The FCA is finalising its regulatory framework via the Crypto Roadmap, which it aims to complete by October 2026. This is underpinned by two key legislative changes. The first is HM Treasury’s draft amendments to the Financial Services and Markets Act 2000 (Regulated Activities) Order 2001 (RAO), which defines the scope of the FCA’s new regulatory regime. The second is the Property (Digital Assets etc) Act 2025, passed in December 2025, which recognises digital assets such as cryptocurrencies, tokenised assets and stablecoins as personal property, giving them enhanced protection under UK law.
These changes have allowed the FCA to move forward with a series of consultations, discussion papers and draft Handbook provisions that cover both conduct and prudential requirements. To continue to offer regulated activities, crypto firms must assess the full implications of the proposed regime and prepare for FCA authorisation.
All firms will need FCA authorisation to carry out the cryptoasset activities listed in the draft RAO – including firms currently registered with the FCA under the Money Laundering Regulations 2017. Those firms already authorised under FSMA for other regulated activities will need to apply for a variation of permissions. Proposed authorised crypto activities are:
The new regime will have a broad territorial reach and cryptoasset firms serving UK customers will typically be in scope, even if they’re based overseas. As such, firms must assess their current and prospective business model to identify which activities will be regulated, and if any exemptions or exclusions apply.
The FCA authorisation window runs from 30 September 2026 until 28 February 2027, with the regime applying from October 2027. With a short timeframe until implementation, applicants need to demonstrate how they meet FSMA requirements, based on the nature, scale, and complexity of their activities. Key elements include:
Firms are expected to have all the necessary plans, arrangements and resources in place to support FCA regulation at the time of submission – to the extent that this is reasonable and practicable. This echoes the FCA’s expectation for firms to take regulation seriously and be “ready, willing and organised” to comply on an ongoing basis.
The time and effort required for the authorisation process should not be under-estimated and firms can significantly benefit from the FCA’s pre-application support (PASS) service and information sessions. Once the assessment process begins, the FCA doesn’t usually accept significant changes to the proposed business model, or put applications on hold for extended periods. So, effective pre-submission preparation is vital.
The breadth of FCA authorisation requirements will represent a significant shift for many firms, in terms of governance, oversight and risk and control frameworks. As a starting point, firms should consider the following key questions and take steps to progress the related actions and priorities that might arise from them.
Governance, systems and controls:
Business model analysis:
Prudential and financial resilience:
IT and operational risk:
Operational resilience:
Compliance and business standards:
The above list is non-exhaustive but gives a good overview of what the FCA is looking for, and the general approach crypto firms need to take. To get started, firms should:
For existing firms that don’t meet the necessary standards for authorisation or choose to strategically exit the UK market, the FCA will provide a transitional provision to help them to run-off their UK business in an orderly way.
For further information, contact Paul Staples.
