Miss the UK crypto window and, from October 2027, you may only wind down

Next Wednesday, 30 September 2026, the UK’s Financial Conduct Authority (FCA) opens its authorisation window for cryptoasset firms. Until 28 February 2027, trading platforms, custodians, intermediaries, stablecoin issuers and staking providers can apply for authorisation under the Financial Services and Markets Act (FSMA); the FCA says the application form itself goes online on opening day. The regime takes effect on 25 October 2027 under regulation 1(2) of the Cryptoassets Regulations 2026. The rules have been settled since 30 June, across five policy statements, and the boundary of the regime since 16 September in a sixth.

The common reading is “five months to apply”. It is not wrong, but it captures only part of the story, and the less important part. According to the FCA’s gateway page, an application remains possible after 28 February, only without any claim to faster processing. The window does not decide whether a firm can apply. It decides what business the firm may still do afterwards. A firm that files within the five months may keep trading until its application is decided, even beyond 25 October 2027. A firm that files later and holds no authorisation on that date enters, by operation of law, a run-off regime in which it may perform existing contracts but not sign a single new one, neither with existing customers nor with new ones. A firm that never applies must have closed its UK business before the start date. There are three routes out of the window, and only the first keeps new business open.

Three routes lead out of the window, and only one keeps new business

The mechanics sit in Part 7 of the regulations and in the FCA’s direction. Under the regulations the window must run for at least 28 days and close at least 28 days before the regime starts; the FCA has set it at 152 days and left just under eight months between closing and 25 October 2027 for processing. For this first route the gateway page states the expectation that applications will be decided before the start date, and, in case that fails, a saving provision: the firm may keep providing its services until the final decision, including where it has referred a refusal to the Upper Tribunal and the case is still pending. All the firm has to do is notify the FCA that it is relying on the provision.

The second route begins on 1 March 2027. An application is still possible, but the FCA writes on its gateway page that it will not expedite its assessment to compensate for a late submission. If the firm holds no authorisation on 25 October 2027, it enters the transitional provision, in the words of the same page, “by operation of law”. According to the FCA’s page on that provision, its purpose is to let existing firms without authorisation run off in an orderly way: it covers the new activities only as far as a contract entered into before the firm joined the provision requires, and it ends after two years at most. New contracts with existing UK customers are excluded, as are new customers. A custodian may go on safeguarding what it already holds but may not accept a further deposit; a platform may close out open positions but may not open another account.

The third route is the shortest. A firm that has not applied by the start of the regime has, according to the gateway page, access neither to the saving provision nor to the transitional provision, and must have wound down its UK cryptoasset business before 25 October 2027. The same applies to a firm whose application was returned as incomplete and which files no valid follow-up; according to the FCA’s transitional provision page, it counts as a firm that never applied. In practice this means: the application inside the window does not buy authorisation, but it buys the time in which the business keeps running while the regulator assesses. The application after the window buys only the right to close in an orderly fashion.

The record so far: 68 registrations from 391 decisions

The FCA has supervised cryptoasset firms since 10 January 2020, so far only under the Money Laundering Regulations (MLRs), which makes it a registration authority without conduct or capital rules. Its own statistics on this predecessor regime, as at 1 September 2026, are the best yardstick for what begins on 30 September. Since 2020 the FCA has received 417 applications and decided 391: 68 registrations, 46 rejections for incomplete files, 14 refusals on the merits and 263 withdrawals. Combining the three non-registration outcomes, 323 of 391 cases, or 83 per cent, ended without an entry in the register; the figure is our own derivation from the FCA table, not a statement by the regulator.

Two readings of these numbers are possible, and both hold. The first is the reading from the supervisor’s side, and it is an interpretation, not a statement by the FCA: a withdrawal usually pre-empts a refusal, so the ratio measures the rigour of the scrutiny. The second reading belongs to the applicants and can be found in the law firms’ briefings of the summer. Travers Smith writes in its July analysis that the overwhelming majority of applicants under the registration regime did not succeed, and that lessons must be learned from that. The more recent figures do show a different ratio, with 13 of the 23 decisions in the past twelve months being registrations, but that is a selection effect: whoever still applies today has usually seen where the bar is set.

For the new regime the history is, on one point, not just a warning but the law. A registration under the MLRs will not convert into an authorisation, and in its guidance on the relationship between the two procedures the FCA states in terms: “Being registered under the MLRs does not guarantee authorisation under FSMA.” On 30 September the 68 registered firms therefore stand in the same queue as any newcomer, with the one difference that the regulator knows their files. A firm that still wants an MLR registration after 30 September, for instance because it wants to start trading before the regime begins at all, is asked on the same page to make its case through the pre-application support service.

