Introduction

Cryptoasset activities in the UK are moving from anti-money laundering (AML)-focused registration under the Money Laundering Regulations (MLRs) to full authorisation and supervision under the Financial Services and Markets Act (FSMA).

Since 2020, cryptoasset firms have operated under a UK registration regime mainly focused on AML and counter-terrorist financing (CTF) compliance ¹. With the recent adoption of the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, ² the UK has established a statutory framework to bring specified cryptoasset activities within the FSMA perimeter.

The new Financial Conduct Authority (FCA)-authorised regime is expected to come into force on 25 October 2027. Firms wishing to undertake in-scope regulated cryptoasset activities must be authorised under FSMA, or have a pending application for authorisation or Variation of Permission (VoP) with the relevant permissions at commencement ³.

There is no automatic conversion to FSMA authorisation. MLR-registered cryptoasset firms, firms registered or authorised under the Payment Services Regulations or Electronic Money Regulations, and firms already authorised under FSMA for other activities must all obtain authorisation or a VoP to carry out regulated cryptoasset activities once the regime commences ⁴.

A new “UK nexus” test captures services directed at UK consumers. Overseas firms providing or directing in-scope cryptoasset services to UK-based consumers must seek authorisation, even if they have no physical presence in the UK, unless a specific exclusion applies ⁵. Firms that currently use a section 21 FSMA (s.21) approver for cryptoasset promotions to UK consumers will need FSMA authorisation to continue marketing under the UK regime. Once a firm is authorised under FSMA, it can communicate its own financial promotions to UK consumers and no longer needs to rely on an s.21 approver ⁶.

There will be no “grandfathering” of existing registrations into FSMA authorisation at commencement, meaning that even firms currently registered under the MLRs will be required to submit a fresh application for full authorisation.

The transition from registration to authorisation represents a major elevation of the regulatory bar for the UK crypto sector.

The months leading up to the application window are critical for internal preparation and remediation. By acting now – building an evidence base, aligning governance with the FCA Handbook, and planning to submit within the application window – firms can protect business continuity and secure their future in the UK’s regulated digital asset market.

Application Window

The FCA expects the application period to run from 30 September, 2026, to 28 February, 2027 (to be confirmed by FCA direction). This five-month window is designed for firms to submit authorisation or VoP applications ⁷.

The timetable is as follows:

Benefits of Applying during the Application Window

Although the FCA will accept applications after the application window closes, firms that apply by 28 February, 2027 will benefit from a saving provision if the application has not been determined by the expected commencement date of 25 October, 2027 ⁸.

Firms that apply during the window can continue to provide services to existing and new customers under their MLR registration while their FSMA application is pending. However, they will not be allowed to launch new regulated activities that fall outside their current MLR registration until their FSMA application is approved.

Applications submitted after 28 February, 2027 will not be expedited to compensate for late submission and may not be eligible for the saving provision. If not determined by go-live, firms that apply outside the application window may be placed into a two-year transitional “run-off” provision. Under this regime, they are restricted to servicing pre-existing contracts until authorisation or a VoP is granted.

Firms relying on the transitional provision must notify the FCA when they start and cease using it, and must notify parties to pre-existing contracts that the firm is not yet authorised, including whether asset protection, dispute resolution mechanisms, or compensation schemes have changed. The transitional provision lasts for up to two years and is expected to end on 25 October, 2029 ⁹.

Firms using a s.21 approver that apply within the designated window may continue using the approver until FCA determines their application. Those that do not apply during the window may continue using the approver until commencement, but after go-live they will be limited to promotions relating only to pre-existing contracts, which do not require an approver ¹⁰.

Existing cryptoasset firms that choose not to apply for authorisation or a VoP before the new regime starts on 25 October, 2027 will have to exit their UK cryptoasset business and will not have access to the saving or transitional provisions. Firms that fail to do so could be at risk of conducting unauthorised business or – in the case of firms already authorised under FSMA – acting without permission ¹¹.

