FCA opens crypto authorisation gateway, but new protections wait until 2027

The Financial Conduct Authority has opened the application gateway for cryptoasset firms seeking authorisation under the UK's incoming regulatory regime.

The gateway opened on 30 September 2026. Firms that need permission under the new regime have until 28 February 2027 to submit an application, before the rules take effect on 25 October 2027.

What has changed

Cryptoasset businesses can now begin applying for FCA authorisation covering regulated crypto activities. The FCA says it will assess firms against standards for consumer protection, safeguarding, market integrity and financial resilience.

Existing firms that apply during the application window may continue operating while the FCA considers their application, subject to the transition arrangements. New firms will need the appropriate permission before carrying on regulated activity once the regime begins.

Opening the gateway is therefore an administrative and regulatory milestone. It is not evidence that an applicant has passed the FCA's assessment.

What has not changed yet

The full regime does not start until 25 October 2027. Until then, the FCA's oversight of much of the crypto market remains limited primarily to financial promotions and anti-money-laundering controls.

Consumers should not assume that a firm's application, or its presence in the existing money-laundering registration regime, means it has been approved under the forthcoming framework.

The FCA continues to describe cryptoassets as high risk. Buyers should be prepared to lose all the money they invest.

What the new regime is intended to cover

The FCA's final rules are designed to bring a wider range of crypto activities within the regulatory perimeter. The framework includes expectations around the safeguarding of customer assets, the operation of trading platforms, disclosures, market abuse and firms' financial resilience.

The rules are intended to create clearer standards for firms and consumers. Regulation cannot remove price volatility, fraud, operational failure or the possibility of a total investment loss.

What this means for consumers

The important dates are 28 February 2027, when the application window closes, and 25 October 2027, when the new regime begins.

Before that start date, consumers should check the exact status of a business rather than relying on broad claims that it is "FCA registered" or has "applied to the FCA". Those descriptions do not establish that the firm has been authorised under the new regime.

Once decisions begin to appear, the FCA Register and official warning list should remain the starting points for checking a firm's permissions and identity. Consumers should also understand which activity, product and legal entity they are dealing with.

The Apolifina view

The application gateway is the beginning of a selection process, not a seal of approval for the crypto market.

The longer-term benefit should be a clearer distinction between businesses that meet the new standards and those that do not. The immediate risk is that firms or promoters blur the difference between applying, being registered for money-laundering supervision and receiving full authorisation.

For investors, the practical conclusion is simple: check what regulatory protection applies today, not what a firm hopes to obtain in 2027.

What remains uncertain

It is not yet known how many firms will apply, how many will be authorised or how long individual assessments will take. The commercial effect will also depend on which businesses adapt successfully and how consumers respond once the regime begins.

Further FCA guidance and individual authorisation decisions will provide more evidence. Until then, an application should not be treated as an outcome.

Continue reading: FCA warns about a Flagstone clone firm · How younger investors use AI · FCA warning on high-return mini-bonds · Stocks and Shares ISAs explained