The UK is moving from a registration system to full authorisation for cryptoasset businesses. Since January 2020, exchanges and custodian wallet providers serving the UK have registered with the Financial Conduct Authority (FCA) under the Money Laundering Regulations 2017 (the MLRs). That registration covers anti-money laundering controls only. It is not a licence to carry on a regulated financial activity.
The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 (SI 2026/102), made on 4 February 2026, bring trading platforms, dealers, brokers, custodians, UK stablecoin issuers and staking providers inside the same authorisation regime that applies to banks, investment firms and insurers. From 25 October 2027 each of these activities needs an FCA permission under Part 4A of the Financial Services and Markets Act 2000 (FSMA). A permission is the FCA's formal approval for a named firm to carry on a named activity.
The FCA's application window opened on 30 September 2026 and closes on 28 February 2027. This is the most important date in the UK crypto calendar: firms that already serve UK customers and apply inside the window can keep trading while the FCA decides, and firms that apply later cannot take on new UK customers if they are not authorised by commencement.
In practice there are now two things a UK crypto business may need: an MLR registration to operate lawfully today, and an FSMA authorisation to operate from 25 October 2027. This guide covers both, for new applicants and for firms already registered.
The dates below come from the FCA's regime pages and the policy statements published on 30 June 2026. They set the order of work for every applicant.
| Date | Milestone | What it means for you |
|---|---|---|
| 4 February 2026 | Cryptoassets Regulations 2026 made | The law creating the new regulated activities is in place |
| 30 June 2026 | FCA final rules published (PS26/9 to PS26/13) | The standards your application is assessed against are known |
| 16 September 2026 | Final perimeter guidance (PS26/18) | The FCA's view of which activities are in scope is settled |
| 30 September 2026 | Application window opens on FCA Connect | New authorisations and variations of permission can be submitted |
| 28 February 2027 | Application window closes | Last day to apply and qualify for the saving provision |
| 31 July 2027 | Last practical date for an MLR registration application | Later MLR applications are unlikely to be decided before commencement |
| 25 October 2027 | Regime commences | In-scope activity needs an FSMA permission or a statutory basis to continue |
The FCA has said it will review applications made in the window in the order it receives them, with the aim of deciding all of them before 25 October 2027. Applying early in the window gives the FCA the most time to ask questions and gives you the most time to answer them.
The 2026 Regulations amend the Regulated Activities Order, the legislation that lists every activity needing FCA permission. They create the following cryptoasset activities. A single business often carries on more than one, and needs a permission for each.
The FCA's final rules also cover cryptoasset lending and borrowing, and admissions, disclosures and market abuse for tokens traded on UK platforms. Lending and borrowing are assessed through the dealing, arranging and custody activities they involve.
Product labels such as wallet, exchange or app do not settle the question. The FCA looks at the facts: who contracts with the customer, who controls the asset or the keys, who executes or routes the order, who appoints the custodian and where each step takes place. A firm that only holds cryptoassets for its own treasury is not a regulated provider for that reason alone.
The working tool is a permission matrix: one row per service, recording the asset, the customer type, the contracting entity, the regulated activity, the UK connection, the permission sought and any exclusion relied on. The FCA's perimeter guidance in PERG 18 gives worked examples for each activity, and every row of the matrix should point to the paragraph it relies on.
The route depends on what your firm holds today. Two points apply to everyone. An MLR registration does not convert into an FSMA permission, and a payment institution or e-money licence does not cover cryptoasset activities.
| Your position today | Route | First decision |
|---|---|---|
| New business with no FCA status | New FSMA authorisation (Part 4A) | Which UK entity applies and which activities it will carry on |
| Registered under the MLRs only | New FSMA authorisation | Which current services fall inside the new perimeter |
| Already FSMA-authorised, for example as an investment firm | Variation of permission | Whether governance, capital and systems support the larger business |
| Payment institution or EMI only | Usually a new FSMA authorisation | Which entity in the group holds which activity |
| Overseas firm with UK customers | UK perimeter analysis, then authorisation of the right entity | A UK subsidiary, or a model that stays outside UK scope |
| Unauthorised firm using a section 21 approver for promotions | New FSMA authorisation | Promotion approval ends as a route at commencement |
Firms that already hold FSMA permissions use the variation of permission process, covered in our guide to FCA variation of permission applications. The cryptoasset questions in the variation form are the same as those in a new application, so the evidence needed for the crypto activity is the same.
