TRW & Co · Funds & Financial Services
Crypto and Digital Asset Lawyers in London
Crypto lawyers London businesses instruct now face a full FCA authorisation regime. The application window opened on 30 September 2026 and closes on 28 February 2027, with the new rules taking effect on 25 October 2027. Exchanges, custodians, brokers, stablecoin issuers and staking providers must decide now whether to apply, restructure or exit.
Key pointMLR registration is not FSMA authorisation: registered firms that do not apply within the window lose the transitional protections and must wind down UK business before 25 October 2027.
At a glance
New regime go-live
The FCA's full cryptoasset regime under the Cryptoassets Regulations 2026 takes effect on 25 October 2027, bringing trading, custody, dealing, staking and stablecoin issuance within FSMA.
Application window
Firms must apply between 30 September 2026 and 28 February 2027 to continue operating while the FCA assesses their applications after go-live.
Promotions already regulated
Since 8 October 2023, crypto promotions to UK consumers must use a permitted route under section 21 FSMA, with risk warnings and cooling-off periods.
Property law confirmed
The Property (Digital Assets etc) Act 2025, which received Royal Assent on 2 December 2025, confirms digital assets can attract personal property rights.
Tax reporting
UK-based reporting cryptoasset service providers must collect user data from 1 January 2026, with first Cryptoasset Reporting Framework reports due by 31 May 2027.
Swipe or scroll →
What cryptoasset law covers in England and Wales
Crypto lawyers London businesses instruct now work in a market that is moving from light-touch registration to full financial services regulation. Exchanges, brokers, custodians, stablecoin issuers, staking providers, token issuers and the investors and banks that deal with them all face new permissions, conduct rules and prudential requirements. The questions are no longer only about anti-money laundering; they are about authorisation, market abuse, custody and property rights.
Cryptoasset law in England and Wales covers four broad areas. First, the regulatory perimeter: whether an activity needs FCA registration or authorisation. Second, marketing: the financial promotion rules that already apply to qualifying cryptoassets. Third, private law: who owns a token, how it can be secured or transferred, and what happens on insolvency. Fourth, disputes and recovery, including fraud, hacks and contractual claims against platforms.
Because the regime is changing in stages, the right advice depends on timing. Crypto lawyers London firms work with should be able to tell you which rules apply today, which apply from the regime's go-live date, and what you must do in the application window in between.
The answer also depends on who you are. A trading platform, a custodian and a token issuer each face different permissions. A bank adding crypto custody faces different questions again, as does an investor whose assets are frozen on a failed platform. Crypto lawyers London clients rely on should start by identifying the activity and the customer, then work through regulation, contracts and property law in that order.
The framework that applies today
Three sets of rules already apply to cryptoasset businesses operating in or into the UK.
Money laundering registration
The FCA has been the anti-money laundering supervisor for cryptoasset exchange providers and custodian wallet providers since January 2020. Firms carrying on those activities in the UK must be registered with the FCA under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. Registration requires a fit and proper assessment of owners and managers and a credible financial crime framework. The regulations also include the travel rule, which requires information about the originator and beneficiary to accompany cryptoasset transfers.
Financial promotions
Since 8 October 2023, qualifying cryptoassets have been within the financial promotion restriction in section 21 of the Financial Services and Markets Act 2000. A promotion to UK consumers must be communicated by an authorised person, approved by an authorised person with the right permission, communicated by an FCA-registered cryptoasset business, or fall within an exemption. FCA rules require prominent risk warnings, a cooling-off period for first-time investors and an appropriateness assessment. Breach is a criminal offence, and it applies to overseas firms marketing into the UK.
Private law and tax
The Property (Digital Assets etc) Act 2025, which received Royal Assent on 2 December 2025, confirms that a thing is not prevented from being the object of personal property rights merely because it is neither a thing in possession nor a thing in action. That supports proprietary claims, tracing and security over digital assets, while leaving the courts to develop the detail. For tax, HMRC requires UK-based reporting cryptoasset service providers to collect user and transaction data from 1 January 2026 under the Cryptoasset Reporting Framework, with first reports due by 31 May 2027.
The new FCA cryptoasset regime
The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 bring cryptoasset activities within FSMA authorisation. The FCA published final rules and guidance on 30 June 2026 in a series of policy statements, summarised on its cryptoasset regime page. The full regime takes effect on 25 October 2027.
| Activity | Typical business | Key requirements |
|---|---|---|
| Operating a qualifying cryptoasset trading platform | Exchanges and multilateral venues | Admission and disclosure rules, market abuse controls, conflicts and fair access |
| Dealing as principal or agent; arranging deals | Brokers, OTC desks, apps routing orders | Best execution, client order handling, conduct rules and the Consumer Duty |
| Safeguarding qualifying cryptoassets | Custodians and wallet providers | New client asset rules for custody, segregation and reconciliation |
| Issuing qualifying stablecoins in the UK | Fiat-referenced token issuers | Full backing, redemption at par, statutory trust over backing assets |
| Staking; lending and borrowing | Staking services and crypto lending platforms | Disclosure, risk controls and consumer protections |
The regime also introduces an admissions and disclosures framework and a market abuse regime for cryptoassets, plus a prudential regime. Decentralised finance arrangements can be in scope where there is an identifiable controlling person. Systemic stablecoins will also be supervised by the Bank of England.
