On September 30, 2026, the UK Financial Conduct Authority opened its authorization gateway for crypto firms, starting a five-month application window that closes February 28, 2027. Every company offering regulated crypto services in the UK — exchanges, custodians, stablecoin issuers, lending plat...
"This is a significant moment for crypto regulation in the UK. We've created a framework that doesn't force firms to choose between regulatory certainty and room to innovate — this regime means they can have both in a stable, competitive home to build and grow." — David Geale, Executive Director of Payments and Digital Finance, Financial Conduct Authority
On September 30, 2026, the UK Financial Conduct Authority opened its authorization gateway for crypto firms, starting a five-month application window that closes February 28, 2027. Every company offering regulated crypto services in the UK — exchanges, custodians, stablecoin issuers, lending platforms, staking providers — must obtain full FCA authorization under the Financial Services and Markets Act (FSMA) by October 25, 2027, or exit the market.
The regime replaces the FCA's existing anti-money laundering register, which has approved only 50 of 368 applicants (14%) since 2020. None of those registrations carry over automatically. Every firm must reapply. The framework introduces prudential capital standards, a bespoke market abuse regime for cryptoassets (MARC), Consumer Duty obligations, and a "controlling entity" test that pulls identifiable DeFi operators into scope. Stablecoin issuers face a 1% capital coefficient — halved from the original 2% proposal after industry pushback — with a permanent floor of £350,000.
This is the UK's most consequential move in digital asset regulation. It arrives 18 months after the EU's MiCA framework went live and weeks after the US Treasury published interim rules under the GENIUS Act. The three regimes now run in parallel, each with different scopes, timelines, and enforcement mechanisms. Firms operating across all three jurisdictions face a compliance matrix that is measurably more complex than it was 12 months ago.
The FCA's crypto authorization process operates on a fixed calendar:
| Date | Event | |------|-------| | June 30, 2026 | FCA published final policy statements and guidance | | July 2026 | Pre-application support meetings began | | September 30, 2026 | Authorization gateway opened | | February 28, 2027 | Application window closes | | October 25, 2027 | Mandatory regime takes effect |
Firms that submit applications by the February 28 deadline but have not yet received a decision when the regime activates on October 25, 2027, benefit from a "saving provision" — they may continue operating for up to two years while the FCA processes their file. Firms that miss the window face a harder path: they may service existing customers on a transitional basis but cannot onboard new users or offer new regulated crypto products. If authorization is ultimately refused, those firms must exit the UK market in an orderly manner, according to the FCA's published guidance.
The FCA has historically operated at a 14% approval rate for its anti-money laundering crypto register. Of 368 applications received since the register opened in 2020, only 50 firms hold registration. Whether this selectivity carries over into the new FSMA-based regime is a material question for the roughly 50 currently registered firms, all of which must reapply from scratch.
The regime creates new regulated activities under FSMA. Covered activities include:
Firms that currently rely on third-party authorized firms to approve their financial promotions will no longer be able to do so. Direct FCA authorization is required to market crypto products and services to UK consumers.
The FCA's prudential framework imposes risk-based capital requirements modeled on the investment firm prudential regime:
The 1% stablecoin coefficient was a direct concession to industry. The FCA's original consultation proposed 2%, which firms argued would make UK issuance uncompetitive relative to EU MiCA requirements. The halving brought the UK figure closer to, though not identical with, EU standards.
The FCA finalized MARC as part of its admissions and disclosures package. MARC prohibits four categories of conduct:
The regime draws substantially from the UK's existing Market Abuse Regulation (UK MAR), adapted for crypto-native behaviors. The FCA acknowledged during consultation that crypto markets exhibit distinct patterns — MEV extraction, wash trading, pump-and-dump schemes — that require tailored treatment. The regulator is considering safe harbors for certain activities, including delayed disclosure of inside information and token burning, based on principles of market function and consumer protection.
On-chain monitoring obligations for large operators have been narrowed relative to the original proposal. Trading platforms bear primary responsibility for detecting manipulation and insider trading on their venues.
Stablecoin regulation under the FCA framework operates jointly with the Bank of England, which supervises systemic stablecoin issuers. Key provisions:
The FCA selected four firms — Revolut, Monee Financial Technologies, ReStabilise, and VVTX — to test stablecoin issuance in its Regulatory Sandbox starting in early 2026, ahead of the formal regime.
The FCA has not carved DeFi out of the regime wholesale. Instead, it applies a "controlling entity" test: where there is an identifiable person or entity carrying on a regulated activity by way of business through a DeFi arrangement, the full rules apply.
