The UK is preparing to introduce a comprehensive regulatory framework for cryptoassets, representing one of the most significant developments for the sector since cryptoasset businesses first became subject to anti-money laundering regulation.
In February this year the UK Parliament passed legislation to bring cryptoassets fully within the FCA’s regulatory perimeter for the first time. The FCA has now published its final rules and guidance for cryptoasset firms which will establish a comprehensive regulatory framework that moves well beyond the anti‑money laundering and financial promotions rules that currently apply to cryptoasset activity in the UK. The new regime will apply to UK based firms and also to overseas firms that wish to provide cryptoasset services to UK customers.
This briefing sets out some of the key elements of the new regime and the practical steps that firms in the cryptoasset sector should be taking now to prepare for the introduction of the new regime in October 2027.
Which cryptoassets does the new regime apply to?
The regime applies to “qualifying cryptoassets”. A cryptoasset is defined as any cryptographically secured digital representation of value or contractual rights that:
- can be transferred, stored or traded electronically; and
- uses technology supporting the recording or storage of data (which may include distributed ledger technology).
A qualifying cryptoasset is one which is fungible, transferable and would not otherwise fall within the scope of the Regulated Activities Order. The definition excludes cryptoassets that cannot be transferred or sold in exchange for money or other cryptoassets and can only be used for limited purposes (such as utility tokens).
For many firms, the practical effect is that a wide range of cryptoassets currently traded on exchanges and platforms are likely to fall within scope. Businesses should therefore assess carefully whether any of their existing or planned activities could become regulated under the new regime.
Which services and activities will be caught?
The new regulations amend the Financial Services and Markets Act 2000 (Regulated Activities) Order 2001 (the “RAO”) to create nine new regulated cryptoasset activities, including:
- Issuing qualifying stablecoin
- Safeguarding qualifying cryptoassets
- Arranging for another person to safeguard qualifying cryptoassets
- Operating a qualifying cryptoasset trading platform (“QCATP”)
- Dealing in qualifying cryptoassets as principal
- Dealing in qualifying cryptoassets as agent
- Arranging deals in qualifying cryptoassets
- Arranging qualifying cryptoasset staking
Authorisation requirements
Firms will require FCA authorisation to carry out any of these activities in the UK and in order to obtain this authorisation will need to meet the FCA’s threshold conditions and demonstrate that they will be able to comply with the FCA’s rules and guidance. Firms which are currently authorised for other regulated activities will need to apply to vary their permissions to include any relevant new activity.
International firms
Authorisation is also required for overseas platforms serving UK retail customers. As might be expected a number of concerns were raised about this in the responses to the FCA’s consultation papers.
One potential difficulty for overseas firms is that the FCA requires some presence in the UK before it can grant authorisation, it will not authorise an overseas firm that has an entirely remote offering to the UK. The FCA has, however, confirmed that in certain circumstances an overseas‑incorporated platform operator can obtain FCA authorisation via a UK branch (rather than requiring a new UK subsidiary to be set up). It is of course important to ensure that a particular arrangement does meet the FCA’s threshold conditions for authorisation and this will be assessed on a case‑by‑case basis at the FCA authorisation gateway.
Firms that only serve UK institutional clients may be able to operate from overseas without FCA authorisation but must seek advice to ensure that they remain outside the regulatory perimeter.
Compliance with FCA rules
Once authorised, firms will need to comply with a comprehensive set of FCA rules covering financial resilience, governance, market operation, and client protection. Authorised firms must maintain adequate financial resources, robust systems and controls, manage conflicts of interest, support fair and orderly trading, and comply with transparency, record keeping, and reporting obligations.
Firms should not view authorisation as a one-off exercise. Compliance with the new requirements will need to be demonstrated on an ongoing basis, which may require significant investment in governance, compliance and risk management arrangements.
Admissions and investor disclosures
Issuers or offerors of cryptoassets must produce compliant qualifying cryptoasset disclosure document (“QCDD”) before a cryptoasset can be admitted to trading on a UK trading platform. QCDDs must contain material information to enable investors to make informed decisions, including details on governance, technology, risks, conflicts of interest and ownership structures. Each QCDD must include a two page “Summary of Key Information” highlighting the main risks, features and conflicts in plain language.
