FCA Cryptoasset Authorisation: The Application Window Is Now Open
Firms that want to carry on regulated cryptoasset activities in the UK when the new regime starts must now apply to the Financial Conduct Authority (FCA) for authorisation. The FCA opened its application window on 30 September 2026 and it closes on 28 February 2027, ahead of the regime coming into force on 25 October 2027. Existing firms that apply within the window can, subject to conditions, keep operating while the FCA decides their application; firms that apply later, or not at all, lose much or all of that protection.
The FCA announced the opening of its authorisation gateway in a press release on 30 September 2026, three months after publishing its final rules and guidance for the cryptoasset regime. The regime brings cryptoasset firms into full regulation under the Financial Services and Markets Act 2000 (FSMA), well beyond the anti-money laundering registration and financial promotion rules that applied until now. The FCA is explicit that authorisation is not automatic: firms that cannot show they meet its standards will not be authorised and will not be able to continue offering regulated cryptoasset services in the UK.
Key Points of the FCA’s Authorisation Gateway
Read with the FCA’s policy statements and its webpage on how the gateway will operate, the press release sets out how the transition will work.
The Application Window and Key Dates
The FCA has set the window under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 (the Cryptoassets Regulations), which Parliament passed on 4 February 2026. The key dates are:
30 September 2026: the application window opened.
28 February 2027: the application window closes.
25 October 2027: the new regime comes into force.
The FCA expects to determine applications submitted during the window before the regime comes into force. That is an expectation rather than a guarantee, so firms should not assume a decision will arrive before commencement.
Continuing to Operate While an Application Is Assessed
Existing firms that apply during the window and have no decision by 25 October 2027 can rely on the savings provision in the Cryptoassets Regulations. This allows them to continue providing cryptoasset services, including taking on new business, while the FCA completes its assessment. It is subject to the relevant conditions, and firms must notify the FCA when they stop using the provision.
The FCA advises firms to apply as early as possible within the window. If an application is refused, and the Tribunal upholds that decision where the firm refers it, the firm enters the transitional provision so that it can exit the UK market in an orderly way.
The Position for Firms That Apply Late or Not at All
A firm that applies after 28 February 2027, but before commencement, and is not authorised by 25 October 2027 enters the transitional provision by operation of law. It may then carry on the newly regulated activities only to the extent needed to perform existing contracts, and cannot enter into new contracts with existing or new UK customers.
A firm with in-scope UK business that does not apply before commencement is not eligible for the transitional provision and must run off its UK cryptoasset business before the regime goes live. The FCA’s webpage on the transitional provision describes it as allowing eligible firms to wind down their UK business over a maximum of two years. For a firm that depends on onboarding customers, applying late means, in practice, a pause on UK growth until authorisation.
Existing Registrations and Permissions Do Not Carry Over
Since January 2020, cryptoasset exchange providers and custodian wallet providers have had to register with the FCA under the Money Laundering Regulations. That registration does not convert into authorisation. The FCA has confirmed that the following firms need authorisation if they carry on an in-scope activity:
firms registered with the FCA under the Money Laundering Regulations;
firms authorised under the Payment Services Regulations or the Electronic Money Regulations;
firms already regulated under FSMA, which will need a variation of permission; and
firms that rely on a section 21 approver for their cryptoasset financial promotions.
Once authorised under FSMA, firms will no longer need a separate Money Laundering Regulations registration for the newly regulated activities.
The Standards Applicants Must Meet
Applicants must show that they satisfy, and will continue to satisfy, the Threshold Conditions in FSMA. The FCA will assess them against its standards on consumer protection, safeguarding of customer assets, market integrity and financial resilience. Those standards are set out in five policy statements published on 30 June 2026:
PS26/9: admissions and disclosures, and the market abuse regime for cryptoassets.
PS26/10: stablecoin issuance.
PS26/11: regulated cryptoasset activities, including trading platforms, intermediaries, custody (with safeguarding rules in CASS 17), staking, and lending and borrowing.
PS26/12: the prudential regime in two new sourcebooks, COREPRU and CRYPTOPRU.
PS26/13: application of the wider FCA Handbook, including the Consumer Duty, conduct of business rules, the Senior Managers and Certification Regime (SM&CR), operational resilience and financial crime requirements.
PS26/12 and PS26/13 apply to all firms; the others depend on the business model. Finalised guidance on the Consumer Duty (FG26/5), operational resilience (FG26/6) and international firms (FG26/7) accompanies PS26/13. It is guidance rather than rules, but signals how the FCA will assess and supervise firms.
Who Needs to Apply for FCA Cryptoasset Authorisation?
The regime covers firms that carry on, or intend to carry on, regulated cryptoasset activities in the UK: issuing qualifying stablecoins, safeguarding cryptoassets, operating a trading platform, dealing as principal or agent, arranging deals, staking, and lending and borrowing. Overseas firms serving UK consumers are also affected. The FCA has published final perimeter guidance in PS26/18 on when cryptoasset activities require authorisation.
