UK Crypto Authorisation Gateway Opens 30 September 2026: What Firms Need to File Before February 2027
The United Kingdom is moving from its existing crypto AML registration framework into full financial-services regulation.
From 7:00 a.m. on 30 September 2026, firms will be able to apply to the Financial Conduct Authority for authorisation to conduct the new regulated cryptoasset activities. The main application window runs until 28 February 2027, ahead of the new regime’s expected commencement on 25 October 2027.
The timing is commercially important. Firms that apply within the designated window can, subject to the statutory conditions, benefit from a saving provision if the FCA has not finally determined their application by commencement. Firms applying after the window may enter a materially narrower transitional position in which they can service certain pre-existing contracts but cannot take on new UK business.
Existing regulatory status does not solve the issue automatically. FCA registration under the Money Laundering Regulations 2017, authorisation or registration under the payment or electronic-money regimes, and existing FSMA permissions do not automatically convert into permission for the new cryptoasset activities.
For exchanges, custodians, stablecoin businesses, trading platforms, staking providers, fintech groups and overseas firms serving UK customers, the next step is therefore not simply “wait until 2027”. The authorisation process starts now.
For readers’ convenience, we have placed the key FCA and legislative materials at the end of this article.
Publish Date
30 Sep 2026
Reading Time
13 minutes
Category
Legal News
Jurisdiction
UK
The FCA gateway opens before the new regime starts
The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 were made in February 2026 and are expected to bring the full cryptoasset regulatory regime into force on 25 October 2027. The Regulations also allow the FCA to receive and determine applications in advance of full commencement.
The FCA has set a dedicated application period so firms can seek their permissions before the new rules become operational.
The application window runs from 30 September 2026 to 28 February 2027
The FCA’s online application system will accept cryptoasset authorisation and variation-of-permission applications from 7:00 a.m. on 30 September 2026.
The designated application period then closes on 28 February 2027.
This window matters because it is linked directly to the statutory transition arrangements.
The FCA has expressly encouraged firms to apply as early as possible within the application period and warns that poor-quality or late applications can create delays, refusals or disruption to existing UK activity.
Which crypto activities enter the UK FSMA perimeter?
The new regime goes considerably beyond the present AML-registration framework.
The FCA’s final perimeter guidance, published on 16 September 2026, addresses regulated activities including:
- issuing qualifying stablecoins;
- safeguarding qualifying cryptoassets;
- operating a qualifying cryptoasset trading platform;
- dealing in qualifying cryptoassets as principal;
- dealing as agent;
- arranging deals in qualifying cryptoassets; and
- qualifying cryptoasset staking arrangements.
The exact perimeter depends on the activity, business model, location and applicable exclusions.
The FCA emphasises that perimeter analysis is fact-specific. Labels used by a business are not determinative, and small differences in contractual or operational structure can change whether an activity is regulated.
Stablecoin issuance becomes a regulated activity
The statutory framework introduces a regulated activity for issuing a qualifying stablecoin.
The legislation looks at matters including the offering of the stablecoin, redemption obligations and the holding of assets intended to maintain its stable value.
Stablecoin businesses also need to monitor further UK developments carefully. The FCA has said it intends to update parts of its perimeter guidance following targeted government amendments affecting areas such as UK qualifying stablecoins and their interaction with other regulated activities.
Custody moves beyond AML registration
Safeguarding qualifying cryptoassets will sit inside the new FSMA perimeter.
For businesses currently registered as custodian wallet providers under the MLRs, this is one of the clearest examples of why existing registration cannot simply be carried forward.
The future regime includes broader conduct, prudential, governance and safeguarding obligations than the existing AML-registration framework.
Trading platforms, dealing and arranging become regulated
Cryptoasset trading-platform operators and firms dealing or arranging deals in qualifying cryptoassets also fall within the new perimeter.
These businesses will need to assess both the permissions required and the wider FCA rules applying to their activities, including the new market-integrity, prudential and conduct framework.
Staking is also inside the new perimeter
The framework captures qualifying cryptoasset staking where a person makes arrangements for another person’s cryptoassets to be used in staking.
