Five months to file, one year to wait, and no second chances. What every crypto firm serving UK customers needs to decide now.
By René-Philippe · FintechLex Insight · September 2026
On 30 September 2026, at 9:00 a.m. London time, the Financial Conduct Authority opens its authorisation gateway for the new UK cryptoasset regime. It closes on 28 February 2027 at 11:59 p.m. The rules themselves bite on 25 October 2027.
Those three dates will decide which crypto businesses keep their UK customers and which ones pack their bags. The FCA has made the timetable very clear. What it has not made easy is the application itself.
We have spent thirty years watching regulators open new licensing windows across Europe and Asia. The pattern rarely changes: a first wave of prepared firms, a stampede in the final weeks, and a long tail of businesses that discover too late that “we’ll deal with it next quarter” was not a strategy. This article tells you where you stand, and what to do before the window shuts.
What the regime actually covers
Parliament completed the legislation in February 2026, bringing cryptoassets inside the Financial Services and Markets Act 2000 (FSMA). On 30 June 2026 the FCA published its final rules in five policy statements (PS26/9 to PS26/13). The regime creates new regulated activities, and anyone carrying them on by way of business in the UK needs authorisation:
- Issuing qualifying stablecoins in the UK
- Safeguarding and administering qualifying cryptoassets (custody)
- Operating a qualifying cryptoasset trading platform
- Dealing in or arranging transactions in qualifying cryptoassets
- Carrying on qualifying cryptoasset staking
The FCA’s application materials also cover crypto lending and borrowing services. On top of the permissions, the FCA layers a full rulebook: capital and liquidity requirements, a market abuse regime modelled on UK MAR, admission and disclosure rules for trading platforms, and the Consumer Duty. This is not a registration. It is a licence, with everything a licence brings.
The MLR myth: why your existing registration will not save you
Here is the misunderstanding we hear most often. Many firms hold a registration under the Money Laundering Regulations (MLR) and assume it will convert. It will not. The FCA states it plainly: MLR-registered firms must apply for FSMA authorisation like everyone else.
The difference is not cosmetic. The MLR registration tested one thing: your anti-money laundering controls. FSMA authorisation tests your governance, senior managers, controllers, capital, systems, conduct and wind-down planning. And even the narrower MLR test proved a steep climb. By the FCA’s own statistics reported in September 2024, it had granted only around 14% of crypto registration applications since 2020. Expect the full authorisation to filter harder, not softer.
The same logic applies to e-money institutions and payment institutions already registered or authorised under the EMRs or PSRs, and to firms that already hold FSMA permissions for other business. They all need either a new authorisation or a variation of permission to cover crypto activities. Nobody gets waved through.
The three scenarios: in time, late, or not at all
The gateway dates decide your legal position on 25 October 2027.
1. You apply between 30 September 2026 and 28 February 2027
The FCA says it expects to decide applications filed in the window before the regime starts. If it has not decided yours by then, a saving provision lets you keep providing your services until it does. You keep your business and your customers.
2. You apply after 28 February 2027 but before 25 October 2027
A transitional provision applies, but it is a narrow one. You may only service existing contracts. No new customers, no new contracts. In practice, you freeze your UK business while the FCA works through a queue in which you stand at the back.
3. You do not apply
From 25 October 2027, any regulated crypto activity you carry on in the UK is unauthorised business. That is a criminal offence under FSMA, not a paperwork issue. You must wind down your UK activities before that date.
| Scenario | When you file | Status on 25 October 2027 | Business impact |
|---|---|---|---|
| On time | 30 September 2026 to 28 February 2027 | Saving provision until the FCA decides; if refused, you stop | Business as usual; new customers allowed |
| Late | 1 March to 24 October 2027 | Transitional provision: existing contracts only | New UK customers frozen |
| No filing | Never | Unauthorised business: criminal offence under FSMA | Wind down UK activities |
Missing the February deadline by a week can cost you a year of growth. Your competitors who filed on time will spend that year onboarding the customers you are not allowed to accept.
Overseas firms: the UK does not stop at its borders
If you run your platform from Zurich, Dubai, Singapore or Hong Kong, do not assume this is someone else’s problem. The regime catches non-UK firms that provide regulated cryptoasset services to UK persons.
There is an exclusion, and it is narrower than many people hope. Overseas firms dealing only with UK institutional clients fall outside the regime, provided those clients do not act as intermediaries serving UK consumers. The moment UK retail customers are in the picture, directly or through a partner, you need to look at authorisation. The main escape route for dealing and arranging: an authorised UK principal dealer or a UK trading platform sits between you and the UK consumer.
The FCA’s baseline expectation is clear: firms that need authorisation should carry on their crypto activities from a UK legal entity. For solo-regulated firms, that means a UK subsidiary, not a branch.
For international groups, the real question is structural: do you authorise a UK entity, route UK business through an authorised UK partner, or exit the UK retail market? Each answer affects your tax position, group capital and banking relationships. Decide before you start drafting.
