UK cryptoasset regulation in 2026: who needs FCA authorisation and how to apply
If your business deals in, arranges, advises on or holds tokens that give rights like shares, debt or a share of revenue, those tokens are specified investments and you need FCA authorisation under Part 4A of the Financial Services and Markets Act 2000 (FSMA) today. From 25 October 2027, the UK's new cryptoasset regime also brings trading platforms, dealing, arranging, custody, staking and UK stablecoin issuance for mainstream cryptoassets inside FSMA, and the FCA's application window for that regime is open now, from 30 September 2026 until 28 February 2027.
Carrying on a regulated activity without permission breaches the general prohibition in section 19 FSMA and is a criminal offence under section 23 FSMA. This guide shows where each token type sits, which permissions each business model needs, and what the FCA expects before and after it grants them.
At a glance
- Today: security tokens are regulated under the Regulated Activities Order 2001 (RAO), and e-money tokens under the Electronic Money Regulations 2011 (EMRs). Exchange and utility tokens sit outside the RAO, but crypto exchange and custody firms must register with the FCA under the Money Laundering Regulations 2017 (MLRs), and cryptoasset promotions to UK consumers have been regulated since 8 October 2023.
- From 25 October 2027: the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 create new FSMA activities for qualifying cryptoassets and stablecoins. MLR registration does not convert into authorisation.
- The window: the FCA's cryptoasset gateway opened on 30 September 2026. Existing firms that apply by 28 February 2027 can keep operating after go-live while the FCA decides their application.
- The rules: final rules are in policy statements PS26/9 to PS26/13 (June 2026), with perimeter guidance in PS26/18 (September 2026).
- The common mistake: relying on a whitepaper label. The FCA classifies a token by its rights and how it works, not by what it is called.
Two perimeters, one deadline
UK cryptoasset firms are dealing with two sets of rules at once.
The current perimeter comes from the FCA's PS19/22: Guidance on Cryptoassets. It sorts tokens into regulated tokens (security tokens and e-money tokens) and unregulated tokens (exchange tokens and utility tokens). A firm working with regulated tokens needs the matching permission now.
The new perimeter starts on 25 October 2027. The Cryptoassets Regulations, passed by Parliament on 4 February 2026, add new regulated activities for "qualifying cryptoassets" and "qualifying stablecoins". That captures much of the exchange token and utility token activity that sits outside the RAO today. The FCA published its final rules on 30 June 2026 and its perimeter guidance (a new PERG 18) on 16 September 2026.
The perimeter is still moving. A further statutory instrument was made in September 2026, after PS26/18 was finalised. The FCA consulted on more PERG changes, with responses due by 18 November 2026, and expects to publish final amended guidance in spring 2027. Check your analysis again when that lands.
How each token type sets your perimeter today
| Token type | What it is | Status today | From 25 October 2027 |
|---|---|---|---|
| Security tokens | Tokens giving rights such as ownership, voting, repayment of debt or a share of future profits or revenue | Specified investments under the RAO. Dealing, arranging, advising, managing and custody need Part 4A permission | Still regulated as specified investments. Safeguarding them is also captured by the new custody activity |
| E-money tokens | Tokens that are electronic money: issued on receipt of funds, for making payments, redeemable at par | Regulated under the EMRs and the Payment Services Regulations 2017 (PSRs). Issuers need EMI authorisation or small EMI registration | UK issuance of a qualifying stablecoin becomes its own FSMA activity. Use PERG 18 to check which regime your token falls under |
| Utility tokens | Tokens that give access to a product, service or network, with no investment rights | Outside the RAO. MLR registration is needed only if you provide crypto exchange or custodian wallet services. Promotion rules apply | If the token is a qualifying cryptoasset, dealing, arranging, custody, trading platforms and staking become regulated |
| Exchange tokens | Decentralised tokens used as a means of exchange or store of value, such as bitcoin | Outside the RAO. Crypto exchange and custodian wallet providers must register under the MLRs before trading. Promotion rules apply | Trading platforms, dealing, arranging, custody and staking become FSMA regulated activities |
Security tokens
A token is a security token if it gives rights comparable to a share or a debt instrument, such as ownership, voting on company decisions, repayment of a debt or a contractual share of future profits or revenue. Firms that deal in, arrange deals in, advise on, manage or safeguard security tokens need the same permissions as for the traditional instrument. In practice that means UK MiFID-scope permissions, prudential capital under MIFIDPRU, the Senior Managers and Certification Regime (SMCR) and market abuse controls. Tokenisation does not change the analysis. The FCA looks at what the holder is entitled to.
