TRW & Co · Financial services regulation
UK Cryptoasset Regulation: The New Regime Explained
Cryptoasset regulation UK firms face is changing fundamentally. The Cryptoassets Regulations 2026 bring exchanges, custodians, brokers, staking providers and stablecoin issuers into FCA authorisation from 25 October 2027. The application window runs from 30 September 2026 to 28 February 2027. This guide explains the new activities, transitional arrangements, overseas access and the existing promotion and AML rules.
Key pointExisting crypto businesses must apply between 30 September 2026 and 28 February 2027 to benefit from transitional arrangements; firms that miss the window may have to stop serving UK customers from 25 October 2027.
At a glance
Regulations made February 2026
The FSMA 2000 (Cryptoassets) Regulations 2026 were made on 4 February 2026 and come fully into force on 25 October 2027.
Gateway open until February
The FCA application window opened on 30 September 2026 and closes on 28 February 2027, with transitional protection for firms applying in time.
Six core activities
Stablecoin issuance, safeguarding, operating a trading platform, dealing as principal or agent, arranging deals and arranging staking become regulated activities.
Promotions rules since 2023
Since 8 October 2023 all firms promoting cryptoassets to UK consumers, including overseas firms, must use a lawful route and follow FCA rules.
Further changes pending
Amending regulations laid in September 2026 and a July 2026 payments consultation will refine stablecoin treatment. Final perimeter guidance is targeted for early 2027.
Swipe or scroll →
The short answer: the new cryptoasset regulation UK regime
Cryptoasset regulation UK-wide is moving from a light-touch anti-money laundering registration model to full authorisation under the Financial Services and Markets Act 2000 (FSMA). The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 were made on 4 February 2026 and come fully into force on 25 October 2027. From that date, firms carrying on the new cryptoasset activities in or to the UK will need FCA authorisation.
The application window is already open. The FCA's gateway opened on 30 September 2026 and closes on 28 February 2027. Firms that apply within the window and are still awaiting a decision at commencement can generally continue operating under transitional arrangements; firms that miss it risk having to stop.
Two existing regimes continue to matter until then and beyond: the cryptoasset financial promotions rules, in force since October 2023, and registration under the Money Laundering Regulations 2017 (MLRs). As of October 2026, amending regulations and further FCA guidance are still in progress.
The new regulated activities
The 2026 Regulations add a new chapter on cryptoassets to the Regulated Activities Order. The FCA's final perimeter guidance, published in September 2026 as a new chapter of its Perimeter Guidance Manual (PERG 18), describes the activities as:
- Issuing qualifying stablecoin in the UK.
- Safeguarding, and arranging safeguarding of, qualifying cryptoassets and certain specified investment cryptoassets (custody).
- Operating a qualifying cryptoasset trading platform, such as an exchange.
- Dealing in qualifying cryptoassets as principal or as agent.
- Arranging deals in qualifying cryptoassets.
- Arranging qualifying cryptoasset staking.
Lending and borrowing are not separate activities, but lending and borrowing transactions may fall within dealing, arranging or safeguarding. Advising on and managing cryptoassets are not new cryptoasset activities in themselves, though existing investment activities may apply to some tokens that are already specified investments.
The Regulations also create an admissions and disclosures regime for cryptoassets offered to the public or admitted to trading platforms, and a market abuse regime covering insider dealing, unlawful disclosure and market manipulation in qualifying cryptoassets. These obligations apply to issuers, platforms and other market participants, not only to authorised firms.
How the cryptoasset regulation UK framework fits together
The new regime sits alongside existing rules rather than replacing all of them at once. The table summarises the main layers as of October 2026.
| Regime | Legal basis | Who it applies to | Status |
|---|---|---|---|
| AML registration | Money Laundering Regulations 2017 | Cryptoasset exchange providers and custodian wallet providers | In force; amended so that it interacts with the new FSMA regime |
| Financial promotions | FSMA section 21 and the Financial Promotion Order; FCA rules | Anyone communicating cryptoasset promotions to UK consumers, including overseas firms | In force since 8 October 2023 |
| FSMA authorisation for cryptoasset activities | Cryptoassets Regulations 2026 and FCA rules | Firms carrying on the new regulated activities in or to the UK | Applications open; full commencement 25 October 2027 |
| Admissions, disclosures and market abuse | Cryptoassets Regulations 2026 and FCA rules | Issuers, offerors, trading platforms and market participants | Commences with the regime |
| Payments and stablecoins | Proposed reform of payments regulation | Stablecoins used in payment chains | HM Treasury consultation, July 2026 |
The FCA published its final rules and guidance for the regime on 30 June 2026. They apply to firms granted permission on or after 25 October 2027 and cover conduct, prudential requirements, custody, trading platforms, staking, lending and borrowing, governance and consumer protection, including application of the Consumer Duty.
