Cryptoasset Firm Authorisation in the UK: The Full Process (2026)
- 4 days ago
- 7 min read
Cryptoasset Firm Authorisation in the UK: The Full Process (2026)
The United Kingdom is moving cryptoasset firms into full financial services regulation. Under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, made in February 2026, a range of cryptoasset activities are being brought within the FCA's remit, and the new regime is expected to come into force on 25 October 2027. From that point, firms carrying on in-scope cryptoasset activities in or to the UK will need to be authorised by the FCA under FSMA, replacing the narrower registration regime that has applied since 2020. Critically, there is no automatic conversion: firms currently registered under the Money Laundering Regulations, authorised under the Payment Services or Electronic Money Regulations, or authorised under FSMA for other activities will all need to obtain fresh FSMA authorisation, or a variation of permission, for cryptoasset activities.
This guide explains the current position, the new regime, which activities require authorisation, the application window and timeline, and what firms should do now.
The current position
Until the new regime commences, UK cryptoasset regulation is comparatively limited. Since 2020, cryptoasset firms have been required to register with the FCA under the Money Laundering Regulations, a regime focused on anti-money-laundering and counter-terrorist-financing compliance. Separately, the financial promotions regime requires cryptoasset promotions to UK consumers to be made or approved by an authorised person. The FCA's oversight of cryptoasset firms therefore currently centres on these two areas, anti-money-laundering registration and financial promotions, rather than on the full range of prudential and conduct standards that apply to other regulated firms. That is what is changing.
The new FSMA regime
The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 create a number of new regulated activities for cryptoassets and bring them within the FSMA perimeter. On 30 June 2026 the FCA published the bulk of its final rules and guidance for the regime, and the new framework is expected to apply from 25 October 2027. The FCA has largely taken the approach of applying its existing rules and guidance to cryptoasset firms, consistent with the government's "same risk, same outcome" principle, with adjustments to reflect the nature of cryptoassets. In practice this means cryptoasset firms will be expected to operate with governance, systems and controls, prudential resources, operational resilience and conduct standards much closer to those expected of traditional regulated firms, and the Consumer Duty is intended to apply to them.
The regime also has extraterritorial reach. The regulations amend the FSMA provisions on carrying on regulated activities in the UK so that firms based overseas that sell or arrange qualifying cryptoassets to or for UK consumers will need authorisation, not only UK-incorporated firms.
Which cryptoasset activities require authorisation
The new regime creates several regulated cryptoasset activities. In broad terms, a firm will need FSMA authorisation if it operates a qualifying cryptoasset trading platform; deals in qualifying cryptoassets as principal or as agent; arranges deals in qualifying cryptoassets; safeguards qualifying cryptoassets, or arranges for another person to do so; issues a qualifying stablecoin in the UK; or arranges qualifying cryptoasset staking. Firms should map their current and planned activities against these regulated activities carefully, because the perimeter determines whether, and for what, authorisation is required. The government and the FCA have indicated that the treatment of certain stablecoin-related activities may be adjusted as a modernised payments regime develops, so firms in that area should track the legislation as it stands at the relevant time.
No automatic conversion
A central feature of the new regime is that existing registrations and authorisations will not convert automatically. Firms registered under the Money Laundering Regulations, firms registered or authorised under the Payment Services Regulations or Electronic Money Regulations, firms already authorised under FSMA for other activities, and firms currently relying on a financial promotions approver will all need to secure FSMA authorisation, or a variation of permission, if they carry on an in-scope cryptoasset activity. This represents a significant elevation of the regulatory bar for the sector, and firms cannot assume that an existing registration will carry them into the new regime. Firms that do not obtain authorisation, or a pending application with the relevant permissions, before commencement must run off their UK cryptoasset business, and firms that continue without authorisation risk breaching the general prohibition.
The application window and timeline
The FCA expects to open the application window on 30 September 2026, closing on 28 February 2027, a five-month period during which firms can submit applications for authorisation or variation of permission ahead of the regime commencing on 25 October 2027. Firms that apply within this window may, subject to meeting the relevant conditions, benefit from transitional and saving provisions that allow them to continue providing cryptoasset services while their application is assessed. The FCA has indicated it will aim to determine applications submitted in the window before the regime commences. An optional pre-application support service is expected to be available from July 2026 to help firms prepare. Given the volume of preparation required, firms should treat the October 2027 commencement date as a deadline that requires action well in advance, not a distant horizon.
