The UK Financial Conduct Authority (FCA) has opened the application gateway for firms seeking authorisation under the UK’s new regulatory regime for cryptoassets. Firms intending to provide or continue providing regulated cryptoasset services in or into the UK should now be working towards a critical 28 February 2027 submission deadline, ahead of the regime taking full effect on 25 October 2027.
A firm whose principal place of business sits outside of the UK may still fall in scope of the regulation where the firm has UK employees or agents undertaking regulated dealing or arranging functions or otherwise operates through substantive UK-based operations. This could include UK servers, UK targeted marketing efforts or bank accounts. UK regulation may also apply where relevant transactions are negotiated, arranged or executed in the UK or through a UK establishment, or safeguarding arrangements involve the exercise of relevant control from the UK.
On 30 September 2026, the Financial Conduct Authority (FCA) opened its authorisation gateway for firms seeking permission to carry on the new regulated cryptoasset activities created by the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 (the “Cryptoassets Regulations”).
The opening of the gateway marks an important transition in the development of the UK’s crypto regulatory framework. Although the new regime will not take full effect until 25 October 2027, firms can now submit applications for authorisation or, for firms already authorised under the Financial Services and Markets Act 2000 (FSMA), applications to vary their existing permissions.
For many crypto businesses, this represents a fundamental change in regulatory status. The UK’s existing regime has principally subjected cryptoasset exchange and custodian wallet providers to registration and supervision obligations under regulations designed for anti-money laundering purposes, alongside separate financial promotion requirements. The Cryptoassets Regulations bring a broader range of cryptoasset activities within scope of FSMA authorisation.
The result is that affected firms will increasingly be regulated in a manner comparable to other FCA-authorised financial services businesses. This will now include prudential requirements, conduct of business standards, governance and systems and controls requirements, the Consumer Duty where applicable, regulatory reporting and ongoing FCA supervision.
On 30 September 2026, the FCA authorization gateway opens.
On 28 February 2027, the gateway application period closes.
On 25 October 2027, the new regime commences.
A firm does not necessarily need to have received its final FCA authorisation by 28 February 2027. Rather, submitting an application within the prescribed application period can allow an eligible existing business to benefit from statutory transitional provisions, after the new regime commences in October 2027, while the FCA reviews its application. Firms applying after 28 February will not have access to those arrangements and may therefore need to cease the relevant regulated activities until permission is obtained.
For existing UK crypto businesses, 28 February 2027 is therefore effectively the critical continuity-of-business deadline.
The Cryptoasset Regulations amend the Financial Services and Markets Act 2000 (Regulated Activities) Order 2001 (RAO) to create a new set of regulated activities specifically directed at cryptoassets.
Broadly, the regime replicates, for crypto businesses, regulation of familiar functions in traditional financial markets: issuance, custody, trading venues, dealing, intermediation and certain staking services.
The new regulated activities include:
This means the new regime potentially reaches a wide range of business models, including crypto exchanges and trading venues, brokers and intermediaries, custodians and wallet providers, stablecoin issuers, certain market makers and principal dealers, and businesses arranging staking services.
The perimeter analysis nevertheless remains highly fact specific. Technology providers, introducers, non-custodial businesses, decentralised protocols, and businesses operating from outside the UK will need to carefully consider whether their particular activities satisfy the statutory definitions and territorial requirements and whether an exclusion applies.
Existing regulatory status of businesses currently engaged in cryptoasset activities does not automatically migrate into the new regime. A crypto business currently registered with the FCA under the Money Laundering Regulations (MLRs) will not automatically receive a Part 4A permission to conduct the corresponding activity from October 2027.
Likewise, firms already authorised under FSMA, or regulated under the Payment Services Regulations or Electronic Money Regulations, will need to consider whether their existing permissions cover their cryptoasset activities. Where they do not, a VoP may be required.
The significance of the new regime extends beyond obtaining a licence.
Once authorised, cryptoasset firms will enter the broader FSMA regulatory architecture. The precise rules applicable to an individual business will depend on its activities, but the FCA’s final rule package published on 30 June 2026 illustrates the scale of the transition.
Firms will need governance arrangements appropriate to the nature, scale, and complexity of their activities. Relevant individuals will also come within the FCA’s framework for individual accountability, including the senior managers and certification regime.
This is likely to require many crypto businesses to formalise governance structures that developed in a comparatively lightly regulated environment and will include clear allocation of senior-management responsibilities and ensuring that boards and management bodies exercise meaningful oversight.
Authorised cryptoasset firms will be subject to the FCA’s new prudential framework for
cryptoasset businesses. Requirements vary according to the activities performed and are intended to ensure firms maintain sufficient financial resources to absorb losses and wind down in an orderly manner.
For applicants, financial resources therefore become both an authorisation issue and an ongoing regulatory obligation.
Crypto businesses will also need to adapt to the FCA’s conduct framework. The FCA has confirmed the application of core handbook requirements to regulated cryptoasset firms and has published specific guidance on applying the consumer duty to the sector.
For firms serving retail customers, this means considering customer outcomes throughout the product life cycle rather than treating regulatory compliance principally as an anti-money laundering or disclosure exercise.
Custodians will face specific requirements concerning the safeguarding of client cryptoassets. Stablecoin issuers will similarly be subject to requirements relating to the safeguarding of backing assets, including a new FCA Handbook Client Assets Sourcebook (CASS) 16 framework.
Businesses relying on third-party custodians will also need to carefully consider how outsourcing and custody arrangements interact with their own regulatory responsibilities.
Authorised crypto firms will need appropriate operational and technological resilience arrangements. This is particularly important for exchanges, custodians, and other businesses where outages, cybersecurity incidents, or failures of outsourced technology can immediately affect customers’ ability to access or transfer assets.
The practical consequence is that technology architecture, outsourcing arrangements, incident management, business continuity, and disaster recovery are increasingly becoming regulatory matters rather than purely operational ones.
Authorised firms will be subject to FCA supervision, reporting requirements, and information requests and will be expected to deal with the FCA in an open and cooperative manner. The FCA’s existing FSMA enforcement toolkit will also be available in relation to the new regulated activities, including financial penalties, public censures and restrictions, or prohibitions where the statutory conditions are satisfied.
Overseas firms should not assume they are outside of the scope as the new regime is also relevant to non-UK businesses carrying on regulated activity in the UK by way of business. Exclusions and exemptions may apply and will be considered on a fact-specific case-by-case basis.
For businesses intending to remain active in the UK crypto market, the opening of the gateway changes the emphasis from regulatory planning to implementation.
Firms should be:
The FCA’s Pre-Application Support Service (PASS) also remains available. The FCA has indicated that requests for pre-application meetings should be supported by meaningful information rather than simply commitments to provide details later.