How the FCA's crypto authorisation gateway will work

The Financial Conduct Authority's gateway for cryptoasset firms opens on 30 September 2026. From that date, businesses that want to carry on a cryptoasset activity that becomes regulated under UK law can apply for the permission they will need before the new regime takes full effect on 25 October 2027.

This matters to a wide range of UK businesses now: cryptoasset exchanges, custodians, stablecoin issuers, trading platforms, brokers and firms arranging cryptoasset deals or staking, whether they are based in the UK or, where the statutory territorial tests bring them into scope, serve UK customers from abroad. It also matters to anyone holding or planning to buy cryptoassets in the UK, because the shift changes who is accountable for a firm's conduct, not whether the underlying asset can lose value.

The gateway itself is a procedural change: the FCA will start accepting applications for a relevant cryptoasset permission under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026. Nothing in the existing anti-money laundering registration regime or the financial-promotion rules changes on 30 September 2026. Firms should not confuse "the gateway is open" with "the new regime is now in force" — those are two different dates, about 13 months apart.

The timetable from application window to full commencement

The FCA's own materials do not agree on what time the gateway opens on 30 September 2026. The regulator's updated gateway webpage says the online application form will be available from 7am. The formal direction dated 20 February 2026, which is the legal instrument setting the application period, states that it begins at 9:00am. FinTechPulse has not seen anything from the FCA resolving this discrepancy, so firms planning to submit at the earliest possible moment should check the FCA's site on the day rather than rely on either time being confirmed.

Which cryptoasset activities will need FCA permission

Subject to the detailed definitions, exclusions and territorial tests in the FCA Handbook (PERG 2.7.20O and its Annex 2), the activities that become regulated from 25 October 2027 are:

• issuing a qualifying stablecoin
• safeguarding cryptoassets
• arranging cryptoasset safeguarding
• operating a qualifying cryptoasset trading platform
• dealing in qualifying cryptoassets as principal
• dealing in qualifying cryptoassets as agent
• arranging deals, including making arrangements with a view to a transaction
• arranging qualifying cryptoasset staking

Whether a particular business model falls within one of these categories depends on statutory exclusions and territorial rules that can change the answer for firms operating overseas or through intermediaries. FCA materials also set out conduct expectations for cryptoasset lending and borrowing, but lending and borrowing are not named as a standalone regulated activity on this list. A firm running a lending or borrowing model needs to work out which of the listed activities its business actually performs; it should not assume "crypto lending" is automatically a separate licence category.

Today's rules are not the new licence

As of 26 September 2026, most of the FCA's role in the crypto market rests on two separate and narrower regimes, neither of which is FSMA authorisation:

Anti-money laundering registration. Firms conducting certain cryptoasset activities register with the FCA under the Money Laundering Regulations. This registration is a check on financial-crime controls. It is not a licence to carry on a regulated activity, and it will not convert automatically into permission under the new regime. A firm that already holds MLR registration will still need to submit a fresh authorisation application and satisfy the FCA under FSMA.

Financial promotion rules. Since 8 October 2023, the UK financial-promotion regime has applied to qualifying cryptoasset promotions made to UK consumers, including promotions from firms based overseas. This governs how cryptoasset products are marketed; it does not authorise the underlying activity.

Some cryptoasset-related products, such as certain security tokens or derivatives, may already sit inside the regulated perimeter for other reasons. That does not change for most cryptoasset spot activities until 25 October 2027.

Which route applies: new applicant, MLR-registered firm, or already-authorised firm

The route into the new regime depends on where a firm starts from:

• A firm with no existing FSMA authorisation needs full Part 4A authorisation plus the specific permission matching its activities.
• A firm already authorised under FSMA for other business (for example, an existing payments or investment firm) must apply to vary its permission to add the relevant cryptoasset activity.
• An MLR-registered cryptoasset business must apply as if starting from scratch for FSMA purposes; its existing AML controls may provide useful evidence but do not substitute for the FCA's assessment under the new regime.

