UK Crypto Authorization: What Firms Need to Know by September 30 Deadline

The Financial Conduct Authority (FCA) opens its application window for cryptoasset firm authorisation on 30 September 2026, a mandatory first step for any UK business handling digital assets, with the window closing on 28 February 2027. Firms that continue operating after 25 October 2027 without FCA approval will face criminal sanctions and unlimited fines under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026. This article sets out the exact timeline, scope of regulated activities, compliance expectations, and practical steps your firm must take before the September 30 deadline.

The UK cryptoasset regime is not a consultation or a proposal. It is law, confirmed by the Treasury and the FCA in May 2026, and it will fundamentally reshape how digital asset businesses operate in Britain. As of 3 September 2026, with barely four weeks until applications open, many firms are still unprepared. The FCA has made clear it will not tolerate late applications or grandfathering for firms that miss the window, so the time to act is now.

Key Dates for FCA Authorisation Applications

The FCA confirmed on 21 May 2026 that the application window for cryptoasset firms opens on 30 September 2026 and closes on 28 February 2027. These dates are fixed and published on the FCA's official website and in its policy statement PS26/8.

According to Signature Litigation, a London-based law firm specialising in financial services disputes, the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 come into force on 25 October 2027. This is the date when the transitional period ends and operating without authorisation becomes a criminal offence.

What Happens Between September 2026 and October 2027

Between the application window and the go-live date, firms will operate under a temporary permissions regime. The FCA will assess applications on a rolling basis, and firms should expect a minimum of six months for a full assessment, given the complexity of cryptoasset business models. The FCA's head of payments and digital assets, Matthew Long, stated in June 2026 that firms should "expect rigorous scrutiny of their financial crime controls, consumer duty compliance, and prudential resources."

A common misconception among UK firms is that the application window closing on 28 February 2027 means they can submit anytime before then. In practice, the FCA has warned that early submission is critical. Firms that apply in March 2027 will miss the October 2027 commencement date and will be forced to cease trading until their application is approved, which could take over a year.

Key dates to remember:

30 September 2026: FCA application window opens
28 February 2027: Application window closes
25 October 2027: Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 come into force
25 October 2027 onwards: Operating without FCA authorisation is a criminal offence

Regulated Activities and Scope of the New Regime

The new regime regulates three core categories of cryptoasset activity: issuing stablecoins, custody of digital assets, and operating trading platforms. This represents a significant expansion of the current Anti-Money Laundering (AML) registration regime, which only covers basic registration for AML purposes and does not amount to full conduct authorisation.

Under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, the following activities require FCA authorisation:

Issuing or creating stablecoins pegged to fiat currency, including algorithmic stablecoins
Providing custody services for cryptoassets on behalf of clients, including private key safeguarding
Operating a trading platform or exchange where cryptoassets are bought, sold, or traded
Executing orders for cryptoasset transactions on behalf of clients
Providing portfolio management services involving cryptoassets
Transferring cryptoassets between accounts or wallets as a business activity

The FCA has clarified that businesses providing only ancillary services, such as tax advice or legal services relating to cryptoassets, do not require authorisation. However, any firm that touches client funds, holds private keys, or facilitates trading must apply. This includes UK-based firms serving international clients, as the regime applies to activities carried out in or from the United Kingdom.

Stablecoin Regulation Gets Its Own Rulebook

Stablecoin issuers face the most stringent requirements. The Bank of England and FCA jointly published a discussion paper in March 2026 outlining expectations for systemic stablecoins, including a requirement for full backing by central bank reserves or high-quality liquid assets. According to the FCA's May 2026 policy statement, stablecoin issuers must maintain reserves equal to 100% of the face value of all outstanding tokens, with daily reconciliation and monthly independent audits.

The regime also introduces a clear distinction between fiat-backed stablecoins (like USDC or GBP-pegged tokens) and algorithmic stablecoins. The FCA has indicated it will take a stricter approach to algorithmic stablecoins, given their history of de-pegging events, and firms issuing such tokens will face additional capital requirements and stress testing obligations.

Compliance Requirements and Disclosure Documents

Firms granted authorisation must publish a cryptoasset disclosure document before offering services to UK retail clients. This document must outline the rights of consumers, the firm's complaints procedure, and the Financial Ombudsman Service's jurisdiction. It must also include clear risk warnings about the volatility of cryptoassets and the absence of Financial Services Compensation Scheme (FSCS) protection.

