Some crypto firms are treating September as a distant deadline. It isn’t.
The FCA’s authorisation application window opens on 30 September 2026 – that is less than four months away and the firms that are not prepared by then face consequences that go well beyond a compliance gap.
This is not an extension of the existing registration system. It is a replacement of it. And the standard being applied is categorically different from anything the sector has had to meet before.
What Is Changing and When
On 25 October 2027, the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 come into force. From that date, carrying on regulated cryptoasset activities in the UK without FCA authorisation will be a criminal offence.
The authorisation application window opens on 30 September 2026 and closes on 28 February 2027. Firms that submit within this window can continue operating during the transition period while their applications are processed. Firms that miss it cannot take on new cryptoasset business while they wait. The FCA has been explicit: there is no grace period for late applicants, and no automatic conversion for firms already registered under the Money Laundering Regulations.
Five activities fall within the new regulatory perimeter: operating a cryptoasset trading platform; dealing in qualifying cryptoassets as principal; arranging deals in qualifying cryptoassets; safeguarding cryptoassets; and arranging qualifying cryptoasset staking. If your business carries out any of these activities and serves UK customers, you will need to be authorised — or qualify for a specific exemption.
Readiness Audit
We are helping crypto firms assess their readiness ahead of the September window. If you would like to understand where your firm stands, speak to our team.
Why AML Registration Is Not Enough
Many firms currently operating in the UK are registered with the FCA under the Money Laundering Regulations. That registration is not a stepping stone to authorisation. It does not carry over, it does not reduce the assessment burden, and it does not demonstrate the things the FCA will now be looking for.
The MLR registration process assesses whether a firm has adequate anti-money laundering controls. The authorisation assessment is a different exercise entirely. It covers business model viability, governance arrangements, the competence and fitness of senior individuals, compliance resourcing and structure, consumer protection policies, and operational resilience. For most firms currently operating under AML registration only, the distance between where they are and where they need to be is significant.
This is not a criticism of how firms have been operating. It is a reflection of how much the regulatory bar has moved. The new regime brings cryptoassets within a framework comparable to that applied to traditional financial services firms — and the preparation required reflects that.
The Timeline Is Tighter Than It Looks
The window opens on 30 September. But that date is not the moment to start preparing – it is the moment to submit.
The FCA has indicated that earlier applications will receive earlier allocation of case officers. Given that the assessment process typically takes six months, a firm submitting on 30 September has a materially better prospect of being authorised before the regime goes live than one submitting in February. The queue matters.
More importantly, the preparation required cannot be compressed into a few weeks. Building or evidencing a compliant governance framework, documenting consumer protection policies, demonstrating operational resilience, and presenting a coherent business model to the FCA’s standard takes time — particularly for firms that have not previously been through an authorisation process. Firms that begin in August will not be ready.
The firms that will navigate this well are those that start the gap analysis now, identify what needs to be built or documented, and give themselves enough runway to do it properly.
Worth asking:
If the FCA assessed your firm’s governance, compliance structure and consumer protection policies today, could you evidence them to the standard required for authorisation? If the answer is uncertain, that is where to start.
What This Means for Financial Promotions
There is an additional consideration for firms currently relying on a section 21 authorised person to approve their crypto marketing. Under the new regime, firms communicating financial promotions for cryptoasset services to UK consumers will need to hold direct FCA authorisation to do so. The third-party approver route will not remain available in the same form once the full regime takes effect in October 2027.
For firms that have been managing their promotions compliance through an approver arrangement, authorisation is not just a question of operational continuity — it is the only route to continuing to market to UK consumers lawfully. That makes the September window directly relevant to the marketing function as well as the compliance function.
The financial promotions regime that has been in force since October 2023 remains fully applicable in the meantime. The two obligations run in parallel. Firms that have not yet reviewed their promotions framework against the current rules have two problems to address, not one.
What Good Preparation Looks Like
The firms that are approaching this well share a consistent starting point: they have mapped their activities against the new regulatory perimeter and confirmed what authorisation they need to apply for. From there, the work falls into roughly three areas.
Governance and senior management. The FCA will assess whether the individuals responsible for running the business are fit and proper, whether responsibilities are clearly allocated, and whether the governance structure is appropriate for the scale and risk profile of the firm. For many firms this requires documentation that does not currently exist in a form the FCA will recognise.
Compliance framework and resourcing. Authorisation requires a credible compliance function — not just a compliance policy. The FCA will want to understand how compliance is staffed, how it operates in practice, and how it interfaces with the business. Firms that have been running lean on compliance under the MLR registration model will need to think carefully about what this requires.
Consumer protection and operational resilience. Policies need to be documented, tested, and evidenced. The FCA’s assessment is not satisfied by a statement of intent. It requires demonstration that the systems and controls are in place and functioning.
None of this is beyond reach for a well-run firm. But none of it happens quickly.
Final Thought
The September window is the most consequential deadline the UK crypto sector has faced. Missing it does not just mean a delayed application — it means an inability to take on new business, potential criminal exposure, and a firm that is effectively frozen while competitors who prepared in time continue to operate.
The question is not whether to apply. For most firms serving UK customers, there is no choice. The question is whether your firm will be ready to submit a credible application on 30 September and if there is any doubt, the time to address it is now.
| Get in touch
We are currently supporting crypto firms with compliance health checks – ahead of the September window. If you are keen to understand where your firm stands, contact us today:
FAQsWhen does the FCA’s crypto authorisation window open? The application window opens on 30 September 2026 and closes on 28 February 2027. The full authorisation regime comes into force on 25 October 2027. Firms that apply within the window can continue operating during the transition period while their applications are assessed. Does my existing FCA registration under the Money Laundering Regulations count towards authorisation? No. MLR registration does not convert to authorisation and does not reduce the assessment burden. Every firm must submit a full application and be assessed against the authorisation criteria, which are substantially more extensive than those applied under the registration process. What types of crypto business need FCA authorisation? The regime covers most firms actively operating in the UK crypto market. This includes crypto exchanges and trading platforms where users buy, sell or swap tokens; firms buying and selling crypto from their own balance sheet such as market makers and OTC desks; brokers and intermediaries that arrange crypto transactions on behalf of clients; businesses holding or safeguarding crypto on behalf of clients, including custody providers and wallet services; and firms offering crypto staking services to clients. Stablecoin issuers whose tokens are used as a means of payment are subject to a related FCA regime already in force. If your firm operates in any of these areas and serves UK customers, the starting assumption should be that authorisation is required. What happens if we miss the application window? Firms that do not apply by 28 February 2027 will not be permitted to take on new cryptoasset business while their application is pending. From 25 October 2027, carrying on regulated cryptoasset activities without authorisation is a criminal offence under UK financial services law. How long does the authorisation process take? The FCA’s target is to process applications within six months of receipt. Earlier applications receive earlier case officer allocation, which means firms submitting in October 2026 are in a materially better position than those submitting in early 2027. Given the preparation required before submission, firms should be starting their gap analysis now |