I asked the FCA release for evidence and it handed me a skeleton: five information points, three of them load-bearing — a proposed guidance, a two-pronged distinction between "technical access" and "substantive transaction participation," and an October 2027 implementation horizon. The other two are housekeeping. Firms are already filing applications; the actual clause text is not public.
Three facts to two blanks. That ratio is itself the finding. Regulators publish skeletons when the political call has been made and the technical drafting has not. The direction is fixed; the measurement is not. And the measurement is the entire game.
Strip the language away and the question is narrow: when a user taps "Swap" once and an algorithm chooses the pool, the split size, and the counterparty, who executed the trade — the user, or the operator of the code?
The UK does not run Howey. It runs FSMA 2000 plus the Regulated Activities Order, a two-column machine: is this a specified investment, and is this a specified activity. Crypto assets are being folded into column one by HM Treasury legislation. This guidance belongs entirely to column two. "Arranging deals in investments" has never required the arranger to touch client money — only to place the client in the trade. Software that selects a venue on someone's behalf has been circling that definition for a decade, and nobody in Whitehall wanted to be the first to say so out loud.
London is not the first mover. MiCA already lists execution of orders on behalf of clients among CASP services, and Brussels has spent two years deferring the fully-decentralised question into a report nobody has published. What differs here is the test, not the territory. Note also the layering: UK crypto firms are already registered under MLR 2017 for anti-money-laundering purposes. Registration is not authorisation. They are different instruments, different standards, different costs — and half the market commentary I read this week conflated them.
Where early ICO ghosts still haunt the ledger is instructive here. In 2017 I hand-traced roughly 15,000 wallets across the top ten ICOs and reduced them to twelve clusters of coordinated bots. Twelve. The trade decisions for fifteen thousand addresses were made by a dozen operators. That is the pattern the FCA is now formalising: the entity count is noise, the decision count is signal. Discretion, not custody, is the new perimeter.
So map the discretion spectrum honestly. A fully automated router — user supplies intent, algorithm selects venue without input — sits at the extreme. A default recommendation the user can override sits in the middle, and nobody has told us which side of the line it falls on. A wallet that signs and broadcasts a transaction the user built themselves, choosing their own pool, sits at the far end and almost certainly stays outside. Same user interface. Three different regulatory outcomes. Architecture is now the compliance strategy.
The economic consequence is arithmetic, not ideology. If best-execution obligations attach — and routing selection is inherently an execution-quality decision, so they plausibly do — then the operator must produce auditable routing logs. Proof, on demand, that venue A was chosen for reasons other than the rebate it pays. That is a compliance system, and compliance systems are fixed costs. Fixed costs do not scale down. They select for scale. Three years of CEX licensing produced exactly this distribution: head concentrated, tail geo-fenced or dead.
The sharper edge is payment for order flow in its on-chain disguise. Where a router takes a rebate for directing flow to a particular venue, the question upgrades from "do you need a licence" to "did you breach best execution while earning a spread." That is a conduct problem, not a permission problem, and conduct problems travel further. It lands directly on order-flow auctions and MEV kickbacks — revenue lines that many aggregators model as core, not incidental. Whales don't route through somebody else's default; they build their own execution and they already demand this disclosure. Retail gets the opaque version. Regulation tends to arrive at retail's door first.
Here is where I part company with the consensus reading. The market split into two camps within hours: one called it clarity and therefore bullish, the other called it a DeFi ban and reached for the exit. Both are mispricing the same variable. Correlation is not causation — the guidance changes no flows in 2026. The cause, if there is one, dates to October 2027, and 2027 is not tradeable this quarter.
The genuine blind spot is structural. Everyone is debating whether they need a licence. The operative change is that the criterion moved from entity type to discretion. "Decentralised," "open source," "non-custodial" — those were legal shields cut to fit an entity test. Against a discretion test they are decoration. The data doesn't care that your code is immutable; it cares who set the parameters. Britain's framing is blunter than America's here, and less romantic: not who wrote the contract, but who held the wheel.
Second blind spot: the likely response is not licensing. It is geo-blocking. Blocking UK IPs costs an afternoon; authorisation costs a year and a policy team. Expect a quiet, permanent thinning of UK-facing DeFi access, executed without a single press release — and a new middleware category selling white-label "compliant routing" to whoever wants to keep the market without building the audit trail.
Watch one date, not the headlines: the consultation paper. That is where a threshold gets written, and thresholds decide everything. Precision in chaos is the only true advantage — and right now the only precision on offer is architectural. If the final guidance draws the line at default recommendations rather than full automation, half the wallets in Britain are already over it. Which half of your product is the algorithm, and which half is you?