The Financial Conduct Authority finalized its UK crypto rulebook on June 30, setting the stage for the next phase of regulation and turning it into a race for firms seeking to maintain full market access when the regime begins in 2027.
The shift is now operational, as the FCA says firms that want to carry out new regulated cryptoasset activities will need authorization under the Financial Services and Markets Act 2000, or a variation of permission if they are already authorized for other regulated business.
That requirement reaches firms already registered with the FCA under anti-money-laundering rules. Existing AML registration does not automatically convert to authorization under the future regime.
In practice, it is a new commercial filter: exchanges, custodians, stablecoin issuers, and other crypto firms have to decide whether the UK warrants a deeper authorization process, earlier compliance work, and ongoing supervision after approval.
The commercial question has expanded beyond whether a firm can meet current AML registration standards. It now includes a question of whether the firm can persuade the FCA that its business model, controls, products, customer base, and regulated activities are ready for a regime expected to start on Oct. 25, 2027.
The FCA gateway resets the access test
The FCA’s gateway guidance is blunt on the point that affects existing crypto firms. Firms seeking to undertake new cryptoasset-regulated activities will need FSMA authorization and the relevant permissions.
Firms already authorized under FSMA for other activities will need to vary their existing permissions. Firms registered under the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 face the same requirement for the new regime.
The regulator reiterates this separation in its MLR registration guidance, stating that MLR registration does not guarantee FSMA authorization and that MLR application forms cannot be converted into FSMA applications.
For firms already active in the UK, this creates a practical break between being within today’s AML perimeter and being permitted to conduct future regulated cryptoasset activities. AML registration may show a firm has passed one set of checks. It gives limited comfort for the new permission gate.
That is the core filter. A firm that sees the UK as strategically important will need to prepare a full authorization case. A firm that sees the UK as marginal must decide whether the documentation, governance work, and supervisory exposure are justified.
The answer may vary significantly among global exchanges, custody providers, stablecoin issuers, payments-linked businesses, and smaller firms that serve only a limited UK customer base.
The formal application period is expected to open on Sept. 30, 2026, and close on Feb. 28, 2027, according to the FCA’s gateway page and its application-period direction.
The same direction sets the window from 9:00 a.m. on Sept. 30, 2026, to 11:59 p.m. on Feb. 28, 2027.
Preparation begins earlier. The FCA says crypto firms considering operating under the new regime can request a pre-application meeting through its pre-application support service, known as PASS. Those meetings are expected to take place starting in July 2026, with scheduling as requests come in.
PASS is optional and free, with a high information threshold. Firms requesting a meeting must provide meaningful supporting information about their proposed business model, products and services, customer types, and analysis of the regulated activities they intend to apply for.
The FCA says it may ask for supporting legal advice and will reject requests that lack meaningful information. It also says pre-application meetings do not guarantee a successful application.
That makes PASS an early readiness test. A firm can apply without a meeting, but a firm that wants one must already understand which activities it plans to carry out and why those activities fall inside the new perimeter.
The firms best placed for the formal window are likely to be those that have already mapped products, permissions, governance, safeguarding, financial crime controls, and customer obligations before the gateway opens.
The FCA has given no indication of capped application numbers or of a strict first-come, first-served process. The bottleneck is more practical. Authorization is a detailed assessment process, and firms that arrive late receive no faster treatment as the regime approaches.
Timing determines the access risk
The gateway creates different outcomes depending on when and whether a firm applies. The important point for market access is that each route carries a different ability to keep or grow UK business once the regime starts.
| Firm position | Likely route | Main access consequence |
|---|---|---|
| Applies during the application period | FCA expects to determine the application before commencement; saving provision may apply while final determination remains pending | May be able to keep providing services while the application is determined, subject to FCA caveats |
| Applies outside the application period but before commencement | Application can still be submitted, with no expedited assessment to compensate for late submission | Without authorization by commencement, the firm may enter transitional status instead of full market access |
| Enters transitional provision | May conduct new UK regulated cryptoasset activities only as necessary for pre-existing contracts | Cannot enter new contracts with existing UK customers or new UK customers |
| No application | Must run off UK cryptoasset business before commencement | No access to saving or transitional provisions and possible unauthorized business risk if it fails to run off |
For in-window applicants, the FCA says it expects to determine applications before the new regime begins. If that assessment remains unfinished, the Treasury’s statutory instrument includes a saving provision that can allow a firm to continue providing cryptoasset services until the application is finally determined.
