There is a common assumption that the FCA’s upcoming cryptoasset regime only affects unregulated firms or those with AML registration. That’s incorrect.
If your firm is already authorised under FSMA and carries out — or plans to carry out — cryptoasset activities, you must apply for a variation of permissions (VoP) during the gateway window opening on 30 September 2026.
This is not a formality. You will need to demonstrate that your governance, systems, controls and financial resources are appropriate for cryptoasset activities. Assuming your existing framework will simply extend to crypto is a key risk.
What a Variation of Permissions Actually Involves
A VoP application is lighter than a full new authorisation, but it is not a tick-box exercise. The FCA will want to see that you have specifically addressed the risks and requirements of cryptoasset activities, not simply bolted them onto your existing arrangements. In practice, this means:
Updated governance arrangements. Your board and senior management need to demonstrate competence and understanding of cryptoasset markets, technology and risks. If nobody on your leadership team has crypto-specific experience, the FCA will notice.
Extended compliance framework. Your existing policies on AML/KYC, transaction monitoring and financial crime need to be updated to cover cryptoasset-specific risks — including wallet-based transactions, blockchain analytics, stablecoin flows and cross-chain activity.
Operational resilience review. Crypto markets operate 24/7 and involve technology risks (smart contracts, custody solutions, blockchain dependencies) that your current resilience framework may not address.
Financial promotions. Any marketing of cryptoasset products or services must comply with the FCA’s crypto-specific financial promotions rules, which sit alongside — but are distinct from — the promotions rules you already follow.
Capital adequacy. The FCA may impose additional prudential requirements for cryptoasset activities. Your capital adequacy assessment will need to account for the specific risks of the new business line.
Why Existing Firms Get This Wrong
The most common mistake we see is treating the VoP as an administrative step rather than a substantive compliance project. Firms assume their existing AML framework, governance structure and operational resilience arrangements are sufficient. In most cases, they are not — not because they are deficient for existing activities, but because cryptoasset activities introduce genuinely different risks that require dedicated policies, controls and expertise.
The second mistake is timing. Many authorised firms believe they can apply for the variation at any point. They cannot. The same five-month gateway window applies: 30 September 2026 to 28 February 2027. Miss it and your firm loses the benefit of transitional arrangements, meaning you would need to cease any new cryptoasset activities from 25 October 2027 until the variation is granted.
What to Do Now
- Scope the variation. Identify exactly which cryptoasset activities you are undertaking or planning, and map them against the FCA’s proposed permission categories. This determines the scope of your VoP application.
- Gap-analyse your compliance framework. Compare your current policies, procedures and controls against what the FCA expects for cryptoasset activities. Focus on AML/KYC, transaction monitoring, custody, operational resilience and financial promotions.
- Assess your governance. Does your board have the crypto expertise the FCA expects? Do your senior managers understand the technology and market risks? If not, consider training, advisory appointments or recruitment.
- Prepare the application. A VoP application still requires a business plan for the new activities, updated regulatory projections and evidence that your firm can manage the additional risks. Allow three to four months for preparation.
How LHI Consulting Can Help
We specialise in helping already-authorised firms extend their permissions into new areas. For firms preparing a cryptoasset VoP, we offer gap analysis against the new requirements, governance readiness assessment, compliance framework extension, financial promotions review and full application preparation and submission support.
| Need help preparing? Contact us for a free 30-minute consultation to assess your readiness.
Email: info@lhiconsult.com | Phone: +44 203 319 5147 | Web: lhiconsult.com |
This article is for general information purposes only and does not constitute legal or regulatory advice. LHI Consulting is a trading style of LHI Holdings Ltd, registered in England and Wales, No. 11496647.
