What you need to know about the UK’s new cryptoasset regulatory regime

By Charles Herbert, 9 November 2026

A new regulatory regime for cryptoassets in the UK will go live from 25 October 2027. The regulator’s stated intent of strengthening consumer protections, enhancing the framework for tackling financial crime, and positioning the UK as a trusted, competitive home for innovation will be very familiar to many within the regulated sector. So too will be many of the governance, conduct, prudential and risk management requirements on cryptoasset firms.

Cryptoasset firms that have previously only been subject to Financial Conduct Authority (FCA) registration under the Money Laundering Regulations 2017 will find themselves in a significantly more intrusive supervisory environment.

However, the principal challenge may be less the substantive rules themselves and more the cost of implementing them. Compliance personnel, risk functions, governance committees, prudential reporting, internal audit arrangements and resilience testing all create ongoing fixed costs, which many smaller operators have not previously been required to bear.

Who does this affect?

The regime affects crypto exchanges, brokers, custodians, stablecoin issuers, staking providers and firms arranging crypto transactions. However, traditional financial services firms, payment firms, and overseas businesses targeting UK customers, should also assess whether they fall within scope.

Practical implications

FCA authorisation

Many cryptoasset firms currently operate under FCA registration under the Money Laundering Regulations 2017. However, registration does not automatically transfer to authorisation following commencement of the new regime in October 2027. Such firms will need to assess whether FCA authorisation is required, or where they are already authorised, whether an application for a variation of permission is necessary.

Firms which are currently not yet authorised should expect significant FCA scrutiny of business models, governance arrangements, financial resources, and financial crime controls.

Governance

Firms that have been run on a more informal basis will also now be expected to have proper governance in place to ensure key decisions are properly made and documented.

The FCA has already signalled that firms should prepare for the Senior Managers and Certification Regime (SM&CR). Particular scrutiny will be applied to the compliance oversight function (SMF16) and Money Laundering Reporting Officer (MLRO) (SMF17).

The UK regulator will also expect clear accountability for risk management and effective challenge, independent of revenue-generating functions.

Audit and risk

Firms will be expected to maintain a documented risk management framework. This includes the Overall Risk Assessment (ORA), which requires firms to identify all material harms and risks, and to assess whether regulatory capital and liquidity resources are sufficient.

The FCA will also expect firms to consider whether an independent internal audit function is necessary, and to put in place a whole suite of documented policies. These will need to cover prudential and capital risk, operational risk, cybersecurity risk, financial crime risk (AML, sanctions and fraud) and conduct risk.

Operational resilience

With the FCA expected to scrutinise operational resilience, firms will need to provide documented service maps, set impact tolerances, and carry out scenario testing in order to demonstrate that they can remain within their impact tolerances during severe but plausible events.

For many crypto firms, this will be the first time such exercises are carried out, and the associated resource requirements should not be underestimated.

Financial resources

The FCA continues to be firmly of the view that cryptoassets remain highly volatile. The new framework is therefore broadly modelled on existing FCA prudential regimes for investment firms, but has been adapted to reflect the specific risks associated with cryptoassets.

Both the core prudential sourcebook (COREPRU) and the sector specific requirements (CRYPTOPRU) will apply to CRYPTOPRU firms which issue qualifying stablecoins, and/or safeguard qualifying cryptoassets. 

The Consumer Duty and regulatory reporting

Cryptoasset firms entering the FCA perimeter will become subject to FCA conduct standards and expectations around delivering good customer outcomes.

This inevitably will require clearer disclosures, better complaints handling, more evidence that products are suitable for the target market, greater scrutiny of customer communications, and regulatory reporting relating to capital, liquidity, governance, and systems and controls.  

Sanctions, fraud and financial crime controls

Cryptoasset firms should also expect the FCA to assess systems and controls in relation to financial crime risk management. Hence the regulator will be scrutinising sanctions screening, transaction monitoring, blockchain analytics, fraud prevention, onboarding controls, and detection of false identities and forged documents.

Market impact

All of these necessary requirements will increase compliance costs substantially and, in addition to capital requirements, are likely to accelerate consolidation. Well-capitalised firms may gain market share but, due to increased costs (or concerns about meeting the FCA threshold conditions), smaller firms may well exit the UK market.

Controllers of and investors in crypto firms will also find themselves much closer to the change-in-control framework that currently applies to investment firms. They should therefore expect much greater scrutiny of fitness, propriety, source of wealth, and governance arrangements.

Next steps

The changes commencing in October 2027 require a fundamental shift for cryptoasset firms in their approach to governance, capital, compliance and regulatory risk. Firms that have not yet done so should carry out full gap analyses against the FCA’s incoming requirements.

Crypto firms can also request meetings with the FCA’s Pre-Application Support Service (PASS) if they have questions as to readiness.

For many businesses, the key question will not be whether they can meet the new requirements, but whether their governance, risk and compliance infrastructure can be scaled prior to the regime commencing.

As with most things, the firms best placed to navigate the changes are likely to be those that begin their preparation early.