FCA defines new crypto authorisation perimeter

The Financial Conduct Authority has published final guidance setting out which cryptoasset activities will require authorisation under the UK’s incoming regulatory regime, two weeks before its application gateway opens.

The new framework is scheduled to take effect on 25 October 2027, but companies seeking to operate under transitional arrangements will be able to apply from 30 September 2026. The application window for those businesses closes on 28 February 2027.

Activities entering the regulatory perimeter include issuing qualifying stablecoins, safeguarding cryptoassets, operating cryptoasset trading platforms, dealing as principal or agent, arranging transactions and arranging cryptoasset staking.

Existing registrations under the Money Laundering Regulations will not automatically convert into authorisation under the Financial Services and Markets Act regime. Businesses therefore need to assess their activities independently rather than assuming an existing FCA status provides a route into the new framework.

The change expands regulation beyond the anti-money-laundering and financial-promotion requirements that have historically covered much of the UK crypto market. Businesses performing regulated crypto activities will instead face a fuller authorisation framework comparable in structure with other parts of financial services.

David Geale, the FCA’s executive director of consumers, payments and competition, said: “Getting ready for regulation starts with understanding how the regime applies to your business.”

The guidance reaches beyond dedicated exchanges. Payment companies, electronic-money businesses, traditional financial institutions exploring digital assets and overseas providers serving UK customers may all need to determine whether particular products or activities fall within scope.

For established crypto companies, preparation is likely to involve more than legal interpretation. FCA authorisation typically requires evidence of suitable governance, financial resources, systems and controls, operational resilience and capable senior management. Businesses built around rapid product development may have to formalise functions that operated more lightly in an earlier stage of the market.

The timetable creates a sequencing challenge. Although the substantive regime does not begin until October 2027, businesses intending to use transitional arrangements must prepare applications considerably earlier. Waiting for commencement before addressing governance or documentation could leave too little time to remedy weaknesses.

Overseas businesses face a separate strategic decision. Providers offering relevant services into the UK can fall within the regime even where their principal operations sit elsewhere. Some will seek authorisation; others may restrict products or leave parts of the UK market if the expected revenue does not justify additional compliance costs.

The FCA consulted on its perimeter guidance earlier this year and has incorporated responses into the final publication. Other elements of the crypto framework cover stablecoins, prudential requirements, admissions, disclosures and market-abuse controls, meaning companies will have to interpret the perimeter alongside a larger package of rules.

The regulatory programme is intended to give crypto businesses a more defined operating framework while applying protections and market standards associated with conventional financial services. Greater clarity can make the UK easier for established institutions to enter, but it also raises barriers for smaller businesses that previously operated with lighter regulatory infrastructure.

Authorisation could therefore accelerate consolidation in parts of the market. Compliance staff, capital requirements and control systems create fixed costs that larger businesses can spread across more customers and transactions. Smaller providers may need to raise capital, specialise or work with authorised partners.

The commercial effects will become clearer once applications enter the gateway. The immediate task for companies is more practical: map each activity against the final perimeter, identify the permissions required and establish whether existing governance can withstand the scrutiny attached to a formal financial-services authorisation process.