FCA Compliance for UK Cryptoasset Firms: Authorisation, Regulated Activities and the New Regime

The UK cryptoasset regime is the most substantial extension of the FCA's regulatory perimeter in over a decade. It replaces a position in which cryptoasset firms were registered for anti-money laundering purposes and subject to financial promotion rules, with one in which they require full authorisation under the Financial Services and Markets Act 2000 and are subject to conduct, prudential, client asset and market abuse requirements.

The timetable is compressed. Applications open on 30 September 2026 and close on 28 February 2027. The regime applies from 25 October 2027. Firms that do not apply within the window and require authorisation will be unable to carry on regulated activity from that date.

This article sets out the shape of the regime, the regulated activities it captures, the requirements applying to firms, and the practical steps firms should be taking now.

How the regime was made

The Government legislated in February 2026 through the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, extending the FCA's remit to cryptoasset activities under the framework established by the Financial Services and Markets Act 2023.

The FCA developed the detailed rules across more than three years, through four discussion papers and ten consultation papers from 2023 onwards.

On 30 June 2026 it published the substantive final package.

The full package is available on the FCA's cryptoasset regime policy statements page.

Alongside these, the FCA published non-Handbook guidance consultations including GC26/4 on COREPRU 7, non-Handbook guidance on the Consumer Duty and on operational resilience, and a cost benefit analysis.

Two elements remain outstanding. Consultation continues on the market-making and decentralised finance sub-regimes under CP26/4. A further policy statement on how the regulatory perimeter applies to cryptoasset activities was expected in September 2026. Firms operating DeFi protocols or engaged in cryptoasset market-making should not treat the June package as settling their obligations.

Which activities are regulated?

The regime captures the following as regulated activities.

Issuing a qualifying stablecoin. Issuance of a stablecoin that references a fiat currency and is issued in the UK, subject to a dedicated sub-regime covering backing assets, redemption, interest and liquidity.

Safeguarding cryptoassets. Custody of cryptoassets for another person, whether or not combined with administration.

Operating a qualifying cryptoasset trading platform. Bringing together buying and selling interests in cryptoassets.

Dealing in cryptoassets as principal or agent.

Arranging deals in cryptoassets.

Staking. Arranging or providing staking services in relation to qualifying cryptoassets.

The activity-based approach means that the analysis turns on what the firm actually does rather than how it describes itself. Automation, decentralisation or the use of distributed ledger technology do not by themselves place an activity outside the perimeter.

In April 2026 the Government published a draft statutory instrument proposing to exclude activities involving UK-issued qualifying stablecoins from the dealing and arranging activities, with the intention of bringing those activities within a modernised payments regime. Firms whose business involves UK-issued stablecoins should track that proposal, and should consider the electronic money regime, where the definitional boundary is directly relevant.

The authorisation timetable

Firms that apply within the window benefit from a transitional regime, under which they may continue to engage in regulated activities while their application is assessed. Firms that do not apply within the window, and that require authorisation, will be unable to carry on regulated activity from 25 October 2027.

Preparing a complete application typically takes three months or longer. Firms intending to apply should be working on the application now.

Firms currently operating under the Temporary Registration Regime must assess their position against the final conduct and prudential requirements and file applications from 30 September 2026. Existing anti-money laundering registration does not carry across into authorisation. Details of the gateway are set out on the FCA's new regime for cryptoasset regulation page.

What authorisation requires

To be authorised a firm must satisfy, and continue to satisfy, the Threshold Conditions in FSMA: appropriate legal status, location of offices, effective supervision, adequate resources, suitability and an appropriate business model.

For cryptoasset firms, the areas that typically require the most work are the following.

Business model articulation. A clear description of the activities carried on, the assets involved, the customers served, the jurisdictions touched and the flow of funds and assets through the business. Firms with complex group structures or offshore components should expect close examination of where activity actually occurs.

Governance and senior management. An appropriate governance structure, individuals of suitable competence, and the allocation of responsibility under the Senior Managers and Certification Regime.

Financial resources. Compliance with the prudential regime, with capital held and demonstrable at authorisation and on an ongoing basis.

Systems and controls. Financial crime, operational resilience, safeguarding of client assets, conflicts management, and complaints handling. Our guide to FCA financial crime compliance addresses the control framework the FCA expects.

Consumer Duty. The FCA has applied the Consumer Duty to cryptoasset firms serving retail customers, drawing on established financial services standards where risks are comparable.

Financial promotions. Compliance with the cryptoasset financial promotions regime, which has applied since 2023 and continues alongside the new framework.

Firms outside the UK seeking authorisation should read FG26/7, which sets out the FCA's approach to international cryptoasset firms.

The stablecoin sub-regime

Issuers of qualifying stablecoins face requirements beyond those applying to other cryptoasset firms.

Backing assets. The stablecoin must be backed by assets meeting specified criteria, held in a manner that protects holders.

Redemption. Holders must be able to redeem at par value, with the redemption process, timing and any conditions specified.

Interest. Rules govern the treatment of interest or return generated on backing assets.

Trust arrangements. Backing assets are subject to trust arrangements protecting holders on insolvency.

Liquidity. Requirements addressing the liquidity of backing assets, including in relation to global liquidity pools.

Capital. A permanent minimum requirement of £350,000. The FCA adopted a K-factor prudential approach and set the K-SII coefficient at 1%, reduced from the 2% proposed at consultation following submissions that the original calibration overstated the risk.