E-money tokens
An e-money token is electronically stored monetary value, issued on receipt of funds to make payment transactions and redeemable at par. A firm issuing a sterling or other fiat-pegged token for payments cannot avoid the EMRs by pointing to the distributed ledger. Issuers need authorisation as an electronic money institution (EMI) or registration as a small EMI. Since 7 May 2026, EMIs and authorised payment institutions have also had to meet the new safeguarding rules in CASS 15, introduced by PS25/12, including safeguarding audits and monthly safeguarding returns.
An EMI or payment institution licence does not give a firm cryptoasset permissions. If you also plan to run a crypto activity under the new regime, you need a separate authorisation or a variation of permission.
Utility tokens
A utility token gives access to a product, service or network and nothing more. It carries no debt claim, no ownership of a trading company and no right to a share of revenue. A purely functional token sits outside the RAO.
Utility token projects most often cross the line through their marketing. If the issuer promotes secondary market liquidity, a token buyback or price appreciation, the token can start to look like an investment. In some circumstances a utility token can also be e-money. And utility token businesses do not automatically need MLR registration. That depends on whether you provide crypto exchange or custodian wallet services.
Exchange tokens
Exchange tokens, such as bitcoin, have no central issuer and are used mainly as a means of exchange, a store of value or for speculation. They are not specified investments under the RAO. However, firms that exchange them, convert them to or from fiat, or hold them for customers must be registered with the FCA under the MLRs before they start trading. The FCA confirms that this registration requirement continues until the new regime starts on 25 October 2027.
The new FSMA cryptoasset activities from 25 October 2027
The Cryptoassets Regulations add these regulated activities for qualifying cryptoassets and qualifying stablecoins:
- issuing a qualifying stablecoin in the UK;
- safeguarding qualifying cryptoassets and relevant specified investment cryptoassets, and arranging safeguarding;
- operating a qualifying cryptoasset trading platform;
- dealing in qualifying cryptoassets as principal or as agent;
- arranging deals in qualifying cryptoassets; and
- arranging qualifying cryptoasset staking.
The FCA's final rules for these activities are in five policy statements published on 30 June 2026:
| Policy statement | What it covers |
|---|---|
| PS26/9 | Admissions and disclosures, and the market abuse regime for cryptoassets |
| PS26/10 | Stablecoin issuance: backing assets, redemption and disclosures |
| PS26/11 | Regulated cryptoasset activities: trading platforms, intermediaries, custody, lending and borrowing, and staking |
| PS26/12 | The prudential regime for cryptoasset firms |
| PS26/13 | How the wider FCA Handbook applies, including the Consumer Duty and SMCR |
Two points change the planning for MLR-registered firms. First, MLR registration does not carry over. Every firm carrying on a new regulated activity needs FSMA authorisation, or a variation of permission if it is already authorised. Second, authorised firms come under SMCR and the full Consumer Duty, neither of which applies to MLR registration today.
Mapping your business model to permissions
A Part 4A permission is a list of specific regulated activities, each tied to particular investment types. Ask for too few and the firm breaches the general prohibition the day it adds a product feature. Ask for activities it does not need and the application becomes harder to assess, with more questions from the case officer.
| Business model | What it needs today | What it needs from 25 October 2027 |
|---|---|---|
| Platform recommending security token allocations | Advising on investments (RAO article 53) | Unchanged |
| Platform that also routes or introduces security token transactions | Advising (article 53) and arranging deals in investments (article 25) | Unchanged |
| Discretionary portfolio management including tokenised securities | Managing investments (article 37), with custody permissions if it holds client assets | Unchanged, plus the new custody activity if it holds qualifying cryptoassets |
| Venue for trading security tokens | Operating a multilateral trading facility (article 25D) or another venue permission | Unchanged |
| Crypto-to-fiat exchange or broker for exchange tokens | MLR registration | FSMA authorisation for dealing or arranging deals in qualifying cryptoassets, or operating a trading platform |
| Custodian wallet provider | MLR registration | FSMA authorisation for safeguarding qualifying cryptoassets |
| Staking service | Depends on structure. Check whether it is a collective investment scheme | FSMA authorisation for arranging qualifying cryptoasset staking |
| Sterling-pegged payment token | EMI authorisation or small EMI registration, with PSR payment permissions | Check PERG 18 to see whether issuance is a qualifying stablecoin activity |
| Crypto-backed payment card | EMI or payment institution authorisation, plus MLR registration for the crypto conversion | EMI or payment institution authorisation, plus FSMA crypto permissions for the conversion activity |
Full and limited permission: not a crypto choice
You may see advice that crypto firms can choose between "full permission" and a cheaper "limited permission". That is wrong. In the FCA Handbook, limited permission is a Part 4A permission for certain lower-risk consumer credit activities only. Cryptoasset and investment firms apply for the permissions their activities need, and the FCA scales its assessment to the risks of the business model.