Firms that do not apply in the window and are not authorised by go-live must have wound down their UK business. Crypto lawyers London firms rely on should be planning that decision now, not in 2027.
The application window
The FCA's application window opened on 30 September 2026 and closes on 28 February 2027. Firms that apply within it can continue existing activities after 25 October 2027 while their applications are determined. Late applicants have no expedited processing and, if not authorised by go-live, can only service existing contracts. Firms that do not apply must exit; continuing would breach the general prohibition in section 19 FSMA. Our pages on the new UK cryptoasset regime and stablecoin regulation give more detail.
How to prepare for authorisation
- Map activities to the new permissions. We analyse each product line against the new regulated activities, including staking, lending and custody, and identify which permissions to seek.
- Choose the entity and location. We advise whether to apply through an existing UK entity, a new subsidiary or, for overseas groups, a UK establishment, and how that interacts with your EU and other licences.
- Build the regulatory business plan. We prepare the business plan, financial projections, capital and liquidity assessments under the new prudential rules, and a wind-down plan.
- Design governance and senior management. We map senior manager functions, board composition and committees, and prepare the individuals for FCA scrutiny.
- Prepare policies and controls. We draft custody, conflicts, market abuse surveillance, financial crime and Consumer Duty frameworks that reflect how the business actually operates.
- Submit within the window and manage the review. We file the application before 28 February 2027 and respond to FCA questions during assessment.
- Transition customers and contracts. We update terms, disclosures and promotions so that they comply from 25 October 2027.
Our FCA authorisation team works alongside our crypto lawyers on every application.
Documents and evidence to assemble
The FCA's registration experience shows that weak applications fail on evidence rather than intent. Assemble these early:
- A complete corporate structure chart showing ultimate beneficial owners, controllers and group entities in every jurisdiction.
- Source of wealth and source of funds evidence for controllers, and CVs and references for proposed senior managers.
- A business-wide money laundering risk assessment covering products, customers, geographies and delivery channels, including blockchain analytics tools and travel rule procedures.
- Custody arrangements: wallet architecture, key management, segregation and reconciliation procedures and any sub-custodian contracts.
- Token admission policies and disclosure documents for each cryptoasset traded.
- Market abuse surveillance tools and escalation procedures.
- Capital and liquidity models under the new prudential rules, with stress testing and a wind-down plan.
- Customer terms, risk warnings, appropriateness tests and Consumer Duty outcomes monitoring.
Many firms find that their current MLR registration documents describe an earlier version of their business. Before applying, reconcile the documents with what your systems actually do. Gaps between the two are one of the quickest ways to lose the FCA's confidence.
Crypto disputes, fraud and asset recovery
The English courts have become a leading forum for cryptoasset fraud and insolvency claims. Courts have granted freezing injunctions over digital assets, disclosure orders against exchanges to identify the holders of wallets, and injunctions against persons unknown. Permission to serve proceedings by alternative means, including electronically, has been granted in suitable cases. The 2025 Act now supports those proprietary claims on a statutory footing.
Speed is critical. Funds moved through mixers or across chains become harder to trace by the hour. A typical response combines blockchain analytics, an urgent application for a proprietary injunction or freezing order, and information orders against exchanges where the assets surface. Our civil fraud and asset recovery team acts in these cases and, where advocacy in the higher courts is required, we instruct specialist counsel.
Disputes also arise between investors and platforms over suspended withdrawals, liquidations, staking losses and token sales. The answer often turns on the platform's terms, the governing law and jurisdiction clause, and whether the assets were held on trust for customers or became part of the platform's estate. Crypto lawyers London investors instruct should review those terms before depositing large sums.
Transactions, institutions and tokenisation
Crypto work is no longer confined to crypto-native firms. Banks, asset managers, payment firms and corporates are buying crypto businesses, launching custody or trading services, holding digital assets on balance sheet and tokenising traditional instruments. Each raises its own legal questions, and crypto lawyers London institutions instruct must combine financial regulation with corporate, finance and insolvency law.