Milestone | Date |
Cryptoasset Regulations made | February 2026 |
FCA final rules and guidance published | 30 June 2026 |
Pre-application support service opens | July 2026 |
Application window opens | 30 September 2026 |
Application window closes | 28 February 2027 |
New regime commences | 25 October 2027 |
What firms should do now
The preparation required is substantial and should begin well before the application window opens. Firms should map their current and planned UK-facing activities against the new regulated activities to establish whether, and for what, they need authorisation; identify which group entities may need authorisation and whether any restructuring is required; and build an authorisation project plan covering governance, senior management under the Senior Managers and Certification Regime, systems and controls, prudential resources, operational resilience, financial crime controls and customer communications. Firms should also review the FCA's rules, guidance and consultations as they are published, and consider using the pre-application support service. Building the evidence base and aligning governance with the FCA Handbook ahead of the window is what protects business continuity through the transition.
How Buckingham Capital Consulting can help
Buckingham Capital Consulting advises cryptoasset firms on the new UK regime and on preparing for FSMA authorisation. We help firms map their activities against the new regulated-activity perimeter, assess whether existing registrations or authorisations are sufficient, and identify any restructuring required. We prepare the authorisation or variation-of-permission application, including the governance, systems and controls, prudential, operational resilience and financial crime elements the FCA expects, and we help firms plan to submit within the application window so that they can benefit from the transitional provisions. Because the bar is being raised substantially, early, well-organised preparation is decisive, and that is where our regulatory experience adds most value.
If you carry on, or plan to carry on, cryptoasset activities in or to the UK, contact our team for an initial assessment of what the new regime requires of you.
Frequently asked questions
When does the new UK cryptoasset regime come into force?
The new FSMA cryptoasset regime is expected to come into force on 25 October 2027. The underlying legislation, the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, was made in February 2026, and the FCA published the majority of its final rules and guidance on 30 June 2026. Ahead of commencement, the FCA expects to open an application window from 30 September 2026 to 28 February 2027, during which firms can apply for authorisation or a variation of permission. Although October 2027 may sound distant, the volume of preparation required, including perimeter analysis, governance alignment and building the application, means firms should begin work well in advance rather than treating the commencement date as a long lead time.
Do existing MLR-registered crypto firms need to reapply?
Yes. There is no automatic conversion of existing registrations into FSMA authorisation. Firms currently registered with the FCA under the Money Laundering Regulations will need to obtain fresh authorisation under FSMA if they carry on an in-scope cryptoasset activity, as will firms registered or authorised under the Payment Services or Electronic Money Regulations and firms already authorised under FSMA for other activities. The transition from the current registration regime to full FSMA authorisation represents a significant increase in the regulatory bar, so even firms that are already MLR-registered should not assume continuity. They will need to prepare and submit a fresh application, ideally within the application window, and address any gaps in governance, prudential resources, operational resilience, financial crime controls and conduct standards.
Which cryptoasset activities will require FCA authorisation?
The new regime creates several regulated cryptoasset activities. A firm will generally need FSMA authorisation if it operates a qualifying cryptoasset trading platform, deals in qualifying cryptoassets as principal or as agent, arranges deals in qualifying cryptoassets, safeguards qualifying cryptoassets or arranges for another person to safeguard them, issues a qualifying stablecoin in the UK, or arranges qualifying cryptoasset staking. Because the regulated-activity perimeter determines whether authorisation is required and for what, firms should map their current and planned activities against these activities carefully. The regime also reaches overseas firms that sell or arrange qualifying cryptoassets to or for UK consumers, so location outside the UK does not, by itself, take a firm outside the perimeter where it serves UK consumers.
What happens if a crypto firm does not apply before the regime starts?
Firms that carry on in-scope cryptoasset activities and do not obtain authorisation, or have a pending application with the relevant permissions, before the regime commences on 25 October 2027 must run off their UK cryptoasset business ahead of commencement. Such firms will not have access to the transitional and saving provisions, which are available only to firms that apply within the application window. A firm that continues to carry on regulated cryptoasset activities without authorisation risks breaching the general prohibition under FSMA, which is a serious matter, and a firm already authorised for other activities that acts without the necessary permission would be acting outside its permission. For this reason, firms that intend to continue serving the UK should plan to apply within the window rather than leave the position unresolved.
Can overseas cryptoasset firms be caught by the UK regime?
Yes. The Cryptoasset Regulations amend the FSMA provisions on carrying on regulated activities in the UK so that firms based overseas can be caught where they carry on certain regulated activities involving the sale or subscription of a qualifying cryptoasset to, or by, a UK consumer. These activities include operating a qualifying cryptoasset trading platform, dealing in qualifying cryptoassets as principal or as agent, and arranging deals in qualifying cryptoassets. As a result, an overseas firm serving UK consumers cannot assume it is outside the perimeter simply because it is not incorporated in the UK. Overseas firms in this position should assess their activities against the new regime and, where they are in scope, plan to seek authorisation within the application window in the same way as UK firms.
