The UK cryptoasset regime: the FSMA gateway, 30 September 2026 to 28 February 2027

From registration to authorisation: what changes

Today's UK regime for those cryptoassets rests on registration under the Money Laundering Regulations plus the financial-promotions rules for marketing to UK consumers. The new architecture is different in kind: full authorisation under FSMA, the same statutory gateway through which banks and investment firms pass, with threshold conditions, ongoing supervision and the FCA Handbook applied to crypto business. Once authorised for the new activities a firm no longer registers separately under the MLRs (registration under regulation 54(1A) of the MLRs, as substituted by SI 2026/102, remains for exchange and custodian wallet providers that are not authorised cryptoasset firms), and the anti-money-laundering obligations themselves continue.

The legal foundation is the government's cryptoasset legislation, published in draft with a policy note on 29 April 2025 and laid before Parliament in draft. It was made on 4 February 2026 as SI 2026/102, and regulation 40(5) inserts a new Chapter 2B into the Regulated Activities Order specifying seven new regulated activities: issuing a qualifying stablecoin from a UK establishment (article 9M); safeguarding qualifying cryptoassets and relevant specified investment cryptoassets, which also captures arranging for a person to carry on that activity (article 9N); operating a qualifying cryptoasset trading platform (article 9S); dealing in qualifying cryptoassets as principal (article 9T); dealing as agent (article 9W); arranging deals (article 9Y); and making arrangements on behalf of another person for qualifying cryptoasset staking (article 9Z6). Anyone carrying on these activities by way of business in the UK will need FCA permission for each activity performed, and the FCA's new-regime hub now frames the whole programme.

The rulebook took shape through 2025 and 2026

The FCA built the substance in public. CP25/14 consulted on stablecoin issuance and cryptoasset custody, the two activities where prudential and client-asset questions bite hardest; the stablecoin issuance activity has three elements in the statute: article 9M(2) requires an offer for sale or subscription from a UK establishment (paragraph (a)), creation of the coin by or on behalf of the issuer or its group (paragraph (b)), and, as the two components of paragraph (c), an undertaking to redeem and the holding of assets to maintain the stable value, the three components the Explanatory Memorandum describes at paragraph 6.9. Article 9M(3) disapplies minting from the offer element in paragraph (2)(a) alone; the activity as a whole is untouched.

CP25/40 covered the regulation of the trading and dealing activities, with the Handbook application completed in CP26/4, perimeter guidance consulted in CP26/13 and finalised in PS26/18 on 16 September 2026, and the application of the Consumer Duty to cryptoasset firms addressed in GC26/2. The FCA's policy statements overview describes the June package as a significant package delivered as part of the Cryptoasset Roadmap and lists further consultations still to come, including on cryptoasset firm failure.

Two design choices deserve emphasis. The first is that the UK, like Switzerland and unlike the EU, extends its existing financial-services statute to crypto in place of a separate code, so crypto firms inherit the machinery built for financial institutions: threshold conditions, senior management accountability and the Consumer Duty.

The second is that the perimeter starts in the statute, with guidance following: regulation 41(6) inserts three new cases into section 418 of the Act. The ninth case treats qualifying stablecoin issuance as carried on in the UK where all of the article 9M(2) elements are carried on there; the tenth treats operating a trading platform, dealing as principal or agent and arranging (articles 9S, 9T, 9W and 9Y) as carried on in the UK where the firm is involved in a sale or subscription to or by a UK consumer and no firm authorised as a trading-platform operator or principal dealer stands between the two, acting in that capacity as intermediary (an authorised agent or arranger does not count); and the eleventh catches safeguarding (article 9N) and arranging staking (article 9Z6) carried on for a UK consumer unless the firm acts at the direction of a person authorised for that same activity. For these purposes a consumer is an individual in the United Kingdom acting outside their trade, business or profession. The test is narrower than a general activities-into-the-UK test, which makes section 418 and PERG 18 joint reading for any non-UK firm with UK customers.

