FCA Crypto Authorisation is the new comprehensive regulatory framework for cryptoasset activities in the UK, established under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, made by Parliament on 4 February 2026. The regime replaces the temporary Money Laundering Regulations (MLR) registration with a full FCA authorisation and supervision regime, bringing crypto activities into the same regulatory architecture as traditional financial services.
The timeline is phased: pre-application support (PASS) begins July 2026, the formal authorisation window opens 30 September 2026 and closes 28 February 2027, and rules become fully effective on 25 October 2027. In-scope activities include operating trading platforms, custody, arranging or executing deals, issuing stablecoins, staking, underwriting offerings, and cryptoasset advice. Firms currently MLR-registered must submit a full application during the authorisation window.
Key requirements include compliance with the Consumer Duty (including a 24-hour cooling-off period for new retail customers), Senior Managers and Certification Regime (SMCR), robust financial crime systems, market abuse controls (insider dealing, market manipulation, unlawful disclosure), adequate financial resources, and clear customer disclosures including that FSCS does not cover crypto losses. The FCA has enforcement powers including unlimited fines, public censure, and criminal prosecution for unauthorised business.
Real-World Example
A crypto exchange currently MLR-registered in the UK must, by 30 September 2026, submit a full FCA authorisation application covering all its regulated activities (operating a trading platform, arranging deals, and custody). The application must include a Consumer Duty implementation plan, SMCR allocation of senior management responsibilities, market abuse surveillance systems, financial crime controls, and a wind-down plan. If approved, the exchange becomes fully FCA-authorised by 25 October 2027. If it fails to submit an application by 28 February 2027, it must cease UK operations, or face criminal prosecution.