Two areas need particular care. Decentralised finance (DeFi) arrangements are in scope where there is an identifiable controlling entity, and the FCA will consult on tailored guidance. For stablecoins, a draft statutory instrument published by the government in April 2026 proposes excluding activities involving UK-issued qualifying stablecoins from arranging and dealing; it is not yet law.
Key Themes for Firms Preparing an Application
Authorisation is a different exercise from registration. Registration focused on financial crime controls; authorisation tests the whole business, from governance to customer outcomes, safeguarding, prudential resources and operational resilience. Compliance Angle’s view is that firms moving from registration should approach this as a new authorisation rather than an update to their existing file.
Timing and quality also need balancing. Applying early maximises the benefit of the savings provision, but an incomplete or inconsistent application is unlikely to serve a firm well. Our view is that firms should submit as early in the window as their readiness genuinely allows.
Parts of the regime are still being developed. The FCA has said that it will:
consult later in 2026 on Financial Crime Guide updates covering anti-money laundering and know your customer obligations;
consult later in 2026 on cryptoasset firm failure, including distribution rules for failed stablecoin issuers and custodians;
consult on tailored DeFi guidance; and
develop supplementary regulatory reporting questions with firms before commencement.
Firms should build applications on the final rules and record any assumptions made where the position is unsettled.
What Should Firms Do Now
For most firms in scope, the priority is a structured readiness assessment and a realistic plan to submit within the window. Practical steps include:
Confirm whether your activities fall within the perimeter, using PS26/18, and whether you need full authorisation or a variation of permission.
Carry out a gap analysis against the policy statements relevant to your business, starting with PS26/12 and PS26/13.
Set a target submission date well before 28 February 2027 and give a named senior individual ownership of the application.
Review governance and SM&CR arrangements, including who will hold Senior Management Functions.
Update policies and procedures, including Consumer Duty arrangements, complaints handling, operational resilience and, where relevant, CASS 17 safeguarding.
Prepare financial projections and capital and liquidity assessments under COREPRU and CRYPTOPRU.
Review customer communications and financial promotions, particularly if you currently rely on a section 21 approver.
Document how you have interpreted any unsettled areas, such as DeFi or stablecoin perimeter questions.
Consider a meeting through the FCA’s Pre-Application Support Service and review its on-demand webinars on the new regime.
Firms already authorised for other activities may need a more targeted exercise focused on the variation of permission. Our article on improving FCA applications for authorisation sets out what generally distinguishes stronger applications.
Frequently Asked Questions About FCA Cryptoasset Authorisation
When does the FCA cryptoasset application window close?
The FCA’s application window opened on 30 September 2026 and closes on 28 February 2027, ahead of the new regime coming into force on 25 October 2027. Existing firms must apply within this window to rely on the savings provision while their application is assessed.
Do crypto firms registered under the Money Laundering Regulations need FCA authorisation?
Yes, if they carry on activities within the new regime. Registration under the Money Laundering Regulations does not convert into authorisation under the Financial Services and Markets Act 2000, so firms must apply.
Can a cryptoasset firm keep operating while its FCA application is assessed?
A firm that applies within the window and has no decision by 25 October 2027 can, subject to conditions, continue its cryptoasset services, including new business. A firm that applies after the window and is not authorised by that date can only perform existing contracts.
What happens if a crypto firm does not apply before the new regime starts?
A firm with in-scope UK business that does not apply before 25 October 2027 cannot use the savings or transitional provisions. It must run off its UK cryptoasset business before the regime comes into force.
Do payment and e-money firms need separate authorisation for crypto activities?
Yes, if they carry on regulated cryptoasset activities. Authorisation under the Payment Services Regulations or the Electronic Money Regulations does not cover the new activities, so these firms need authorisation under the Financial Services and Markets Act 2000.
How Compliance Angle Can Help
For cryptoasset firms preparing for the new regime, Compliance Angle’s support includes:
FCA authorisation and application support, including readiness assessments, regulatory business plans and application preparation.
Gap analyses and compliance frameworks and policies tailored to the firm’s activities.
SM&CR support, including responsibilities maps and Statements of Responsibilities.
Consumer Duty support for firms serving retail customers.
Risk management and governance, including board oversight and risk frameworks.
Ongoing compliance support, including compliance monitoring plans once a firm is authorised.
Our support is practical and proportionate, reflecting each firm’s business model, permissions, size and regulatory risk. If you would like to discuss your firm’s position ahead of the 28 February 2027 deadline, please contact us at info@complianceangle.co.uk.
Source: Financial Conduct Authority, “FCA opens the gateway to regulated crypto”, press release, 30 September 2026; and “Overview of our cryptoassets regime policy statements”, 30 June 2026.