The substance is now settled in the policy statements of 30 June 2026 (PS26/9 to PS26/13). PS26/10 requires UK-issued qualifying stablecoins to be backed one-for-one by short-term deposits and short-term government debt, with at least 5 per cent of the pool in on-demand deposits, a composition requirement where an issuer uses expanded assets, the pool held on statutory trust for holders under CASS 16, and redemption at par as soon as practicable and no later than the end of the business day after the day on which the issuer receives the coin, a redemption counting as completed when the issuer makes the payment order or, where it operates the holder's payment account and needs no transfer to another payment service provider, credits that account (CRYPTO 2.4.14R, 2.4.18R and 2.4.19R, made by the Cryptoassets (Stablecoins) Instrument 2026). The time limit does not apply where meeting it would breach a legal requirement or court order, including under the money laundering legislation, where the holder asks for another currency, the exchange takes longer and the holder was told the likely timeframe when enquiring, or where redemption is suspended (CRYPTO 2.4.20R), and the FCA states that it expects issuers to carry out anti-money-laundering checks before accepting the coin. PS26/11 applies the client-asset regime to custodians through a new CASS 17, adapted to on-chain holdings, so that client cryptoassets sit outside the firm's estate on failure, while stating that CASS 17 will not at this stage apply to custody of relevant specified investment cryptoassets, which stay under CASS 6; the FCA's guidance on international firms uses that protection as the reason it expects safeguarding to be done from a UK legal entity.

Two September developments sit on top. The FCA finalised the perimeter guidance in PS26/18, a new PERG 18 with a further consultation planned for the fourth quarter of 2026, following the amending regulations. And on 15 September 2026 the Treasury laid draft amending regulations under the affirmative procedure, not yet approved or made, which would among other things recast the stablecoin issuance offer element, carve transfers and exchanges of UK-issued stablecoins out of dealing and arranging, add safeguarding, proprietary-trading and technical-services exclusions and make stablecoin issuance a controlled activity for promotions. The draft would come into force on the day after the day on which it is made (draft regulation 1(2)), except that its direct amendments to the Regulated Activities Order and the Financial Promotion Order would come into force on 25 October 2027 with the regime (draft regulation 1(3)). Its changes to SI 2026/102 itself would come into force on that day after making, while the amended provisions of SI 2026/102 would continue to take effect on the dates that instrument fixes; draft regulation 4(2) changes those dates only for three consequential amendments (regulations 43, 46 and 47), which would come into force 21 days after the draft does. The Treasury's policy note accompanies the April 2026 exposure draft. At the date of this update the draft had not been approved by either House and remained a draft.

The gateway: 30 September 2026 to 28 February 2027

The gateway opened on 30 September 2026. The FCA fixed the period by direction on 20 February 2026: 9:00am on 30 September 2026 to 11:59pm on 28 February 2027, and no amended direction has been published. Its gateway page, updated on the opening day, states that the application period started on 30 September 2026 and will close on 28 February 2027, that applications are made through the FCA's Connect system with a financial data template, and that a firm already authorised under FSMA applies to vary its permission and submits the FCA's cryptoasset form for variation applications as part of that application; the FCA's press release of the same day, "FCA opens the gateway to regulated crypto", states that authorisation is not automatic. The application fees are in the Cryptoasset Activities (Periodic and Application Fees) Instrument 2026 (FCA 2026/58, made on 24 September 2026), whose application-fee provisions have been in force since 30 September 2026. The FCA has also proposed, in CP26/32 (closed 12 October 2026), targeted deferrals for platform operators and intermediaries; the proposed deferral of the admissions requirements would be available only to operators that apply within the window and list the affected assets in their application. The statutory instrument does not fix the application period itself. Regulation 52 requires the FCA to fix the period by direction not later than one year before the full commencement day, for at least 28 days and ending at least 28 days before that day, and regulation 1(2) fixes the full commencement day as 25 October 2027. Regulation 52(3) provides for the direction to be amended or replaced for the purpose of extending the period; it confers no express power to shorten it.

