FCA Cryptoasset Authorisation Gateway 2026–2027

A business can be on the FCA’s anti-money laundering register, serve UK customers and still need a completely different permission to operate after October 2027. That is the change behind the FCA cryptoasset gateway. Registration under the current Money Laundering Regulations (MLRs) is not a passport into the next system.

The question is no longer whether the UK intends to regulate more crypto services. The application process has begun. Since 30 September 2026, applicants have been able to use the FCA’s Connect system to request authorisation or seek changes to their existing regulatory scope. The window closes in February 2027, months before the new rules take effect. For an exchange with an existing customer base, that gap could determine whether it can keep taking on customers while the regulator reviews its case. For a new entrant, it is a chance to settle the legal structure before launch.

Why MLR Registration Is No Longer Enough

MLR registration vs FSMA authorisation involves more than a change in paperwork. The first mainly addresses financial crime supervision. The second asks whether the organisation is fit to undertake particular regulated activities under the Financial Services and Markets Act 2000. That brings the operating model, people in control, financial resources and customer protections into sharper focus.

There is no automatic upgrade for an existing MLR registrant. Nor can an electronic money or payments permission simply be assumed to cover crypto services. An entity already authorised under FSMA will generally have to request some type of permission for the additional activities. We believe there are two practical routes for FCA cryptoasset authorisation gateway: 1) new authorisation, and 2) a change to an existing scope.

Therefore we recommend considering a platform registered for AML purposes that has since introduced custody or brokerage features. Its old registration demonstrates a track record, but the regulator will still need to understand the present product, not the one described in an earlier submission. The same applies to management roles, outsourced technology and a person responsible for the situation when a customer cannot access assets. Treating a historical registration as proof of future compliance leaves these questions unanswered.

Who Should Review Their UK Activities Now?

An established exchange and a software supplier may both use the word “crypto” on their websites. Their regulatory position can be quite different. The legal position depends on what is actually done, not the product label. An operator should trace how orders are received and executed, who holds customers’ assets, how instructions travel through the platform and which entity enters into the contract.

Three groups deserve particular attention in our opinion: existing MLR registrants, businesses with other FCA permissions, and new or overseas providers entering the UK market. The first two should establish whether they need fresh authorisation or a variation.

For overseas groups, the initial task is to identify what is supplied in/ to the UK and whether that service falls within the new statutory perimeter. A UK website or overseas incorporation, taken alone, is not a reliable answer.

This is also the right moment to revisit arrangements that have changed quietly over time.

An outsourcing contract may give a third party more control than the corporate chart suggests. A wallet described as “non-custodial” may operate differently in practice. Under UK crypto regulation 2027, those details can affect both the permissions requested and the evidence expected with the submission. A perimeter review should come before policy drafting, not after it.

The Three FCA Dates That Matter

The FCA crypto application window 2026 opened at 9:00 am on 30 September 2026.

Businesses can now send an authorisation request, or a variation of permission, through Connect. The regulator has also published useful information about its application forms and financial data template. Opening the gateway doesn’t mean every applicant is ready to press submit; it means that preparation and filing can happen now rather than at some future launch.

The next official FCA Direction date is 28 February 2027, 11:59 pm, as the end of the special period. It is often described in searches as the FCA crypto authorisation deadline 2027, but that shorthand needs care. It is a deadline for entering the relevant application period, not a blanket ban on submitting later.

Finally, the 25th of October 2027 is the full commencement date. That is when the wider regulatory framework takes effect and the right to continue relevant UK services becomes critical. These are two separate decisions for management: when to apply, and what can lawfully happen after commencement if the FCA has not reached a decision. Confusing February with October can lead to the wrong plan for onboarding, contracts and the customer base.

What Happens If the FCA Has Not Decided?

Submitting within the special period matters most to operators already serving the market. If their case remains undetermined when the new regime starts, the saving provision may allow continued provision of the relevant services while the process reaches a final outcome.

The official guidance also addresses certain cases involving a refusal challenged before the Upper Tribunal. The protection is conditional; it should never be presented as automatic authorisation. Those relying on it will have notification obligations.

And can crypto firms apply after 28 February 2027? Yes. The FCA says late submissions are possible, but it will not accelerate assessment to make up for the delay. Where a request arrives after the special window but before commencement, and permission is still outstanding on 25 October 2027, the transitional route can apply by operation of law, subject to the relevant conditions.

This distinction has a direct commercial effect. Under the FCA crypto transitional provisions, an eligible provider may continue regulated activity only as necessary to fulfil contracts made before entering that arrangement. It cannot sign fresh contracts with existing UK customers or bring in new UK customers under new contracts. That is a run-off position, not business as usual.

A provider choosing not to apply must plan to end in-scope UK operations before commencement. Merely leaving an application until after the new framework begins does not preserve the right to trade. Where the result is a refusal, withdrawal or tribunal decision, the exact route also needs to be checked against the saving and transitional rules rather than assumed from the date alone. The FCA’s gateway guidance explains the different outcomes.

Preparing a File That Matches the Real Business

For anyone asking how to prepare for FCA crypto authorisation, start with a description of the service that a person outside the product team could follow. Identify each regulated function, responsible legal entity, relevant customer group and UK connection. Then check the evidence. Does the organisational chart match the contracts? Do the financial forecasts reflect the planned activity? Can management explain how custody, transaction processing and complaints work on an ordinary day?

A common weak point is the distance between policy and practice. It is easy to write that incidents are escalated promptly. It is harder to show who receives an alert on a Saturday, who can stop a transaction and how decisions are recorded. The assessment should cover governance, senior management, financial crime safeguards, operational resilience, outsourcing, financial resources, customer treatment and an orderly wind-down. Not every applicant needs identical documents; the activities and operating  model determine the detail.

So what does a crypto authorisation readiness assessment cover? At its best, it tests the legal perimeter, the accuracy of the materials and the issues likely to delay review. A gap report should assign owners and practical fixes, rather than simply list missing policies. For businesses still shaping their strategy, the regulator’s optional pre-application support service may also be worth considering; a meeting requires meaningful information in advance and does not guarantee approval.

FCA cryptoasset authorisation support from Icon.Partners can assist with the perimeter review, permission strategy and preparation of the documentation. The gateway is open today. The useful question for management is whether the next submission will describe a business that is genuinely ready to operate under the new rules.