There is no single "UK crypto licence" today. Firms carrying on in-scope cryptoasset activity currently register with the Financial Conduct Authority (FCA) under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the MLRs). From 25 October 2027, a new regime under the Financial Services and Markets Act 2000 (FSMA) requires cryptoasset firms to be authorised by the FCA, and the window to apply opened at 9:00am on 30 September 2026 and closes at 11:59pm on 28 February 2027. Existing MLR registrations do not convert automatically.
For most firms, the next four months are the period that decides whether they keep serving UK customers without interruption. This guide sets out the regulatory timeline from the FCA's own publications and then focuses on the part of the application that technical teams own: IT controls, safeguarding and the security of the means of access to client cryptoassets. It is not legal advice.
Two Regimes, One Transition
The FCA's cryptoassets page sets out the key milestones for the new rules:
| Date | Milestone |
|---|---|
| July 2026 | Pre-application support (PASS) opens for cryptoasset firms |
| Summer 2026 | Policy statements published |
| 30 September 2026 | Application period starts |
| 28 February 2027 | Application period ends |
| 25 October 2027 | New regime expected to come into force |
Until the new regime commences, MLR registration remains the requirement for in-scope firms. After commencement, firms carrying on the new regulated cryptoasset activities need FSMA authorisation with the right permissions, or a variation of permission if they are already authorised for other activities. The FCA's perimeter guidance (PS26/18) states that firms currently registered under the MLRs, authorised under FSMA, or registered or authorised under the Payment Services or Electronic Money Regulations will all need to be appropriately authorised if they carry on a regulated cryptoasset activity in the UK that is not covered by an exclusion.
FCA Registration Under the Money Laundering Regulations
For a firm that needs to operate before October 2027, MLR registration is still the gateway. The FCA's guidance on how to apply sets out the main steps:
- Read the MLRs and the registration forms. The FCA expects applicants to show a comprehensive understanding of the UK AML/CTF regime. Applications are submitted through the FCA's Connect system.
- Consider a pre-application meeting. These are free and informal. The FCA usually asks for documentation in advance covering the business model, customer types, products, jurisdictions, flow of funds, the AML framework and proposed senior managers.
- Appoint an MLRO. Regulation 21(3) of the MLRs requires a Money Laundering Reporting Officer. The FCA expects that person to have relevant knowledge and experience, including of cryptoassets, to be heavily involved in preparing the application, and to remain in post throughout. It warns that changing the MLRO may cause significant delays.
- Pay the fee. Cryptoasset registration falls into Category 6 of the FCA's pricing categories, and registered firms also pay annual periodic fees.
Once the FCA has all the information it needs, it has three months to decide. The four possible outcomes are approval, rejection (for applications missing minimum information), withdrawal and refusal. Withdrawn and refused applications do not get their fee back. While the application is under assessment, the firm must not use it to promote its services or imply FCA endorsement.
The New FSMA Regime and Its Deadlines
The FCA's direction under regulation 52 of the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 fixes the relevant application period as 9:00am on 30 September 2026 to 11:59pm on 28 February 2027. The FCA has confirmed that the gateway is open and that applications, including variations of permission for firms already authorised, must be submitted through Connect.
The FCA's guidance on what firms should be doing now is notably operational. It asks firms to:
- Review the new regulated activities and decide which permissions they need.
- Check that the scope of permissions matches their business model and risk profile.
- Carry out a gap analysis against the expected FSMA requirements.
- Agree a realistic implementation plan at board level that sets out who is accountable, what needs to change, how it will be delivered and when.
- Assess the resources and costs of preparation, authorisation and ongoing compliance.
Why Applying Inside the Window Matters
The FCA's description of how the gateway operates draws a sharp line between firms that apply inside the application period and those that do not.
- Applied in the window. The FCA expects to determine the application before commencement. If it has not, a saving provision lets the firm continue providing cryptoasset services until the application is finally determined, including while a refusal is before the Upper Tribunal.
- Applied after the window but before commencement. The FCA will not expedite late applications. A firm not authorised by 25 October 2027 enters a transitional provision and can only carry on the new regulated activities to the extent needed to perform contracts entered into beforehand. It cannot take on new contracts with existing or new UK customers.
- Did not apply. The firm must run off its UK cryptoasset business before commencement. Continuing risks breaching the general prohibition in section 19 of FSMA, or acting without permission under section 20 for firms already authorised.
The FCA also warns that poor quality applications may be rejected, delayed or refused. For an existing UK-facing business, a weak application submitted on time can be almost as damaging as a late one.
The Security Evidence the Application Asks For
The FCA has published an information document describing the authorisation application form for cryptoasset firms (version dated 17 September 2026). Alongside the general sections every FSMA applicant completes, it includes cryptoasset-specific sections driven by the business model. Several of them are security engineering questions in regulatory language:
- IT self-assessment and IT controls. The firm must provide information about its IT systems through an IT self-assessment.
- Records of client cryptoassets. The firm must show how it manages and keeps accurate records of the cryptoassets it holds for each client.