Many crypto businesses also move fiat money, and many payment firms now want to offer crypto. The two regimes sit side by side: the payment or e-money licence covers the fiat leg, and the FSMA permission covers the crypto activity. Payments made with UK-issued qualifying stablecoins have their own perimeter questions, and HM Treasury has brought forward amending legislation so that certain stablecoin payment uses do not need separate dealing or arranging permissions. Custody, overseas-issued stablecoins and cross-border flows still need their own analysis, set out in our guide to stablecoin payments regulation in the UK.
Every firm on the FCA's cryptoasset register that carries on an in-scope activity needs FSMA authorisation by 25 October 2027. There is no automatic conversion and no fast-track; the FCA has confirmed this in its published webinar answers.
The registration stays in force and must be maintained until commencement. Your MLRO, transaction monitoring and suspicious activity reporting continue as now, and the FCA will use what it already knows about your firm when it reviews the FSMA application.
The FSMA standards go well beyond anti-money laundering. The FCA expects registered firms to show how their existing controls have been extended to cover:
A registered firm that applies inside the window and is still awaiting a decision on 25 October 2027 can keep providing its services, including to new customers, under the saving provision described below.
A new business that wants to start serving UK customers before 25 October 2027 needs an MLR registration first. The MLRs require registration before any cryptoasset exchange or custody activity begins, and the MLR fee is £11,260 (FCA application fee Category 6).
Since 30 September 2026 the FCA has encouraged firms to apply for FSMA authorisation rather than MLR registration. A firm that still needs an MLR registration should contact the FCA's Pre-Application Support Service (PASS) and explain why. If the FCA agrees, the information in the FSMA application can be used for the MLR application as well, and a single fee is charged: the higher of the MLR registration fee and the FSMA authorisation fee.
The FCA has a three-month statutory period to decide an MLR registration once it holds a complete application. It has advised firms not to apply for MLR registration after 31 July 2027, because a later application is unlikely to be decided before commencement.
A new entrant with no existing UK business cannot rely on the saving or transitional provisions. It may start in-scope activity only once its permission is granted.
The timing of your application decides what you can do on 25 October 2027 if the FCA has not yet decided it. The three outcomes are set out in the FCA's gateway and transitional provision pages.
| When you applied | Position at 25 October 2027 if undecided |
|---|---|
| Valid application between 30 September 2026 and 28 February 2027 | Saving provision: continue providing services, including new business, until the application is finally decided |
| Valid application after 28 February 2027 and before commencement | Transitional provision: perform existing contracts only, no new contracts with UK customers, for up to two years |
| No valid application before commencement | No protection: UK business must be run off before 25 October 2027 |
The saving provision protects continuity. It covers firms already providing in-scope services that applied inside the window, and it lasts until the application is finally decided, including any reference to the Upper Tribunal. You must tell the FCA when you start relying on it and when you stop. The FCA can, in limited cases, direct a firm into the more restrictive transitional provision.
The transitional provision supports an orderly wind-down, not growth. A firm in it may only perform contracts made before it entered, may not take on new UK customers or new business with existing ones, and may only communicate financial promotions needed to perform those contracts. It lasts for a maximum of two years. The firm must notify the FCA and every counterparty to a pre-existing contract, stating that it is not FCA-authorised and whether asset protection, dispute resolution or compensation arrangements have changed.
An application that does not contain the FCA's minimum information is returned without assessment and the fee is refunded. Unless a valid application replaces it, the firm is treated as if it never applied. A complete file submitted in the window is therefore the single most valuable step a UK crypto business can take this winter.
The FCA assesses every applicant against the Threshold Conditions in FSMA: a UK-supervisable structure, adequate financial and non-financial resources, suitable people and controllers, and a business model the FCA can understand and supervise. The five policy statements of 30 June 2026 set the detailed standards.
The FCA wants to see the people who will run the firm in the UK. That means a board with relevant experience, a chief executive, a compliance officer and a money laundering reporting officer (MLRO) approved for their senior roles, and a clear line of responsibility for every material rule. Our guide to hiring MLROs and heads of compliance sets out what the FCA looks for in these appointments.
Anti-money laundering duties continue unchanged under the MLRs, including the cryptoasset travel rule that requires originator and beneficiary information to accompany transfers. The FCA expects blockchain analytics, sanctions screening, a business-wide risk assessment tailored to your customers and products, and a working suspicious activity reporting process to the National Crime Agency.
