The UK's new cryptoasset regulatory regime will take effect from 25 October 2027, requiring firms conducting relevant activities to have full Part 4A authorisation from the Financial Conduct Authority (FCA). This includes firms currently registered under the Money Laundering Regulations as cryptoasset exchange providers and custodian wallet providers, who now need to apply for full authorisation.
For existing businesses that are not yet FCA authorised and want certainty that they can continue to operate from 25 October 2027, the FCA's authorisation application window is already running and will close on 28 February 2027. Firms that already have Part 4A authorisation covering other regulated activities will need to obtain a variation of permissions, within the same application window, in order to conduct the cryptoasset regulated activities.
For firms that have not yet commenced the authorisation application process, action is now urgent. This note provides guidance on the steps firms should take.
Cryptoasset regulated activities and the regulatory perimeter
Eight regulated activities will apply in relation to qualifying cryptoassets:
- Issuing a qualifying stablecoin
- Safeguarding cryptoassets
- Arranging cryptoasset safeguarding
- Operating a qualifying cryptoasset trading platform
- Dealing in qualifying cryptoassets as principal
- Dealing in qualifying cryptoassets as agent
- Arranging deals in qualifying cryptoassets
- Arranging qualifying cryptoasset staking
"Qualifying cryptoassets" are cryptoassets that are fungible, transferable and are not simply a record of value or contractual rights.
Some of these activities are very broadly cast in the legislation, so firms will need to use FCA guidance to understand whether their own business operations truly fall within the new regulatory regime. The FCA has published Cryptoasset Perimeter Guidance (Policy Statement 26/18) and also proposed amendments to this guidance (Consultation Paper 26/36 published on 21 October 2026) (together "the Perimeter Guidance").
Key areas of clarification provided by the Perimeter Guidance include the following.
Qualifying cryptoassets and specified investment cryptoassets
A cryptoasset that falls within an existing category of specified investment is excluded from the definition of a qualifying cryptoasset and will therefore continue to be regulated under the existing framework, not the new regime. However, in the case of cryptoassets which are securities or contractually-based investments, safeguarding activities in respect of these cryptoassets will be come under the new regulated activity of safeguarding, or arranging safeguarding, of cryptoassets. Firms which have currently have permission for safeguarding and/or arranging safeguarding of assets will therefore need to consider whether they will require a variation of permission if they wish to safeguard or arrange the safeguarding of cryptoassets.
UK qualifying stablecoins
Certain transactions involving UK qualifying stablecoins (that is, qualifying stablecoins issued by a UK authorised person within the terms and scope of the regulated activity of issuing qualifying stablecoins) are excluded from the regulated activities of dealing in qualifying cryptoassets (as principal or agent) and arranging deals in qualifying cryptoassets. The exclusion is available where the activity relates to the transfer of a UK qualifying stablecoin to another person and/or the exchange of a UK qualifying stablecoin for money or another UK qualifying stablecoin.
The effect of the exclusion is that many payment-related activities involving UK qualifying stablecoins will not require permission for dealing in qualifying cryptoassets (as principal or agent) or arranging deals in qualifying cryptoassets.
Overseas firms
The FCA's Overseas Persons Exclusion is not available in relation to the new regulated cryptoasset activities. Firms operating cryptoasset businesses from outside the UK will need to assess carefully whether their activities fall within the territorial scope of the UK's cryptoasset regulatory regime. Section 418 (6C) - (6E) Financial Services and Markets Act 2000 (FSMA) expressly brings cryptoasset regulated activities performed from overseas with or for UK consumers into territorial scope.
By way of business
To constitute a regulated activity under FSMA, the activity must be conducted "by way of business". The FCA is applying a narrow concept of what it means to conduct a cryptoasset regulated activity "by way of business". A person must be in the business of engaging in the activity, meaning it must form part of the person’s business, rather than merely occurring in the course of other business activities carried on by that person, or merely because that person engages in cryptoasset markets.
The distinction will be important for retail participants in cryptoasset markets and for firms that hold, acquire, or use cryptoassets as part of treasury, investment, or operational activities, but which do not otherwise operate a cryptoasset business.
Automation and decentralisation
FSMA does not establish a separate concept of a ‘person’ for the purposes of regulated cryptoasset activities. The question of whether there is a person carrying on the activity should therefore be approached in the same way as for any other regulated activity. In cryptoasset arrangements, activities may be undertaken through software, smart contracts, distributed ledger technology, distributed governance mechanisms, or other technological arrangements.
The fact that an arrangement makes use of such technology does not determine whether there is a person carrying on a regulated activity. The fact that an arrangement is described as decentralised, or as a DeFi arrangement, does not mean that there is no relevant person. The fact that a function is performed automatically does not necessarily mean that it is not being performed by, or as part of an activity carried on by, a person. Automated arrangements necessarily operate according to their design and the inputs, criteria or parameters applicable to them. Depending on the facts, a relevant person may include a person who determines or materially influences that design or those inputs, criteria or parameters.
Relevant considerations may include the extent to which one or more persons determine, influence, operate, maintain, update, or exercise control over the relevant arrangements or the material criteria, parameters, or functionality through which they operate.
When business models involve some degree of decentralisation, this can make it more difficult to determine who is carrying on a regulated activity. Each case will turn on its own facts, which may vary substantially from case to case, especially because decentralisation operates on a spectrum. It may be that more than one person involved in the arrangements needs to be authorised or exempt. The analysis with respect to whether authorisation is needed should therefore be considered in respect of each person involved.
Technical service provider exclusion from the arranging activity
The exclusion applies where a person (‘A’) is neither an authorised person nor a payment service provider; A merely provides a technical service; that technical service allows another person to access services provided by a third person, or to access a decentralised protocol (‘V’); and one or both of the following conditions is met: (a) V is carrying on a regulated activity in relation to the services to which access is provided and is an authorised person or exempt person in relation to carrying on that activity; or (b) V is a decentralised protocol.
In the FCA’s view, this exclusion distinguishes the provision of technical access from substantive intermediation in respect of transactions in qualifying cryptoassets. The exclusion addresses the risk that a person whose role is confined to supplying non-discretionary technical functionality could otherwise fall within the potentially broad activity of arranging deals in qualifying cryptoassets merely because that functionality provides a means of accessing a regulated service or decentralised protocol used in connection with the arrangements. It does not remove from the perimeter persons whose involvement in the arrangements amounts to more substantive or discretionary intermediation in transactions.
Obtaining authorisation
Compiling the necessary detailed information to complete an authorisation application is not a quick process, even for firms that are already registered with the FCA as a cryptoasset business under the Money Laundering Regulations.
The FCA has endeavoured to set out clearly the information that will be required, for example the application guidance available through this page and this PDF.
On 2 November 2026 the FCA updated its guidance webpages adding a series of video guides for cryptoasset firms applying for authorisation.
The application needs to be submitted through the FCA's Connect platform, for which firms will first need to register. In preparing to submit an application firms should carefully consider the FCA's information document, which signposts numerous documents that will need to be uploaded including financial forecasts, certain compliance and systems documents, and information about key personnel and controllers.
For firms that fail to submit complete application information first time around , the timescale for obtaining information can be considerably extended as the FCA will pause the application while seeking further information. Firms may, therefore, wish to obtain assistance in preparing the application from an external expert compliance or law firm.
While in principle firms can ask for a pre-application meeting with the FCA through the pre-application support service, time is running short to do so if the 28 February 2027 application window is to be met.
How we can help
DACB's financial regulation experts are currently working with numerous cryptoasset businesses who will be seeking authorisation under the new regulatory regime. Please contact any of our authors for further information.
