- Crypto firms can apply for full FCA authorisation for the first time. Those that want to keep operating in the UK should apply by 28 February 2027.
- The regime itself doesn’t come into force until 25 October 2027, so none of the new protections are live.
- No firm has been authorised yet. The FCA says it expects to decide applications before the regime starts, which is an expectation rather than a promise.
Anyone who has bought crypto in Britain over the past few years has done it from firms the FCA checked for money laundering and very little else. That now starts to change. Applications for full authorisation opened today, and the rules sitting behind them take effect on 25 October 2027.
For the first time, a UK crypto firm will have to show a regulator how it holds your money, how it treats you as a customer and whether it has the financial strength to survive a bad quarter. None of that is in force yet, and the firm you use today is operating under exactly the same rules it was yesterday. Authorisation also won’t change what you bought. An authorised firm can meet every standard the FCA sets and the asset can still fall to nothing.
What firms have now, and what they’d be getting
Since January 2020 the FCA has supervised UK crypto businesses for one thing: anti-money-laundering compliance. Registration under those rules asks whether a firm knows who its customers are and can spot dirty money passing through it. It asks nothing about whether your coins are held separately from the company’s own balance sheet, or whether the business could absorb a large loss without taking your funds down with it.
Full authorisation is the regime most of the rest of UK financial services has been under for years. The FCA says applicants will be assessed on consumer protection, safeguarding of customer assets, market integrity and financial resilience. It published the final rules and guidance in June 2026, so firms have had the detail for some months.
There’s a third layer that already exists and is easy to confuse with this one. Since October 2023, crypto promotions aimed at UK consumers have had to carry risk warnings and give new customers a cooling-off period. That regime governs the advertising. This one governs the business behind it.
The dates, and the gap between them
Two dates matter. Firms intending to keep operating here should apply by 28 February 2027. The regime comes into force on 25 October 2027.
The eight months in between are covered by a transitional arrangement that most readers will never hear about but which decides whether their account keeps working. An existing firm that applies during the window can carry on providing cryptoasset services, including taking on new customers, while its application is assessed, if no decision has been reached by the time the regime starts. The FCA says it expects to determine applications submitted in that period before the deadline, and it is careful to call that an expectation.
In the press release announcing the opening, Dominic Cashman, the FCA’s Director of Authorisation, said: “The UK’s new crypto regime will give consumers greater protections and firms a clear framework to operate in. Firms can now apply for authorisation and start preparing for regulation.” That’s the regulator describing its own policy, and it is framing rather than evidence: the notice opens a form, it doesn’t demonstrate that any consumer has been better protected.
What authorisation doesn’t buy you
Authorisation is conduct regulation. It sets standards for how a firm behaves and lets the FCA act when it doesn’t. It is not a government guarantee on your balance.
The release says nothing about whether the Financial Services Compensation Scheme will cover cryptoasset firms, or whether customers will be able to take complaints to the Financial Ombudsman Service. Neither should be assumed from this announcement. If you want to understand where the risk actually sits with the platform you use, our guide to buying crypto in the UK covers how different firms hold customer assets.
The notice also leaves two practical questions open. It says firms that can’t show they meet the standards “will not be authorised to operate in the UK market”, but it doesn’t set out what an orderly wind-down looks like for their customers, or what happens to a firm still serving UK users without permission after October 2027. And there are no numbers anywhere in it: no estimate of how many firms will apply, how many are likely to pass, or how many are operating here now.
The language is doing some work
The FCA calls this a “landmark moment” and a “significant milestone”, and says the UK is a step closer to becoming “one of the most trusted places in the world to build and invest in cryptoasset businesses”. That’s a target the regulator has set for itself. No external body has ranked anything, and the thing that happened today is an application window opening.
Which doesn’t make it unimportant. Firms have spent years complaining that Britain had no route to being properly regulated, only a narrow money-laundering register that many of them failed. A route now exists. Whether it leads anywhere is a 2027 question.
What to watch
The first names through. A list of authorised firms, and how long each took, will tell you far more about this regime than the announcement does. Watch the refusal rate too: the money-laundering register turned away the large majority of early applicants, and if authorisation proves similarly hard to get, some platforms UK customers currently use will simply stop serving them.
And watch the February deadline. A major exchange that doesn’t file by then is telling you something about its plans for the UK. More policy coverage here.