New crypto regime: A practical blueprint for getting ready

Chrissy Hill sets out the steps firms should take to prepare for the Financial Conduct Authority’s cryptoasset regulations.

For years, the standard line on crypto was that it operated beyond the reach of regulation. In the UK, that line is disappearing. The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 (FSMA) bring cryptoassets squarely within the FCA’s remit, and with them one of the most significant expansions of the UK regulatory perimeter in a decade. For the first time, firms dealing in cryptoassets will be expected to meet the same authorisation and conduct standards as the rest of financial services.

The direction of travel is now fixed and the application window is open. Firms that use the window well will not simply avoid a scramble later; they will turn a regulatory obligation into a head start.

Over the past few years, global environmental, social and governance (ESG) objectives have continued to fragment, and ESG-related regulation in many centres is now being streamlined to lessen the burden of disclosure and marketing obligations on firms and to encourage economic growth. This article considers the changing face of ESG for financial institutions and insurers, including the key changes, the most likely pressure points for firms in the near future, and the way that matters will continue to evolve.

Know the regime and key dates

The regulations hand the FCA responsibility for authorising and supervising cryptoasset activity. A defined set of activities is being drawn inside the perimeter: issuing qualifying stablecoins, safeguarding or custody of cryptoassets, operating a cryptoasset trading platform, dealing in cryptoassets as principal or agent, arranging deals, and providing staking services.

Note what that list is: a set of activities, not a set of technologies. The regime does not target protocols or code as such, and a firm whose only role is writing or maintaining software is unlikely to be in scope on that basis alone. But the FCA has been explicit that decentralised features and smart contracts do not, of themselves, take an arrangement outside the perimeter, and there is no general technical-services exclusion. The question is always who is actually carrying on the activity.

Here are the key dates:

• Authorisation gateway: open now as of 30 September 2026, and closes on 28 February 2027 (a fixed window)
• Regime fully live: 25 October 2027, after which in-scope activity in or to the UK needs FSMA permissions

The UK is not acting in isolation here. The EU’s MiCA regime is already in force, and the US has legislated on stablecoins. But the UK’s model, built on full FSMA authorisation, sets a notably high bar.

Crucially, existing registration under the Money Laundering Regulations (MLR) will not carry a firm across. There is no automatic conversion, meaning MLR-registered firms must apply for authorisation like everyone else. Those that file within the window may benefit from a saving provision that lets them keep operating while the FCA determines their application. Those that miss it will not. Registration under the money laundering rules got you through the door. Authorisation is the whole house, and the FCA will want to see every room.

Hear more from Chrissy Hill in our Crypto 101, available here

Registration under the money laundering rules got you through the door. Authorisation is the whole house, and the FCA will want to see every room.

Step one: Map your regulated activities

The first practical task is the least glamorous and the most important: work out precisely which of your activities fall inside the new perimeter, and evidence the conclusion. It is a mistake to assume you are out of scope because a business model feels peripheral. The safer discipline is to map every activity against the regulated list and document why each does, or does not, fall within it.

That means asking hard questions of each business line. Are we issuing, or facilitating the issuance of, a stablecoin? Do we hold cryptoassets (or the means of control over them) on behalf of clients? Are we matching buyers and sellers, or arranging deals, even where we never touch the asset itself? Do we offer staking, directly, or through a third party?

The boundaries are where the difficulty lives, so the FCA’s final perimeter guidance (PS26/18) is essential reading, particularly for group structures; overseas entities serving UK customers; firms that build, deploy or front-end a protocol; and 'we only introduce' arrangements that may amount to a regulated activity in substance.

The output should be a documented activity map, owned by someone senior. It is the foundation on which every later step is built.

Step two: Identify the authorisation you need

Once activities are mapped, the next task is to translate them into permissions: which regulated activities require which authorisation, and which entity in the group will hold them.

Here it helps to borrow a nutritionist’s logic. Regulatory readiness is, in truth, a kind of healthy-eating plan. Just as a balanced diet depends on getting a handful of core food groups right, an authorised firm depends on getting a handful of core elements right from the outset (i.e., its corporate structure, its governance, its financial resources, its systems and controls, and its people). An application to the FCA that addresses these key ingredients coherently, as parts of a single plan rather than as disconnected work-streams, is far more digestible to a regulator than one assembled piecemeal.

