FCA Cryptoasset Authorization: What Firms Need to Know Before the 2026 Gateway Opens

Published: Sep 25, 2026
By: Chris Brodersen; Walter Zinenko; Louis Bruno
Share

Key Takeaways

The FCA’s cryptoasset authorization gateway opens September 30, 2026, and the application window closes February 28, 2027.
The new regime takes full effect on October 25, 2027, when operating a regulated cryptoasset activity in the UK without authorization becomes unlawful.
Nine regulated activities trigger the requirement, including operating a trading platform, dealing as principal or agent, safeguarding cryptoassets, and cryptoasset staking.
Existing UK cryptoasset registrations under the Money Laundering Regulations do not convert automatically; firms must apply for a new FSMA authorization.
Of 391 MLR cryptoasset registration cases the FCA completed through August 1, 2026, only 17% resulted in registration.
Firms anywhere in the world can fall within the FCA’s perimeter if they reach UK consumers, even without a UK office or legal entity.

A New Regulatory Requirement for Cryptoasset Participants

The Financial Conduct Authority (FCA) opens its cryptoasset authorization gateway on September 30, 2026. From that date, organizations carrying out regulated cryptoasset activities involving UK consumers can apply for FCA authorization under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, made by HM Treasury on February 4, 2026, after a draft was approved by resolution of both Houses of Parliament.

The application window stays open through February 28, 2027. Organizations already operating in the UK cryptoasset market that apply within that window can rely on saving provisions, which allow continued UK activity while the FCA reviews the application. The full regime takes effect on October 25, 2027. From that date, carrying out a regulated cryptoasset activity in or into the UK without authorization becomes a breach of UK financial services law.

For organizations based outside the UK, whether in the United States, the Gulf, Asia, or Europe, the practical message is the same. Reaching UK consumers, directly or through an intermediary, can bring an entity within the FCA's perimeter. Having no UK office, staff, or legal entity does not place a firm outside the scope.

Key Dates to Be Aware Of

Date	Milestone
February 4, 2026	HM Treasury makes the Cryptoassets Regulations (SI 2026/102)
June 30, 2026	FCA publishes final rules and guidance for the new regime
September 30, 2026	Authorization gateway opens; application period begins; FCA begins discouraging new MLR registration applications
February 28, 2027	Application period closes; deadline to rely on saving provisions
July 31, 2027	Latest practical date for MLR applications
October 25, 2027	New regime takes full effect

FCA Background & Focus on Cryptoassets

The Financial Conduct Authority is the UK's conduct regulator for financial services. It authorizes and supervises firms across banking, insurance, investments, consumer credit, and payments, and writes the rules that those firms follow. Its statutory objectives are consumer protection, market integrity, and effective competition, with a secondary objective added in 2023 to support the growth and international competitiveness of the UK economy.

The FCA has supervised UK cryptoasset businesses since January 10, 2020, but for one purpose only: anti-money laundering. Registration under the Money Laundering Regulations asks whether a firm has adequate financial crime controls and whether the people running it are fit and proper. It does not ask whether the firm holds enough capital to absorb a loss, whether client cryptoassets are genuinely there and segregated, how the firm handles a customer complaint, or whether its venue can detect manipulation. Since October 2023, the FCA has also policed how cryptoassets are promoted to UK consumers and has restricted the sale of cryptoasset derivatives to retail clients.

That is the whole of the FCA's current remit over crypto. The new regime replaces a single-purpose registration with full authorization. The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 bring cryptoasset activity within the same framework that governs banks, brokers, and asset managers, adapted where cryptoasset activity genuinely differs. That design choice is the most important thing for a firm to understand, because it imports the whole apparatus at once: threshold conditions, a senior manager's regime, prudential capital, client asset rules, the Consumer Duty, and permanent supervision.

What Are the Nine Regulated Cryptoasset Activities?

From October 25, 2027, when the new regime takes full effect, an organization carrying out even one of the following nine regulated cryptoasset activities in relation to UK consumers needs FCA authorization or an applicable exclusion. The application window opens on September 30, 2026, and closes on February 28, 2027, giving organizations roughly 13 months to secure authorization before the requirement takes effect.

