Written by Marcia Howards, Senior Associate Solicitor · SRA-regulated · Last reviewed 6 September 2026
UK crypto regulation is now built around a single FCA authorisation regime under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026. Any UK-facing business that operates a crypto trading platform, provides custody, issues a stablecoin, offers crypto lending or staking, or acts as a broker or intermediary must become authorised by the Financial Conduct Authority (FCA). The application gateway opened for a defined window before the regime takes full effect, and firms operating in scope without authorisation risk being unable to continue trading or worse, committing a criminal offence. This guide explains how the regime works, who it applies to, the key dates, and the practical steps a crypto business needs to take now.
Saracens Solicitors’ Blockchain, Crypto & Digital Assets team advises exchanges, custodians, stablecoin issuers, DeFi projects, funds and individual holders on UK crypto law. This page is our main reference guide to the regime and is updated as it develops so please bookmark it, or contact us directly if you need advice on your specific position.
Prefer to speak to someone now? Call our team on +44 (0)20 3588 3500, or press the Enquire button at the top of this page and we will call you back.
How UK Crypto Regulation Works: The Short Version
Until recently, UK crypto businesses operated under a patchwork of rules: registration with the FCA under the Money Laundering Regulations (MLR), restrictions on financial promotions, and general consumer protection law. There was no bespoke authorisation regime for crypto activities themselves — a business could register for AML purposes without ever being assessed on its financial resources, governance or operational resilience.
That gap has now been closed. The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 bring a defined list of cryptoasset activities within the FSMA “regulated activities” perimeter, the same legal framework that governs banks, investment firms and insurers. From this point on, carrying on a qualifying cryptoasset activity in or into the UK without FCA authorisation is a regulatory breach and, in some cases, a criminal offence. For background on the wider shift toward regulating digital infrastructure, see our piece on the Web3 and blockchain landscape.
Key Dates in the UK Cryptoasset Regime
The table below sets out the milestones that matter most. We keep this updated as the FCA confirms further detail, so treat this as the current position rather than a fixed historic record.
| Milestone | Date | What it means |
| FSMA (Cryptoassets) Regulations 2026 made | 4 February 2026 | Crypto activities formally brought inside the FSMA regulatory perimeter |
| FCA Policy Statement PS26/9 published | 30 June 2026 | Final Handbook rules and guidance for the new regime confirmed |
| FCA authorisation gateway opens | 30 September 2026 | Firms can submit applications for FCA authorisation |
| Application window closes | 28 February 2027 | Last date to apply and retain transitional (“grandfathering”) protection |
| Full regime commences | 25 October 2027 | Only authorised firms may carry on regulated cryptoasset activities in the UK |
The practical point that gets lost in the detail: firms that apply within the gateway window benefit from transitional protection and can generally continue operating while their application is assessed. Firms that miss the window face a cliff edge – under the transitional provisions they may only be able to service existing contracts, not take on new UK customers, and ultimately must wind down UK-facing activity before the regime commences in full.
What Are the Regulated Cryptoasset Activities?
The Regulations bring five categories of activity within the FCA’s perimeter. If your business carries on any of the following and has UK customers, you are likely in scope:
- Operating a cryptoasset trading platform or exchange
- Dealing in cryptoassets as principal or agent, or arranging cryptoasset deals
- Providing cryptoasset custody (safeguarding assets or private keys on behalf of clients)
- Issuing a qualifying stablecoin
- Arranging or providing crypto lending, yield or staking services
Acting purely as an intermediary or broker introducing UK clients to crypto products can also bring a business within scope. If you are still working out whether your specific model is caught, our plain-English breakdown – Do You Need FCA Authorisation for Your Crypto Business? – goes activity-by-activity in more depth.
Who Needs FCA Authorisation?
The scope is wider than most founders assume. You are likely affected if you:
- Operate any exchange, trading desk or matching engine for cryptoassets
- Hold client cryptoassets in custody, even as a secondary or incidental service
- Issue or redeem a stablecoin that UK consumers can access
- Offer crypto lending, yield products or staking, whether directly or via a partner
- Market or intermediate crypto products to UK consumers, including via UK-facing marketing or apps
- Operate a DeFi front-end or interface where there is an identifiable company or operator behind it and UK users can access it
Genuinely decentralised protocols with no central operator generally fall outside the perimeter, but very few consumer-facing products meet that bar in practice — most have a company, foundation or development team standing behind the interface. This applies equally to businesses based outside the UK: if you are based in the UAE, the US or elsewhere but knowingly serve UK clients, UK crypto regulation can still apply to you. Our dedicated guide for UAE crypto businesses serving UK clients covers this cross-border position in detail.
Existing MLR-Registered and FSMA-Authorised Firms
Two groups of firms often assume, incorrectly, that they are already covered:
Firms already registered under the Money Laundering Regulations
If your business is registered with the FCA under the MLRs as a cryptoasset business, that registration does not automatically convert into FSMA authorisation. You must still apply through the gateway. Your MLR compliance history can support your application, but it is not a substitute for it.
Firms already FSMA-authorised for other activities
If you already hold FCA authorisation for other regulated activities (for example, payment services or e-money issuance) and want to add a cryptoasset activity, you will typically need to apply for a Variation of Permission (VoP) rather than a fresh authorisation but the underlying standards you need to meet are the same.
What Does FCA Authorisation Actually Involve?
The FCA is applying its existing financial services authorisation standards to crypto firms. In practice, this means demonstrating:
- Fitness and propriety of senior managers, directors and controllers
- Adequate financial resources, with capital requirements varying by activity
- Robust AML/KYC systems and controls
- Operational resilience – documented plans for outages, cyber incidents and third-party failures
- Consumer protection measures, including fair treatment and clear client disclosures
- Compliance with the Senior Managers and Certification Regime (SM&CR)
For a firm that has never been through FCA authorisation before, this is a substantial undertaking. Policies, governance frameworks, financial projections and SM&CR mapping typically take months to prepare to the standard the FCA expects, starting early is not optional if you want to be ready within the application window.
