On September 30, a thirteen-month countdown begins for every firm doing crypto business in the United Kingdom. The Financial Conduct Authority opens its application window for crypto asset authorisation — and the guidance published in the run-up makes clear that no one will be able to talk, label, or rebrand their way around it. From October 25, 2027, carrying out regulated cryptoasset activities in the UK without FCA authorisation will be unlawful, unless an exemption or transitional provision applies.
This is the moment the UK's crypto regime stops being a white paper and starts being a licensing exam. For founders, compliance officers, and investors, the next five months — the window closes on February 28, 2027 — will determine who gets to keep operating in one of the world's most important financial centers.
What the regime covers
The FCA's Policy Statement 26/18, containing the Perimeter Guidance (Regulated Cryptoasset Activities) Instrument 2026, draws the boundary of the new regime. Part 1 of Annex B to the instrument came into force on September 16, 2026; the remainder takes effect on October 25, 2027. From that date, the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 introduce new regulated activities for cryptoassets into the FCA's perimeter.
The scope is deliberately broad. Activities set to require authorisation include safeguarding cryptoassets, operating a cryptoasset trading platform, dealing in cryptoassets as either principal or agent, arranging cryptoasset transactions, and certain staking activities. Together, those categories cover most of the commercial infrastructure the UK crypto market currently relies on — custodians, exchanges, brokers, and staking providers.
Substance over labels
The most consequential element of the guidance is not the list of activities but the FCA's approach to interpreting it. The regulator has made clear that it will judge firms by the activities they actually perform, not by how they describe themselves. A business marketing itself as a "wallet," "exchange," "platform," or "broker" cannot rely on that label to determine its regulatory status. What matters is the underlying activity.
This closes off a strategy that served many firms well during the industry's early years: careful product naming and messaging designed to sit just outside the regulatory perimeter. As Cardamon CEO Areg Nzsdejan noted in a recent LinkedIn post, firms that have structured their products or marketing around particular terminology now have no room for ambiguity. The onus is on each firm to understand exactly what it does — in functional terms — and to map that against the perimeter guidance.
For legal and compliance teams, the practical exercise is a forensic one: inventory every service, feature, and customer flow, and test each against the regulated activities. A firm that believes it is merely a technology provider may discover that its arrangements amount to arranging transactions. A firm that calls itself a non-custodial wallet may discover that its safeguarding practices say otherwise.
The dates are now fixed, and the sequencing matters:
- September 30, 2026: the application window opens. Firms wishing to benefit from the transitional arrangements must apply within the window.
- February 28, 2027: the application window closes. Firms that miss it cannot rely on the transitional run-off provisions.
- October 25, 2027: the full regime takes effect. From this date, regulated cryptoasset activities in the UK require authorisation.
With the gateway opening today, firms have a limited period to prepare applications that meet the regulator's expectations — and the FCA's expectations are famously detailed. Authorisation applications demand governance documentation, financial projections, compliance frameworks, and evidence of operational resilience. Firms that start in October have a fighting chance; firms that start in January are cutting it close.
How the FCA is helping firms prepare
To its credit, the regulator is not simply publishing rules and waiting for the failures. The FCA is hosting webinars to help firms understand the rules and prepare for authorisation. An introduction to the UK's new crypto regulatory regime is already available on demand, and the next sessions will cover applying the FCA handbook, getting authorised, and the prudential framework. For smaller firms without large compliance departments, those sessions are worth attending early rather than late.
The broader UK regulatory conversation is also examining how the system supports innovation. The House of Lords Financial Services Regulation Committee has opened an inquiry into regulatory sandboxes — how regulators and firms use them, whether they drive innovation, their role in developing regulation, and whether they represent value for money. The call for evidence runs until October 23, 2026, and its outcome could shape how the FCA's sandbox interacts with the new authorisation regime.
What happens to firms that do nothing
The transitional provisions are the regime's pressure valve: firms that apply within the window can continue operating under transitional or run-off arrangements while their applications are processed. But the valve closes on February 28, 2027. After that, unlicensed activity in the perimeter becomes a regulatory offence, and the FCA's enforcement toolkit — fines, public censures, and restrictions — applies in full.
International firms serving UK customers from abroad should be paying particular attention. The regime applies to firms carrying on regulated activities "in the UK," a test that has historically captured cross-border service provision in financial regulation. Foreign exchanges and custodians with UK users cannot assume the regime stops at the border.
The bigger picture
The UK's move is part of a global pattern visible across September 2026: regulators worldwide are replacing years of crypto ambiguity with concrete, enforceable regimes. The US is advancing agency rulemaking after the CLARITY Act's defeat; Singapore is writing its stablecoin framework into statute; the EU's MiCA is in enforcement phase. The direction of travel is uniform — the era of operating in regulatory grey space is ending, everywhere at once.
For well-run firms, that is good news. Authorisation is a moat: it raises the cost of entry for competitors and builds institutional trust. For firms that have relied on ambiguity, it is an existential test. The window opens today. The clock is now running.
Sources