325 firms and a form that appears only on opening day

How many firms the FCA expects is set out in its aggregate cost benefit analysis of the regime: 325, comprising 25 stablecoin issuers, 10 trading platforms and 290 intermediaries, with 60 custodians, 60 staking providers and 15 lenders counted as additional activities of those same firms. The regulator itself calls the estimate “subject to significant uncertainty” and concedes that consultation feedback suggested a larger number of firms in scope. For an authority that decided 391 registration applications in six years, authorisation applications from up to 325 firms in five months are a different cadence, especially as an FSMA authorisation tests more than an anti-money-laundering registration.

What it costs the firms is quantified in the same analysis. A trading platform bears, on the FCA’s own figures, transition costs of GBP 5.5 million and ongoing costs of GBP 3.2 million a year, spread across custody, admission documents, market abuse surveillance and cross-cutting rules. What the regulator commits to in processing time appears nowhere: the FCA pages we reviewed name no binding deadline, only the expectation of deciding applications from the window before the regime starts. Consultancies estimate eight to twelve months from submission, but those are rule-of-thumb estimates from other procedures, not an undertaking by the regulator.

The FCA has put two tools in place ahead of the gateway. The pre-application support service offers a free preliminary meeting in which a firm explains its business model and hears what the regulator expects; the FCA has announced that it will reject requests unaccompanied by meaningful supporting information, and its statistics since January 2024 show 115 requests, 82 meetings held and 19 refused. The second instrument is the perimeter guidance PS26/18 of 16 September, of which FCA director David Geale said: “Getting ready for regulation starts with understanding how the regime applies to your business.” Whether an activity falls within the regime at all is therefore the first question before any application, and it was answered fourteen days before the window opens.

The rules are final; the edge of the regime is still moving

The five policy statements of 30 June are, in the FCA’s words, the completion of its crypto roadmap, which has run since 2023 through four discussion papers and ten consultation papers. The edge of the regime is not complete. According to the FCA press release of 16 September, the government has published an amending instrument introducing targeted exclusions and clarifications, among them for UK stablecoins, proprietary trading and market making, certain technology providers, decentralised protocols, safeguarding involving central securities depositories, and financial promotions. The FCA intends to consult on corresponding changes to its perimeter guidance in October, that is, while the window is open. The regulator itself says the changes will not affect most crypto firms; for the few they do affect, they decide whether an application is needed at all.

A second loose end is described by Freshfields in its July briefing: the FCA intended to consult in September on deferring the admissions and disclosures regime for tokens already in circulation when the regime starts. That concerns the inventory of every platform, because under PS26/9 each admitted token will in future need its own disclosure document; the exception for tokens fungible with those already admitted has been removed, and the FCA itself expects 750 rather than 250 such documents by the start date. A firm drafting its application in October is therefore drafting against a rulebook whose core is fixed and whose edges are still moving. Waiting will not settle the edges; the assumptions the application rests on therefore belong in the application itself.

Five papers set out what an authorised firm must hold

Capital is the first threshold. PS26/12 sets the permanent minimum requirement by activity: GBP 75,000 for arranging and agency dealing, GBP 150,000 for safeguarding and for operating a trading platform, GBP 350,000 for issuing qualifying stablecoins and GBP 750,000 for dealing as principal, which the FCA expressly aligns with the initial capital requirement for investment firms under MIFIDPRU. The binding figure is the higher of this floor, one quarter of the previous year’s expenditure and the activity-based K-factors; for stablecoin issuers the FCA reduced the operational risk K-factor in the final rules from 2 to 1 per cent of coins in circulation.

The second threshold is client assets. For stablecoin issuers PS26/10 requires redemption within T+1, with the clock in the final rule starting only once the token has arrived in the issuer’s wallet, so that anti-money-laundering checks can take place beforehand; 48 per cent of the 52 responses to the consultation draft had opposed the original rule. The backing assets sit, under Handbook chapter CASS 16, in a statutory trust per product, at least 5 per cent of them in on-demand deposits, and issuers may hold a 5 per cent excess. For the custody of client cryptoassets the new chapter CASS 17 of the Handbook applies, with a trust structure and daily reconciliation; the settlement float was raised from 1 to 2 per cent.