Buying or investing in a crypto business
Acquiring control of an FCA-authorised firm requires prior approval of the change in control from the FCA, and completing without it is a criminal offence. For crypto targets, due diligence should cover the status of MLR registration, the readiness of any authorisation application, the quality of custody arrangements, historic promotions to UK consumers, sanctions exposure in transaction flows and any open FCA correspondence. Warranties and indemnities should be tailored to those risks, and conditionality should account for the application window and go-live date. Our M&A team handles the transaction mechanics.
Security and lending over digital assets
Lenders taking security over cryptoassets need to decide how control will be achieved in practice, typically through a custodian agreement, multi-signature arrangements or a control agreement with the borrower's platform. The 2025 Act supports the proprietary basis of such security, but enforcement depends on technical control and on the terms of the custody arrangements. Valuation volatility means margin calls and close-out rights must be precise.
Tokenisation of traditional assets
Tokenised funds, bonds and other securities usually remain within the existing securities and funds regimes rather than the new cryptoasset regime. Firms experimenting with distributed ledger settlement should consider the Bank of England and FCA's Digital Securities Sandbox and the existing rules on prospectuses, collective investment schemes and settlement.
Risks and common mistakes
Assuming MLR registration is enough for the new regime
Registration under the Money Laundering Regulations is not authorisation under FSMA. Registered firms that want to continue operating after 25 October 2027 must apply for authorisation for each relevant activity within the application window. The FCA will assess governance, prudential resources, conduct and client asset arrangements, not just financial crime controls. Firms should treat the application as a new and much more demanding exercise, and budget management time accordingly. Missing the window removes the benefit of the transitional provisions and may force a wind-down.
Marketing into the UK from overseas
The financial promotion restriction applies to communications capable of having an effect in the UK, wherever they originate. Overseas exchanges and token issuers that target UK users through websites, apps, social media or influencers without an authorised approver or registered status risk committing a criminal offence. The FCA publishes warnings about firms it believes are promoting without permission. Geo-blocking, UK-specific terms and clear marketing controls are essential for firms that are not yet permitted to promote to UK consumers.
Weak custody and segregation
Insolvencies of crypto platforms internationally have shown how much depends on whether customer assets were properly segregated and held on trust. Pooled wallets with poor records leave customers as unsecured creditors. The new FCA custody rules require segregation, reconciliation and clear records. Firms should review wallet architecture, key management and terms now, because changing them to meet the new rules can take months and may require customer consent.
Treating stablecoins as payments products
A UK-issued qualifying stablecoin will be regulated as a cryptoasset issuance activity, with requirements for full backing, redemption at par and a statutory trust over backing assets. Firms that assumed the e-money regime would apply, or that structured redemption around discretionary policies, will need to rework their models. Payment firms planning to use stablecoins for settlement should check how the new rules interact with their existing payments permissions.
Ignoring the tax reporting obligations
The Cryptoasset Reporting Framework applies separately from the FCA regime. UK-based reporting cryptoasset service providers have been required to collect user and transaction data since 1 January 2026. Firms that have not built the onboarding fields and record-keeping needed will struggle to report accurately by the first deadline. HMRC has published guidance on collecting cryptoasset user and transaction data.
Cross-border crypto: Bangladesh, the EU, the Gulf and Asia
Crypto businesses are international by default, and regulators increasingly expect local presence. Structuring decisions made for one market affect licensing elsewhere.
Bangladesh
Bangladesh Bank has repeatedly warned the public against dealing in virtual currencies, and foreign exchange controls restrict outbound payments. UK firms should not assume they can serve Bangladeshi residents, and families holding crypto across both countries need specific advice. See our UK–Bangladesh page.
European Union
The EU's Markets in Crypto-Assets Regulation applies a licensing regime for crypto-asset service providers. A UK authorisation does not passport into the EU, so groups serving both markets usually need separate licensed entities and policies mapped to each regime.
The Gulf
Dubai has a dedicated virtual assets regulator, and Abu Dhabi and Dubai's financial free zones have their own regimes. Many groups combine a Gulf entity with a UK one, with English-law contracts and London arbitration between them.
Singapore and China
Singapore licenses digital payment token services through the Monetary Authority of Singapore and has restricted firms serving only overseas customers. Mainland China prohibits most crypto trading activity, which affects any group with Chinese founders, developers or customers.
How TRW & Co's crypto lawyers London clients instruct can help
TRW & Co's London office is authorised and regulated by the Solicitors Regulation Authority. We act for crypto businesses, investors, financial institutions entering digital assets and individuals affected by crypto fraud.
Authorisation and registration
Perimeter analysis, MLR registration, and applications for FSMA authorisation in the application window, including business plans, governance and policies.
Promotions and products
Review of financial promotions, risk warnings, appropriateness tests and customer journeys, and advice on staking, lending and stablecoin products.
Transactions
Token issues, investment rounds, acquisitions of crypto businesses, change in control notifications and security over digital assets, working with our fintech team.
