Summary
- The Financial Services Act 2025 has no DeFi carve-out and no DeFi chapter. The perimeter is the General Prohibition (s. 16) on carrying on a Regulated Activity "by way of business in GMC", read with the three-limb test in Schedule 1, Part 1, para. 3.
- Writing and publishing code is not a listed activity. Arranging (para. 16), custody (para. 43), managing assets (para. 56), managing a fund (para. 59) and operating a trading facility (para. 54) are, and a front-end operator, fee recipient or key-holder can fall inside them.
- Exclusions that matter: arrangements that do not bring about a deal (para. 17), merely enabling parties to communicate (para. 18), order routing without interaction (para. 55), and the non-GMC person exclusions (paras. 71, 79).
- Conduct rules apply regardless of licensing: s. 19A (misleading, deceptive, fraudulent or dishonest conduct in relation to a Virtual Asset) and Part 9 (misleading statements and impressions, ss. 102–103).
- A DAO wanting legal personality uses a company (Companies Act 2025) or an LLP (LLP Act 2026); an unwrapped DAO carrying on business with a view of profit risks being a general partnership under the Partnership Act 2026.
The starting point: there is no DeFi exemption, and no DeFi prohibition
The Financial Services Act 2025 regulates activities, not technologies. An activity is a Regulated Activity if it is specified in Schedule 1 (s. 19). No person may carry on a Regulated Activity "by way of business in GMC, or purport to do so" unless it is a Licensed Firm (a firm holding a Financial Services Licence from the Gelephu Financial Services Office, GFSO) or an Exempt Firm (a person listed in Schedule 3) (s. 16(1)). Dealing (paras. 4, 12), arranging (para. 16), advising (para. 28), custody (para. 43), trading facilities (para. 54) and managing assets (para. 56) all refer expressly to Virtual Assets.
A Virtual Asset is "a digital representation of value that can be digitally traded" that is not legal tender and is "neither issued nor guaranteed by any jurisdiction". Most governance and utility tokens fit. Some tokens will instead be Specified Investments (shares, debt instruments, fund units, derivatives: Schedule 1, Part 3), which brings the securities framework into play (see our guide to tokenisation and digital securities). The question for any protocol is therefore not "is DeFi allowed?" but "who, if anyone, is carrying on a specified activity by way of business in GMC?"
The three tests that decide the answer
Test 1: is there an activity in Schedule 1?
Deploying immutable smart contracts is not, in itself, dealing, arranging, custody, management or operating a facility. But most protocols have people around them who do more. Ask, for each person or entity:
| Role | Schedule 1 activity to test |
|---|---|
| Hosts a front-end that lets users swap tokens through the protocol | Arranging Deals in Investments (para. 16): "making arrangements with a view to another person ... Buying or Selling a ... Virtual Asset" |
| Runs a matching engine or order book where users' orders interact | Operating a Multilateral Trading Facility (para. 54(1)(a)), which expressly covers facilities on which Virtual Assets are traded |
| Holds or controls private keys, multisig thresholds or admin keys over user funds | Providing Custody (para. 43(1)(a)): "safeguarding ... Virtual Assets ... belonging to another" |
| Rebalances a vault or strategy at its own discretion | Managing Assets (para. 56): managing "on a discretionary basis assets belonging to another" |
| Pools user deposits and manages them as a whole for shared returns | Managing a Collective Investment Fund (para. 59), read with the s. 106 definition |
Test 2: is it carried on "by way of business"?
Schedule 1, Part 1, para. 3 sets three alternative limbs. A person carries on an activity by way of business if the person "(a) engages in the activity in a manner which in itself constitutes the carrying on of a business; (b) holds himself out as willing and able to engage in that activity; or (c) regularly solicits other persons to engage with him in transactions constituting that activity".
Limbs (b) and (c) are the ones DeFi teams underestimate. A protocol with a marketing site, a community channel and a fee switch is holding itself out and soliciting, whether or not the activity is "in itself" a business. GFSO may make rules refining the test (s. 6).
Test 3: is it carried on "in GMC"?
Section 16 applies to activity carried on "in GMC". The Financial Promotion Restriction in s. 18 applies to a communication originating outside GMC "only if the communication is capable of having an effect in GMC" (s. 18(3)), and Part 9 applies where a statement is made "in or from" GMC or the person induced is in GMC (s. 102(4)). A team working from Gelephu is in GMC whoever its users are; for a team abroad with GMC users, the Non-GMC Person exclusions are central.
