It is a fair question. The new UK cryptoasset regulatory framework, brought in by the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, is comprehensive. But not every business that touches crypto falls within it. And conversely, some businesses that don’t think of themselves as “crypto companies” very much do.
This guide cuts through the legal language to give you a clear picture of where you stand.
The Core Test: Regulated Activities
The new regime creates a list of specific “regulated cryptoasset activities.” If your business carries out any of these activities in the UK, or carries them out elsewhere for UK customers, you will generally need to be FCA-authorised (or qualify for an exemption).
The regulated activities are:
Operating a crypto trading platform — running a venue where buyers and sellers can trade cryptoassets. This includes centralised exchanges, OTC desks and peer-to-peer platforms.
Crypto custody — holding cryptoassets on behalf of clients, or controlling the means by which clients can access their assets. This catches custodial wallets, custody services offered as part of a wider product, and institutional custody.
Stablecoin issuance — offering, redeeming, or maintaining the value of a stablecoin, or arranging for another party to do so from a UK establishment.
Crypto intermediation — acting as an intermediary between buyers and sellers of cryptoassets, including brokers and dealers.
Crypto lending and staking — lending clients’ cryptoassets or operating staking services on their behalf. (Note: staking your own assets is not regulated.)
Arranging deals in cryptoassets — facilitating transactions in cryptoassets as a business, even if you don’t hold assets yourself.
Who Is Exempt?
Some activities and entities fall outside the scope of the new regime:
-
Individual investors trading their own crypto for personal investment — not regulated
-
Genuinely decentralised protocols with no identifiable central operator — not regulated, though this is a complex analysis
-
Tokenised versions of existing regulated investments (such as tokenised shares or bonds) — these are regulated as the underlying investment, not as cryptoassets
-
Mining operations — not a regulated activity in itself
-
NFT platforms — most NFTs fall outside the definition of “qualifying cryptoasset,” though the position depends on the specific characteristics of the token
The boundaries here are not always clear-cut, which is precisely why legal advice at an early stage is critical. The list is not exhaustive and obtaining a legal opinion of your particular activity is recommended.
The Territorial Question
One of the most important aspects of the new regime is how it applies to firms based outside the UK. In broad terms, if your business is serving UK customers — even from a foreign jurisdiction — you may still fall within the UK regulatory perimeter. The FCA takes a purposive approach: if UK consumers are using your platform, the fact that your servers are in another country will not, on its own, take you outside the scope of UK regulation.
This is a significant consideration for crypto businesses based in the EU, US, or further afield that have UK users.
What Happens If You Carry On Activities Without Authorisation?
This is where the stakes become very serious. Under FSMA, carrying on a regulated activity in the UK without authorisation (or exemption) is a criminal offence. It can result in:
-
Prosecution and potentially imprisonment
-
Unlimited financial penalties
-
All agreements entered into in breach of the restriction being unenforceable — meaning you cannot recover money owed to you under those contracts
-
FCA enforcement action and public censure
The FCA has demonstrated clearly that it will pursue enforcement action against unauthorised crypto firms. This is not an area where it is safe to take a “wait and see” approach.
The Transition Window: Your Safety Net — But Only If You Use It
The FCA application gateway opens on 30 September 2026 and closes on 28 February 2027. Firms that submit a complete application within this window can continue to operate during the assessment period — this is known as the “saving provision.” Once the new regime goes live in October 2027, only authorised firms will be able to operate.
The window is six months. The preparation required for a solid application takes considerably longer than that.
Getting the Answer Right
The honest truth is that many businesses sit in a grey area — their activities don’t map neatly onto the list of regulated activities, or they involve a combination of regulated and unregulated elements. The right answer requires a careful analysis of what your business actually does, who your customers are, and how the FCA is likely to view your model.
At Saracens Solicitors, we carry out regulatory scoping reviews for crypto businesses at exactly this stage — helping founders and boards understand where they stand before they invest in building out a compliance function or, worse, before they receive a letter from the FCA.
If you are asking yourself whether this applies to your business, the answer is: let’s find out properly. Call us on 020 3588 3500 or send us an enquiry to arrange a confidential consultation with our digital assets team.
This blog is for general information only and does not constitute legal advice.