The FCA also notes caveats, including circumstances in which it may direct a firm into the transitional provision instead.
Late applicants face a different problem. The FCA says firms can apply outside the application period, but a late submission will receive no expedited assessment. If a firm applies after the window closes but before the regime starts, and lacks authorization by commencement, it will enter the transitional provision by operation of law while the application is determined.
That transitional route falls short of full access. The FCA says firms under the transitional provision will only be able to conduct new UK-regulated cryptoasset activities to the extent necessary to perform pre-existing contracts.
They cannot enter into new contracts with existing UK customers or new UK customers.
For a consumer-facing exchange, that could mean the difference between maintaining parts of a legacy book and competing for new UK users. For a custodian, it could affect whether new mandates can be signed.
For a stablecoin issuer or related service provider, UK planning could become a question of whether the business can secure the required permissions before the market becomes harder to access.
Firms that do not intend to apply, or that ultimately fail to apply before commencement, face the clearest route out. The FCA says they must wind down their UK cryptoasset business before the new regime commences.
Firms that fail to do so could risk conducting unauthorized business or, for firms already authorized under FSMA, acting without permission.
That makes the application window a point of sorting. Some firms may treat the UK as a core market and move early. Others may limit product offerings, pause expansion, or prepare for run-off if the authorization burden is too high relative to the available UK opportunity.
FCA guidance supports a readiness race shaped by timing, evidence, and assessment, with practical pressure coming from the impact of late status on new business.
Supervision is part of the access decision
The authorization race also carries weight because approval keeps the process open. The FCA says authorized cryptoasset firms will be subject to supervision.
It describes supervision as oversight of firms and individuals controlling firms to reduce actual and potential harm, with a focus on areas where harm is greatest and firms that pose higher risks to its objectives.
The FCA’s authorization, supervision and enforcement guidance also states that once authorized, crypto firms will be subject to enforcement powers.
Under FSMA, those powers include financial penalties, public censure, prohibition on individuals from engaging in regulated activity, and prosecution. The FCA says it will apply the same enforcement approach to firms and individuals carrying out new cryptoasset-regulated activities as it does to other regulated firms.
That changes the business case for UK access. The decision includes whether a firm wants to operate in the UK as a supervised financial services business, with the associated controls, documentation, governance, and conduct expectations.
That may favor larger firms with established compliance teams, experience in regulated markets, and sufficient UK revenue to absorb the operational burden. It may push smaller or more lightly staffed firms toward limited activity, delayed entry, or exit.
It may also force global firms to decide whether the UK deserves early internal priority alongside other regulatory projects.
The UK has tried to position its crypto regime as a way to bring activity into a clearer financial-services framework rather than leaving it on the fringes. The gateway is where that policy becomes operational.
Firms that want UK access will need to turn policy monitoring into application preparation, and application preparation into a case the FCA can assess.
The next meaningful signal will be whether crypto firms treat the UK application window as a strategic priority before it opens. A firm that requests PASS with a mature business model analysis is sending a different signal from a firm still trying to decide which activities need permission.
A firm that applies during the window may preserve more optionality than one that waits until the new regime is near. A firm that does not apply is effectively choosing a UK run-off path unless its business falls outside the new regulated activities.
That is why the FCA gateway is consequential now, even though the full regime is expected in 2027. The deadline that shapes commercial behavior includes the preparation cycle before the application window, the window itself, and the access risk that follows for firms that arrive late.
For UK crypto users and counterparties, the result may be a more selective market. For firms, it is a capital-allocation question: spend early effort to compete under FSMA authorization, accept a constrained route if timing slips, or decide the UK is outside the plan for the full process.
The FCA frames the gateway as an authorization process. Its guidance points to something more durable for the market: access will depend on authorization readiness alongside existing AML registration.
By 2027, the firms still competing for UK crypto business may be the ones that treated the gateway as a race long before the starting line became visible.