Disputes and recovery
Urgent injunctions, disclosure orders against exchanges, claims against platforms and insolvency-related claims for customers and creditors.
We do not promise authorisation outcomes, which are for the FCA, but we give a clear assessment of readiness and gaps. Browse our practices, read about our anti-money laundering work, or contact us at info@trw.co.
Checklist for crypto decision-makers
Use this checklist to test readiness. Crypto lawyers London boards rely on would expect clear answers to each point:
- Have we mapped every product to the new regulated activities and decided which permissions to seek?
- Will we apply between 30 September 2026 and 28 February 2027, and is the application on track?
- If we will not apply, do we have a compliant UK wind-down plan before 25 October 2027?
- Are all UK-facing promotions made or approved through a permitted route, with the required warnings and frictions?
- Do our custody arrangements segregate customer assets and keep records that would survive an insolvency?
- Do our MLR registration documents still describe the business accurately?
- Are we collecting the data needed for Cryptoasset Reporting Framework reports?
- Have we assessed our licensing position in the EU, the Gulf and Asia for every market we serve?
- Do we have an incident plan for hacks, including blockchain analytics support and urgent legal action?
Related pages: payments and e-money and financial services regulation.
Frequently asked questions
01Do we need FCA authorisation if we are already MLR-registered?
Yes, if you want to carry on the newly regulated activities after 25 October 2027. MLR registration covers anti-money laundering supervision only. The Cryptoassets Regulations 2026 bring trading platforms, dealing, arranging, custody, staking, lending and stablecoin issuance within FSMA authorisation. Registered firms must apply within the window, between 30 September 2026 and 28 February 2027, to benefit from the transitional provisions that let them keep operating while the FCA decides.
02What happens if we miss the application window?
The FCA has said it will not expedite late applications, so they may not be decided before 25 October 2027. A firm that is not authorised by then can only perform existing contracts, not enter new ones, while its application is pending. A firm that does not apply at all has no transitional protection and must wind down its UK cryptoasset business, because continuing would breach the general prohibition in section 19 FSMA.
03Can an overseas exchange market to UK customers?
Only through a permitted route. Since 8 October 2023, promotions of qualifying cryptoassets to UK consumers must be communicated by an authorised person, approved by a suitably permitted authorised person, communicated by an FCA-registered cryptoasset business, or fall within an exemption. The rules apply to communications capable of having an effect in the UK, wherever made. Overseas firms without a route should block UK users and avoid UK-targeted marketing until they have one.
04How will stablecoins be regulated?
Issuing a qualifying stablecoin in the UK will be a regulated activity from 25 October 2027. FCA rules require UK-issued qualifying stablecoins to be fully backed and redeemable at par, with backing assets held on a statutory trust. Stablecoins that become systemic will also be supervised by the Bank of England. Firms using stablecoins for payments should consider how the new rules interact with their payments permissions.
05Is cryptocurrency legally property in England?
Yes. English courts had already treated cryptoassets as property for many purposes, and the Property (Digital Assets etc) Act 2025 confirms that a thing is not prevented from attracting personal property rights merely because it is neither a thing in possession nor a thing in action. That supports proprietary injunctions, tracing, trust claims and security over digital assets, with the courts developing the detailed rules.
06What can we do if our crypto has been stolen?
Act quickly. Preserve evidence, record wallet addresses and transaction hashes, and instruct blockchain analysts to trace where the assets moved. English courts can grant freezing or proprietary injunctions, including against persons unknown, and disclosure orders requiring exchanges to identify account holders. Exchanges can often freeze accounts once served with an order. Delay allows assets to be dissipated through mixers and cross-chain transfers.
07What is the Cryptoasset Reporting Framework?
It is an international tax transparency standard implemented in the UK. UK-based reporting cryptoasset service providers have been required to collect information about users and their transactions since 1 January 2026, and must submit their first reports to HMRC by 31 May 2027. HMRC will exchange information with other participating tax authorities. It applies alongside, not instead of, the FCA regime.
Sources and official materials
- Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 — Statutory instrument creating the new regulated activities
- FCA: Cryptoasset regime policy statements — Final rules, guidance and key dates
- FCA: A new regime for cryptoasset regulation — FCA hub for the new regime and application process
- Property (Digital Assets etc) Act 2025 — Personal property rights in digital assets
- Money Laundering Regulations 2017 — Cryptoasset business registration and travel rule
- HMRC: Collecting cryptoasset user and transaction data — Cryptoasset Reporting Framework obligations
- FCA: Cryptoassets — AML supervision and financial promotions
General information only, current as at 21 October 2026. It is not legal advice and does not create a solicitor–client relationship. It reflects the law of England and Wales unless stated otherwise; Scotland and Northern Ireland have separate legal systems, and the law changes frequently. Check current official sources and take advice on the facts of your matter.