Market Abuse and Financial Promotions for Cryptoassets
Alongside authorisation, the regime introduces a market abuse framework for qualifying cryptoassets, covering insider dealing, market manipulation and unlawful disclosure, mirroring the rules that already apply to listed securities. The financial promotions regime for crypto, in force since 2023, continues to apply and has tightened over time. Any business approving or communicating crypto-related financial promotions to UK consumers needs to do so through a properly authorised route, or risk enforcement action regardless of where the firm is based.
Cryptoasset Taxation Alongside Regulation
Regulatory authorisation and tax treatment are separate but connected issues — HMRC’s approach to cryptoassets has continued to evolve alongside the FCA’s regime, and getting the structuring wrong on one side often creates problems on the other. We cover the detail in Cryptoasset Tax Changes, and businesses operating lending or staking products in particular should also read our comparative analysis of how crypto lending and yield products are regulated across the UK, EU, US and Australia, since the UK’s approach is converging with — but not identical to — its major counterparts.
Don’t Overlook Succession: Crypto, Wills and Trusts
Regulation focuses on how a business operates, but individual founders, directors and high-net-worth holders also need to think about what happens to their own cryptoassets on death or incapacity. English law increasingly treats cryptoassets as property capable of being held on trust or passed under a will, but only if access, custody and tax are planned for properly. See Crypto in Your Estate: Why Your Cryptocurrency Needs to Be in Your Will, What Happens To Crypto When You Die, and Can You Put Digital Assets in a Trust? for a fuller picture, or speak to our Estate Planning, Wills & Probate team directly.
Stablecoins, Custody and Central Bank Digital Currencies
Stablecoin issuance and custody carry some of the most detailed requirements in the new regime, reflecting concerns about consumer money being held safely. Our earlier deep dive, UK’s FCA Update: Stablecoins & Crypto Custody, remains useful background, as does our explainer on CBDCs: The Future of Money or a Privacy Nightmare? for businesses thinking about how a Bank of England digital pound could interact with their own products.
How to Prepare for FCA Authorisation: A Step-by-Step Approach
There is a sensible order of operations for any crypto business that wants to keep trading lawfully in the UK once the regime takes full effect:
- Assess whether you are in scope – a proper legal review of your business model, not a guess
- Identify precisely which regulated activities you carry on, since requirements differ by activity
- Map your existing AML/KYC framework against the new perimeter and close any gaps
- Build your governance structure: policies, procedures, SM&CR mapping and financial projections
- Take pre-application support from the FCA where available, to de-risk your submission
- Submit your application within the gateway window to secure transitional protection
- Keep monitoring FCA guidance – DeFi, operational resilience and financial crime guidance are all still developing
Businesses that treat this as a compliance project starting now, rather than a form-filling exercise starting close to a deadline, are consistently the ones that get through the gateway smoothly.
Common Mistakes Crypto Businesses Make
- Assuming an existing MLR registration will automatically carry over – it will not
- Treating the application as a document exercise rather than a genuine change to how the business is governed and resourced
- Overlooking cross-border exposure, particularly where an overseas platform knowingly serves UK customers
- Leaving succession planning for founders and key holders until after the corporate structuring is done
- Waiting for the deadline to approach before starting preparation, when authorisation timelines are measured in months, not weeks
For guidance on crypto regulation, call our team on +44 (0)20 3588 3500, or press the Enquire button at the top of this page and we will call you back.
Frequently Asked Questions / Questions & Answers
Is cryptocurrency regulated in the UK?
Yes. UK crypto regulation now covers trading platforms, custody, stablecoin issuance, lending and staking, and broking or intermediary activity, all brought within the FSMA authorisation perimeter by the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026.
Do I need FCA authorisation to run a crypto exchange in the UK?
If your platform operates a trading venue, matching engine or dealing desk accessible to UK customers, you will need FCA authorisation for that activity, or you will need to exit the UK market before the regime commences.
What happens if I don’t apply for FCA authorisation in time?
Firms that miss the application window lose the benefit of transitional protection. In practice, this means being unable to take on new UK customers and, ultimately, having to wind down UK-facing activity before the full regime takes effect.
Does my existing MLR registration cover me under the new regime?
No. MLR registration does not automatically transfer into FSMA authorisation. You must submit a separate application, although your compliance history under the MLRs can support that application.
Are decentralised finance (DeFi) protocols regulated?
Genuinely decentralised protocols with no identifiable operator generally fall outside the regime for now, and the FCA has signalled further DeFi-specific guidance is coming. Where there is a company or team operating the interface UK users interact with, that business is very likely in scope.
Do overseas crypto businesses need to worry about UK regulation?
Yes, if you knowingly market to or onboard UK-based clients. Location outside the UK does not, by itself, put you outside the perimeter — see our guide for UAE crypto businesses serving UK clients for a worked example.
How Saracens Solicitors Can Help
Saracens Solicitors is a full-service law firm based at Thanet House on the Strand in London, advising a national and international client base. Our Blockchain, Crypto & Digital Assets team works alongside our Corporate Law, Banking & Finance and Corporate Crime & Risks teams to support crypto businesses end to end — from scoping whether you are caught by the new regime, through governance and AML documentation, to the authorisation application itself and, where relevant, succession planning for founders and key holders.
Whether you are a start-up building a crypto product, an established exchange securing your UK licence, or an overseas business assessing UK exposure, contact us on +44 (0)20 3588 3500 or via our Blockchain, Crypto & Digital Assets page for a confidential consultation.