The authorisation gateway and transitional arrangements
The Regulations required the FCA to set an application period at least a year before commencement. It has done so: applications for authorisation or variation of permission should be made between 30 September 2026 and 28 February 2027 through the Connect system. The FCA's page on what firms need to do warns that applying outside the window, or submitting a poor-quality application, may leave a firm unable to continue its cryptoasset activities when the regime starts.
The Regulations contain savings and transitional provisions for firms that apply within the window. In broad terms, where an application has been made during the relevant period and has not been determined by commencement, or has been refused but remains open to review, the firm can continue the relevant activity while the process concludes, subject to conditions and FCA directions. Firms that do not apply in time do not get that protection.
- Map activities to the new perimeter. Use PERG 18 to decide which of the new activities you carry on, and whether you carry them on in the UK.
- Decide the legal entity. Choose whether to apply through an existing UK entity, a new UK subsidiary or, where permitted, a branch.
- Close the gap from MLR registration. Assess what is needed beyond your current AML controls: conduct rules, prudential resources, custody, governance and senior manager approvals.
- Prepare the application. Draft a specific business plan, financial projections, wind-down plan, and policies, and nominate senior managers for approval.
- Submit within the window. Apply between 30 September 2026 and 28 February 2027 to benefit from the transitional arrangements.
- Respond and implement. Answer FCA questions promptly and implement the final rules ahead of 25 October 2027.
The process follows the general FSMA authorisation model described in our guide to the FCA authorisation process, including the threshold conditions and senior manager approvals.
The 28 February 2027 deadline is the one that matters most for existing businesses. An incomplete application submitted in time is generally better protected than a perfect one submitted late, but a weak application risks refusal. Start now and plan for FCA questions during the first half of 2027.
Overseas firms and access to UK customers
The regime is designed to capture firms providing cryptoasset services in or to the UK, including firms based overseas that serve UK customers. Whether an overseas firm needs authorisation depends on where the activity is carried on and on the exclusions available. PERG 18 addresses the overseas persons exclusion, reverse solicitation, and how a group's structure affects whether an activity is carried on in the UK. The FCA has also issued separate guidance on third-country firms operating trading platforms for UK users.
For overseas exchanges and brokers, the practical choice is usually between establishing a UK authorised entity and withdrawing from active service to UK customers. Reverse solicitation is narrow and should not be relied on for a business model that actively markets to UK users. Even where no authorisation is needed, the financial promotion rules apply to promotions communicated to UK consumers, wherever the firm is based.
Existing rules: financial promotions and AML registration
Financial promotions
Since 8 October 2023, all firms marketing cryptoassets to UK consumers, including overseas firms, must use a lawful route: communication by an FCA-authorised person, approval by an authorised person with the necessary permission, communication by a cryptoasset business registered under the MLRs, or an exemption in the Financial Promotion Order. Promotions outside these routes breach section 21 of FSMA, a criminal offence. FCA rules require risk warnings, a cooling-off period for first-time investors, appropriateness assessments and a ban on incentives to invest. Our article on the financial promotions regime covers the approval gateway in more detail.
AML registration under the MLRs
Cryptoasset exchange providers and custodian wallet providers must currently register with the FCA under the MLRs before carrying on business in the UK. The FCA has long reported a high rate of rejected or withdrawn registration applications, reflecting weak AML controls. The 2026 Regulations amend the MLRs so that the registration regime interacts with the new authorisation regime, while AML obligations themselves continue. Our Money Laundering Regulations guide explains the core obligations.