I have sat on both sides of this counter (i.e. building compliance inside an investment bank and then inside a crypto-native firm) and most of the distance between a regulator and a crypto business is not disagreement. It is translation. An application that makes the technical legible to the regulator, and the regulatory legible to the engineers, is already halfway home.

In practice that means preparing a credible regulatory business plan, being clear on which permissions each entity needs, and back-planning from the close of the window rather than drifting towards it. The FCA's pre-application support service (PASS) remains available during the window and firms that have not yet engaged should use it.

Early engagement in the window is worth far more than a polished submission filed at the end of it. The firms that struggle will not be the ones with hard questions to answer. They will be the ones that left the answering too late or pretended there were no questions to answer.

An application that makes the technical legible to the regulator, and the regulatory legible to the engineers, is already halfway home.

Step three: Run an honest gap analysis

With activities and permissions understood, firms should measure themselves against what an authorised firm actually looks like. A candid gap analysis is uncomfortable but invaluable, and it should span every area the FCA will test:

• governance and senior accountability, including the Senior Managers and Certification Regime
• systems, controls and operational resilience
• financial crime such as anti money laundering, sanctions screening, the FATF Travel Rule, and the use of blockchain analytics
• safeguarding and custody of client assets
• prudential soundness and adequate financial resources
• consumer protection, including the cryptoasset financial promotions regime.

The value of the exercise lies in its honesty. This is the document that tells a firm how large the task really is and where the genuine weaknesses sit. It is far better to find them now than to have the FCA find them later.

There is a deeper point here, and it is the one a compliance team feels most keenly. The FCA is not testing whether a firm intends to do the right things (that is assumed by applying). Rather it is testing whether the firm can show that it does the right things.

Most crypto firms already do a great deal well, but often what they cannot yet do is evidence it. Decisions live in chat threads. Controls live in someone’s head. The person who built a system may be the one who runs and reviews it.

The work of the next year is largely the work of turning the informal into the evidenced.

And the evidence a regulator trusts most is the awkward kind: a breach log with entries in it, an incident escalated and honestly resolved, or a launch delayed because a control was not ready. A spotless record rarely reads as 'we are perfect'; it reads as 'we are not looking'.

The work of the next year is largely the work of turning the informal into the evidenced.

Step four: Build the implementation plan

A gap analysis only earns its keep if it becomes a plan, and the plan is where a hard truth surfaces: the FCA does not authorise applications, it authorises businesses. Authorisation is not a legal matter with a submission at the end of it. It is a change programme that touches every team: engineering building the monitoring hooks, operations redesigning onboarding, finance building the capital and liquidity numbers, and product changing flows it would rather leave alone, with the lawyers producing perhaps a fifth of the whole picture. Someone senior inside the firm has to conduct that orchestra.

Firms should turn their findings into a sequenced, resourced and owned programme, anchored to the close of the authorisation window on 28 February 2027.

Long-lead items deserve early attention. Senior hires, systems and custody arrangements, and the build-out of policies and controls all take longer than anyone expects. Firms should resist the temptation to wait for further guidance before starting, as the rules are final and the shape of the regime is clear enough to begin now. The plan should carry visible senior fluency and ownership as well as board oversight. It should be treated as a living document that is revisited as the FCA publishes further guidance, rather than a one-off exercise filed and forgotten.

The day after: Supervision is forever

One last point, and it is the one firms most often forget. Authorisation is not the finish line. It is the starting gun. Firms plan for the application the way people plan for a wedding, and forget they are entering a marriage. The day the permission is granted, supervision begins, and supervision is permanent. The application becomes a promise the firm is held to. This means the management information built for the submission now has to run every month, to a standard, indefinitely. And the firm carries positive obligations to tell the regulator when something goes wrong. The application team cannot simply disband. It becomes the compliance function.

Preparation as advantage

It is tempting to see all of this as a burden. It is more useful to see it as architecture.

Firms that prepare early will secure regulatory certainty sooner, move through authorisation more smoothly, and earn something that is becoming genuinely valuable: the confidence of institutions, banking partners and clients who increasingly expect a firm to be authorised before they will deal with it.

The new regime is not the end of crypto in the UK. It is the point at which the industry is asked to meet the standards the rest of financial services already meets. Governance built in as architecture, rather than bolted on afterwards, is what lets a firm do the thing every founder actually wants: move fast and stay defensible. Firms that treat the new regime as an invitation to build well, rather than a form to be completed under duress, will be the ones still standing, and thriving, when it goes live in 2027.