The third threshold is the market itself. Under PS26/9 the market abuse regime, MARC, remains industry-led: the FCA does not police trading; the platforms and intermediaries must detect, report and disrupt abuse. Large platforms, defined by an average annual revenue of at least GBP 10 million over three years, measured across the group and all activities, additionally carry on-chain monitoring and cross-platform information sharing. For the application this means that the systems a firm needs for this are part of the authorisation assessment, not something to be dealt with after authorisation.

MiCA allowed 27 deadlines; London allows one

The nearest comparison is the European Markets in Crypto-Assets Regulation (MiCA), and it shows what is particular about the UK window. Under Article 143(3) MiCA, providers that were operating under national law before 30 December 2024 could continue without a MiCA authorisation until 1 July 2026 or until their application was decided, whichever came first; every member state was free to shorten or remove that period. The list published by the European Securities and Markets Authority (ESMA) shows the outcome: 15 states chose the full 18 months, among them France, Italy and Malta; Germany and Austria chose twelve, Sweden nine, and the Netherlands, Poland and Finland six. ESMA warned as early as December 2024 of the consequence: an authorisation in state A could arrive after the transitional period in state B had ended, and in that gap the same provider was operating there without permission.

London has chosen the opposite. One window for all, one start date for all, one authority for all, and no transitional period that depends on the firm, but a run-off provision that depends on the filing date. The price is the missing passport: a MiCA authorisation is valid throughout the European Economic Area under Article 65, a UK authorisation is valid in the UK, and according to the Morgan Lewis briefing the FCA is not currently in a position to recognise overseas platforms as equivalent. For a German provider with UK customers, the BaFin authorisation under the Crypto Markets Supervision Act is therefore the beginning of the analysis, not the end.

The figures in the European register show how the transitional periods have played out. On 16 September ESMA listed 349 authorised providers, 94 of them supervised by BaFin, 35 by the French Autorité des marchés financiers (AMF), 29 by the Dutch Autoriteit Financiële Markten (AFM), 25 by the Cypriot regulator and 22 by the Maltese regulator; the count is our own tally of the ESMA register file. Germany leads the list despite having chosen one of the shorter periods, and Malta, which ESMA criticised in its peer review of July 2025 for issues left unresolved when it granted an authorisation, ranks fifth. The concern of Marie-Anne Barbat-Layani, chair of the French regulator AMF, about “regulatory shopping” has not yet translated into market share in the register. The UK window removes the ground from under that question: there is only one counter.

Praise on publication day, objections in the weeks after

On 30 June the market spoke with one voice. David Geale, then the FCA’s executive director for payments and digital finance, called the day “a significant moment for crypto regulation in the UK” in the press release and added that the regulator could not regulate away risk. Rhiannon Butterfield of UK Finance and Su Carpenter of the trade body CryptoUK welcomed the rules in the same release. The Chancellor, Rachel Reeves, said in her Mansion House speech on 14 July that the UK had “one of the best stablecoin regimes in the world”. The objections came later, and they are aimed less at the rules than at what lies behind them.

In July UK Finance published a 24-page policy analysis that credits the rulebook with robustness but finds a move away from the principle of “same risk, same regulatory outcome” in the detailed capital and conduct rules; the trade body would have preferred an adapted version of the existing chapter CASS 6 to the new CASS 17 for custody, and would rather see market surveillance with the regulator than with the platforms. Travers Smith considers it highly likely that there will be a rush in February 2027 and writes that the FCA will not want to wave through firms sneaking in weak applications just inside the deadline. Both objections converge on the same point: the capacity of an authority that is to receive applications from up to 325 firms in five months and decide them in eight more.

The sharpest objection came from Parliament, three weeks before the window opens. On 9 September the House of Lords inflicted a defeat on the government, voting 194 to 138 in favour of an amendment by Lucy Neville-Rolfe to the Financial Services and Markets Bill that requires the Treasury to publish a digital assets strategy within twelve months. Lucy Neville-Rolfe’s reasoning in Hansard: policy was developing “too often issue by issue, product by product and regulator by regulator”, and firms offering digital asset products reported that banks were closing their accounts. The government pointed to its wholesale financial markets digital strategy of July 2025 and to the first report of its champion Chris Woolard in July 2026, and lost all the same. For the firms in the window this is no side issue: an authorisation without a bank account is, as Rami Ranger, Lord Ranger of Northwood, put it in the same debate, largely theoretical.

Recommendations

Glossary