The timeline: the gateway and the application clock
| Route | Window | What the FCA has said |
|---|---|---|
| New regime, existing firms | Apply between 30 September 2026 and 28 February 2027 | The FCA expects to decide these applications before 25 October 2027. If it has not, existing firms can keep operating until it does |
| New regime, late applications | After 28 February 2027 and before 25 October 2027 | No guarantee of a decision before go-live. Firms still waiting at go-live fall under a transitional provision that only allows them to run off their UK business |
| No application | — | Existing firms must run off their UK cryptoasset business before 25 October 2027 |
| MLR registration before go-live | Open now | Required to trade before the new regime. The FCA advises against applying after 31 July 2027 |
| Other FSMA authorisations (for example security token permissions) | Ongoing | Since January 2026, the FCA has measured itself against 4 months for complete applications and 10 months for incomplete ones. The Treasury has confirmed that it will amend FSMA to make these the statutory deadlines, which are currently 6 and 12 months |
| EMI and payment institution applications | Ongoing | FCA target of 3 months for complete applications and 10 months for incomplete ones |
All of these clocks run from a complete application. In the firms we have reviewed, the gap between submission and the FCA accepting an application as complete is where most time is lost.
Applications are submitted through Connect, which firms now reach through the My FCA portal. The FCA published a preview of the cryptoasset application form on 8 July 2026. It has a core layer that most applicants complete, covering senior management, controllers and IT, plus a cryptoasset records management policy, and activity-specific modules for stablecoins, custody, staking, lending and borrowing, intermediaries and trading platforms. The FCA also offers pre-application meetings through its pre-application support service.
Building an application the FCA can approve
The regulatory business plan
The regulatory business plan is the core of the application. A pitch deck written for investors will not work. The FCA expects a clear, factual account of:
- target customers, distinguishing retail and professional clients;
- distribution channels, fees and charges;
- technology, including key management, custody architecture and wallet security;
- transaction monitoring, sanctions screening and blockchain analytics;
- outsourcing, and whether the board genuinely controls the technology or depends entirely on third-party developers;
- governance, lines of accountability and escalation routes for system failures; and
- how the firm will deliver good outcomes under the Consumer Duty.
Our guide to structuring a UK fintech FCA authorisation application explains how to write a business plan that holds up when the FCA cross-checks it against the rest of the application. For the wider process, see [The Complete Guide to FCA Authorisation in the UK](\URL TO CONFIRM).
Financial resources and wind-down
Applicants must show that they will meet their capital and liquidity requirements when authorised and continue to meet them. For new-regime cryptoasset firms, the requirements are in PS26/12. Investment firms are under MIFIDPRU, and EMIs under the EMRs. Financial projections should cover at least three years, with a base case and a stress scenario, and should be tied to the permissions you are asking for. The supporting documents should show that:
- fixed overheads are funded from capital resources the firm can actually use;
- capital resources meet the requirement for the permissions sought at all times;
- liquidity planning covers customer redemptions and withdrawals in a severe market disruption; and
- a wind-down plan shows how the firm would close in an orderly way, returning customer assets without consumer loss.
Engage, Execute, Embed
We use our Engage, Execute, Embed method on crypto applications. Engage: settle the regulatory requirements before the infrastructure is built. Execute: run the process and organisational changes alongside the technology build. Embed: test the controls in live operation before the FCA sees them. It stops engineering teams shipping code that conflicts with custody, client onboarding or promotion rules, which is far harder to fix after an application has gone in.
What changes once you are authorised
Authorisation is the start of supervision, not the end of the project. Once a firm appears on the Financial Services Register, it must keep up with ongoing obligations, which typically include:
- regulatory returns through RegData, now reached through My FCA, covering financial position, capital and complaints;
- an annual Consumer Duty board report assessing whether customers are getting good outcomes and fair value;
- SMCR: keeping senior manager approvals and responsibilities maps up to date, and certifying certified staff as fit and proper every year;
- operational resilience self-assessments and impact tolerances, for firms within the scope of those rules; and
- financial crime controls and returns, including the annual financial crime return (REP-CRIM) where your firm is in scope.
The first year
In the firms we have reviewed, the first twelve months after authorisation draw the closest supervisory attention. The FCA compares what the firm actually does with the commitments in its business plan. Missed volume projections, unnotified departures of senior managers and outages all prompt questions.