That means staking-as-a-service models should be analysed against the statutory activity rather than assuming that technical participation in proof-of-stake networks remains outside financial-services regulation.
MLR registration does not become FSMA authorisation
This is one of the most important transition points.
Businesses already registered with the FCA under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 still need separate FSMA authorisation if they intend to conduct a regulated cryptoasset activity under the new regime.
The FCA states expressly that there will be no automatic conversion.
Existing MLR systems can help, but the standards are broader
An existing AML framework is not irrelevant.
The FCA says systems and controls maintained by MLR-registered firms can help demonstrate preparedness. However, firms also need to assess areas beyond the current AML framework, including market conduct, customer treatment and senior leadership.
FSMA authorisation also requires firms to satisfy the statutory Threshold Conditions.
These include:
- a suitable business model;
- effective supervision;
- appropriate financial and non-financial resources;
- suitability; and
- applicable requirements concerning the location of offices.
The FCA specifically warns existing crypto registrants that the FSMA fit-and-proper requirements for individuals are broader than those applying under the MLR registration framework.
Payment and e-money firms also need a separate perimeter review
The gateway is not relevant only to crypto-native firms.
The FCA expressly identifies businesses registered or authorised under the Payment Services Regulations 2017 and Electronic Money Regulations 2011 as potentially needing authorisation under the new crypto regime.
A payment institution or EMI that adds stablecoin, custody, trading or other cryptoasset functionality should therefore not assume that its existing regulatory status covers the new activity.
Where a business is already authorised under FSMA, it will generally need to consider a variation of permission rather than a completely separate first-time authorisation application.
Applying inside the window gives firms a stronger transitional position
The distinction between an in-window and a late application is one of the most commercially significant elements of the gateway.
In-window applicants may use the saving provision
The FCA expects applications made between 30 September 2026 and 28 February 2027 to be determined before commencement.
Where that does not happen, the statutory framework contains a saving provision allowing the firm, subject to the applicable conditions, to continue providing cryptoasset services while its application is finally determined.
That protection can continue where an FCA refusal has been referred to the Upper Tribunal and no final determination has yet been made.
The FCA retains powers in specified circumstances to move a firm from the saving arrangement into the more restrictive transitional provision.
This is not equivalent to guaranteed authorisation.
It is a mechanism designed to reduce the risk that firms making timely applications must stop operating merely because the FCA has not completed its assessment by commencement.
Late applications can restrict new UK business
Firms can still submit an authorisation or variation application after 28 February 2027 and before the full regime begins.
However, the FCA has made clear that late applicants will not receive expedited treatment simply because they missed the designated period.
More importantly, a firm that applies outside the window but is not authorised when the regime starts will generally enter the statutory transitional provision.
Transitional firms may be limited to pre-existing contracts
Under that arrangement, the business may only conduct the new regulated cryptoasset activities to the extent necessary to perform a pre-existing contract entered into before it entered transition.
The FCA states that such firms will not be able to:
- enter into new contracts with new UK customers; or
- enter into new contracts with existing UK customers.
That difference can have a substantial commercial impact.
A firm may technically remain able to service part of its existing book while effectively being prevented from normal customer acquisition or account expansion until authorisation is obtained.
Firms that do not apply must run off UK business
Businesses that do not intend to seek authorisation cannot rely on the saving or transitional provisions.
They must run off the relevant UK cryptoasset business before 25 October 2027.
Continuing a regulated cryptoasset activity without the required permission after commencement could breach the FSMA general prohibition.
For already authorised firms, carrying on activities outside their permissions can create a separate permissions breach.
This means a decision not to apply is itself a regulatory project.
The business needs a documented wind-down plan covering customers, assets, contractual obligations, complaints, custody arrangements and the point at which UK activity will cease.
Existing MLR applicants may need to run two processes
The opening of the FSMA gateway does not immediately abolish the current MLR registration requirement.
Until the new regime commences, businesses providing in-scope cryptoasset services in the UK must continue to comply with the existing MLR registration rules.
This creates a potentially awkward period for new entrants.