The exclusions that do the work
Arranging: paras. 17 and 18
Arranging is the widest activity, and it has two exclusions written for infrastructure. Para. 17 excludes "arrangements which do not or would not bring about the transaction to which the arrangements relate". Para. 18 provides that a person does not arrange "merely by providing means by which one party to a transaction ... is able to communicate with other such parties".
A pure interface that displays on-chain state and lets a user sign with their own wallet has a credible para. 18 argument: it is a channel between the user and a contract the user executes against. The argument weakens as the interface adds routing logic, charges a spread or is the only practical way to use the protocol, because then the arrangements "bring about" the transaction. Para. 19 excludes from arranging any arrangements amounting to operating an MTF or OTF, but only because para. 54 catches them instead.
Trading venues: para. 54 and the para. 55 order-routing exclusion
Para. 54(1)(a) covers "the operation of a Multilateral Trading Facility on which ... Virtual Assets ... are traded". An MTF is a multilateral system bringing together multiple third-party buying and selling interests "in accordance with non-discretionary rules, in a way that results in a contract". An on-chain order book with a matching engine run by an identifiable operator matches that closely. An automated market maker is harder: users trade against a pool under deterministic code, and whether that "brings together" third-party interests turns on the design of the pool and the role of its operator. Para. 55 excludes a facility that is "merely an order routing system" where orders "are merely transmitted but do not interact"; routers and aggregators that forward orders to a venue without matching them sit within that language.
Custody: who holds the keys
Para. 43 is about "safeguarding" assets "belonging to another". Where each user holds their own keys and no team-controlled key can move user assets, nobody is safeguarding for another. Upgradeable contracts with an admin key, pausable contracts and multisig-controlled pools holding user deposits move the analysis toward custody, because the key-holder can control others' assets.
Non-GMC persons: paras. 71 and 79
A "Non-GMC Person" carries on the listed activities but not "from a permanent place of business maintained by him in GMC". Para. 79 excludes such a person's dealing and arranging where it is with or through a Licensed Firm or the result of a "legitimate approach", meaning one "not solicited by such person in any way" (para. 79(7)); para. 79(6), applied by para. 71, does the same for agreeing to arrange, hold or manage. The practical rule for a foreign team: do not solicit in GMC, and route GMC-facing distribution through a Licensed Firm.
Conduct rules that apply whether or not you are licensed
Section 19A prohibits any person, "in or from the GMC", from conduct in relation to a Virtual Asset or a Regulated Activity that is "misleading or deceptive or likely to mislead or deceive", fraudulent, or dishonest. It has no "by way of business" qualifier and no licensing threshold.
Part 9 adds two contraventions. Under s. 102, making a statement known or recklessly believed to be false or misleading in a material respect, or dishonestly concealing material facts, to induce another to acquire, dispose of or exercise rights in a Financial Instrument, Specified Investment or "Accepted Virtual Asset" contravenes the Act. Under s. 103, intentionally creating a false or misleading impression as to the market in, or price or value of, Financial Instruments or Accepted Virtual Assets is a contravention. Part 9 is confined to Accepted Virtual Assets (those GFSO considers meet its requirements, s. 5A), but s. 19A covers any Virtual Asset.
Wash trading to inflate volume, untrue audit claims and governance messaging that conceals a known exploit are all within these provisions. Separately, s. 5A(4) bars any Regulated Activity in GMC involving an algorithmic stablecoin token, a privacy token or similar technology.
Which GMC entity can a DAO use?
The choice is between the entities the Acts provide, and the analysis of what an unwrapped DAO already is.
The unwrapped DAO risk: a general partnership
The Partnership Act 2026 defines partnership as "the relation which subsists between persons carrying on a business in common with a view of profit" (s. 1); profit-sharing is prima facie evidence of it (s. 2). Every partner is an agent of the firm (s. 5) and partners are jointly liable for its debts (s. 9). A token-holder collective that votes to deploy treasury capital for a return and shares the proceeds has those features, and members who never intended to be partners can find themselves jointly liable. This is the main reason to use a legal wrapper.
A company under the Companies Act 2025
A private company can be formed with one member (s. 20A) and must have at least one director "ordinarily resident in GMC" (s. 145(1)), meaning resident or holding a valid work visa or pass (s. 145(1A)). The constitution (s. 22) can restrict the company's otherwise full capacity (s. 23(1), (1B)), so it can require specified decisions to follow an on-chain vote, with directors bound to implement it; directors remain subject to the duty to act and with reasonable diligence (s. 157). A company pays 15% on chargeable income (Income Tax Act 2025, s. 43(1)(a)).
