UK crypto authorisation with overseas shared services

The legal lead should first map products, customers, assets and activities to the entity performing them. Include the UK contracting entity, overseas providers and anyone controlling orders or customer assets. The new crypto activities include qualifying stablecoin issuance, safeguarding, platform operation, dealing, arranging and staking arrangements. Each requires its own analysis of the statutory elements, business test, territorial connection and exclusions. (SI 2026/102, regs. 40–44.)

An applicant without FSMA authorisation needs the relevant Part 4A permission. An already authorised firm normally applies to vary its permission. Existing MLR registration does not convert into authorisation. Before October 2027, a business conducting in-scope UK cryptoasset exchange or custody activity must still register under the MLRs before starting. Existing FSMA permissions remain relevant where the assets or services already fall within that regime. (FSMA, ss. 19, 22 and 55H; MLRs, regs. 8, 9, 14A and 56; FCA, Registration under the MLRs ahead of the new FSMA regime, “Requirement to be registered”.)

The current application window runs from 30 September 2026 to 28 February 2027. A qualifying application within that period can engage the statutory saving while it remains undetermined or a refusal remains open to review, subject to the prescribed conditions and FCA powers. The saving has a two-year outer limit after commencement. Late applications can instead lead to restricted performance of pre-existing contracts under the cryptoasset transitional provision. Filing does not supply present MLR registration or remove financial-promotion restrictions. The board should document the applicable continuation route separately from its application timetable. (FCA direction under reg. 52, section 2; SI 2026/102, regs. 53–56; FSMA, s. 21; MLRs, reg. 56.)

The UK authorisation and transition guide explains the wider permission and market-access decisions. For shared services, the additional question is whether an overseas company remains a support provider or performs a regulated activity itself.

Engineering support does not acquire an exemption merely because the group calls it technical work. Transaction routing, control of transfer instructions and custody arrangements need separate examination. The group custody exclusion in the incoming article 9O has specific conditions, including an authorised connected custodian accepting the required responsibility. The proposed technical-services exclusion remains part of the draft miscellaneous amendments and the October consultation. It should not be the sole basis for the operating model. (SI 2026/102, reg. 40(5), inserting RAO, arts. 9N, 9O and 9Y; FCA, CP26/36, “Why we are consulting”.)

The FCA published its principal final crypto rules on 30 June 2026, with substantive application from 25 October 2027. For a crypto-only firm outside the common-platform and MiFID categories, SYSC 8.1.6R applies as a rule. Much of the detailed outsourcing material, including SYSC 8.1.7–8.1.11, applies as guidance through the application table. The legal lead should record that distinction in the compliance plan. (FCA, PS26/13, ch. 6 and Appendix 1, FCA 2026/44, cl. F and Annex B; SYSC 1 Annex 1, 3.3R and Table A, column B.)

The board should approve an accountability map connecting each service to a UK accountable owner, operational team and escalation route. Record the decisions reserved to the applicant, delegated authority, information rights, deputies and intervention powers. This map is a proposed way to evidence the allocation; the formal SM&CR Management Responsibilities Map requirement depends on the firm's classification. (SYSC 4.1.1R; PS26/13, ch. 7.)

For this group, the allocation should address the following functions:

• Engineering can develop software and operate infrastructure overseas. The UK technology owner should control the approval process for material UK service changes, security exceptions and restoration priorities. Preserve access to source code, configurations, deployment records and qualified support. If the overseas team can move customer assets or operate trading arrangements, return that function to the permission analysis before approving it.
• AML operations can collect documents, conduct screening and investigate alerts under the applicant's procedures. UK senior management must approve the relevant AML policies. The nominated officer must assess disclosures and retain the necessary reporting decisions. Give the applicant access to complete case files and the ability to require further investigation. (MLRs, regs. 19(2), 21(3)–(5) and 39(7).)
• Customer service can answer enquiries and administer cases overseas. The UK owner should approve the procedures, escalation rules and delegated redress limits. Record complaint recognition, customer communications and decisions in systems the applicant can supervise. The future complaints duties remain the firm's responsibility. (DISP 1.3.1R; PS26/13, ch. 12.)
• Finance can prepare accounts and forecasts overseas. UK management should review the applicant's own financial position, approve its regulatory submissions and decide how it will fund service continuity. Separate group allocations from resources actually available to the UK entity. (FSMA, Sch. 6, para. 2D; SYSC 4.1.1R.)

For AML, distinguish outsourced performance from statutory reliance on another institution's due diligence. Regulation 39(7) permits outsourced performance where the arrangements preserve the applicant's liability. Reliance under regulation 39(1)–(6) has separate eligibility, information-access and territorial conditions. An unregulated group processing centre does not become an eligible reliance institution through common ownership. (MLRs, reg. 39.)

