FCA clarifies when overseas crypto platforms fall under UK rules

The Financial Conduct Authority has told cryptoasset firms based outside the UK that incorporating offshore will not, on its own, keep them outside the UK authorisation perimeter. On 16 September 2026 the regulator published PS26/18, its final perimeter guidance, alongside a new Handbook chapter, PERG 18, setting out when an overseas trading platform, custodian or staking provider is treated as carrying on a regulated activity in the UK.

The guidance matters to any firm serving UK consumers from abroad, to UK-based cryptoasset businesses, to firms already authorised by the FCA, and to firms currently registered only under the Money Laundering Regulations. It also matters to UK consumers, because it marks out which overseas platforms will eventually need FCA authorisation to keep dealing with them, and which will not.

Two dates sit either side of the guidance and should not be confused. Firms can start applying for the new permissions from 30 September 2026. The regulated activities themselves, and the requirement to hold FCA authorisation to carry them on by way of business in the UK, do not take effect until 25 October 2027.

Why an overseas address is not an exemption

Under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, a set of new regulated activities comes into force on 25 October 2027: operating a qualifying cryptoasset trading platform, dealing as principal or agent, arranging deals, safeguarding cryptoassets, and arranging qualifying cryptoasset staking. From that date, a person carrying on any of these activities by way of business in the UK will generally need FCA authorisation, unless an exemption, saving provision or transitional run-off provision applies.

The FCA's guidance makes clear that the ordinary "overseas person" exclusion, which lets many overseas firms deal with UK counterparties without UK authorisation in other markets, does not apply to these cryptoasset activities. Whether an overseas firm is caught depends on the facts of what it does and who it serves; overseas incorporation and the location of its servers, staff or holding company are not decisive on their own. PERG 18.3 states that territorial scope turns on the statutory deeming provisions and the substance of the arrangement, and that the legal form of a branch or subsidiary is not by itself decisive.

The direct-access test for trading, dealing and arranging

For trading platforms, dealing and arranging deals, the relevant deeming rule sits in section 418(6C) of FSMA, inserted by the 2026 Regulations. It treats an overseas firm as carrying on the activity in the UK where it is involved in a sale or subscription that involves a UK consumer, and no appropriately authorised intermediary stands between the overseas firm and that consumer.

A "consumer" for this purpose is an individual in the UK acting outside their trade, business or profession. So an overseas trading platform made directly available to UK consumers, with no authorised firm sitting between the platform and the customer, can require FCA authorisation even though the platform and its operator are based entirely abroad.

This is a fact-specific test, not a blanket rule that any website reachable from the UK is automatically regulated. The guidance does not support treating mere technical accessibility as enough; what matters is whether the overseas firm is actively involved in a sale or subscription with a UK consumer without an authorised intermediary in between.

Principal versus agent: the FCA's own example

The FCA's guidance draws a sharp line between two ways an FCA-authorised firm might connect a UK customer to an overseas platform.

Where an authorised firm trades on an overseas platform as principal, on its own account, under its dealing-as-principal permission, the overseas platform is not treated as carrying on the trading-platform activity in the UK — provided the platform itself is not made available for use by UK consumers. PERG 18.7.4 sets this out as a specific example.

Where the same authorised firm instead trades on the overseas platform as agent, acting on behalf of UK consumers, the result flips. The FCA says the overseas platform is then carrying on the platform activity in the UK and needs authorisation, because the authorised intermediary is acting for the consumer rather than trading on its own account. Routing a UK customer's order through a UK broker does not, by itself, keep an overseas venue outside the perimeter if that broker is acting as the customer's agent.

Custody and staking use a different test

Safeguarding and arranging qualifying cryptoasset staking are governed by a separate provision, section 418(6E). An overseas firm's activity is treated as carried on in the UK when it is performed for a UK consumer and is not performed at the direction of another person who is itself authorised to carry on that same activity.

For custody, the guidance focuses on substantive control rather than contractual promises. A provider is likely to be carrying on safeguarding if it retains any means of bringing about a transfer of the benefit of a customer's cryptoasset, even where its contract says it will not exercise that control. A genuine self-custody provider — one where the customer keeps control and the provider has no technical means to move the asset — sits outside the safeguarding activity.

Arranging qualifying cryptoasset staking is drawn broadly. It can cover pooled custodial staking, managing the end-to-end staking lifecycle, pooling customer assets and distributing rewards. A purely technical staking service may fall within a statutory exclusion, but the FCA says additional involvement — such as making staked assets and rewards easier to access, compounding rewards automatically, or selecting validators on the customer's behalf — can take a provider back into scope.

Gateway, application window and full commencement

Opening the application gateway on 30 September 2026 does not start the substantive regime. Firms can apply, and the FCA can begin assessing applications, but the legal requirement to hold authorisation for the new activities only bites on 25 October 2027.

The application period matters beyond administrative convenience. Under the 2026 Regulations, a qualifying application made during the specified window that remains undetermined when the regime commences can benefit from a saving provision under regulation 53, subject to its conditions, allowing the applicant — and qualifying overseas group members — to continue relevant activity while the FCA finishes its assessment. That saving chapter ceases to have effect two years after full commencement, subject to the detailed statutory conditions.

Firms can apply outside the window, but the legislation does not give them the same assurance of access to the saving provisions, and they may be unable to continue the relevant activity once the regime commences on 25 October 2027.

What existing firms must do

Holding FCA authorisation for other activities today, or being registered under the Money Laundering Regulations as a cryptoasset business, does not automatically convert into permission for the new regulated activities. An already authorised firm may need a variation of permission; a firm currently registered only for anti-money laundering purposes may need a fresh authorisation application. Firms should treat the 30 September 2026 to 28 February 2027 window as the point to establish their position, rather than assuming existing status carries over.

A qualification: this guidance is final, but not finished

PS26/18 is described by the FCA as final guidance following its consultation, CP26/13, which drew 78 responses. But the FCA has also said it will consult again in late 2026 on targeted changes prompted by Government amendments to the underlying legislation, covering areas that include stablecoins, proprietary trading and market making, technology providers, decentralised protocols, certain safeguarding structures and financial promotions. It aims to publish revised perimeter guidance in early 2027. Firms and readers should treat the September 2026 text as the current position under the existing legislation, not as a permanently settled statement of where every business model sits — the exact detail of the coming amendments is not yet established in the material available at the time of writing.

Assessing whether any specific overseas platform, custodian or staking service falls inside the perimeter depends on facts not set out in general guidance: the customer's location, who controls the private keys or transfer mechanism, the precise scope of any intermediary's permission, and who directs the service. General guidance can indicate the shape of the test; it cannot substitute for that firm-specific analysis.

What this means for UK consumers

FCA authorisation, once it applies to a platform, custodian or staking provider, brings that firm within the FCA's conduct and supervisory requirements. It does not remove the risk that a cryptoasset can lose value, and authorisation of a firm does not automatically mean every service it offers carries Financial Services Compensation Scheme protection or access to the Financial Ombudsman Service — those protections vary by activity and by the specific claim. Readers weighing whether to use a particular platform should check the FCA's own register and published materials rather than relying on marketing claims about regulatory status.

What to watch next

The primary texts are PS26/18 and PERG 18 on the FCA's website, which set out the guidance discussed here in full. Firms considering an application should also review the FCA's material on preparing for the new regime and the 2026 Cryptoassets Regulations themselves for the precise statutory wording of the territorial tests. The FCA's promised late-2026 consultation, and the revised guidance expected in early 2027, will be the next point at which the perimeter for overseas firms may shift again.