Issuing a qualifying stablecoin in the UK
Safeguarding qualifying cryptoassets and RSICs
Arranging for another person to safeguard qualifying cryptoassets or RSICs
Operating a QCATP
Dealing in qualifying cryptoassets as principal
Dealing in qualifying cryptoassets as an agent
Arranging (bringing about) deals in qualifying cryptoassets
Making arrangements with a view to transactions in qualifying cryptoassets
Qualifying cryptoasset staking, including pooled and liquid-staking structures

Which Business Models Fall Within the FCA’s Cryptoasset Perimeter?

Many overseas cryptoasset organizations assume that holding a license elsewhere, or having no UK legal presence, keeps them outside the FCA's reach. Under the new regime, that assumption often does not hold. The scenarios below illustrate how UK-facing activity can trigger an authorization requirement, regardless of where an organization is based.

Business Model	Why UK Authorization May Apply
A US crypto exchange allows UK retail customers to open accounts and trade bitcoin and other qualifying cryptoassets.	Operating a qualifying cryptoasset trading platform (QCATP) accessible to UK consumers is a regulated activity.
A Dubai-based exchange markets its platform to UK consumers through online advertising, UK-focused webpages, or introducers.	Marketing to UK consumers can trigger both financial promotion rules and platform authorization requirements.
A Singapore exchange accepts UK retail customers even though it has no UK office, staff, or legal entity.	Physical presence in the UK is not a condition of the perimeter; UK-facing activity is what matters.
An overseas exchange provides its services indirectly to UK consumers through a broker, app, or other intermediary that is not appropriately FCA-authorized.	Both the overseas firm and the unauthorized intermediary can carry exposure under the new regime.
A Swiss crypto broker buys or sells cryptoassets as principal with UK retail customers.	Dealing in qualifying cryptoassets as principal is a standalone regulated activity.
An EU broker executes cryptoasset transactions as an agent on behalf of UK retail customers.	Dealing in qualifying cryptoassets as an agent falls within the same regulated activity category.
An offshore firm arranges cryptoasset transactions between UK retail customers and an exchange or liquidity provider.	Arranging deals in qualifying cryptoassets is a regulated activity in its own right.
A non-UK organization operates a crypto lending platform through which UK consumers lend or borrow cryptoassets.	Lending and borrowing are business models, not standalone activities. The FCA expects these platforms to need dealing as principal or agent, often alongside arranging and safeguarding.
An overseas lender lends cryptoassets directly to UK consumers or borrows their cryptoassets in return for yield.	Disposals, redemptions, and yield paid in qualifying cryptoassets can each constitute dealing as principal or agent, regardless of which side of the loan a firm sits on.
An overseas wallet or custody provider safeguards cryptoassets or controls private keys for UK consumers.	Safeguarding qualifying cryptoassets or relevant specified investment cryptoassets (RSICs) is a regulated activity.
An overseas staking provider stakes cryptoassets on behalf of UK consumers, including via a pooled or liquid staking service.	Qualifying cryptoasset staking is captured whether offered individually or pooled.
A centrally controlled overseas decentralized finance (DeFi) protocol provides trading, lending, or staking services to UK consumers.	Calling a service decentralized will not prevent regulation if identifiable people or organizations exercise sufficient control.
An overseas token issuer makes a public offer of qualifying cryptoassets to people in the UK or seeks admission of its token to a UK-regulated cryptoasset trading platform.	Admissions and disclosure requirements can apply even if the issuer carries on no other regulated activity.
An overseas cryptoasset organization sends promotional messages to UK consumers via social media, influencers, email, websites, or apps.	Existing UK financial promotion rules can apply independently of whether full FCA authorization is required.

MLR Registration Does Not Convert Automatically

This is the single fact most likely to catch existing UK cryptoasset businesses off guard. The FCA has been explicit: firms currently registered under the UK's Money Laundering Regulations (MLRs) for cryptoasset AML purposes should not assume that registration carries over into the new regime. There is no automatic conversion. An MLR-registered firm has to secure a new authorization through the FSMA gateway to keep operating once the regime takes full effect on October 25, 2027.