Reverse solicitation: do not build a business on it
Many overseas platforms hope to rely on reverse solicitation: “the customer came to us.” Under the new UK regime, that door is closed. As of mid-2026, the UK does not plan any exemption for reverse solicitation, whether the UK customer’s approach is solicited or unsolicited. If you serve UK consumers, the perimeter applies, whoever made the first call. Any business model that relies on UK retail customers “finding you on their own” needs a rethink before 25 October 2027.
What the FCA wants to see in your file
The FCA has published a 68-page information document describing what it expects. Anyone who has built a banking or EMI licence application will recognise the shape of it. At minimum, your file must cover:
- The permissions you seek, mapped activity by activity against the regulated perimeter
- Your client types and target markets
- Your senior managers, controllers and close links
- Your group and organisational structure
- A regulatory business plan with financial forecasts
- An IT and cybersecurity self-assessment
- Governance, compliance monitoring, complaints handling and record-keeping arrangements
- Financial crime controls, including AML, sanctions and market abuse surveillance
The FCA also expects your board to approve a credible implementation plan. The question is not whether you understand the rules, but whether your board owns them. A file drafted by consultants and rubber-stamped by directors tends to fall apart at the first round of questions. Expect the FCA to question your senior managers directly. Make sure they know what their own application says.
Capital: the number that sinks business plans
The prudential rules (PS26/12) set minimum own funds as the highest of three measures:
- Permanent minimum requirement: from £75,000 to £750,000, depending on your activity
- Fixed overheads requirement: one quarter of your relevant annual expenditure, with a deduction for gas fees passed on to customers
- Activity-based K-factors: for example, 1% of average stablecoins in issuance for issuers (cut from the 2% consulted on), and a 40% position risk adjustment on net cryptoasset exposures
A basic liquid assets requirement comes on top. For a lean start-up the permanent minimum usually sets the bar. For a scaling platform, overheads and K-factors take over quickly.
The classic mistake: founders model capital on today’s balance sheet, while the FCA reads the growth plan they submit. Make sure your shareholders have seen the number before the FCA does.
The pre-application meeting: use it
Since July 2026, the FCA has offered pre-application support meetings. Take one, and arrive with a clear business model, a draft perimeter analysis and a proposed structure. Do not arrive with a slide deck about how blockchain will change the world. The FCA already knows. It wants to know how you will protect client assets on a Tuesday afternoon when your custodian’s API goes down.
Marketing: check your financial promotions before your ads run
Since October 2023, crypto firms have needed a lawful route to market to UK consumers. The new regime changes that route. Once authorised under FSMA, you can communicate your own financial promotions without a separate section 21 approver, and you can approve promotions for unauthorised entities in your own group. Qualifying cryptoassets remain restricted mass market investments, so the full set of promotion rules – risk warnings, cooling-off period and appropriateness checks – still applies.
The trap sits in the transitional provision. A late applicant may only communicate promotions relating to pre-existing contracts. Your marketing team needs to know which regime you are in on 25 October 2027 before it books a single campaign.
Build or buy?
Some firms will partner with an authorised firm, acquire one, or restructure so that a licensed group entity carries the UK business. Acquiring an authorised firm requires FCA approval of the new controllers: it does not avoid scrutiny, it shifts it. And a MiCA CASP authorisation gives you no passport into the UK. Your MiCA documentation gives you a head start, provided you adapt it to the FCA’s rules rather than simply changing the letterhead.
Your checklist for the next five months
- October 2026: confirm your perimeter. Which regulated activities do you carry on, for which UK clients, from which entity?
- October 2026: decide your structure. UK entity, partner, acquisition or exit.
- November 2026: book a pre-application meeting and appoint your senior managers.
- November to December 2026: build the business plan, capital model and policies. Get board approval of the implementation plan.
- January 2027: file. Do not aim for 28 February. Every regulator in the world slows down under a deadline surge, and the FCA will be no exception.
The bottom line
The UK has chosen to become a serious crypto jurisdiction, and serious jurisdictions charge an entry fee in time, capital and governance. Firms that treat 30 September as the start of a five-month project will keep their UK business. Firms that treat 28 February as a target date will learn what a transitional provision really means.
FintechLex advises crypto and fintech groups on licensing strategy, perimeter analysis and the acquisition of regulated entities in the UK, Switzerland, the EU and Asia. If you need a view on which route fits your business, contact us at insight@fintechlex.com.
This article is for general information only and does not constitute legal advice.
Sources
- FCA, “Cryptoassets: how the gateway will operate”
- FCA press release of 30 June 2026 on the final cryptoasset rules
- Sidley Austin, “UK Cryptoasset Regulation – Action Points for 2026-27” (January 2026)
- FinanceFeeds, “FCA Crypto Gateway Opens 30 September”
- LexisNexis, FCA cryptoasset registration statistics (September 2024)
- FCA, “Cryptoasset firms: use of section 21 approvers”
- Freshfields, “Set in stone: five landmark crypto policy statements” (July 2026)
- Greenberg Traurig, “UK Cryptoasset Regulatory Landscape: Key Takeaways for Overseas Firms” (June 2026)
- Morgan Lewis, “UK Finalises Cryptoasset Rules” (July 2026)