Existing MLR-registered cryptoasset firms do not roll over into the new regime; they apply through the same gateway as newcomers, against the full FSMA standard. Firms already authorised under FSMA apply for a variation of permission through the same gateway. The FCA's application-form information pack sets out the content of the file, and the FCA has not, at the date of this update, published figures on applications received through the gateway. The Economic Secretary to the Treasury's speech of 6 October 2026 confirmed the government's timetable, with the window open since 30 September and the regime in force from 25 October 2027. Five months is not long for a file that must cover business model, governance, systems and controls, financial resources, client-asset arrangements and Consumer Duty readiness. In our judgement firms that file early in the window will have more time for dialogue with the FCA before 25 October 2027; the FCA states that it will not expedite assessment of applications made after the window closes.

Reading it from Zurich and the EU

For Swiss and EU firms the perimeter question comes first: the new activities catch business conducted in the UK, and serving UK customers from abroad is what PERG 18, finalised in September 2026, addresses, so any firm with meaningful UK-facing revenue needs a documented position before October 2027. Strategically, the UK completes the comparison. Switzerland integrates crypto into existing law, and for exchange, brokerage and individually allocated custody of payment tokens its entry point is membership of a self-regulatory organisation, anti-money-laundering supervision without a prudential licence (our Swiss deep-dive); the EU built a bespoke code with a passport (MiCA and its AML layer); and the UK now extends FSMA with neither an SRO-style entry point nor an EU passport.

For groups, the realistic outcomes are three: a UK subsidiary through the gateway (the FCA's baseline, with a UK branch contemplated in its guidance for trading-platform operators offering access to global liquidity from a comparably regulated home jurisdiction, and case by case for dual-regulated firms), a documented perimeter position that keeps UK business out of scope, or an orderly exit from UK customers before 25 October 2027. Choosing among them is a board decision for the autumn of 2026, while the gateway is open, because only an application made inside the relevant application period qualifies for the regulation 53 saving, which extends to overseas persons in the applicant's group for the activity applied for.

What this means for you

• Map your activities against all seven. Issuance, safeguarding, platform, dealing as principal, dealing as agent, arranging deals and arranging staking are separate activities, each needing its own permission. Staking itself is not the regulated activity: article 9Z6 catches making arrangements for another person's staking, and article 9Z9 excludes technical services, including validator-node operation, only where the provider does not hold itself out as offering qualifying cryptoasset staking to the public.
• MLR registration does not convert. Regulation 53(2) treats a firm that applied inside the application period, and any overseas person in the same group, as if Parts 3 to 6 had not come into force for the activity to which the application relates while the application is undetermined or a refusal remains open to review. Two limits apply: where an in-window application has been refused but the refusal is still open to review, the FCA may on the grounds in regulation 55(5) direct that the narrower regulation 56 exemption applies instead (regulation 55(3)), and Chapters 2 and 3 of Part 7 cease to have effect at the end of the two years beginning with 25 October 2027 (regulations 53(3) and 55(9)). Treat it as a full authorisation project with a 2026 budget.
• File inside the window, and early within it. Regulation 52(5) does not prevent an application outside the period, but only those who applied inside it get the regulation 53 saving; a firm that applies after the window and before 25 October 2027 falls to the narrower regulation 56 transitional exemption, which covers the performance of pre-existing contracts only and permits no new contracts with new or existing UK customers, and a firm that has not applied by then has neither, unless it is an overseas person in the same group as an applicant: regulation 53(2) covers it, for the activity applied for, while the saving runs for the applicant, and regulation 55(4) gives it the regulation 56 exemption where a UK-established group member's in-window application has been refused and is no longer open to review, or has been withdrawn; the FCA treats a firm whose application was rejected for missing the minimum information, and not followed by a valid one, as not having applied.
• Non-UK firms: settle the perimeter position now. UK-facing business needs a documented analysis against section 418 and PERG 18 before the regime bites in October 2027.

Isak Legal advises crypto businesses on UK, EU and Swiss regulatory strategy, authorisation readiness and cross-border perimeter analysis. See our Digital Assets and United Kingdom pages, or get in touch.

This client update is provided for general information only, reflects the position as at 17 October 2026 and does not constitute legal advice or create a lawyer-client relationship. The FCA's main rules and perimeter guidance are final, further targeted consultations continue, the gateway is open, and amending legislation is before Parliament in draft; verify the current texts and dates at the official sources linked above before acting. For advice on a specific matter, please contact us.