Stablecoins and further changes still to come
Issuing a qualifying stablecoin in the UK becomes a regulated activity, with FCA rules on backing assets, redemption and disclosure. Stablecoins that become widely used in payments may also fall under Bank of England oversight as systemic arrangements. Our article on stablecoin regulation in the UK covers this in detail.
As of October 2026, further legislation is pending. The Financial Services and Markets Act 2000 (Cryptoassets) (Miscellaneous Amendments) Regulations 2026 were laid before Parliament in September 2026 but have not yet been made. They would, among other things, exclude UK-issued qualifying stablecoin from the dealing and arranging activities to avoid overlap with a reformed payments framework, and make related changes to the Financial Promotion Order. HM Treasury's July 2026 consultation on modernising payment services regulation proposes bringing certain stablecoins into the payments perimeter. The FCA has said it plans to consult on corresponding perimeter guidance changes, with final guidance targeted for early 2027.
Risks and common mistakes
Assuming MLR registration is enough
MLR registration tests anti-money laundering systems. FSMA authorisation tests the whole firm: governance, conduct, prudential resources, custody arrangements, operational resilience, consumer protection and the fitness of senior managers. The FCA has said existing AML systems will help, but firms must assess what else is needed. Treating the new application as an upgrade of the old registration usually underestimates the work, particularly for custody and client asset protection, which are central to the new rules.
Missing the application window
Firms that apply after 28 February 2027 will not benefit from the transitional arrangements, and the FCA may not decide their application before 25 October 2027. They may have to stop serving UK customers from that date until authorised. Submitting a rushed application to beat the deadline also carries risk, because the FCA has warned that poor-quality applications may be refused. Firms should plan to submit well before the deadline, leaving time to respond to questions.
Misjudging the UK perimeter for overseas operations
Overseas groups often assume that a non-UK entity can continue serving UK users relying on reverse solicitation or the overseas persons exclusion. These are narrow, fact-specific exceptions. Active marketing, UK-targeted apps and UK-language promotions are likely to undermine them. Groups should review customer onboarding, marketing and contracting entities against PERG 18 and decide on a UK structure before the window closes.
Non-compliant promotions during the transition
Firms preparing for authorisation sometimes increase marketing to build a UK customer base. Every promotion to UK consumers must follow a lawful route and comply with the FCA's rules on risk warnings, cooling-off and incentives. Influencer campaigns, referral bonuses and social media posts are frequent problems. The FCA actively issues alerts against non-compliant promotions, and a breach can undermine a pending authorisation application.
Illustrative scenario: an MLR-registered exchange preparing to apply
This scenario is illustrative only and does not describe any real firm.
A UK company registered under the MLRs runs a retail exchange and custody wallet for UK customers. Its parent, based outside the UK, provides liquidity and holds most private keys. Under the current cryptoasset regulation UK model, the UK company's main obligations are AML compliance and financial promotion rules.
Mapping the business against PERG 18 shows that the UK company will need permissions for operating a trading platform, dealing, arranging and safeguarding. The parent's role raises further questions: if it holds keys for UK customers or deals with them directly, it may be carrying on regulated activities in the UK itself.
The group decides to move key management for UK customers into the UK entity, restructure liquidity provision under a documented intra-group agreement, and appoint UK-based senior managers with crypto and markets experience. It updates its wind-down plan to show how customer assets would be returned if the UK company failed, and reviews its marketing so that referral bonuses are removed.
The application is submitted in December 2026, leaving time for FCA questions before the window closes. The cost is a more substantial UK operation than the group originally planned, but the alternative, relying on the parent to serve UK customers from abroad, would have carried far greater perimeter risk once the cryptoasset regulation UK regime begins.
Cross-border considerations
Many UK-facing crypto businesses are groups with operations in the EU under MiCA, the Gulf, Singapore or elsewhere. The UK regime is different in design and timing, so authorisation elsewhere does not carry over. Groups should map which entity contracts with UK customers, where assets are held, and whether intra-group arrangements such as liquidity provision or custody amount to regulated activities in the UK. For businesses with founders or operations in Bangladesh, where crypto activity faces significant restrictions, structuring and source-of-funds evidence need early attention.
What to do next
As of October 2026, the priority for firms in scope of the cryptoasset regulation UK regime is the application window. A practical checklist:
- Map current and planned activities against the new perimeter and PERG 18.
