Regulatory Influencer: Navigating the FCA’s New FSMA 2000 Cryptoasset Regime Authorisations in the UK

On January 29, 2026, the UK’s Financial Conduct Authority (FCA) held a webinar setting out its supervisory expectations for the forthcoming UK cryptoasset regulatory framework. This follows HM Treasury’s 2023 proposals to bring cryptoasset activities within the regulatory perimeter and the subsequent laying before parliament of the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2025, which will place these activities formally under FCA oversight. 

Subject to parliamentary approval, the regime is expected to take effect on October 25, 2027. The webinar placed particular emphasis on the authorisation gateway, with the FCA signalling that firms should begin structured preparation now, including early engagement with their pre-application support service (PASS) to assess how the regime will apply to their business models well in advance of any application.

This is demonstrative of a wider supervisory strategy aimed at promoting early readiness among in-scope firms, indicating a deliberate effort by the FCA to shift firms to proactive compliance planning, with authorisation strategy, governance enhancements and control framework development positioned as near-term priorities rather than deferred implementation tasks.

The bigger picture

The FCA has confirmed that UK cryptoasset firms will move from the current anti-money laundering (AML) registration framework to a full authorisation regime under FSMA. This represents a significant step up in regulatory expectations at the gateway, bringing crypto firms more closely in line with standards applied to traditional financial services.

At present, cryptoasset businesses carrying on certain activities in the UK must register with the FCA under the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 (MLRs) and comply with those requirements. The shift to a FSMA-based regime signals a transition from a primarily financial crime-focused framework to a broader prudential and conduct regulatory model.

Difference in scope between the MLRs and FSMA

Source: FCA Webinar

Compared with the current AML registration model, the new regime places crypto firms on a much broader supervisory footing that mirrors traditional regulated firms. It is no longer sufficient to focus on AML controls alone; firms must demonstrate comprehensive governance, operational robustness, client protections and risk management across all aspects of their business — before authorisation is granted.

Firms entering the entirety of the FCA’s regulatory perimeter for the first time may be shocked by the breadth and depth of the FCA Handbook. Some of the key areas that cryptoasset firms preparing for authorisation should familiarise themselves with are outlined here:

• Operational Resilience: The FCA's Senior Management Arrangements, Systems and Controls sourcebook (SYSC) 15A (Operational Resilience Requirements) and related systems and controls under SYSC, which requires firms to implement robust governance, including effective risk management.
• Outsourcing Arrangements: SYSC 8 (Outsourcing), which outlines how firms must manage risks associated with outsourced and critical third-party relationships.
• Client Assets: The FCA’s Client Assets Sourcebook (CASS) already sets out detailed rules for custody, segregation, reconciliations and record-keeping; the FCA has indicated these will apply or be adapted for crypto custodians.
• Governance & Senior Management Accountability: The new regime will apply established governance expectations, including: Principles for Businesses (PRIN), Threshold Conditions (COND) and the Senior Managers & Certification Regime (SM&CR) — requiring clear responsibilities, fitness & propriety assessments, and oversight functions.

The existing Handbook should be read alongside ongoing consultation proposals on how these rules will be adapted for cryptoasset firms, for a holistic understanding of regulatory expectations:

• CP25/40: Regulated Cryptoasset Activities
• CP25/41: Regulating Cryptoassets: Admissions & Disclosures and Market Abuse Regime for Cryptoassets
• CP25/42: A prudential regime for cryptoasset firms
• CP26/4: Application of FCA Handbook for regulated cryptoasset activities – Part 2
• GC26/2: Application of the Consumer Duty to cryptoasset firms

Understanding the authorisations journey: authorisation or variation

Cryptoasset firms in scope of the proposed legislation with ongoing activity and services within the UK will be expected to apply for authorisation within the application period of September 30, 2026 to February 28, 2027, for timely approval before the commencement of the regime. 

However, firms that are already authorised under FSMA will not be required to apply for authorisation, but rather a variation of permission (VoP) to undertake regulated cryptoasset activity.

It should be noted that firms currently registered with the FCA under the MLRs will not be automatically converted to the new regime and will need to secure authorisation. 

Additionally, cryptoasset firms that are currently using the services of another FCA-authorised firm to approve their financial promotions (known as an s.21 approver) will no longer be able to do so and will likewise require authorisation to continue their activities.

Understanding the authorisations journey: saving and transitional provisions

Source: FCA Webinar

The regulatory framework establishes two distinct mechanisms governing firms' operational status during the regime transition: the Saving Provision and the Transitional Provision. Eligibility is determined by application timing and methodology, independent of FCA discretion. However, the FCA may direct that a firm operating under the Saving Provision should instead enter the Transitional Provision.

Broadly put, three operational scenarios could emerge as firms begin the authorisation process:

1. Firms applying within the application window: Applications submitted during the designated period are expected to receive a determination prior to regime commencement. Should determination extend beyond commencement, the Saving Provision permits continued cryptoasset service provision, including new business acquisition, pending final determination.

2. Firms applying outside the application window: Applications submitted after the designated period but before regime commencement trigger the Transitional Provision if undetermined at commencement. Under this provision, firms may service existing UK customers exclusively but are prohibited from acquiring new UK business until authorisation is granted.

3. Firms that do not apply: Firms electing not to pursue authorisation must run-off their UK business prior to regime commencement. No access to Saving or Transitional Provisions is available. Failure to complete run-off exposes firms to potential prosecution for unauthorised business conduct or for operating without permission.

Why should you care?

Firms should care because the shift to a full FSMA authorisation regime significantly raises the regulatory bar and makes the upcoming authorisation a critical dependency for doing business in the UK crypto market. Failure to secure authorisation on a timely basis could restrict not only a firm’s ability to continue providing existing services, but also delay or prevent planned product launches, market expansion or strategic partnerships that depend on regulated status.

Beyond the immediate gateway, the regime has longer-term implications for how crypto businesses are structured and run. Authorisation will require firms to evidence sustainable governance frameworks, clearly allocated senior management responsibilities and robust control environments that can scale with the business. Approaching this as a forward-looking transformation exercise, rather than a narrow compliance task, will better position firms to meet supervisory expectations, support growth plans, and operate with greater credibility in an increasingly regulated market.

Next steps and upcoming key dates

Source: FCA Webinar

• January-June 2026: The FCA will engage with industry through a series of webinars during this period; the topics of the webinars have yet to be decided, but the FCA has indicated that they will be industry-led. Firms should take advantage of the series to ask pressing questions or raise any edge cases.
• July 2026: Pre-application support service opens for the cryptoasset authorisation gateway. Firms should make use of the service to better understand the FCA’s expectations. The FCA has confirmed that the proportionality principle will apply for the small firms seeking authorisation, and relevant firms should utilise PASS to understand how this will be applied in practice. The FCA has also confirmed that firms can have multiple PASS meetings prior to the actual application.
• September 30, 2026-February 28, 2027: The FCA has underscored its expectation that firms already conducting relevant UK business, including those registered under the MLRs, should submit applications within this window. It expects that all applications received during this period will receive a determination before the regime commences and has resourced itself accordingly.
• October 25, 2027: New regime commences on this date, subject to final approval from parliament.