An unresolved MLR application does not become an FSMA application
Where an MLR application is still pending when the FSMA gateway opens, the firm still needs to decide whether to submit a separate FSMA application.
The FCA will determine the applications separately, even where assessment happens concurrently.
From 30 September, the FCA says it will encourage applicants to focus primarily on FSMA authorisation.
A business that still wants to pursue new MLR registration after the gateway opens should contact the FCA’s Pre-Application Support Service and explain why registration remains necessary.
Importantly:
- an MLR registration application cannot be treated as an FSMA application;
- MLR registration does not guarantee FSMA authorisation; and
- a refusal under the MLR regime does not necessarily prevent later FSMA authorisation if the firm subsequently meets the required standards.
The FCA has now published final perimeter guidance
Timing the gateway shortly after publication of the final perimeter guidance is deliberate.
On 16 September 2026, the FCA published PS26/18: Cryptoasset Perimeter Guidance, giving firms its current interpretation of when the new activities require authorisation.
The guidance is particularly relevant to:
- existing MLR registrants;
- payment and electronic-money firms;
- traditional financial institutions entering crypto;
- stablecoin issuers;
- crypto exchanges and custodians; and
- overseas businesses serving UK consumers.
Perimeter guidance is guidance, not legislation
The FCA also makes an important legal distinction.
Its PERG material represents the regulator’s interpretation of the statutory perimeter, but does not create, widen or narrow the regulated activities established by legislation, and it does not bind the courts.
Businesses with complex models should therefore analyse the underlying statutory provisions rather than relying only on high-level labels.
Further perimeter changes are already expected
The September guidance is not necessarily the final word before commencement.
The FCA says it plans further targeted consultation following government amendments concerning areas including:
- UK qualifying stablecoins;
- proprietary trading and market making;
- certain technology providers;
- decentralised protocols;
- certain safeguarding structures; and
- financial promotions.
For firms applying early, that creates an important drafting issue.
Applications need to reflect the current law and guidance while remaining adaptable to rule and perimeter changes made before October 2027.
Authorisation is broader than an AML application
Firms should not approach the FSMA gateway as a renamed MLR process.
The FCA published a major package of final crypto rules on 30 June 2026 covering:
- admissions and disclosures;
- cryptoasset market abuse;
- stablecoin issuance;
- regulated cryptoasset activities;
- prudential requirements; and
- application of the wider FCA Handbook.
Authorised firms will also need to operate within the broader standards that apply to FCA-regulated businesses.
Consumer Duty and senior-management requirements matter
The FCA’s current standards for future authorised crypto firms include the Principles for Businesses, Consumer Duty and Senior Managers and Certification Regime.
For firms that have operated primarily under AML registration, this can require significant changes to governance.
The authorisation project should therefore consider:
- allocation of senior-management responsibilities;
- governance and board oversight;
- product governance;
- customer outcomes;
- conflicts of interest;
- complaints;
- operational resilience;
- financial resources;
- regulatory reporting; and
- internal compliance monitoring.
Prudential readiness must be built before commencement
The FCA has also finalised its prudential framework for cryptoasset firms.
It states that all regulated crypto firms will face financial-resilience requirements, including capital and stress-testing expectations, with activity-specific requirements layered on top where relevant.
A credible application therefore needs more than policies.
The proposed financial model, capital position and ongoing ability to meet regulatory requirements must align with the permissions being requested.
What the FCA expects firms to prepare
The FCA has already published information to help applicants understand the application form and an updated financial data template for cryptoasset firms.
It also tells firms to complete a regulatory gap analysis before filing.
Permission mapping should come first
The application should begin with a clear description of what the business actually does.
Applicants should map:
- products;
- customer types;
- contractual flows;
- custody arrangements;
- transaction flows;
- staking arrangements;
- stablecoin activity;
- platform functions; and
- any non-crypto regulated services.
From that model, the firm can determine which permissions are required.
The FCA specifically expects firms to review their proposed scope of permissions against their business model and risk profile.
The implementation plan should have board ownership
The FCA recommends a realistic implementation plan agreed at board level.