An LLP under the LLP Act 2026
An LLP has separate legal personality (s. 4), any individual or body corporate may be a partner (s. 11), and a partner is not personally liable for the LLP's obligations except for their own wrongful act (s. 12). Partners' rights and duties follow the LLP agreement or the First Schedule defaults (s. 14), so a DAO's governance rules can be written into the agreement. Requirements: at least two partners (s. 28), a manager who is a natural person aged 18 or over and ordinarily resident in GMC (s. 29), a GMC registered office (s. 32), an annual solvency declaration (s. 30) and a non-public Register of Controllers (Part 6A). For tax an LLP is transparent (Income Tax Act 2025, s. 36A(1)), so non-citizen individual partners benefit from the 0% rate on income derived on or before 31 December 2030 (s. 43(1)(ba)).
If the DAO's activity is regulated
GFSO will consider a licence application only from a Body Corporate or a Partnership (GEN Rulebook 5.2.2(1)). A Licensed Firm incorporated in GMC must have its head and registered office in GMC (GEN 4.5.1). It must appoint a Senior Executive Officer, Compliance Officer and Money Laundering Reporting Officer as Approved Persons (GEN 5.5.1(1)), subject to the residency rule in GEN 5.5.2. A fully anonymous, leaderless DAO cannot meet those requirements; a regulated venue or vault needs identified, approvable individuals.
Practical checklist / Next steps
- Map every human and entity around the protocol (deployer, front-end host, multisig signers, fee recipient, foundation) and test each against the Schedule 1 table above, then against the para. 3 limbs.
- Design for the exclusions you want: no team-controlled keys over user assets (para. 43), interfaces that only communicate (para. 18), routing that does not match orders (para. 55).
- If the team is outside GMC, do not solicit GMC users and document the "legitimate approach" position (para. 79(7)).
- Adopt a public-statements policy that satisfies s. 19A and Part 9.
- Wrap the DAO: a company for a treasury or operating entity, an LLP for a member-governed structure with transparent tax; avoid an unwrapped partnership.
- If any element is regulated, plan for GEN 5.2.2, 4.5 and 5.5 and begin with GFSO's initial meeting.
Frequently asked questions
Is a decentralised exchange legal in GMC without a licence?
There is no prohibition on decentralised technology as such. The question is whether an identifiable person operates a facility on which Virtual Assets are traded (para. 54) or arranges deals (para. 16) by way of business in GMC. A router that merely transmits orders (para. 55) and an interface that merely enables communication (para. 18) have exclusions; a matching engine run by a team does not.
Does a DAO need to register in GMC?
No provision requires it. But members of an unwrapped DAO carrying on business in common with a view of profit may be partners under the Partnership Act 2026, with joint liability (s. 9). A GMC company or LLP gives legal personality and limited liability, at the price of a resident director (Companies Act 2025, s. 145) or resident manager (LLP Act 2026, s. 29).
Can a foreign DeFi team serve users in GMC?
A Non-GMC Person dealing or arranging as the result of a "legitimate approach" or with or through a Licensed Firm is excluded (para. 79). Solicitation aimed at GMC, including promotions capable of having an effect in GMC (s. 18(3)), removes that protection.
Key takeaways
- GMC regulates activities, not code. Apply Schedule 1, then para. 3, then territoriality, to each person around the protocol.
- Paras. 17, 18 and 55 protect true infrastructure; key control, discretion and fees pull a team inside paras. 43, 56 and 54.
- Sections 19A and 102–103 apply to everyone, licensed or not.
- An unwrapped DAO risks being a general partnership; a GMC company or LLP is the wrapper, and a regulated product needs a GMC head office and resident Approved Persons.
This article is general information about the law of the Gelephu Mindfulness City Special Administrative Region as at the date above. It is not legal advice and does not create a lawyer–client relationship.
You may contact Basnet Law at basnet@basnetgmc.com or office@basnetgmc.com for any legal queries related to GMC.
References
- Financial Services Act 2025, ss. 5A, 6, 16, 18, 19, 19A, 102, 103, 106; Schedule 1, Part 1, para. 3; Part 2, paras. 4, 12, 16, 17, 18, 19, 28, 43, 54, 55, 56, 59, 71, 79; Part 3; Schedule 3
- GEN Rulebook 2026, Rules 4.5.1, 5.2.2, 5.5.1, 5.5.2
- Companies Act 2025, ss. 20A, 22, 23, 145, 157
- Limited Liability Partnerships Act 2026, ss. 4, 11, 12, 14, 28, 29, 30, 32, Part 6A
- Partnership Act 2026, ss. 1, 2, 5, 9
- Income Tax Act 2025, ss. 36A, 43(1)(a), 43(1)(ba)
