure.
No feature is “necessarily determinative” or a separate perimeter test, and their weight depends on the activity.
The draft adds that “the fact that no single person exercises unilateral or complete control” does not necessarily determine the outcome. More than one person may need to be authorized or exempt.
| Feature group | Facts to record |
|---|---|
| Governance and decision-making | Who can propose, veto and execute; quorum, token concentration, delegation; security councils; legal wrapper |
| Operational and technical | Upgrade keys, pause roles, parameter setters, oracles, keepers, deployer keys, front-end hosting |
| Economic and commercial | Fee switches and recipients, treasury signers, emissions, grants, who pays developers and auditors |
For each role, record the holder type (EOA, multisig, timelock or governance executor), the threshold, the signers and who they work for.
Add the timelock delay, any role that can bypass it, and when each last changed. Most of these facts can be read from the chain, so a regulator can read them too.
Two gaps to check first
- Roles meant to be revoked or handed to governance at launch that still sit with a deployer key.
- Emergency roles that skip the timelock.
The FCA's DeFi consultation, GC26/7, shows why the second matters. In its case study of the April 2026 Drift exploit, attackers induced administrators to pre-sign transactions that transferred control.
A zero-timelock configuration let the changes take effect immediately. Our GC26/7 checklist covers what firms integrating DeFi should map.
Front ends and Article 9Z2A
Article 9Z2A, which the draft instrument would add to the Regulated Activities Order, excludes some technical providers from arranging deals in qualifying cryptoassets.
Under draft PERG 18.8.25, the provider must be neither authorized nor a payment service provider, and must merely provide a technical service.
That service must give access to an authorized or exempt provider's regulated service, or to a decentralised protocol. It does not extend to dealing.
The draft says which features point each way.
| More likely a technical service | Indicators of discretion |
|---|---|
| Responds to user instructions without qualitative judgment | Chooses between venues or liquidity sources |
| Lets the user choose the provider or protocol | Decides whether or when an order is sent |
| Does not select, recommend or rank routes or counterparties | Adjusts routing by price or speed |
| Does not negotiate or set material terms | Represents that it will obtain best execution |
An arrangement is not necessarily a decentralised protocol just because it uses smart contracts, has public code, spreads governance among token holders or names no operator.
The exclusion also leaves the financial promotion restriction and the Money Laundering Regulations untouched (18.8.34 and 18.8.35).
A control inventory for counsel
Start from the contract-level inventory in our decentralization tests comparison. Draft PERG 18 adds five questions:
- Each person's role (18.2.3). What each contributor, signer, maintainer and front-end operator does, how continuously, at what scale and on what terms.
- UK links (18.3.1A). Where each is established, and which entities have UK staff or offices.
- Who acts on decisions (18.1.18). Who designed material functions, who can change parameters, and who deploys, maintains or updates the contracts.
- Commercial benefit (18.1.17 and 18.1.18). Who receives fees or treasury funds, who pays contributors, and who promotes the arrangement.
- Front-end routing (18.8.26 to 18.8.31). Who picks the protocols and routes offered, any ranking or best execution claims, and how the operator is paid.
How to respond by November 18
Send comments by November 18, 2026 in one of three ways:
- the FCA's online response form;
- email to cp26-36@fca.org.uk;
- in writing to the Cryptoasset Policy Team, Financial Conduct Authority, 12 Endeavour Square, London E20 1JN.
Say in what capacity you respond. An organization's response is published under its name unless you say you respond as an individual.
If you do not use the form, state whether you consent to your name and response being published.
Frame comments as interpretation; PERG is not the place for guidance on individual business models. Concrete architectures still help on Questions 1 to 3 (decentralization) and 14 (technical services).
What Guardian does
Guardian's audits for onchain teams start with a design review of roles, upgrade paths and the threat model.
Managed Security tracks every address you have deployed, on every chain, with its owner, its upgrade path and whether its code is the code that was reviewed.
For an authorization file, Guardian's compliance work maps every role that can move value, upgrade, pause, freeze or change parameters. Your counsel owns the legal reading.
Frequently Asked Questions
Does a DAO need FCA authorization?
The DAO label does not decide it. Draft PERG 18 asks whether, on the facts, one or more persons carry on a regulated activity by way of business in the UK.
Are DeFi front ends excluded from the arranging activity?
Some may be, under Article 9Z2A in the draft amending regulations. The exclusion is less likely to apply where a front end selects, ranks or routes transactions, exercises discretion or promises best execution.
How do I respond to CP26/36?
Send comments by November 18, 2026 through the FCA's online response form or by email to cp26-36@fca.org.uk. You can also write to the Cryptoasset Policy Team at the FCA, 12 Endeavour Square, London E20 1JN.
Sources
- FCA: CP26/36 Cryptoasset perimeter guidance (October 21, 2026)
- FCA: CP26/36 consultation paper and draft PERG 18 text (PDF, October 2026)
- FCA: GC26/7 Decentralised finance guidance (DeFi) (October 21, 2026)
- FCA: GC26/7 guidance consultation, including Case Study 6 (PDF, October 21, 2026)
- legislation.gov.uk: The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, SI 2026/102 (made February 4, 2026)
- legislation.gov.uk: The Financial Services and Markets Act 2000 (Cryptoassets) (Miscellaneous Amendments) Regulations 2026 (draft statutory instrument)
- FCA: Overview of our cryptoassets regime policy statements (June 30, 2026)
Document your control facts before you apply
Guardian maps every address, role, signer and upgrade path your protocol runs on, so counsel can test draft PERG 18 against the facts.