The FCA's own registration outcomes data show why this matters. Of 391 MLR cryptoasset registration cases the FCA had completed through August 1, 2026, only 17% ended in registration; 67% ended in withdrawal, 12% in rejection, and 4% in formal refusal. Securing a registration under the existing regime has been the exception rather than the rule, and there is no reason to assume the new FSMA gateway will be more forgiving.

The same principle applies in the other direction. Organizations already authorized under FSMA for other regulated activities, such as payment services or e-money issuance, need to vary their existing permissions to add any of the nine new cryptoasset activities. An existing license does not automatically cover them either.

Two Populations, One Requirement

Registered under the MLRs? You need a new FSMA authorization application, not a renewal.

Already FSMA-authorized for other activities? You need a variation of permission, not an assumption of coverage.

Blockchain.com and Avian Labs both illustrate the point: each currently holds an FCA cryptoasset registration under the MLRs, and neither registration will, by itself, carry them past October 25, 2027. Any organization in the same position, MLR-registered today and planning to keep serving UK consumers, needs to treat the upcoming application window as a fresh authorization project, not a formality.

Why the Application Window Matters

The FCA will accept applications from September 30, 2026, through February 28, 2027. Organizations already operating in the UK cryptoasset market that apply within that window can continue their UK activity under the savings provisions while their applications are under review. Organizations that wait until after the window closes, or that submit late within it, risk an enforced pause in UK activity once the regime takes full effect on October 25, 2027.

Two recent experiences offer a caution. Firms that exited the EU market when the Markets in Crypto-Assets Regulation took full effect, and firms that struggled through the UK's earlier anti-money laundering registration process, both learned that authorization projects take longer than expected and that unprepared applications often fall short on the first attempt. Treating the coming months as a scoping and preparation period, rather than waiting for the deadline, gives an organization more room to respond to FCA questions and close gaps before the window closes.

Preparation Starts With Scoping

Determining which activities and consumer relationships fall inside the new perimeter is the first step in any authorization project, and the one that shapes everything that follows.

How EisnerAmper Supports FCA Registration

Meeting the FCA's expectations calls for coordinated work across legal structuring, governance, financial crime controls, prudential requirements, and consumer protection. We work with cryptoasset organizations, from overseas exchanges and brokers to lending platforms and token issuers, across the path to UK authorization.

Service Area	How We Help
Perimeter and Scope Assessment	We map your organization's activities, from exchange access to lending, custody, staking, and token issuance, against the FCA's nine regulated activities to identify where authorization or an exclusion applies.
Authorization Application Preparation	We help build and project-manage the application package, including business plans, financial projections, and the supporting documentation the FCA gateway requires.
Governance and Controls Readiness	We support the design of governance frameworks, the Senior Managers and Certification Regime, and anti-money laundering controls that UK regulators look for ahead of authorization.
Prudential and Financial Crime Framework	We help build the prudential capital, safeguarding, and financial crime frameworks that sit behind the FCA's cryptoasset rulebook.
Ongoing Supervisory Support	Once authorized, we help organizations build the reporting, monitoring, and governance routines that keep pace with FCA supervisory expectations.
Registration Project Management	We coordinate and project-manage the FCA authorization application end-to-end, keeping the submission on track against the gateway timeline and managing the FCA's information requests through to a decision.
Policy and Procedure Drafting	We draft some or all of the required policies and procedures, spanning areas such as consumer protection, AML and financial crime, cybersecurity, business continuity, vendor risk management, data privacy, and supervisory arrangements.
Training	We educate management and staff on their obligations and responsibilities under the new regime, so the control framework is understood by the people who have to operate it.

Start Your Scoping Assessment

The application window opens September 30, 2026, and closes February 28, 2027. Organizations that begin scoping now have more time to prepare a complete application and respond to FCA feedback. Contact EisnerAmper's UK Cryptoasset Regulation Task Force to discuss what the new regime means for your organization.

Use the form below to connect with our team.

This material is for general informational purposes only and does not constitute legal, regulatory, tax, or investment advice. Organizations should consult with qualified advisors regarding their specific circumstances before making decisions related to UK cryptoasset authorization.