The FCA’s crypto authorisation window opens on 30th September. For firms submitting applications and operating under the landing slot arrangement, the immediate compliance question is changing – from “are we ready to apply?” to “what happens now?”
The answer is not “less scrutiny.” It is different scrutiny. The FCA’s enforcement focus shifts from identifying firms operating without a lawful basis to assessing how firms within the regime are performing against their ongoing obligations. That is a qualitative change, and for firms that are treating September as the goal rather than the starting point, it is a more demanding one.
The Enforcement Pattern Since October 2023
The FCA has been building its crypto enforcement capability since the financial promotions regime came into force. The 413 promotions withdrawn or amended in 2024, the 20 individuals interviewed under caution, and the HTX proceedings in February 2026 are all part of the same build phase – the FCA establishing that it can and will act, against UK firms and overseas ones, through regulatory intervention and through the courts.
That build phase is not over. The FCA will continue to act against firms operating without a lawful promotion route, and the HTX proceedings made clear that overseas incorporation is not a defence. But the opening of the authorisation window marks a shift in emphasis. The FCA’s supervisory resource is increasingly focused on how authorised and registered firms are performing — not just whether they are within the regime.
Where Supervisory Attention Is Focused Now
Financial promotions quality in authorised firms. Having worked to bring firms within the regime, the FCA will now look at whether the promotions of authorised firms actually meet the standard. Risk warning prominence, appropriateness assessment substance, and the incentive prohibition are all in scope. The gap between documentation and operational delivery — which this series has covered in detail — is the lens the FCA applies.
Affiliate and partner channel oversight. The FCA has signalled this as a specific supervisory priority. Authorisation does not resolve the accountability question for affiliate channels — authorised firms remain responsible for promotions published on their behalf, and the FCA will be looking for evidence that oversight frameworks are functioning, not just documented.
Consumer Duty evidencing. The FCA’s two-year Consumer Duty review is expected later in 2026. Firms that cannot produce evidenced, outcome-based board reports will be in the FCA’s sights. The review is expected to result in targeted supervisory action.
AI and automated decision-making. As covered in last week’s piece, the FCA’s joint interest with the ICO in how firms use automated systems in customer-facing decisions is increasing. Appropriateness assessments, fraud detection, and customer segmentation are all areas where both regulators are paying attention.
Overseas firms. The HTX precedent holds. Overseas firms directing services at UK consumers remain within the FCA’s enforcement scope and the willingness to litigate demonstrated in February 2026 has not diminished.
What Changes for Firms Under Active Assessment
Firms who are submitting authorisation applications and who are operating under the landing slot arrangement are in a specific supervisory position. The FCA expects them to continue complying with all existing obligations while the application is assessed — and to respond promptly and completely to any requests for further information.
What is less well understood is that the FCA’s review of an application runs concurrently with its supervisory oversight of the firm’s ongoing activity. Evidence of compliance failures during the assessment period — in financial promotions, in Consumer Duty, or in data protection — is relevant to the FCA’s assessment of the firm’s governance and compliance capability. The assessment period is not a period of reduced scrutiny.
Worth asking:
Worth asking:
If your FCA supervisor requested evidence of your financial promotions monitoring framework, your Consumer Duty outcome data, and your affiliate oversight records today — could you produce all three, completely and quickly?
What the Firms Best Placed Have in Common
The firms managing the post-September supervisory environment most effectively share a consistent pattern. They moved from treating compliance as a project — something with a start date and an end date — to treating it as an operational function. Their financial promotions frameworks are evidenced. Their Consumer Duty board reports are substantive. Their affiliate monitoring is active, not contractual. And their senior management can account for all of this at the level of operational evidence, not policy documents.
That is what the FCA is looking for. It is also, increasingly, what the ICO is looking for in parallel on data protection.
If You Have Gaps
Post-September is also the moment when firms discover that the authorisation process — or the scrutiny that comes with it — has surfaced gaps they need to close. This is normal. What matters is how quickly and how systematically those gaps are addressed.
A structured remediation programme — working through each gap in order of regulatory risk, documenting progress, and building the evidence trail the FCA would expect to see — is materially different from an ad hoc response to individual issues as they surface. The FCA’s published guidance on how it views firms that self-identify and remediate proactively is clear: early, systematic remediation is treated differently from reactive remediation after supervisory contact.
If the authorisation process or this series has helped identify specific gaps in your framework, the next step is a structured conversation about what closing them looks like and in what order.
Final Thought
The opening of the September authorisation window is a regulatory milestone, not a finishing line. The firms that treated it as the goal will find that the FCA’s ongoing supervisory expectations require more than what was sufficient to apply.
The regulatory environment for crypto firms in the UK is more structured, more supervised, and more actively enforced than at any point in the sector’s history. That is not a temporary state — it is the direction the FCA has been moving since 2023, and authorisation accelerates rather than concludes that journey.
Speak to our team about where your firm stands — and what to do next.
Contact LHI Consulting for a free 30-minute consultation.
Book a free consultation
We help crypto firms assess their compliance frameworks against the FCA’s ongoing supervisory expectations — and close gaps systematically before they become supervisory issues.
Email: info@lhiconsult.com | Phone: +44 203 319 5147 | Web: lhiconsult.com
This article is for general information purposes only and does not constitute legal or regulatory advice. LHI Consulting is a trading style of LHI Holdings Ltd, registered in England and Wales, No. 11496647.
FAQs
Does FCA enforcement reduce once the authorisation window opens?
No. The opening of the window shifts the emphasis — from identifying firms operating outside the regime to assessing how firms within it are performing — but it does not reduce enforcement activity. Firms operating without a lawful basis continue to face enforcement risk. Authorised firms face ongoing supervisory scrutiny of their compliance.
Our authorisation application has been submitted. Do we need to do anything during the assessment period?
Yes. You should continue to comply with all existing obligations, respond promptly to any FCA requests for further information, and operate your compliance frameworks as if they were under active review — because they are. Evidence of compliance failures during the assessment period is relevant to the FCA’s assessment of your application.
We have identified gaps in our framework through the authorisation process. How should we approach remediation?
A structured approach — prioritising gaps by regulatory risk, documenting the remediation programme, and building an evidence trail of what was done and when — is significantly stronger than an ad hoc response. The FCA distinguishes between firms that identify and remediate proactively and those that respond reactively to supervisory contact. Early, systematic remediation is the stronger position.
We are an overseas firm. Does the authorisation window change our position?
Not significantly. The FCA’s position on overseas firms — established by the HTX proceedings — is that the regime applies to any promotion or service directed at UK consumers, regardless of where the firm is based. The authorisation window does not create an exemption for overseas firms.
What is the FCA’s Consumer Duty two-year review and when is it expected?
The FCA has indicated it will review Consumer Duty implementation approximately two years after the Duty came into force in July 2023. That review is expected later in 2026 and is anticipated to result in targeted supervisory action against firms where implementation has been weakest. Firms that have not built evidenced, outcome-based Consumer Duty frameworks should treat the period before publication as their last realistic window to address gaps proactively.