A cryptoasset firm must hold own funds at least equal to the highest of three amounts: its permanent minimum requirement (PMR), its fixed overheads requirement (FOR) and its K-factor requirement. The PMR is a fixed floor set by activity. The FOR is based on the previous year's audited expenditure and stands as a proxy for the cost of an orderly wind-down of the whole firm. K-factors are charges that rise with the volume of business, for example the value of client assets held.
The final PMR figures in PS26/12 are unchanged from consultation. Where a firm carries on several activities, the highest applicable PMR applies.
| Activity | Permanent minimum requirement |
|---|---|
| Dealing in qualifying cryptoassets as principal | £750,000 |
| Issuing a qualifying stablecoin | £350,000 |
| Safeguarding qualifying cryptoassets | £150,000 |
| Operating a qualifying cryptoasset trading platform | £150,000 |
| Qualifying cryptoasset staking | £150,000 |
| Dealing as agent or arranging deals | £75,000 |
The FCA kept the £750,000 figure for dealing as principal to align it with the initial capital for investment firms that deal on own account. Stablecoin issuers also hold a K-factor charge on the value of coins in issue, which PS26/12 reduced from 2% to 1%. Cryptoassets a firm holds on its own balance sheet are either subject to a 40% charge, where they are admitted to a UK platform and can be prudently valued, or deducted from capital in full.
The application must show these figures as forecasts for the applicant entity itself, not for its group, together with a liquidity assessment, stress scenarios and a wind-down plan. The FCA's financial data template must reconcile to the business plan.
The cost has four parts: the FCA fee, capital, people and systems.
| Cost item | Position |
|---|---|
| MLR cryptoasset registration fee | £11,260 (Category 6), one-off and non-refundable |
| FSMA authorisation fee | Set by the FCA fees rules for each permission; confirm on the FCA fees page when you apply |
| Combined MLR and FSMA application | A single fee equal to the higher of the two |
| Application returned as incomplete | Fee refunded by the FCA |
| Regulatory capital | From £75,000 to £750,000 depending on activity, or more where the FOR or K-factors are higher |
| Annual periodic fees | Charged by the FCA each year after authorisation |
The larger costs are internal: a UK board and senior management team, an MLRO and compliance function, blockchain analytics and screening tools, custody technology, an annual client assets audit where you hold customer cryptoassets, and professional indemnity and cyber insurance. Budget these in the financial forecasts that accompany the application, because the FCA tests whether the applicant can afford them under stress.
The FCA has not published a fixed service standard for cryptoasset applications. Its stated aim is to decide every application made in the window before the regime starts on 25 October 2027. An application submitted in October 2026 therefore has around 12 months before commencement, and one submitted on the last day of the window has just under 8 months.
For planning, a complete application that answers the FCA's questions promptly is typically decided in 6 to 8 months. The variables are the number of permissions sought, the complexity of the group and the speed and quality of your responses to information requests. A firm already registered under the MLRs starts with an advantage, because the FCA already knows its people and its financial crime framework.
| Stage | Typical duration |
|---|---|
| Perimeter analysis and permission matrix | 2 to 4 weeks |
| Gap analysis and board-approved plan | 2 to 4 weeks |
| Pre-application meeting with PASS (optional) | Arranged by the FCA on request |
| Preparing the full application file | 2 to 4 months |
| FCA review and information requests | 6 to 8 months after submission |
The FCA applies its ready, willing and organised test: the firm must be able to start the regulated business on the day permission is granted. A credible plan for capital, people and systems at submission, delivered during the review, meets that test.
Details of our support for crypto applicants are on the UK cryptoasset authorisation page.
The FCA's 73-page information document previews the form. It first builds your permission set, then asks the standard FSMA questions, then asks tailored questions for custody, stablecoins, trading, staking, lending and borrowing. Every document must describe the same business.