- Decide the UK legal entity and whether overseas operations must change.
- Complete a gap analysis against the final FCA rules published in June 2026.
- Nominate and prepare senior managers for approval.
- Prepare capital, custody, wind-down and Consumer Duty arrangements.
- Submit the application before 28 February 2027.
- Keep financial promotions and MLR compliance tight in the meantime.
- Track the amending regulations and HM Treasury's payments reforms.
TRW & Co's London office is authorised and regulated by the Solicitors Regulation Authority. Our cryptoassets team advises on perimeter analysis, authorisation applications, financial promotions and AML, working with our fintech and anti-money laundering teams. To discuss your firm's position under the new cryptoasset regulation UK regime, contact us at info@trw.co.
Frequently asked questions
01When does the new UK cryptoasset regime start?
The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 come fully into force on 25 October 2027. Some provisions came into force earlier, 21 days after the Regulations were made on 4 February 2026, so the FCA could make rules and accept applications. The FCA published final rules in June 2026 and its application window runs from 30 September 2026 to 28 February 2027. From commencement, firms carrying on the new activities in or to the UK must be authorised or benefit from the transitional arrangements.
02What happens to firms registered under the Money Laundering Regulations?
MLR-registered cryptoasset firms must apply for FSMA authorisation, or a variation of permission if already authorised, if they want to continue the new regulated activities after 25 October 2027. The FCA has said their existing systems and controls will help but will not be enough on their own: they must also meet conduct, prudential, custody and governance requirements. The 2026 Regulations amend the MLRs so the registration regime interacts with the new authorisation regime, while AML obligations continue to apply.
03Do overseas crypto exchanges need FCA authorisation?
If they carry on the new regulated activities in the UK or with UK customers and no exclusion applies, generally yes. The FCA's perimeter guidance in PERG 18 explains the overseas persons exclusion, reverse solicitation and how group structure affects whether activities are carried on in the UK. These exceptions are narrow. Many overseas exchanges will need a UK authorised entity or will have to stop actively serving UK customers. Financial promotion rules apply to UK-directed marketing regardless.
04What if we miss the 28 February 2027 deadline?
The FCA can still accept applications outside the window, but firms that apply late do not benefit from the transitional arrangements that allow in-time applicants to continue operating while their applications are decided. If a late application has not been granted by 25 October 2027, the firm may have to stop carrying on the relevant activities in the UK. The FCA has also warned that poor-quality applications may be refused, so quality matters as well as timing.
05Are stablecoins covered by the new regime?
Yes. Issuing a qualifying stablecoin in the UK becomes a regulated activity, and dealing, arranging and custody activities can involve stablecoins. Amending regulations laid in September 2026, not yet made, would exclude UK-issued qualifying stablecoin from the dealing and arranging activities to avoid overlap with a reformed payments framework. HM Treasury's July 2026 consultation proposes bringing certain stablecoins into payments regulation, and systemic stablecoins may also be subject to Bank of England oversight.
06Can unregulated firms still promote crypto to UK consumers?
Only through a lawful route. Since 8 October 2023, a cryptoasset promotion to UK consumers must be communicated by an FCA-authorised person, approved by an authorised person with the necessary permission, communicated by an MLR-registered cryptoasset business, or fall within an exemption in the Financial Promotion Order. Promotions outside these routes breach section 21 of FSMA, a criminal offence. FCA rules on risk warnings, cooling-off periods, appropriateness and incentives also apply.
Sources and official materials
- The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 — SI 2026/102, made 4 February 2026
- FCA: A new regime for cryptoasset regulation — Commencement, final rules and regime design
- FCA: What you need to do when preparing for the new regime — Application window and preparation steps
- FCA: Cryptoasset firms marketing to UK consumers — Financial promotion routes and rules
- HM Treasury: Modernising payment services regulation — July 2026 consultation including stablecoins in payments
General information only, current as at 21 October 2026. It is not legal advice and does not create a solicitor–client relationship. It reflects the law of England and Wales unless stated otherwise; Scotland and Northern Ireland have separate legal systems, and the law changes frequently. Check current official sources and take advice on the facts of your matter.