Five dates decide who operates in the UK
The UK has finished designing its crypto regime and started the clock on entering it. The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 — passed on 4 February 2026 — bring cryptoasset dealing, intermediation, trading platforms, custody, qualifying stablecoin issuance and staking arrangements inside the FSMA perimeter for the first time. On 30 June 2026, the FCA published Policy Statement PS26/9, completing the core rulebook: over a thousand pages of final rules and guidance that will apply to authorised cryptoasset firms.
What remains is the entry mechanics, and they are unforgiving:
- 4 Feb 2026DONEThe Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 passed.
- 30 Jun 2026DONEThe FCA published Policy Statement PS26/9, completing the core rulebook.
- 30 Sep 2026SOON30 September 2026 — the authorisation gateway opens. The application form goes live in the FCA's online system.
- 28 Feb 2027AHEAD28 February 2027 — the application window closes.
- 25 Oct 2027HARD STOP25 October 2027 — the regime commences. From that date, carrying on in-scope cryptoasset activity in or to the UK without FSMA permission is unlawful.
No one is grandfathered — including firms already registered
The trap in this transition is assuming an existing status carries over. It does not:
- MLR-registered cryptoasset firms get no automatic conversion. Registration under the Money Laundering Regulations was an AML check, not authorisation; the new regime requires a full FSMA application with permissions for each regulated activity.
- Firms already authorised under FSMA — including payments and e-money firms — need a Variation of Permission to add the new cryptoasset activities. Existing PSR/EMR authorisation doesn't reach them.
- EU firms with a MiCA licence have no UK passport. MiCA covers the EU; the UK regime is its own perimeter, and serving UK clients means UK authorisation — the mirror image of the "MiCA transitional period is over" story on the EU side. For most cross-border firms the real question is now both licences, sequenced deliberately.
- Overseas firms serving UK customers are in scope: the perimeter reaches activity "in or to the UK," and the FCA expects most firms to operate through a UK legal entity, with narrow exceptions.
And a sobering data point from the last time the FCA ran a crypto entry process: in the MLR registration round, most applications did not succeed. The gateway will be a quality filter, not a queue.
What's in scope
The Regulations define the new regulated activities. If your business touches any of these for UK clients, the gateway applies to you:
- Operating a cryptoasset trading platform
- Dealing in cryptoassets as principal or as agent
- Arranging deals in cryptoassets (intermediation)
- Safeguarding (custody) of cryptoassets
- Issuing qualifying stablecoins
- Arranging cryptoasset staking
Each permission carries its own rulebook consequences under PS26/9 — conduct, prudential (the new crypto prudential sourcebook), systems and controls, operational resilience — which is why the first step of any credible application is mapping which permissions your actual business model needs, no more and no fewer.
What the FCA will actually read
The application is a dossier describing a real, operable firm — the same philosophy as every serious authorisation regime, with crypto-specific depth. The FCA has published what the form will ask; the skeleton:
- Business model and programme of operations, mapped to the requested permissions
- Governance: management structure, Senior Managers, fit-and-proper
- Financial resources against the new prudential requirements
- Systems and controls under the Handbook as applied by PS26/9
- Custody arrangements — segregation, wallet architecture, client-asset protections — where relevant
- Financial-crime framework (your MLR-era programme is the floor, not the ceiling)
- Operational resilience, outsourcing and technology risk
- Wind-down planning
The FCA has been offering pre-application support meetings since July 2026 — used well, they materially de-risk the submission. Used as a substitute for preparation, they don't.
How we can help: Gateway Readiness
Time-boxed to the window, built for firms that intend to be operating in November 2027:
- 1Perimeter and permission mapping.What your business does in the Regulations' terms, which permissions it needs, and the honest out-of-scope analysis — the scoping the FCA itself says firms must not leave late.
- 2Gap analysis against the final rules.Your current arrangements against PS26/9's requirements per permission: governance, prudential, custody, systems, financial crime, resilience. Output: a gap register with owners and a realistic close-out plan.
- 3Application build.The full dossier, drafted with your operating team, in the structure the FCA's own application materials prescribe — including the crypto-specific sections your business model triggers.
- 4Pre-application meeting preparation.Getting real value from the FCA's support meetings: the questions to ask, the story to present, the issues to surface early rather than discover in requisitions.
- 5Through the gateway.Submission inside the window, requisition responses, and the operational readiness work so the firm you described is the firm the FCA finds.
- 6The dual-track strategy.For firms serving both markets: sequencing UK authorisation with EU (MiCA) status — entities, substance, and which licence anchors which activity. One plan, not two collisions.
Who this is for
- MLR-registered UK crypto firms — who must convert registration into authorisation or stop in October 2027.
- FSMA-authorised firms adding crypto — payments, e-money and investment firms needing a Variation of Permission.
- EU/MiCA-licensed CASPs serving UK clients — for whom MiCA does not reach the UK.
- Global platforms and exchanges — facing the UK-entity expectation and a full perimeter analysis.
- Stablecoin issuers — for whom qualifying-stablecoin issuance is now a UK regulated activity in its own right.
- Custodians and staking providers — squarely and explicitly in scope for the first time.
FAQ
Yes. MLR registration was an anti-money-laundering check, not authorisation — and there is no automatic conversion. Continuing your activities after 25 October 2027 requires FSMA authorisation with the right permissions, applied for through the gateway.
Not for the new activities. Firms with existing FSMA authorisation — including payment institutions and e-money institutions — need a Variation of Permission to carry on the new regulated cryptoasset activities.
The window's key benefit is the saving provision: apply validly inside it and you may continue operating after commencement while your application is determined. Apply late and you get no expedition and no saving — if you're undetermined on 25 October 2027, you stop. The FCA has been explicit that late applicants shouldn't expect priority.
No. MiCA authorisation covers the EU; the UK regime is a separate perimeter under FSMA, and serving UK clients means UK authorisation. For cross-border firms the real planning question is both regimes, sequenced — which is exactly what our dual-track work covers.
Operating a trading platform, dealing as principal or agent, arranging deals, custody, issuing qualifying stablecoins, and arranging staking — for activity in or to the UK. Whether your model triggers them is the perimeter analysis, and it's the first thing we do.
The FCA expects most firms to operate through a UK legal entity, with narrow exceptions for certain overseas arrangements. If you're currently offshore-only, entity and substance planning belongs at the start of the project, not the end.
Now. The gateway opens 30 September 2026 and closes 28 February 2027; the rulebook is over a thousand pages; the FCA's pre-application meetings are already running; and the last comparable process rejected most applicants. A credible application is a quarter's work, minimum — the window is exactly five months long.
General information only, not legal advice. Nothing here is a prediction or guarantee of how the FCA will decide any application.