| Evidence area | What it should show |
|---|---|
| Regulatory business plan | Services, customers, distribution, revenue and operating model that match the permissions sought |
| People and control | Board, senior managers, controllers, close links, reporting lines and decision rights |
| Financial case | Three-year forecasts, financial data template, capital and liquidity calculations, stress tests and wind-down plan |
| Financial crime | Business-wide risk assessment, customer due diligence, blockchain analytics, sanctions screening and reporting |
| Conduct | Consumer Duty assessment, promotions, appropriateness tests, disclosures and complaints handling |
| Technology and resilience | IT and cyber controls, incident response, record keeping, outsourcing oversight and business continuity |
| Activity-specific evidence | Custody trust and reconciliations, stablecoin backing and redemption, platform admissions and surveillance |
Firms applying for MLR registration before commencement, and every FSMA applicant, need a financial crime framework built for cryptoassets. The MLR registration form asks for:
| Higher-risk indicators | Lower-risk indicators |
|---|---|
| Privacy coins, mixers and other anonymity tools | Small-value storage or savings use |
| Access through VPN, TOR or anonymising services | Closed-loop systems and micro-payments |
| Transfers split to stay under verification thresholds | Transaction and balance limits set by the firm |
| Funds sent to newly created addresses | Funds from the customer's own account in a lower-risk country |
| Links to darknet markets, unregulated exchanges or fraud | Low-value, regular payment patterns |
Controls follow from these factors: transaction limits and delays for higher-risk flows, enhanced checks for politically exposed persons and higher-risk customers, blockchain analysis of the source and destination of funds, and a process to restrict and report incoming transfers that cannot be reversed on-chain. Our guide to FCA financial crime compliance covers the full framework.
Being incorporated outside the UK does not by itself take a firm outside the regime. The usual test of whether an activity is carried on in the UK applies first, and the 2026 Regulations then treat certain activities with UK consumers as carried on in the UK even where the firm is abroad.
A customer approaching the firm first is not an exemption. The FCA has said reverse solicitation does not settle the question, and an overseas firm with UK retail customers should assume it is in scope until it has a reasoned analysis that says otherwise.
The FCA's approach to international cryptoasset firms (FG26/7) expects an applicant to operate through a UK legal entity with real UK presence: a sufficient share of leadership and decision-making in the UK, and senior managers who spend adequate time here. A UK branch alone is generally not accepted, because UK client asset protections may not hold if an overseas firm becomes insolvent. The main exception is operating a trading platform, which the FCA will consider through a UK branch where the home regulator offers comparable protection. A firm also authorised in the EU under MiCA still needs a separate UK permission, as described in our MiCA licence guide.
Authorisation starts the ongoing relationship with the FCA. An authorised cryptoasset firm submits regulatory returns, pays annual periodic fees, maintains its capital above the requirement at all times, has its client asset arrangements audited each year where it holds customer cryptoassets, and notifies the FCA before material changes such as new controllers or new services.
Senior managers carry personal responsibility for their areas, and the Consumer Duty requires evidence each year that customers receive good outcomes. Authorisation is not a guarantee against losses: cryptoasset holdings are not generally covered by the Financial Services Compensation Scheme, and firms must explain the protections that do and do not apply. Our guide to FCA compliance for UK cryptoasset providers sets out the full set of ongoing obligations.
Today an exchange or custodian wallet provider serving the UK needs an FCA registration under the Money Laundering Regulations. From 25 October 2027 each in-scope activity, such as running a trading platform, dealing or custody, needs FSMA authorisation.
The application window runs from 30 September 2026 to 28 February 2027. Firms can still apply afterwards, but a firm not authorised by 25 October 2027 can then only perform existing contracts.
No. MLR registration does not convert into FSMA authorisation. Registered firms must apply for the permissions they need and keep their registration in place until commencement.
The MLR registration fee is £11,260. The FSMA authorisation fee depends on the permissions sought, and capital ranges from £75,000 to £750,000 depending on activity.
The FCA aims to decide all applications made in the window before 25 October 2027. A complete application is typically decided in 6 to 8 months.
No. A payment or e-money licence covers the fiat payment activity only. Crypto activities need an FSMA permission, usually through a new application for the relevant entity.
Generally not where it deals with UK consumers. The 2026 Regulations treat many activities with UK consumers as carried on in the UK, and reverse solicitation is not an exemption.
Not after commencement. A new entrant may only carry on in-scope activity once permission is granted; before then it needs an MLR registration to operate in the UK.
Buckingham Capital Consulting has obtained FCA authorisations since 2013 for firms including Dzing Finance and Hryze (EMI), Nexpay (API) and Moneliq (variation of permission), and prepares FSMA cryptoasset applications and MLR registrations to the same standard. It maps each crypto service to the right permission, builds the business plan, prudential forecasts and financial crime framework, and manages the FCA's questions through to decision.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.