UK intermediaries will only be permitted to arrange deals in cryptoassets for retail clients if the cryptoasset is admitted to trading on at least one authorised cryptoasset trading platform and has a QCDD. These rules do not apply to UK-issued stablecoins.
Market abuse
A new crypto market abuse regime has been introduced. Insider dealing and market manipulation prohibitions apply to qualifying cryptoassets admitted to trading on a UK QCATP. This is understandable given the huge movement in the value of cryptoassets which have occurred following comments by high profile individuals who ave significant influence in the cryptoasset sector. However, many of these individuals are based outside the UK so it will be interesting to see how this operates in practice.
Lending and borrowing
Cryptoasset lending or borrowing is not a separate regulated activity but, in many cases, will fall within the dealing and arranging activities.
Retail access to cryptoasset lending and borrowing is permitted, subject to safeguards. The FCA decided against including provisions from its consumer credit rulebook (although some crypto related lending will be regulated credit agreements and so fall within the existing rules).
Express prior consent is required from retail clients on key terms. All lending to retail clients must be over collateralised with negative balance protection, meaning clients cannot lose more than their pledged collateral.
Staking
One of the new regulated activities is arranging cryptoasset staking. The FCA’s analysis has indicated that retail clients may have a limited understanding of the staking process. Therefore, the new rules require clear information to be provided and express prior consent of key terms to be obtained each time cryptoassets are staked. Comprehensive record keeping of staking activities is required, and operational resilience, prudential and safeguarding requirements apply.
Decentralised Finance (DeFi)
HMT has stated that “where specified activities are being undertaken on a truly decentralised basis, ie where there is no person that could be seen to be undertaking the activity by way of business”, the regime will not apply.
The FCA has confirmed it will apply its rules only where a clear controlling person carries on the regulated activities. Whether a person is in scope will be assessed on a case‑by‑case basis, and this will need to be considered carefully if relying on an argument that no authorisation is required.
Further FCA guidance on decentralisation is expected in late 2026.
Timelines and Transitional Arrangements
The key timelines for the introduction of the new regime are as follows:
- New regulated activities and FCA rules take effect: 25 October 2027
- FCA application window: 30 September 2026 to 28 February 2027
- Pre application support meetings: available from July 2026
Further information about the FCA application process is available on the FCA’s website.
Existing registrations under the Money Laundering Regulations (“MLR”) will not automatically convert to Part 4A permissions (i.e., full FCA authorisation under FSMA). Firms already authorised under FSMA for other activities will need to apply for a variation of permission (“VoP”) if they wish to carry out the new regulated cryptoasset activities (for example, banks wishing to act as cryptoasset trading platforms or intermediaries).
MLR registered firms that apply during the window can continue to provide services to existing and new customers under their MLR registration while their FSMA application is pending. The FCA has said it aims not to duplicate requests for information it already has as part of a firm’s MLR registration.
Applications submitted after 28 February 2027 will not be expedited and may not be eligible for transitional or savings provisions. Firms that apply outside the window may be placed into a two-year transitional “run off” provision.
What should you do now?
We recommend that clients take the following steps:
- Determine whether your current or planned activities fall within the scope of the new regulated cryptoasset activities. If they do, start preparing now!
- Identify which type of authorisation is required.
- Carry out a gap analysis against the FCA’s requirements, identifying where existing arrangements need to be strengthened (systems and controls, governance, Senior Managers and Certification Regime, Consumer Duty, prudential requirements, safeguarding).
- Consider the implications for your operating model and corporate structure, particularly if you are an international firm.
- Take advantage of the FCA’s pre application support meetings (available now) and authorisation webinars.
- For firms already authorised under FSMA, assess whether a variation of permission application is needed to carry out the new regulated cryptoasset activities.
- Engage with legal, compliance and accounting advisers at an early stage. This is strongly recommended to ensure a compliant business model and a complete application.
Conclusion
The new regime represents a significant milestone in the development of the UK's cryptoasset market. While the reforms are intended to improve consumer protection, market integrity and confidence in the sector, they will also require many firms to review their governance, compliance and operational frameworks. Businesses that begin assessing the impact of the changes now are likely to be best placed to navigate the transition successfully.
If you would like to discuss any aspect of this briefing or how the new regime may affect your business, please contact your usual contact at the firm or any member of the team listed below.