Management location also depends on the regime. The FCA's current MLR application guidance does not impose a universal UK residence requirement on the nominated officer. Under the final FSMA approach, the FCA expects the compliance oversight and money laundering reporting function holders, SMF16 and SMF17, to work from the firm's UK principal place of business. It may consider other overseas senior managers, while expecting appropriate UK leadership and decision-making. The recruitment plan should address that transition. (FCA, Application for registration, “Money Laundering Reporting Officer/Nominated Officer”; PS26/13, p. 35; FG26/7, paras. 6.4–6.7 and 6.13.)

The legal and operational owners should document each actual provider, service, location and dependency. Group policies alone cannot establish the applicant's contractual rights against a separate company. For relevant outsourcing, use the following issue list to translate the applicable duties and supervisory expectations into enforceable terms. Detailed SYSC requirements must retain the firm-specific rule or guidance status identified above. (SYSC 8.1.6R–8.1.11R; UK GDPR, art. 28(3).)

1. Define services and instructions. Specify deliverables, systems, authorised locations, accountable contacts and the applicant's right to direct corrective work. State who can approve a change affecting UK customers or regulatory compliance.
2. Preserve access and audit. Give the applicant and its auditors usable access to relevant records, personnel and premises. Provide for FCA cooperation and access where required for supervision. Check whether local law permits those rights to be exercised; a contractual promise cannot remove a statutory restriction.
3. Set record responsibilities. Identify who creates each record, where it is held, how it is retrieved and which retention period applies. MLR records generally run for five years from the relevant transaction completion or relationship end, with the statutory qualifications. Contract termination must preserve records still required by law. (MLRs, reg. 40(1)–(5).)
4. Require incident escalation. The provider should report suspected disruptions, security events and loss of access promptly enough for UK assessment and reporting. Allocate investigation, evidence preservation, customer communications and remediation. Distinguish the agreed internal notification period from the regulator's legal deadline.
5. Control subcontracting. Identify every onward provider and dependency. The current FCA MLR application guidance expects applicants to retain control by preventing further outsourcing of the outsourced AML service. For other arrangements, address prior written consent and equivalent protections. A data-processing authorisation does not by itself satisfy the FCA's outsourcing expectations. (FCA, Application for registration, “Outsourcing”; SYSC 8.1.9R; UK GDPR, art. 28(2), (4).)
6. Make exit executable. Provide for termination, continued transition support, data export, access credentials and the rights needed to move or resume the service. Price and fund that support. Treat source-code escrow, step-in mechanisms and particular notice periods as negotiated solutions to identified dependencies, rather than universal statutory clauses.

The agreement should also allocate contractual liability and dispute resolution. The commercial allocation must leave the applicant able to meet its own obligations. If the provider will not grant effective access or continuity rights, the board should change the provider or redesign the service before relying on it. (SYSC 8.1.6R; FSMA, Sch. 6, para. 2C.)

Resolve the data route before enabling access

The data lead should prepare a schedule of controllers, processors, countries, hosting locations, remote users and onward recipients. Include identity documents, screening results, support tickets and transaction histories. Determine roles from actual decisions about processing. A group company acting solely on documented instructions can be a processor; a company deciding its own purposes may be a controller. Processor arrangements require Article 28 terms, including security, assistance, audit and return or deletion duties. (UK GDPR, arts. 4(1)(7)–(8), 26 and 28.)

Remote access by a separate overseas group company can be a restricted transfer even where data stay on UK servers. Access by the UK entity's own employee abroad is a different legal relationship, although security and other processing obligations remain. Record the employer and legal recipient, not just the user's location. (ICO, International transfers, “Are we making a restricted transfer?”; UK GDPR, arts. 32 and 44A.)

For a restricted transfer, first check whether current UK adequacy regulations cover the destination, recipient and processing. If they do not, establish a valid safeguard, commonly the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. EU clauses alone do not establish the UK route. Apply the current data protection test and document the assessment. Under Article 46, the protection after transfer must not be materially lower than under UK law. Assess the recipient's obligations, access risks and effective supplementary measures. (UK GDPR, arts. 44A, 45A and 46(1A), (6)–(7); ICO, International transfers, “Appropriate safeguards”.)

If that test cannot be met, use another lawful route only where its actual conditions are satisfied, or change the destination or access design. Routine group processing should not depend on treating exceptional derogations as a general outsourcing permission. The country assessment must also check local licensing, secrecy, disclosure and data restrictions that could prevent service delivery or regulator access. The affected access should begin only after those legal conditions and the necessary contracts are satisfied. (UK GDPR, arts. 46 and 49; FSMA, Sch. 6, para. 2C(1)(f).)