A risk-based compliance monitoring programme should test controls at planned intervals. It should cover complaints handling, customer communications, financial promotions and transaction limits at real trading volumes, not just as written in the policies. Board minutes, management information packs and risk register updates are the evidence the FCA will ask for.
Financial crime
Every crypto-facing firm needs strong anti-money laundering and counter-terrorist financing controls, whether its tokens sit inside or outside the RAO. Blockchain analytics, wallet screening and enhanced due diligence must pick up sanctions exposure, politically exposed persons and links to illicit activity. Suspicious activity reports go to the National Crime Agency whenever there is knowledge or suspicion of money laundering. Weak financial crime controls expose both the firm and its senior managers to FCA enforcement and, in the most serious cases, criminal prosecution.
In-house compliance or outsourced support?
Many newly authorised firms weigh up an in-house compliance hire against an outsourced retainer. Here is a worked example for a £60,000 salary, using 2026/27 employer National Insurance (15% above £5,000) and the 3% minimum employer pension contribution on qualifying earnings:
| In-house hire (£60,000 salary) | Compliance Consultant Silver | Compliance Consultant Gold | |
|---|---|---|---|
| Annual cost | About £69,600 (salary, employer NI and minimum pension), before recruitment, training, cover and overheads | £14,340 + VAT a year (£1,195 a month, billed quarterly), or £12,900 + VAT a year (£1,075 a month, billed annually) | £28,740 + VAT a year (£2,395 a month, billed quarterly), or £25,860 + VAT a year (£2,155 a month, billed annually) |
| Response time | Depends on availability and absence | 1 business day | 4 working hours |
| Advisory time | One person's capacity | 8 hours a month | 16 hours a month |
| Templates | Drafted or bought separately | 6 professional toolkits | 14 professional toolkits |
| Access | Internal reporting line | Monthly briefing and 30-minute call | Named consultant and mobile access |
On these figures, Gold billed quarterly costs about 41% of the direct employment cost of a £60,000 hire, and Silver billed annually about 19%. A retainer also avoids the single-point-of-failure risk of one in-house compliance officer. All retainer fees are quoted net of VAT. Ongoing costs at mid-sized firms are covered in [what mid-sized UK investment firms spend on FCA compliance in 2026](\URL TO CONFIRM).
Frequently asked questions
Do crypto firms need FCA authorisation in 2026?
It depends on the tokens and the activity. Firms dealing in, arranging, advising on, managing or holding security tokens need Part 4A authorisation now, and e-money token issuers need EMI authorisation or registration. Crypto exchange and custody firms working with exchange tokens need MLR registration now and FSMA authorisation from 25 October 2027.
When is the deadline to apply under the new cryptoasset regime?
The application window runs from 30 September 2026 to 28 February 2027. Existing firms that apply in the window can keep providing their services after 25 October 2027 while the FCA decides their application. Firms that apply later have no such protection and may have to run off their UK business.
Does MLR registration convert into FSMA authorisation?
No. MLR registration does not carry over. Registered firms must apply for FSMA authorisation like any other applicant, and being registered does not guarantee that authorisation will be granted.
Are utility tokens regulated by the FCA?
A purely functional utility token is outside the RAO today. Cryptoasset promotions to UK consumers have been regulated since October 2023, and from 25 October 2027 dealing, arranging, custody, trading platforms and staking involving qualifying cryptoassets become regulated activities. A utility token marketed as an investment can also become a security token.
How long does FCA authorisation take?
For mainstream FSMA applications, the FCA measures itself against 4 months for a complete application and 10 months for an incomplete one. Under the crypto gateway, the FCA expects to decide applications made by 28 February 2027 before the regime starts on 25 October 2027.
Get your token perimeter checked before you apply
Getting the permission scope wrong is expensive to fix. Too narrow, and the firm breaches the general prohibition as it grows. Too wide, and the application draws questions it did not need to. Compliance Consultant is led by founder Lee Werrell, a Chartered Fellow of the CISI with more than 25 years of UK financial services regulatory experience, and our senior associate consultants review every part of the application, from token classification and permissions to financial projections and wind-down plans.
To review your token model and plan your application, book a free discovery call at https://bit.ly/CCDiscovr or speak to our authorisation voice agent at https://bit.ly/FCADiscoAuthn. You can also call UK Freephone 0800 689 0190 or our international line 020 8243 8620, or email info@complianceconsultant.org. Making Compliance Work.
This article is general information, not legal advice. Compliance Consultant and Compliance Doctor are trading styles of UK Compliance Consultant Limited, Companies House number 14805896. UK Compliance Consultant Limited is not authorised by the FCA.