FCA opens crypto authorisation gateway ahead of 2027 regime

The Financial Conduct Authority (FCA) opened the application gateway for its new UK cryptoasset authorisation regime on 30 September 2026. From that date, firms conducting specified cryptoasset activities in or into the UK can submit applications through the FCA's Connect system for the permissions they will need once the regime commences in full on 25 October 2027.

The change affects businesses already operating in these markets: stablecoin issuers based in the UK, custodians and staking providers operating in the UK or on behalf of UK consumers, and platforms, dealers and arrangers whose trading or intermediation activities involve a UK consumer, including overseas firms, subject to statutory exceptions. Many of these firms currently hold only a limited registration under the Money Laundering Regulations, covering anti-money-laundering supervision. That registration does not convert into the fuller FSMA authorisation the new regime requires.

Two dates define the transition. Existing providers seeking access to the more permissive saving provision should submit a complete application by 28 February 2027, subject to the statutory conditions described below. The regime itself starts on 25 October 2027, after which conducting an in-scope activity without permission can breach sections 19 or 20 of the Financial Services and Markets Act 2000 (FSMA).

Which cryptoasset businesses need FCA authorisation

The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, made on 4 February 2026, bring the following into the FCA's regulated-activities perimeter from 25 October 2027:

• issuing qualifying stablecoins in the UK
• safeguarding, or arranging the safeguarding, of qualifying cryptoassets and certain tokenised investments
• operating a qualifying cryptoasset trading platform
• dealing in qualifying cryptoassets as principal or agent
• arranging deals, including relevant lending and borrowing models
• arranging qualifying cryptoasset staking

Territorial scope extends beyond firms with a UK base. For trading-platform, principal-dealing, agent-dealing and arranging activities involving a UK consumer, an overseas firm can fall within the UK perimeter even without a UK establishment, subject to statutory exceptions, according to the explanatory memorandum to the 2026 regulations. Custody and staking businesses need authorisation when the activity is carried on in the UK or on behalf of a UK consumer, again subject to exceptions. Overseas firms conducting specified trading or intermediation activities solely for UK institutional customers generally sit outside the authorisation requirement, provided those customers do not act as intermediaries for UK consumers.

Whether a specific exchange, broker, lender, staking service or overseas platform falls within these definitions is fact-sensitive and turns on the statutory wording and exemptions in the 2026 Regulations and the FCA's PS26/18 perimeter guidance, published 16 September 2026. Firms with doubt about their own position should check that guidance and the legislation directly rather than rely on a general description.

Existing registration or permission is not enough

The FCA has been explicit that registration under the Money Laundering Regulations does not automatically convert into FSMA authorisation. Registration and authorisation apply different statutory tests, and a firm that has held AML registration for years can still be refused authorisation if it cannot meet the new standards.

Firms already authorised by the FCA for other financial services, such as banks and payment firms, are not exempt either. They must apply for a variation of permission covering each relevant cryptoasset activity they intend to carry on; dual-regulated firms may also need to engage the Prudential Regulation Authority.

Some cryptoasset businesses have already been subject to FCA anti-money-laundering supervision since January 2020, and UK cryptoasset promotions have been regulated since October 2023. The 2027 regime introduces full FSMA authorisation for the newly regulated activities listed above; it does not mark the first time crypto businesses have faced any UK regulation.

What the FCA will assess

Applicants will be assessed against the FCA's Threshold Conditions and relevant Handbook requirements. Depending on the firm's activities, this can include the Consumer Duty, the Principles for Businesses, operational resilience rules, financial-crime systems and controls, senior-management accountability and prudential requirements.

Activity-specific rules sit on top of this baseline. UK stablecoin issuers face backing, safeguarding, redemption and disclosure requirements, including a final rule permitting an excess of up to 5% in the backing-asset pool. Custodians face CASS 17 custody requirements, with a settlement-float limit of 2% under the final safeguarding approach the FCA published on 30 June 2026. Trading platforms face execution and market-conduct requirements, lending and borrowing providers face retail protections, and market participants generally face disclosure, admission and market-abuse controls. No single capital figure applies across the regime; prudential thresholds depend on a firm's activities, expenditure and risk profile under the applicable prudential sourcebook, so firms should not treat any one number as a universal requirement.

The FCA says it developed this framework through four discussion papers and ten consultation papers since 2023, and received 78 responses to its cryptoasset perimeter consultation reported on 16 September 2026.

The saving provision: a complete application by 28 February 2027

The designated application period runs for five months, from 30 September 2026 to 28 February 2027. An existing provider that submits a complete application within this window and whose application is still pending when the regime commences on 25 October 2027 may continue providing cryptoasset services, including taking on new UK business, under the saving provision while the FCA finishes assessing it. That continued access is subject to statutory conditions, a notification requirement, and the FCA's power in specified circumstances to direct a firm into the more restrictive transitional provision instead.

The FCA expects to publish a further direction explaining how firms must notify it that they are using, or have ceased using, the saving provision. That direction had not been published as of 3 October 2026, so firms planning to rely on the saving provision should watch for it rather than assume the current guidance is final on this point.

Applying later: a narrower transitional provision

Applications remain possible after 28 February 2027. The deadline closes the designated window; it does not bar later applications outright.

The practical consequence of applying late is what changes. A firm that applies after 28 February 2027 but before commencement, and that lacks the necessary permission on 25 October 2027, may enter the transitional provision rather than the saving provision. Under the transitional provision, it may act only as necessary to perform contracts made before it entered that provision. It cannot take on new contracts with existing or new UK customers while its application is assessed.

No application at all: wind down before 25 October 2027

A firm that makes no application before commencement must run off its UK cryptoasset business before 25 October 2027. Continuing to carry on the regulated activity without permission after that date risks breaching sections 19 or 20 of FSMA.

What this means for people and businesses using crypto in the UK

Full authorisation brings UK cryptoasset firms under conduct, safeguarding, prudential and governance rules that go beyond anti-money-laundering supervision. But the FCA itself describes cryptoasset markets as comparatively higher risk, and expects some residual market-abuse risk to remain even once the regime is in force. Authorisation changes how a firm is supervised; it does not make an underlying cryptoasset investment safe, and it does not remove the risk that a customer can lose money.

FCA authorisation does not by itself establish blanket Financial Services Compensation Scheme or Financial Ombudsman Service cover for every cryptoasset customer or activity once the regime starts. Any such protection must be checked by activity and claim type against the FCA's published rules, rather than assumed from the fact of authorisation alone.

It is also not yet established, from the sources available, how many firms have applied since the gateway opened, how many currently AML-registered firms intend to apply, or how many may leave the UK market rather than seek authorisation.

What to watch next

The FCA said on 16 September 2026 that the Government plans a further statutory instrument amending the underlying 2026 Regulations, to be followed by additional perimeter guidance in early 2027. That could change the detailed scope of who needs authorisation before the regime commences. The FCA's planned direction on notifying use of the saving provision is also still to come. Firms assessing their own position should consult the FCA's cryptoasset regime pages and the legislation directly, rather than relying on general reporting, before concluding whether a specific business model is in or out of scope.