A UK-incorporated applicant must satisfy the applicable UK head-office condition. The FCA assesses central management and control, including material management decisions and central administrative functions. An overseas parent may set group strategy, but the applicant needs people who can evaluate its UK risks and act on them. Board minutes should record challenge, decisions and completed follow-up where shared services affect the UK business. (FSMA, Sch. 6, para. 2B; COND 2.2.3G.)

The chief executive should test whether each accountable owner has the time, expertise, budget and authority to supervise the provider. A UK title with decisions controlled entirely abroad requires redesign. Depending on the deficiency, that may mean hiring UK control staff, changing reporting lines, obtaining direct system access or moving a reserved decision into the UK management process. The statutory tests concern effective supervision and adequate resources; they do not prescribe a universal headcount or residence-day formula. (FSMA, Sch. 6, paras. 2C–2D; FG26/7, paras. 6.5 and 6.13.)

The technology and operations leads should map important business services through their group dependencies. Test an overseas-centre outage, unavailable administrators, lost access to customer records and failure of a common provider. Record what happens to customers, how the UK team intervenes and whether recovery remains within the firm's impact tolerances. The incoming UK basis is SYSC 15A and the FCA's final crypto resilience guidance. (SYSC 15A.2, 15A.4–15A.6; FG26/6, sections 3–4 and 7–9.)

DORA becomes relevant through a separate EU connection, including an EU cryptoasset service provider authorised under MiCA using ICT services. In that case, the EU entity's obligations can require additional group contract and register provisions. They do not establish the UK applicant's duties merely because its provider is overseas. Separate the UK control requirements from any EU obligations in the service schedule. (Regulation (EU) 2022/2554, arts. 2(1)(f), 28 and 30.)

Incident procedures must also accommodate rules already made for 18 March 2027. Under incoming SUP 15.18, an in-scope firm reports an operational incident as soon as practicable once it reasonably believes a reporting threshold is met. Personal-data breaches have a separate assessment and timetable: processor notification to the controller without undue delay after becoming aware of a breach, and controller notification to the regulator without undue delay and, where feasible, within 72 hours after becoming aware of it unless the breach is unlikely to risk individuals' rights and freedoms. One reporting process should route the facts to both assessments. (FCA 2026/6, SUP 15.18.1R and 15.18.6R; UK GDPR, art. 33(1)–(2).)

Maintain an internal inventory of group services, dependencies, owners and exit arrangements. Check separately whether the applicant falls within the firm classes required to notify material third-party arrangements or submit a regulatory register. Those reporting requirements are not universal. A conditional intra-group reporting exception does not remove the need to control the service or, where applicable, maintain the register. (FCA 2026/6, SUP 15.19.1R, 15.19.7R and 16.33.1R, 16.33.6R–16.33.7R.)

The application lead should reconcile every document to the same legal entities, service descriptions and accountable people. The FCA's published form information identifies organisation and ownership, business planning, financial forecasts, IT controls, financial crime, compliance monitoring, complaints and records management. The shared-services evidence should substantiate those sections. (FCA, Information about the authorisation application form for cryptoasset firms, pp. 15–20, 23, 27–28 and 32–35.)

Use the following submission checklist:

• The legal lead supplies the entity and permission analysis, country schedule, ownership and close-links records, and any exclusions relied on.
• The board and management supply the operating chart, reserved decisions, delegated authorities, applicable senior-manager approval materials and resources committed to oversight.
• Service owners supply the provider assessments, service agreements, subcontracting decisions and evidence that access, instructions and termination rights can operate.
• The AML lead supplies UK procedures, case escalation and sampling results. Explain group processing, outsourced tools, settings and testing through the financial-crime application materials.
• The technology and data leads supply architecture, access controls, the IT assessment, data contracts, transfer assessments and results of recovery and record-retrieval tests.
• Finance and operations supply entity-specific forecasts, service costs, funding dependencies and a funded plan to replace or wind down essential services.

Add activity-specific evidence where the permissions require it. Stablecoin issuance and third-party custody have separate application sections; a general technology agreement may leave those requirements unanswered. An overseas firm applying through a UK branch must also address the dedicated international-firm assessment. A UK subsidiary using overseas suppliers does not become such a branch merely through those contracts. (FCA, Information about the authorisation application form for cryptoasset firms, pp. 38, 44 and 47–50.)

Before submission, the board should resolve contradictions between the business plan and actual decision rights. Identify remaining implementation work, its owner and completion date accurately. Do not attest that a control exists when it remains planned. Before the affected activity starts, the firm must have the permissions, approvals, data route and functioning controls that apply to it. The FCA's preparation guidance calls for a board-agreed implementation plan identifying accountability, changes, delivery and completion. (FCA, What you need to do when preparing for the new cryptoasset regulatory regime, “What we expect firms to be doing now”.)