Map Activities and Required Permissions

In preparation for the new regime, firms should map their business model to in-scope activities, including: operating a trading platform; custody or safeguarding and arranging safeguarding; dealing as principal or agent; arranging or making arrangements with a view to transactions; issuing qualifying stablecoins; and qualifying cryptoasset staking (including arranging staking and operating a staking platform) ¹³.

Firms should ensure that their permissions matrix covers each activity and avoids inadvertent Collective Investment Scheme (CIS) structuring. The legislation and policy notes define territorial scope; overseas firms directing in-scope services at UK customers should assess authorisation needs ¹⁴.

Beyond traditional permissions, firms should determine if their business involves certain “designated activities.” The new Designated Activities Regime (DAR) allows the FCA to set rules for specific activities (such as public offers of cryptoassets), even if the firm does not require full authorisation. Additionally, firms must benchmark operations against the Principles for Businesses (PRIN) and Systems and Controls (SYSC) sourcebooks.

Key steps

• Build an activity-by-activity permissions matrix covering core services and staking, setting out the legal basis and any exclusions.
• Conduct CIS risk screens on any staking models and document your rationale and customer disclosures (the FCA has issued guidance to ensure that staking models are not inadvertently structured as a CIS) ¹⁵.
• Assess whether any of your activities fall under the DAR and plan how you will comply with the applicable FCA rules.
• Prepare a regulatory business plan linking each activity to the required permissions and the target operating model for your business.

Key Takeaways

The complexity of a full FSMA application should not be underestimated. The FCA expects firms to be ready, willing, and organised at authorisation or VoP, and will refuse poor-quality or incomplete applications. Applications that fail to meet minimum requirements may be rejected and treated as if the firm has not applied. In that case, the firm will lose eligibility for the saving and transitional provisions and will need to orderly exit its UK cryptoasset business before go-live.

Firms undertaking regulated cryptoasset activities should start their preparation now, follow a structured plan, engage early with the FCA during the PASS and apply during the application window to be able to benefit from the saving provision.

In our next article, we will outline several recommendations for firms undertaking, or planning to undertake, regulated cryptoasset activities, alongside the key steps they should take to prepare themselves for full authorisation or VoP and supervision by the FCA.

Footnotes

[1] Financial Conduct Authority, “Cryptoasset Firms: Registration under the MLRs ahead of the New FSMA Regime,” March 26, 2026.

[2] UK Government, “The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026,” February 4, 2026.

[3] Financial Conduct Authority, “Cryptoassets: How the Gateway Will Operate,” January 8, 2026.

[4] Ibid.

[5] HM Treasury, “Regulatory Regime for Cryptoassets (Regulated Activities) – Draft SI and Policy Note,” Part 3, December 15, 2025.

[6] Financial Conduct Authority, “Cryptoasset Firms: Use of S.21 Approvers,” 27 February, 2026.

[7] Financial Conduct Authority, “Cryptoassets: How the Gateway Will Operate,” 8 January, 2026.

[8] Ibid.

[9] Financial Conduct Authority, “Cryptoassets: the Transitional Provision,” 8 January, 2026.

[10] Financial Conduct Authority, “Cryptoasset Firms: Use of S.21 Approvers,” 27 February, 2026.

[11] Financial Conduct Authority, “Cryptoassets: How the Gateway Will Operate,” 8 January, 2026.

[12] Financial Conduct Authority, “New Regime for Cryptoassets Regulation: Authorisations Introductory Webinar,” January 2026, webinar.

[13] Financial Conduct Authority, “Cryptoasset Regulated Activities: FSMA and the FCA Handbook,” 8 January, 2026.

[14] HM Treasury, “Regulatory Regime for Cryptoassets (Regulated Activities) – Draft SI and Policy Note,” Part 3, 15 December, 2025.

[15] Financial Conduct Authority, “Regulating Cryptoasset Activities,” 16 December, 2025.