- Proof of cryptoasset safeguarding trust. The firm must show how it will act as trustee when safeguarding cryptoassets.
- Third-party custodian arrangements. The firm must show how it will appoint and oversee third parties that safeguard cryptoassets for its customers.
- Cryptoassets means of access policy. The firm must show it has robust security and organisational arrangements to safeguard the means of access to client cryptoassets.
- CASS 6 questionnaire. Firms that will only safeguard relevant specified investment cryptoassets must comply with CASS 6 and complete a questionnaire.
Trading platforms, lenders and staking providers face additional sections. The common thread is that the FCA wants to see how the controls work, not just that a policy exists.
Means of Access: What It Means in Practice
"Means of access" is the regulatory way of describing whatever gives control over client cryptoassets: private keys, key shares, seed phrases, signing devices and the credentials that can instruct a custodian. A means of access policy that will survive scrutiny usually answers six questions with evidence.
- Where is each means of access generated and stored? Hardware security modules, MPC key shares or hardware wallets, and in which locations. Our guide to HSM private key management covers the architecture choices.
- Who can use it, and how many people are needed? Quorum design, signer independence and separation of duties. See crypto multisig security and separation of duties.
- How is a transaction verified before signing? Independent calldata and destination checks, allowlists and out-of-band confirmation for large transfers.
- How are keys backed up and recovered? Documented backup locations, recovery ceremonies and tests, kept separate from operational infrastructure recovery.
- What happens when someone leaves or a device is lost? Rotation triggers, access revocation and key ceremony records.
- How would you detect misuse? Monitoring of signing activity, alerts on unusual destinations or volumes, and an incident response plan that covers key compromise.
The same evidence supports the safeguarding trust and record-keeping sections, because a firm can only prove it holds client assets on trust if it can reconcile its client ledger to on-chain balances under its control.
Building a Credible Implementation Plan
With the window closing on 28 February 2027, a practical plan for a firm starting now might look like this:
- Weeks 1 to 3: confirm the regulated activities and permissions, using the FCA's perimeter guidance and legal advice where needed. Decide whether a PASS meeting is worthwhile and gather the supporting analysis the FCA requires before it will hold one.
- Weeks 3 to 8: run the gap analysis. For technical controls, compare current key management, access control, monitoring and third-party oversight against what the application sections ask for. Record owners and dates for each gap.
- Weeks 8 to 14: close the gaps that the application will expose, prioritising means of access, safeguarding records and IT controls. Commission independent testing where the evidence is thin.
- Weeks 14 onwards: finalise board-approved documents, complete the IT self-assessment and financial data template, and submit well before the deadline to leave time for the FCA's information requests.
Common Weaknesses in Applications
The FCA's published guidance highlights several reasons applications fail or stall. Each has a security equivalent.
- Generic documents. The FCA asks for documents that are specific, final and signed off, and says it will not review drafts. A security policy copied from a template, describing controls the firm does not run, is the clearest example.
- Information that changes mid-assessment. Significant changes may lead the FCA to suggest withdrawing and reapplying. Re-architecting custody during the assessment is exactly that kind of change, so settle the design first.
- Over-reliance on advisers. The FCA states that firms remain accountable and must be able to explain everything in the application. Engineering leads should expect to be questioned on the controls they own.
Firms serving both the UK and the EU will find substantial overlap with the evidence required under MiCA and the ICT risk management requirements of DORA, which makes it worth designing one control set that satisfies both.
Frequently Asked Questions
Do I need an FCA licence to run a crypto business in the UK?
Today, firms carrying on in-scope cryptoasset activity must register with the FCA under the Money Laundering Regulations. From 25 October 2027, firms carrying on the new regulated cryptoasset activities will need FCA authorisation under FSMA, or a variation of permission if already authorised.
When is the FCA crypto application window?
The FCA set the relevant application period as 9:00am on 30 September 2026 to 11:59pm on 28 February 2027. Firms that apply inside this window benefit from a saving provision if their application has not been determined when the new regime starts.
Will my existing FCA MLR registration carry over to the new regime?
No. The FCA has stated that existing registrations and permissions do not convert automatically. MLR-registered firms must apply for FSMA authorisation to carry on the new regulated cryptoasset activities.
What is a cryptoasset means of access policy?
It is a section of the FCA authorisation application in which the firm must show it has robust security and organisational arrangements to safeguard the means of access to client cryptoassets, such as private keys, key shares and signing credentials.
How long does FCA cryptoasset registration take?
For MLR registration, the FCA has three months to decide once it has all the information it needs. In practice information requests extend the overall timeline, so complete and specific applications are processed faster.
Sources
- FCA: Cryptoassets (key milestones)
- FCA direction on the relevant application period under regulation 52 of the FSMA (Cryptoassets) Regulations 2026
- FCA: Cryptoassets, how the gateway will operate
- FCA: What you need to do when preparing for the new cryptoasset regime
- FCA: Information about the authorisation application form for cryptoasset firms (17 September 2026)
- FCA: Cryptoassets, how to apply for registration
- FCA PS26/18: Cryptoasset perimeter guidance