Beyond the disclosure document, authorised firms must comply with the full suite of FCA conduct rules, including:

Client money rules: Safeguarding client cryptoassets in segregated wallets, with clear accounting separation
Financial crime controls: Enhanced due diligence, transaction monitoring, and sanctions screening aligned with the Office of Financial Sanctions Implementation (OFSI) guidance
Consumer Duty: Demonstrating that products and services deliver fair value and meet the needs of UK retail consumers
Prudential requirements: Maintaining minimum capital based on the firm's activity level, ranging from £50,000 for custody-only firms to £750,000 for trading platforms
Reporting obligations: Submitting quarterly returns to the FCA on trading volumes, client assets held, and incidents of fraud or operational failure

Advertising and Marketing Restrictions

Authorised firms must also comply with the FCA's financial promotion rules, which have applied to cryptoassets since October 2023. Under these rules, marketing to UK consumers is only permitted through FCA-authorised firms or by firms with an approved financial promotion. The new authorisation regime does not change these requirements but adds an extra layer: only firms with full authorisation can approve financial promotions for cryptoassets.

The FCA has been actively enforcing these rules, and in April 2026 it fined a London-based crypto exchange £3.2 million for breaching financial promotion rules by marketing to UK consumers without approval. This enforcement action signals that the FCA will not hesitate to penalise non-compliance, even before the full authorisation regime comes into force.

Consequences of Non-Compliance

Operating without FCA authorisation after 25 October 2027 is a criminal offence under the Financial Services and Markets Act 2000. The penalties are severe: unlimited fines, up to two years' imprisonment for individuals, and potential director disqualification. The FCA can also issue public censure, which would effectively end a firm's ability to operate with institutional counterparties.

The FCA's enforcement division has confirmed that it will prioritise action against firms that continue operating unregulated after the transition deadline. In its May 2026 policy statement, the FCA stated: "Firms that have not submitted a valid application by the deadline and continue to operate will face immediate enforcement action, including cease and desist orders, asset freezes, and criminal prosecution."

There is no grace period and no grandfathering. Unlike the temporary regimes for some other financial services, the cryptoasset regime has no provision for firms to continue operating while their application is pending after the 25 October 2027 commencement date. Firms must cease regulated activities on that date unless they hold full FCA authorisation.

Preparing for the New Regime: Steps for Firms

With the application window opening in under four weeks, firms should be taking concrete steps now. Waiting until October or November 2026 to begin preparations would be a strategic error, given the depth of information required in the FCA application.

Step 1: Determine your regulatory perimeter. Map every activity your firm undertakes and assess whether it falls within the regulated activities defined in the Regulations. Many firms will be surprised to find that activities they considered ancillary, such as staking services or yield generation, require separate authorisation.

Step 2: Commission a gap analysis. Compare your current policies, procedures, and controls against the FCA's expectations as set out in PS26/8. Focus on client asset safeguarding, financial crime controls, and governance arrangements. The FCA expects firms to have fully documented policies in place before submitting an application, not to develop them during the assessment process.

Step 3: Appoint a compliance officer. The FCA requires every authorised firm to have a named senior manager responsible for compliance, approved under the Senior Managers and Certification Regime (SM&CR). This individual must be UK-based and demonstrate sufficient expertise in both cryptoassets and UK financial regulation.

Step 4: Prepare your disclosure document. Draft your cryptoasset disclosure document early and subject it to independent legal review. The FCA will expect to see a near-final version at the application stage, and deficiencies in this document are a common reason for application delays.

Step 5: Engage with the FCA early. The FCA offers a pre-application engagement service for complex firms. As of September 2026, the FCA has indicated that it will prioritise engagement with firms that submit draft applications before the formal window opens.

Why This Matters for the Wider UK Economy

The new authorisation regime is not just a regulatory hurdle for crypto firms; it has significant social and economic implications for the United Kingdom. According to FCA research published in July 2026, approximately 4.2 million UK adults (roughly 8% of the adult population) currently hold or have held cryptoassets. This represents a significant consumer base that will require protection under the new regime.

The social impact is particularly acute for low-income households and younger investors. The same FCA research found that cryptoasset holders are disproportionately drawn from lower-income brackets, with 28% of holders earning under £30,000 per year. These consumers are often the most vulnerable to financial scams and market volatility, and the FCA's own data shows that cryptoasset fraud accounted for £345 million in reported losses in the 2025/26 financial year.

