The Financial Conduct Authority opened its FCA crypto authorisation gateway on 30 September 2026, allowing firms to apply for permission to carry on newly regulated cryptoasset activities in the UK. The move brings crypto businesses operating in the country into full FCA regulation for the first time, with standards covering consumer protection, safeguarding of customer assets, market integrity and financial resilience.
The gateway was created under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, which amend the Regulated Activities Order to establish a new set of regulated activities directed at cryptoassets. The regime replicates for crypto businesses the regulation of familiar functions in traditional financial markets, including issuance, custody, trading venues, dealing, intermediation and certain staking services.
Deadlines and Transitional Arrangements
Businesses planning to keep serving the UK market must submit their applications through the FCA crypto authorisation gateway no later than 28 February 2027, with the full regime taking effect on 25 October 2027. The regulator has urged firms to file well ahead of that date instead of treating it as a target, according to JD Supra.
Submitting an application within the prescribed period allows an eligible existing business to benefit from statutory transitional provisions, continuing to provide cryptoasset services, including taking on new business, while the FCA reviews its application after the new regime commences. A firm does not need to have received final authorisation by the February deadline, but those applying after it may struggle to gain approval in time and could need to cease the relevant regulated activities until permission is obtained, JD Supra reported.
Decisions on applications filed within the window are expected ahead of the regime's start date, the regulator said. Applicants must show clearly that they satisfy the regulator's standards, and any firm unable to demonstrate this will be denied authorisation for the UK market.
How to Apply Through FCA Connect
Applications for Part 4A permission covering the new cryptoasset regulated activities can now be submitted via FCA Connect. Firms that already hold FSMA authorisation have the option of seeking a variation of permission instead, adding the relevant cryptoasset activities to what they are currently permitted to do.
A firm's existing regulatory status will not carry over into the new framework on its own. Registration with the FCA under the Money Laundering Regulations does not entitle a crypto business to an automatic Part 4A permission for the corresponding activity from October 2027, according to JD Supra. Businesses with current FSMA authorisation, or those supervised under the Payment Services Regulations or Electronic Money Regulations, must assess whether the permissions they hold extend to their cryptoasset work and seek a variation where they fall short.
The FCA is supporting firms to prepare for authorisation through pre-application discussions and webinars, which are available on demand. Its Pre-Application Support Service remains available, though the regulator expects meeting requests to come with substantive detail rather than promises to supply information at a later stage, JD Supra reported.
What the New Regime Requires
Crypto businesses caught by the rules will face oversight much like that applied to conventional FCA-authorised financial services firms. Obligations will span capital and prudential rules, standards for how business is conducted, governance, systems and controls, the Consumer Duty where it applies, plus regulatory reporting and ongoing supervision.
Senior staff at authorised firms will fall under the regulator's individual accountability framework, which encompasses the senior managers and certification regime. Governance structures must be proportionate to the nature, scale and complexity of each firm's activities, with clear allocation of senior-management responsibilities.
Issuers of stablecoins will face rules on how backing assets are safeguarded, under a new Client Assets Sourcebook (CASS) 16 chapter of the FCA Handbook. Custodians will face specific requirements concerning the safeguarding of client cryptoassets, and firms that outsource custody to third parties must weigh how those arrangements affect their own regulatory obligations.
Once authorised, firms come under continuing FCA oversight that includes reporting duties and information requests, alongside an expectation of open and cooperative dealings with the regulator. The FCA's existing enforcement toolkit will be available in relation to the new regulated activities, including financial penalties, public censures and restrictions or prohibitions where statutory conditions are satisfied.
Scope Reaches Overseas and Decentralised Businesses
A broad set of business models could be captured, spanning exchanges and trading venues, brokers and other intermediaries, custodians and wallet providers, stablecoin issuers, some market makers and principal dealers, and firms that arrange staking services. The perimeter analysis remains highly fact specific, according to JD Supra.
A firm whose principal place of business sits outside the UK may still fall in scope where it has UK employees or agents undertaking regulated dealing or arranging functions, or otherwise operates through substantive UK-based operations. That could include UK servers, UK-targeted marketing efforts or bank accounts. Regulation may also apply where relevant transactions are negotiated, arranged or executed in the UK or through a UK establishment, or where safeguarding arrangements involve the exercise of relevant control from the UK.
Technology providers, introducers, non-custodial businesses and decentralised protocols will need to consider carefully whether their particular activities satisfy the statutory definitions and territorial requirements, and whether an exclusion applies. Exclusions and exemptions will be considered on a fact-specific, case-by-case basis.
Preparing for Authorisation
Dominic Cashman, director of authorisation at the FCA, said the new regime will give consumers greater protections and firms a clear framework to operate in. The regulator said the framework reflects the government and FCA's determination that the UK's crypto sector should be defined by integrity and trust, along with growth and innovation.
The authorisation process is designed to establish that an applicant can meet FCA standards in practice, and policies that do not correspond to a firm's actual operating model are unlikely to be sufficient, according to JD Supra. Firms should compare their existing governance, financial resources, safeguarding, compliance, risk management, operational resilience and conduct arrangements against the FCA's final rules, and identify proposed senior managers with sufficient expertise and authority.
The FCA published its final crypto rules and guidance in June 2026, with the final rule package published on 30 June 2026 illustrating the scale of the transition, according to JD Supra. The regulator has confirmed the application of core handbook requirements to regulated cryptoasset firms and has published specific guidance on applying the consumer duty to the sector.
Conclusion
The opening of the FCA crypto authorisation gateway on 30 September 2026 starts the clock for crypto firms seeking to operate in the UK under full regulation. Existing businesses face a 28 February 2027 application deadline to benefit from transitional arrangements that let them continue operating while their applications are assessed, with the new regime taking full effect on 25 October 2027. Firms that cannot demonstrate they meet the FCA's standards on consumer protection, safeguarding, market integrity and financial resilience will not be authorised to operate in the UK market.
Frequently Asked Questions
When did the FCA crypto authorisation gateway open?
The FCA opened its authorisation gateway on 30 September 2026, allowing firms to apply for permission to carry on the new regulated cryptoasset activities created by the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026. Firms can apply through FCA Connect for Part 4A permission.
What is the deadline for crypto firms to apply for FCA authorisation?
Firms intending to continue operating in the UK should apply by 28 February 2027, ahead of the new regime coming into force on 25 October 2027. The FCA has encouraged firms to apply as early as possible rather than treating the February date as a target.
Can existing UK crypto firms keep operating while their application is assessed?
Yes. Existing firms that apply during the application period can continue providing cryptoasset services, including taking on new business, while their application is assessed if a decision has not been made before the new regime comes into force on 25 October 2027, under statutory transitional provisions.
Does FCA registration under the Money Laundering Regulations carry over to the new regime?
No. A crypto business currently registered with the FCA under the Money Laundering Regulations will not automatically receive a Part 4A permission to conduct the corresponding activity from October 2027. Existing regulatory status does not automatically migrate into the new regime.
Do overseas crypto firms fall under the UK's new crypto regime?
Potentially. A firm whose principal place of business is outside the UK may still fall in scope where it has UK employees or agents undertaking regulated dealing or arranging functions, or operates through substantive UK-based operations, which could include UK servers, UK-targeted marketing or bank accounts.
Sources