Sterling-denominated stablecoins that become systemic fall within the Bank of England's regime as well as the FCA's.

On 22 June 2026 the Bank published a policy statement on regulating sterling-denominated systemic stablecoins, together with a consultation on a draft Code of Practice. Responding to its earlier consultation, the Bank moved to a backing asset split of 70% short-term UK government debt and 30% unremunerated deposits at the Bank.

On 30 June 2026 the Bank and the FCA published a joint approach paper setting out how they and other authorities will work together in regulating systemic stablecoin issuers, including the division of responsibilities and the circumstances in which dual supervision applies.

Issuers with the potential to reach systemic scale should plan for both regimes rather than the FCA regime alone.

Client asset protection

PS26/11 sets client asset protections for firms safeguarding cryptoassets for others.

The underlying principle mirrors established client asset regulation: assets held for clients must be identifiable, segregated from the firm's own assets, and returnable. Firms should expect requirements covering segregation, records and reconciliation, custody arrangements including any use of sub-custodians, and the position on insolvency.

Firms that also hold fiat client money in connection with cryptoasset activity should consider whether payment services safeguarding obligations apply alongside the cryptoasset requirements.

Market abuse for cryptoassets

PS26/9 establishes the Market Abuse Regime for Cryptoassets alongside admissions and disclosures requirements.

The regime addresses insider dealing, unlawful disclosure and market manipulation in relation to qualifying cryptoassets, and imposes obligations on trading platforms and other participants to detect, prevent and report abusive conduct.

Firms operating trading platforms should expect requirements analogous to those applying in traditional markets: surveillance capability, escalation, and reporting of suspicious orders and transactions.

Consequences of operating without authorisation

Carrying on a regulated cryptoasset activity without authorisation after the regime takes effect is a criminal offence. Consequences include unlimited fines, imprisonment for up to two years, and contracts entered into in the course of the unauthorised activity being unenforceable.

The unenforceability point is commercially significant and often overlooked. A firm operating without required authorisation may find that agreements with counterparties and customers cannot be enforced.

What firms should be doing now

Determine whether authorisation is required. Map the firm's activities against the regulated activity definitions. Where the position is unclear, monitor the perimeter guidance and consider seeking advice. Do not assume that decentralisation, automation or an offshore structure removes the activity from scope.

Assess the group and operating model. Identify which entity carries on which activity and where. International groups should read FG26/7 and consider whether the UK activity requires a UK-authorised entity.

Begin the application. A complete application takes three months or longer to prepare. The window is five months. Firms leaving preparation until the gateway opens are unlikely to submit a strong application within it.

Use pre-application support. The FCA has made pre-application meetings available. Firms with complex or novel models should engage.

Assess prudential position. Model the capital requirement under the final rules, including the K-factor calculation and, for stablecoin issuers, the £350,000 permanent minimum and the K-SII coefficient.

Build the control framework. Financial crime, client asset protection, operational resilience, conflicts, complaints and Consumer Duty. Authorisation is assessed against what the firm has in place, not what it intends to build.

Track the outstanding elements. The perimeter policy statement, and consultation on market-making and DeFi sub-regimes under CP26/4.

Where firms most often have difficulty

Assuming AML registration carries across. Registration under the Money Laundering Regulations does not confer authorisation and does not shorten the application.

Perimeter analysis based on self-description. Firms describing themselves as technology providers, protocol developers or non-custodial while performing activity that falls within the regulated definitions.

Group structure not aligned to the regime. UK-facing activity carried on from an entity that cannot be authorised, or activity distributed across entities in a way that obscures where it occurs.

Underestimating the client asset requirements. Firms treating custody as a technical function rather than a regulated activity with segregation, reconciliation and insolvency-protection obligations.

Capital modelled on the consultation rather than the final rules. The K-SII coefficient was reduced from 2% to 1% in the final package; other calibrations also changed.

Leaving the application to the window. Five months is the window for submission, not for preparation.

Regulatory developments to track

The FCA policy statement on the regulatory perimeter for cryptoasset activities.

Consultation and final rules on the market-making and decentralised finance sub-regimes under CP26/4.

The Bank of England Code of Practice for systemic sterling stablecoins, following the June 2026 consultation.

The draft statutory instrument proposing to exclude UK-issued qualifying stablecoin activities from dealing and arranging, with the intention of bringing them within a modernised payments regime.

Non-Handbook guidance on prudential requirements, including COREPRU 7 following GC26/4.

Firms operating in both the UK and the EU should note that the analysis under MiCA will not necessarily produce the same result as under the UK regime.

Dates and scope may change. Firms should confirm the current position against FCA, Bank of England and Government publications.

About Regulatory Counsel

Regulatory Counsel advises UK and international financial services firms on authorisation, prudential and conduct requirements, governance, financial crime and regulator engagement.

Our work with cryptoasset firms covers regulatory perimeter analysis, FCA authorisation applications under the cryptoasset regime, group and operating model structuring, prudential assessment under the cryptoasset prudential regime, stablecoin issuance requirements including backing assets and redemption, client asset protection frameworks, market abuse surveillance, financial crime frameworks and business-wide risk assessment, Consumer Duty implementation, operational resilience, SM&CR implementation, and preparation for supervisory engagement.

Contact our regulatory team at info@regulatorycounsel.co.uk.

This article is provided for general information and does not constitute legal or regulatory advice. Firms should confirm the current position against FCA, Bank of England and Government publications and take advice on their specific circumstances.