That plan should identify:
- who is accountable;
- what needs to change;
- how changes will be delivered; and
- when implementation will be completed.
For a first-time FSMA applicant, this can be as important as the policy documents themselves.
PASS is available, but it is not regulatory advice
Firms can request an optional, free pre-application meeting through the FCA’s Pre-Application Support Service.
The FCA expects a meaningful submission before the meeting, including information on:
- business model;
- products and services;
- customer types; and
- analysis of the regulated activities for which the firm expects to apply.
The regulator may also request supporting legal analysis.
However, PASS does not provide legal advice and does not guarantee authorisation.
UK crypto regulatory timeline
| Date | Development | Practical significance |
|---|---|---|
| 4 February 2026 | Cryptoasset Regulations made | Legislative framework established for the new FSMA perimeter |
| 30 June 2026 | FCA final crypto rules published | Core conduct, stablecoin, prudential and market rules finalised |
| 16 September 2026 | Final perimeter guidance published | Firms receive detailed FCA guidance on which activities may require authorisation |
| 30 September 2026 | Gateway opens at 7:00 a.m. | Authorisation and variation-of-permission applications can be submitted |
| 28 February 2027 | Designated application window closes | Key date for access to the stronger saving arrangements |
| 25 October 2027 | New regime expected to commence | Regulated cryptoasset activities require the relevant FSMA permission |
What existing firms should do before filing
FCA MLR-registered firms
Existing registrants should not simply reuse their current AML application pack.
They should perform a full FSMA gap analysis covering governance, conduct, prudential requirements, Consumer Duty, senior management, operational resilience and activity-specific rules.
Existing FCA-authorised firms
Banks, investment firms and other FSMA-authorised entities should determine whether their current permissions cover the intended activity.
Where not, a variation of permission will be required rather than relying on existing authorisation.
Payment institutions and EMIs
Payments businesses entering stablecoin or broader crypto activity should map the crypto perimeter separately from their existing PSR or EMR permissions.
The fact that a business is already supervised by the FCA does not automatically authorise the new cryptoasset activities.
Overseas crypto firms
The FCA expressly identifies overseas firms providing cryptoasset services to UK consumers as within the audience for its new perimeter guidance.
Cross-border businesses should therefore analyse UK nexus, customer relationships and any available exclusions before assuming that an offshore entity can continue its current UK model after October 2027.
What firms should prioritise now
With the gateway opening on 30 September 2026, firms intending to remain active in the UK should be moving from policy monitoring into application preparation.
A practical workstream should include:
- Perimeter analysis — identify each current and planned regulated cryptoasset activity.
- Permission mapping — determine whether a new Part 4A application or variation of permission is required.
- Entity and governance review — confirm which group company should be authorised and where decision-making sits.
- Controller and senior-management preparation — identify relevant individuals and entities early.
- Regulatory gap analysis — compare current arrangements with the FCA Handbook and crypto-specific rules.
- Prudential modelling — test financial resources and stress scenarios against the future framework.
- Application documentation — align the business plan, financial data and policies with the actual operating model.
- Transition planning — understand the consequences of in-window filing, late filing or non-application.
Legasset assists crypto, fintech, payments and digital-asset businesses with UK regulatory perimeter analysis, FCA authorisation strategy, application preparation, governance, AML/CFT, stablecoin regulation and cross-border market entry.
For firms transitioning from MLR registration, payment/e-money permissions or an overseas operating model, we can also support the gap analysis between the existing structure and the new FSMA authorisation framework.
UK Crypto Authorisation Gateway FAQ
When does the FCA crypto authorisation gateway open?
The FCA gateway opens at 7:00 a.m. on 30 September 2026.
Firms will then be able to submit applications for authorisation or, where already authorised under FSMA, applications to vary their existing permissions.
When does the application window close?
The designated application period closes on 28 February 2027.
Applying within this period is particularly important for firms that may need to rely on the statutory saving arrangements if their application remains pending when the new regime starts.
When does the new UK crypto regime start?
The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 are expected to come fully into force on 25 October 2027.
