On April 15, 2026, the UK Financial Conduct Authority published Consultation Paper 26/13 — the final perimeter guidance defining which cryptoasset activities fall under its regulatory authority. The consultation, open until June 3, 2026, covers seven categories of regulated activity: stablecoin i...
"Our research results highlight the need for clear regulation that supports a safe, competitive, and sustainable crypto sector in the UK." — Matthew Long, Director of Payments and Digital Assets, Financial Conduct Authority
On April 15, 2026, the UK Financial Conduct Authority published Consultation Paper 26/13 — the final perimeter guidance defining which cryptoasset activities fall under its regulatory authority. The consultation, open until June 3, 2026, covers seven categories of regulated activity: stablecoin issuance, custody (safeguarding), trading platform operation, principal dealing, agent dealing, deal arrangement, and staking.
The framework converts the UK's current light-touch AML-only registration model into a full Financial Services and Markets Act (FSMA) authorization regime. Firms currently registered under the Money Laundering Regulations will not be grandfathered. Every crypto operator serving UK consumers — including offshore platforms — must apply for new authorization during a five-month window opening September 30, 2026, or cease operations by October 25, 2027.
Since taking over crypto firm oversight in 2020, the FCA has received 359 registration applications and approved only 47 — a rejection rate exceeding 85%. Firms granted recent approvals include BlackRock and Standard Chartered. The regulator's historical approval rate rose from 15% to 45% in late 2025 after cutting review times from 17 months to five. Whether it can scale that throughput to an entire industry remains an open question.
The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, enacted by Parliament on February 4, 2026, establishes the statutory foundation. The FCA's CP26/13 builds on that by mapping the perimeter — defining precisely which activities require authorization and which do not.
Seven regulated activities are specified:
Trading platforms face additional requirements. Large CATPs must monitor and report suspected market abuse. All CATPs must implement nondiscriminatory access, risk-neutral trading systems with legal separation of credit-exposure activities, and principles-based oversight of algorithmic trading.
Intermediaries must comply with best execution, transparency, disclosure, reporting, and governance standards. For retail distribution, cryptoassets — except UK-issued stablecoins — must be admitted to at least one authorized CATP before they can be offered. Retail and elective professional client orders must execute on UK-authorized venues only.
The framework also addresses crypto lending and borrowing: retail clients must over-collateralize borrowings, and firm recourse is limited to collateral only. No negative balances.
The most operationally significant provision may be the custody classification rule. Any firm holding client cryptoassets for more than 24 hours during trade settlement must obtain a full safeguarding license. The firm becomes a regulated custodian, subject to capital requirements and segregation obligations.
The FCA further defined "shadow custody": firms that retain theoretical override authority over client funds — even if they pledge never to exercise it — are classified as custodians. The regulator stated this applies "regardless of blockchain or smart contract use."
This catches a wider net of firms than traditional custody definitions. Software providers, middleware platforms, and automated settlement systems that route or temporarily hold assets may now require safeguarding authorization if their architecture permits a 24-hour hold or includes administrative key access.
Validators and node operators face a related provision. Pure technology exemptions are revoked the moment a provider offers "added value" features such as user dashboards, yield programs, or reward-compounding tools. Those features trigger the requirement for full authorization to arrange staking services.
The FCA proposal effectively ends simplified "one-click" staking for UK retail clients. Firms offering staking services must:
The requirement for explicit consent — not a blanket opt-in buried in terms of service — represents a significant operational change. Platforms currently offering default staking on deposit will need to redesign user flows.
Staking service providers must also meet safeguarding obligations. Assets committed to staking are not exempt from custody protections, meaning firms must hold sufficient reserves and maintain client entitlements throughout the staking period.
Stablecoin issuers operating in the UK must be UK-established entities. The FCA requires issuers to control the entire lifecycle: from initial offering through redemption and reserve maintenance. Non-compliant issuers face authorization denial.
This provision creates a jurisdictional barrier for offshore stablecoin issuers. Tether (USDT) and Circle (USDC) — which together account for the vast majority of the $320 billion global stablecoin market, according to DeFiLlama — would need UK-incorporated entities managing reserves domestically to meet the standard.
The Bank of England retains a separate regime for sterling-denominated systemic stablecoins. UK-issued qualifying stablecoins receive preferential treatment under intermediary rules, creating a regulatory incentive for domestic issuance.
The FCA explicitly stated that standard overseas persons exemptions — which allow foreign financial firms to serve UK clients under certain conditions — will not apply in most cryptoasset cases. If a platform serves UK retail users, the activity falls within UK jurisdiction regardless of where the firm is incorporated.