What firms must do before they apply

The FCA expects firms to have done substantive preparation before submitting, not to use the application as a starting point for working out what they need. Its published expectations are that firms should:

• identify the regulated activities and permissions that match their business model
• carry out a gap analysis against FSMA requirements
• obtain board agreement to an implementation plan
• assign clear accountability for delivering it
• assess the resources and cost of both getting authorised and staying compliant afterwards

The FCA has also made a free, optional Pre-Application Support Service (PASS) meeting available since 11 May 2026. Requesting one does not guarantee authorisation and the FCA does not give advice through it. A request has to include meaningful information: the proposed business model, products, services, customer types, and the firm's own analysis of which permissions it needs.

What the application will ask for

A 73-page preview of the application form, dated 17 September 2026, sets out the kind of evidence the FCA expects, though the document itself says the live form was still being finalised at that point. It covers firm and ownership details, senior managers, organisational structure, the permissions and client types being applied for, a regulatory business plan, financial forecasts, IT controls, financial-crime controls, compliance monitoring and complaints handling. On top of this general evidence, the FCA asks for activity-specific material depending on the model — for example, distinct evidence for a stablecoin issuer, a custodian, a staking arrangement, an intermediary or a trading platform.

The FCA has warned that poor-quality or incomplete submissions can be rejected without a full assessment, which causes delay or refusal and can affect a firm's access to the statutory protections described below.

In-window, late and absent applications are treated differently

The FCA says it expects to decide applications submitted during the formal window — 30 September 2026 to 28 February 2027 — before the regime commences on 25 October 2027. That is an expectation, not a guarantee that every application will be approved or decided in time.

Three outcomes follow, depending on when and whether a firm applies:

Applied in the window, decision still pending. An eligible firm whose in-window application has not been finally determined by 25 October 2027 may be able to rely on a statutory saving provision to keep providing cryptoasset services until the FCA reaches a final decision. This depends on the detail of the legislation and any FCA direction, and the FCA has said it will publish a further direction on how firms must notify it when using, or ceasing to use, the saving provision — that direction had not been published in the sources reviewed for this article.

Applied after 28 February 2027 but before commencement, without permission by 25 October 2027. This firm falls into a transitional provision. It may continue servicing pre-existing contracts, but it cannot enter new contracts with either new or existing UK customers. The FCA has said it will not expedite an assessment simply because a firm applied late.

Did not apply before commencement. A firm with no application in progress by 25 October 2027 has to run off its UK cryptoasset business before that date. It does not get the saving provision or the transitional provision. Continuing to carry on a now-regulated activity without authorisation or the relevant permission risks breaching sections 19 or 20 of FSMA.

What authorisation will and will not mean for consumers

FCA authorisation is a check on a firm and its specific permitted activities. It does not remove the risk that a cryptoasset falls in value, and it does not stop the volatility, cyber, financial-crime, operational, liquidity or firm-failure risks that the FCA has already identified in its work on cryptoasset promotions. An authorised firm can still fail, and a customer can still lose everything invested in a cryptoasset.

Authorisation also does not automatically mean a customer is covered by the Financial Services Compensation Scheme (FSCS). FSCS eligibility depends on the specific firm, the specific regulated activity carried out, the nature of the loss, and whether the firm has a legal liability to the customer that FSCS can step in for. Under current rules, the FCA's prescribed crypto risk summary states that the cryptoasset investment itself is not protected by FSCS because it is not a specified investment. The new regime changes which activities sit inside the regulatory perimeter, but that does not mean every future crypto service will carry FSCS cover. Anyone wanting to check whether a specific product or firm would be protected should use the FSCS's own eligibility checker rather than assume protection follows from a firm simply being FCA-authorised.

What to watch next

Several details remain open as this article goes to press: whether the FCA resolves the 7am-versus-9am discrepancy on the gateway opening time; whether the live application form matches the 17 September 2026 preview once it goes live; and when the FCA publishes its promised direction on notifying use of the saving provision. Firms and their advisers should check the FCA's gateway page and the relevant application-period direction directly before relying on any specific time, form content or transitional detail, and should treat firm-specific questions about which permission a business model needs as a matter for their own legal analysis against the FCA's PERG 2 guidance and PS26/18.