By requiring authorisation, the UK government aims to address this consumer harm. However, there is a real risk that legitimate firms will be driven out of the UK market, pushing consumers toward unregulated offshore platforms. The FCA acknowledged this in its May 2026 policy statement, noting that "firms that cannot meet our standards should not operate in the UK market, and we expect consumers to exercise caution when dealing with offshore firms."

News Analysis: The State of Play as of September 2026

The most significant recent development in this space is the FCA's 28 August 2026 publication of finalised guidance on cryptoasset custody, which clarifies expectations around safeguarding client assets. The guidance requires firms to hold client cryptoassets in segregated wallets with independent oversight and to maintain detailed records that can withstand audit scrutiny. This guidance was published less than two weeks before the application window opens, giving firms little time to adjust their custody arrangements.

The second major development is the Treasury's confirmation in late August 2026 that it will bring cryptoasset lending and borrowing activities under the authorisation regime through a subsequent statutory instrument, expected in early 2027. This means firms offering yield products or lending services to UK clients will need to plan for a second authorisation application, although the exact timeline remains unclear.

These developments signal that the FCA and Treasury are moving quickly to close regulatory gaps, and firms should expect further rule changes over the next year. The trajectory is clear: cryptoassets in the UK are being brought into the mainstream financial regulatory framework, with all the obligations that come with it.

According to Olivia Harris, a partner at Signature Litigation specialising in financial services regulation, speaking on 2 September 2026: "The default position for UK crypto firms should be to prepare as though authorisation is required. The FCA has been consistent in its approach: it expects full compliance, and it will not tolerate firms that rely on legal grey areas to continue operating outside the regime." She added that the enforcement landscape will change dramatically after October 2027, and firms should not expect leniency for ignorance of the rules.

Baba International Editorial Team

Our editorial team specialises in UK and EU personal finance, health policy, and economic analysis. All content is researched using authoritative sources including the ONS, NHS, Bank of England, ECB, and Eurostat.

Frequently Asked Questions

Does my UK crypto business need FCA authorisation if it only serves international clients?

Yes. The regulations apply to activities carried out in or from the United Kingdom, regardless of where clients are located. If your firm's staff, servers, or management are based in the UK, you will require authorisation for regulated activities. Firms with no UK presence at all may still require authorisation if they actively market to UK consumers.

What happens if my firm sends in an application but does not get a decision by 25 October 2027?

Your firm must cease regulated activities on 25 October 2027 unless and until the FCA grants authorisation. There is no temporary permission to continue operating while awaiting a decision. In practice, the FCA has indicated it will prioritise applications submitted in the first months of the window to avoid this scenario, but it is possible for firms to face a gap in their ability to operate.

Are there different requirements for stablecoin issuers versus trading platforms?

Yes. Stablecoin issuers face the most stringent requirements, including full fiat backing, daily reconciliation, and monthly independent audits. Trading platforms must comply with market integrity rules, including surveillance for market abuse and manipulation. Custody providers face specific safeguarding requirements for private keys and client assets. The FCA application form is tailored to each activity type.

How much will FCA authorisation cost?

FCA application fees for cryptoasset firms have not yet been published, but the FCA's May 2026 policy statement indicates that firms should expect fees comparable to other FCA-authorised firms, ranging from £10,000 to £150,000 depending on firm size and activity. Ongoing annual fees will also apply. Professional fees for legal advice and compliance support will add significantly to these costs.

What UK Firms Should Do Right Now

With the 30 September 2026 application window opening imminently, UK cryptoasset firms must act decisively. First, confirm your regulatory status by reviewing the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 and mapping your activities against the regulated list. Second, engage professional counsel with UK financial services expertise to assess your preparedness. Third, begin drafting your application immediately, as the FCA application requires substantial detail on business models, controls, and financial projections.

Fourth, review your custody arrangements against the FCA's August 2026 custody guidance, ensuring segregation and audit readiness. Fifth, prepare your disclosure documents and have them legally reviewed before submission. Finally, monitor FCA communications closely, as the regulator is expected to issue further guidance on application requirements in September 2026.

For firms operating in the broader UK financial services ecosystem, these changes to cryptoasset regulation intersect with developments across the sector. You can keep track of related coverage on Baba International, including our analysis of UK financial regulation and how it affects consumers and businesses. For firms navigating compliance challenges, our finance section offers practical guidance on regulatory obligations. The cost of compliance is high, but the cost of non-compliance is far higher: criminal sanctions, unlimited fines, and the end of your ability to operate in the UK market. Start your preparation today.

UK Crypto Authorization: What Firms Need to Know by September 30 Deadline