This means offshore exchanges and service providers must either obtain FCA authorization (with the operational and capital requirements that entails), establish a UK subsidiary, or block UK users. The provision directly targets the long-standing practice of operating from low-regulation jurisdictions while marketing to UK consumers.
The approach aligns with the FCA's broader enforcement posture. Between 2023 and 2025, the regulator issued over 1,700 consumer alerts against unauthorized crypto firms promoting services to UK residents.
The regulatory timeline is compressed:
| Milestone | Date | |-----------|------| | CP26/13 consultation published | April 15, 2026 | | Consultation closes | June 3, 2026 | | Final rules published | Summer 2026 | | Final policy statement | Autumn 2026 | | Authorization gateway opens | September 30, 2026 | | Application window closes | February 28, 2027 | | Full regime in force | October 25, 2027 |
Firms that miss the application window face fines, suspensions, and potential permanent closure. No automatic grandfathering from existing AML registrations.
The FCA launched a pre-application support service offering webinars on regulatory expectations, anti-money laundering obligations, and Senior Managers & Certification Regime (SM&CR) requirements. The regulator acknowledges the scale of the transition: approximately 40+ currently registered firms and an unknown number of unregistered operators must navigate the process.
The UK framework arrives 18 months after the EU's Markets in Crypto-Assets Regulation (MiCA) became fully operative in December 2024. The two regimes share similar objectives but diverge in execution.
| Feature | UK FSMA Regime | EU MiCA | |---------|---------------|---------| | Passporting | None — UK authorization only | Cross-border passporting across EU member states | | Staking | Explicit consent, detailed disclosure, safeguarding | Not directly regulated under MiCA 1.0 | | Custody threshold | 24-hour rule + shadow custody definition | No equivalent time-based threshold | | Offshore access | Standard exemptions revoked | Reverse solicitation permitted in limited cases | | DeFi | "Same risk, same regulatory outcome" for identifiable entities | Excluded from MiCA 1.0; MiCA 2.0 consultation underway | | Advertising | Mandatory risk warnings, cooling-off periods, approval gates | Licensing and transparency focus | | Timeline | October 2027 | Fully operative December 2024 |
The UK's principles-based approach contrasts with MiCA's prescriptive rules. The FCA treats DeFi activities under a "same risk, same regulatory outcome" standard — entities with identifiable control are subject to regulation; truly decentralized activities without a business undertaker are exempt. MiCA excluded DeFi entirely from its first iteration; a MiCA 2.0 consultation is expected in late 2026.
On April 20, 2026, BIS General Manager Pablo Hernández de Cos warned in Tokyo that fragmented stablecoin regulation risks "severe" arbitrage opportunities, calling global coordination "critically important." The UK-EU divergence on custody rules, staking treatment, and DeFi scope illustrates precisely the fragmentation pattern de Cos described.
The UK is the largest cryptocurrency economy in Central, Northern, and Western Europe. According to the FCA's own consumer research (Wave 6, December 2025), approximately 8% of UK adults hold cryptoassets — down from 12% in 2024 — though average holdings rose from £1,595 to £1,842. Public awareness of crypto remains at 91%.
Separate Finder research from 2026 estimates 11% ownership, or approximately 6 million adults. Bitcoin is held by roughly 70% of UK crypto investors; Ether by approximately 35%.
The sector's UK turnover stands at £24.3 billion, according to The Data City, growing at 18.4% annually with a projected value of £30.4 billion by 2027.
Among registered firms, the list includes eToro, Fidelity, Galaxy Digital, PayPal, and Wintermute. The new regime will also catch currently unregulated entities: DeFi front-ends with identifiable UK operators, node operators offering value-added staking, and custody-adjacent software platforms.
The FCA's CP26/13 converts the UK crypto market from a registration-based AML regime into a full financial services authorization framework. The scope is broad: seven activity categories, explicit custody thresholds, staking governance requirements, and revoked offshore exemptions.
The practical question is throughput. The FCA's historical approval rate of 13% (47 of 359 applications) — even after recent improvements to 45% — suggests many firms will not survive the authorization process. Whether the regulator can process what may be hundreds of applications in a five-month window, while maintaining its stated standards, will determine whether the UK retains its position as Europe's largest crypto economy or pushes activity to jurisdictions with lighter requirements.
The framework's 24-hour custody rule and shadow custody doctrine will force architectural reviews across the industry. Firms that assumed they were technology providers — not custodians — may discover otherwise. The consultation closes June 3, 2026. After that, the rules are final and the clock starts.