In practice, this means:
The FCA's language — "same risk, same regulatory outcome" — signals that the test will be applied functionally rather than formally. A protocol team that deploys smart contracts, controls upgrade keys, and captures fee revenue is likely to be treated as a regulated entity regardless of DAO governance structures.
The regulator has stated it intends to consult separately on detailed DeFi guidance, including specific indicators of decentralization and how rules interact with DeFi business models, operational resilience, and financial crime risks. That consultation has not yet been published.
For the first time, UK crypto firms will fall under the FCA's Consumer Duty, which requires firms to deliver "good outcomes" for retail customers. This imposes obligations around:
Retail crypto customers will also gain access to the Financial Ombudsman Service (FOS) for dispute resolution — a protection previously unavailable to crypto users in the UK. This is a structural shift: it means individual users can escalate complaints against authorized crypto firms to an independent adjudicator backed by statutory enforcement powers.
The three major Western crypto regulatory frameworks now operate concurrently, each with distinct characteristics:
| Feature | UK FCA | EU MiCA | US GENIUS Act | |---------|--------|---------|---------------| | Scope | Full crypto activities | Full crypto activities | Payment stablecoins only | | Authorization timeline | Sep 2026 – Oct 2027 | Live since June 2024 | Not yet enforceable | | Stablecoin capital | 1% of customer assets | EMI authorization required | Lower minimum requirements | | Yield prohibition | Yes | Yes | Yes | | Passporting | No | Yes (27 EU countries) | No | | DeFi treatment | Controlling entity test | Under ESMA review | Not addressed | | Market abuse regime | MARC (bespoke) | Adapted from MAR | SEC/CFTC enforcement | | Enforcement ceiling | FCA powers under FSMA | 12.5% annual turnover | $100K/day + criminal |
The UK's approach sits between the EU and US models. MiCA offers EU-wide passporting — one license covers 27 countries — which the UK does not replicate. The GENIUS Act addresses only stablecoins, leaving broader crypto regulation to SEC and CFTC rulemaking. The UK regime covers the full spectrum of crypto activities under a single regulator.
A firm operating in all three jurisdictions faces three separate authorization processes, three capital regimes, and three market abuse frameworks. The compliance burden is cumulative, not overlapping.
Katie Harries, Coinbase's head of policy for Europe, stated upon the rules' publication: "The publication of the FCA's final crypto rules is a major milestone for regulatory clarity and a strong outcome for the U.K.'s competitiveness in digital asset innovation."
50 currently registered firms must reapply. No existing anti-money laundering registrations carry over. The FCA's historic 14% approval rate (50 of 368 applicants) raises questions about how many firms will clear the new, more demanding bar.
The application window is short. Five months — September 30, 2026, to February 28, 2027 — to prepare and file a full FSMA authorization application. Pre-application meetings started in July, meaning firms that waited until the gateway opened are already behind.
Stablecoin economics shifted. The 1% capital coefficient (down from 2%) and removal of the redemption forecasting obligation reduce compliance costs for issuers. The £350,000 floor remains a barrier for smaller entrants.
DeFi is not exempt. The controlling entity test brings identifiable protocol operators into scope. Only "truly decentralised" arrangements — no controlling person, no business activity — fall outside the regime.
Consumer Duty and FOS access are structural. UK crypto users gain formal complaint and redress mechanisms for the first time. This raises the liability exposure for authorized firms.
Three-jurisdiction compliance is now the baseline for any firm with UK, EU, and US operations. The regimes do not harmonize with each other.
The UK's crypto licensing regime is now operational. The authorization gateway opened five days ago; the clock is running. Firms that intend to operate in the UK after October 25, 2027, have a defined path — and a defined deadline.
The framework's economic implications are measurable. Capital requirements, compliance infrastructure, legal advisory costs, and the overhead of Consumer Duty obligations will filter smaller operators out of the UK market. The FCA's historical approval rate suggests this is by design. The regulator has consistently signaled preference for fewer, better-capitalized, and more closely supervised crypto firms over a large, loosely monitored population.
For the broader market, the UK regime completes a regulatory trifecta. The EU went first with MiCA. The US is moving on stablecoins through the GENIUS Act and broader crypto oversight through SEC and CFTC rulemaking. The UK now occupies the middle ground — full-scope coverage under a single regulator, without EU-style passporting or US-style fragmentation.
The data point that matters most: 50 firms are registered today. How many will hold FCA authorization by October 2027 will determine whether the UK's "global hub" ambition translates into market reality, or whether the compliance burden pushes activity to jurisdictions with lower barriers to entry.