Does an FCA MLR registration automatically convert into crypto authorisation?
No.
The FCA expressly states that there is no automatic conversion from MLR registration into FSMA permission.
An MLR-registered crypto business must separately obtain the relevant FSMA authorisation if its activities fall inside the new perimeter.
Do existing payment or e-money firms need another FCA permission?
Potentially.
Firms authorised or registered under the payment or electronic-money regimes must separately assess whether they carry on one of the new regulated cryptoasset activities.
Existing status under the PSRs or EMRs does not automatically provide cryptoasset permission.
What happens if a firm applies before 28 February 2027 but the FCA has not decided by October 2027?
Subject to the statutory conditions, an in-window applicant may benefit from the saving provision and continue providing relevant cryptoasset services while its application is finally determined.
The FCA has powers in certain circumstances to direct a firm into the more restrictive transitional arrangement instead.
What happens if a firm applies after 28 February 2027?
A late application can still be submitted before commencement.
However, where the firm has not been authorised by 25 October 2027, it may enter the transitional provision and generally be limited to performing pre-existing contracts.
It will not be able to enter new contracts with existing or new UK customers while relying on that provision.
What happens if a crypto firm does not apply at all?
A business that does not intend to apply must run off the relevant UK cryptoasset activity before the new regime commences.
Otherwise, it risks conducting regulated business without authorisation.
Can a firm still apply for MLR registration after 30 September 2026?
Yes, before the new regime begins, but the FCA says firms should focus on FSMA authorisation once the gateway opens.
A firm that still has a commercial reason to seek MLR registration after 30 September should contact PASS and explain its plans. The MLR and FSMA applications remain legally separate.
Which activities may require authorisation?
The new perimeter includes activities such as issuing qualifying stablecoins, safeguarding qualifying cryptoassets, operating cryptoasset trading platforms, dealing, arranging deals and qualifying cryptoasset staking.
The analysis remains fact-specific, and exclusions or other regulatory regimes may affect the result.
Is the September 2026 FCA perimeter guidance legally binding?
No.
The FCA states that its PERG guidance reflects its interpretation of the legislation but does not itself create, widen or narrow the statutory perimeter and does not bind the courts.
What should firms prepare before submitting an application?
The FCA expects firms to identify their required permissions, conduct a regulatory gap analysis, prepare a board-approved implementation plan and assess the resources and costs of authorisation and ongoing compliance.
The application also requires financial information tailored to the firm’s business model.
UK Crypto Authorisation: Official FCA and Legislative Materials
The FCA’s gateway page confirms the 30 September 2026 opening, 28 February 2027 closing date, application-form arrangements and the different saving, transitional and run-off positions available to firms.
II. Financial Conduct Authority — PS26/18: Cryptoasset Perimeter Guidance
The final September 2026 guidance explains when the new regulated cryptoasset activities may require FCA authorisation and how the new perimeter interacts with existing UK regulatory frameworks.
III. Financial Conduct Authority — Preparing for the New Cryptoasset Regulatory Regime
This FCA resource sets out what firms should do before applying, including permission mapping, regulatory gap analysis, board-level implementation planning and preparation for authorisation.
IV. Financial Conduct Authority — MLR Registration Ahead of the New FSMA Regime
The guidance explains how existing and new MLR registration applications interact with the FSMA gateway and confirms that MLR registration does not convert automatically into FSMA authorisation.
V. Financial Conduct Authority — Overview of the Final UK Cryptoasset Rules
The FCA’s June 2026 policy package brings together the final rules on stablecoins, regulated cryptoasset activities, prudential requirements, admissions and disclosures, market abuse and application of the FCA Handbook.
VI. Financial Conduct Authority — Standards for Authorised Cryptoasset Firms
This guidance explains the Threshold Conditions, fit-and-proper requirements, Principles for Businesses, Consumer Duty and other high-level standards relevant to future authorised crypto firms.
VII. UK Legislation — Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026
The statutory instrument creates the new cryptoasset regulatory framework, establishes the 25 October 2027 full commencement date and provides the legislative basis for advance applications, saving provisions and transitional arrangements.
